synchronize passwords (DS-> AD)

[Denise Cosso]

Hi,



    I would like to help to understand how does the timing of passwords 
between Directory Server and AD (Windows8). Configured unidirectional 
timing (LDAP->AD), not installed the Windows side PassSync.



    The Directory Server is with password in Sha256 and I can only 
synchronize passwords with AD if you change the password in plain text 
by ldappasswd command. (I know that this password is stored in the 
changelog)



    How do I adjust the timing between the Directory Server and AD with 
different encryption using a feeling (ldap->ad), without putting 
passwords in plain text?



thanks,

Denise

[Rich Megginson]

On 05/17/2013 12:24 PM, Denise Cosso wrote:
>  Hi,
>
>      I would like to help to understand how does the timing of 
>  passwords between Directory Server and AD (Windows8). Configured 
>  unidirectional timing (LDAP->AD), not installed the Windows side 
>  PassSync.
>
>      The Directory Server is with password in Sha256 and I can only 
>  synchronize passwords with AD if you change the password in plain text 
>  by ldappasswd command. (I know that this password is stored in the 
>  changelog)
>
>      How do I adjust the timing between the Directory Server and AD 
>  with different encryption using a feeling (ldap->ad),
>  
"feeling"?

>  without putting passwords in plain text?
>  
Not sure what you're asking, but see 
https://fedorahosted.org/389/ticket/47309
>  thanks,
>
>  Denise
>
>
>
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users

sudo group with a space

[Dan Lavu]

Has anybody successfully created a sudoers group in 389 that contains a space? Whatever
way I try to escape the space in my sudouser attribute it just doesn't like it.
I'm able to escape the space in /etc/sudoers by using \ . 

So..

sudouser: %domain\ admins
sudouser: %domain admins
sudouser: \%domain\ admins
sudouser: "%domain admins"
sudouser: '%domain admins' 
 
have not worked, thanks in advance.

Dan

sudo group with a space

[Jonathan Vaughn]

Works for us fine without any fancy treatment:
sudouser: %Global System Administrators

using sudo 1.8.something on centos.

On Wed, May 22, 2013 at 7:36 PM, Dan Lavu <dan(a)lavu.net&gt; wrote:

>  Has anybody successfully created a sudoers group in 389 that contains
> a
>  space? Whatever way I try to escape the space in my sudouser attribute it
>  just doesn't like it. I'm able to escape the space in /etc/sudoers by using
>  \ .
>
>  So..
>
>  sudouser: %domain\ admins
>  sudouser: %domain admins
>  sudouser: \%domain\ admins
>  sudouser: "%domain admins"
>  sudouser: '%domain admins'
>
>  have not worked, thanks in advance.
>
>  Dan
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users

sudo group with a space

[Dan Lavu]

John,

Thats the last thing I wanted to hear. What attributes do you have, sudouser, sudooptions,
sudorun? Also are you using sssd or pam ldap?

Dan


On May 22, 2013, at 7:52 PM, Jonathan Vaughn <jonathan(a)creatuity.com&gt; wrote:

>  Works for us fine without any fancy treatment:
>  sudouser: %Global System Administrators
>  
>  using sudo 1.8.something on centos.
>  
>  On Wed, May 22, 2013 at 7:36 PM, Dan Lavu <dan(a)lavu.net&gt; wrote:
>  Has anybody successfully created a sudoers group in 389 that contains a space? Whatever
> way I try to escape the space in my sudouser attribute it just doesn't like it.
> I'm able to escape the space in /etc/sudoers by using \ .
>  
>  So..
>  
>  sudouser: %domain\ admins
>  sudouser: %domain admins
>  sudouser: \%domain\ admins
>  sudouser: "%domain admins"
>  sudouser: '%domain admins'
>  
>  have not worked, thanks in advance.
>  
>  Dan
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users
>  
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users

sudo group with a space

[Jonathan Vaughn]

we're using sssd for Kerberos logins with LDAP user account details, and
it's caching sudo LDAP for us too. I'm not sure off hand if it'll work with
nested groups if you use them - we haven't used nested groups on any of the
groups we've used with sudo (due to other various programs failing to
support either recursing through groups or using the memberof attribute on
the user).

For that example I gave before, the other sudo values are:
sudocommand: ALL
sudohost: ALL

On other sudoroles we have specific commands and hosts too. We're not using
any other sudo attributes on our sudoroles at the moment (we actually need
to update the schema for the version of sudo we're running, since it
expectes sudorunasuser and sudorunasgroup rather than sudorunas, for
example).

On Wed, May 22, 2013 at 7:54 PM, Dan Lavu <dan(a)lavu.net&gt; wrote:

>  John,
>
>  Thats the last thing I wanted to hear. What attributes do you have,
>  sudouser, sudooptions, sudorun? Also are you using sssd or pam ldap?
>
>  Dan
>
>
>  On May 22, 2013, at 7:52 PM, Jonathan Vaughn <jonathan(a)creatuity.com&gt;
>  wrote:
>
>  Works for us fine without any fancy treatment:
>  sudouser: %Global System Administrators
>
>  using sudo 1.8.something on centos.
>
>  On Wed, May 22, 2013 at 7:36 PM, Dan Lavu <dan(a)lavu.net&gt; wrote:
>
> > Has anybody successfully created a sudoers group in 389 that contains a
> > space? Whatever way I try to escape the space in my sudouser attribute it
> > just doesn't like it. I'm able to escape the space in /etc/sudoers by using
> > \ .
> >
> > So..
> >
> > sudouser: %domain\ admins
> > sudouser: %domain admins
> > sudouser: \%domain\ admins
> > sudouser: "%domain admins"
> > sudouser: '%domain admins'
> >
> > have not worked, thanks in advance.
> >
> > Dan
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
>
>
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users
>
>
>
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users
>

sudo group with a space

[Dan Lavu]

John,

Thanks for all the info. I'm running a very similar setup but I'm still using the
legacy sudo-ldap.conf for my sudo info, I'll install sudo-sss and give that a whirl. 

Dan

On May 22, 2013, at 8:09 PM, Jonathan Vaughn <jonathan(a)creatuity.com&gt; wrote:

>  we're using sssd for Kerberos logins with LDAP user account
> details, and it's caching sudo LDAP for us too. I'm not sure off hand if it'll
> work with nested groups if you use them - we haven't used nested groups on any of the
> groups we've used with sudo (due to other various programs failing to support either
> recursing through groups or using the memberof attribute on the user).
>  
>  For that example I gave before, the other sudo values are:
>  sudocommand: ALL
>  sudohost: ALL
>  
>  On other sudoroles we have specific commands and hosts too. We're not using any other
> sudo attributes on our sudoroles at the moment (we actually need to update the schema for
> the version of sudo we're running, since it expectes sudorunasuser and sudorunasgroup
> rather than sudorunas, for example).
>  
>  On Wed, May 22, 2013 at 7:54 PM, Dan Lavu <dan(a)lavu.net&gt; wrote:
>  John,
>  
>  Thats the last thing I wanted to hear. What attributes do you have, sudouser,
> sudooptions, sudorun? Also are you using sssd or pam ldap?
>  
>  Dan
>  
>  
>  On May 22, 2013, at 7:52 PM, Jonathan Vaughn <jonathan(a)creatuity.com&gt; wrote:
>  
> > Works for us fine without any fancy treatment:
> > sudouser: %Global System Administrators
> > 
> > using sudo 1.8.something on centos.
> > 
> > On Wed, May 22, 2013 at 7:36 PM, Dan Lavu <dan(a)lavu.net&gt; wrote:
> > Has anybody successfully created a sudoers group in 389 that contains a space?
> Whatever way I try to escape the space in my sudouser attribute it just doesn't like
> it. I'm able to escape the space in /etc/sudoers by using \ .
> > 
> > So..
> > 
> > sudouser: %domain\ admins
> > sudouser: %domain admins
> > sudouser: \%domain\ admins
> > sudouser: "%domain admins"
> > sudouser: '%domain admins'
> > 
> > have not worked, thanks in advance.
> > 
> > Dan
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
> > 
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
>  
>  
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users
>  
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users

Fresh instalation problem

[Alan Orlič Belšak]

Just tried to make fresh install, but when I try to manage it with 389 
Console (Configuration), I got the following error:
The user 
uid=admin,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot does 
not have permission to perform this operation.

OS is Centos 6.4, 389 are the following versions:
389-admin-console-1.1.8-1.el6.noarch
389-adminutil-1.1.15-1.el6.i686
389-ds-base-1.2.11.15-11.el6.i686
389-admin-1.1.29-1.el6.i686
389-ds-console-doc-1.2.6-1.el6.noarch
389-dsgw-1.1.10-1.el6.i686
389-admin-console-doc-1.1.8-1.el6.noarch
389-console-1.1.7-1.el6.noarch
389-ds-base-libs-1.2.11.15-11.el6.i686
389-ds-1.2.2-1.el6.noarch
389-ds-console-1.2.6-1.el6.noarch

I found this:
http://lists.fedoraproject.org/pipermail/389-users/2011-January/012718.html

But this is old error. The interesting thing is that the upgrades are 
working ok.

Alan

On 23.5.2013 4:15, Dan Lavu wrote:
>  John,
>
>  Thanks for all the info. I'm running a very similar setup but I'm 
>  still using the legacy sudo-ldap.conf for my sudo info, I'll install 
>  sudo-sss and give that a whirl.
>
>  Dan
>
>  On May 22, 2013, at 8:09 PM, Jonathan Vaughn <jonathan(a)creatuity.com 
>  <mailto:[e-mail]>> wrote:
>
> > we're using sssd for Kerberos logins with LDAP user account details, 
> > and it's caching sudo LDAP for us too. I'm not sure off hand if it'll 
> > work with nested groups if you use them - we haven't used nested 
> > groups on any of the groups we've used with sudo (due to other 
> > various programs failing to support either recursing through groups 
> > or using the memberof attribute on the user).
> >
> > For that example I gave before, the other sudo values are:
> > sudocommand: ALL
> > sudohost: ALL
> >
> > On other sudoroles we have specific commands and hosts too. We're not 
> > using any other sudo attributes on our sudoroles at the moment (we 
> > actually need to update the schema for the version of sudo we're 
> > running, since it expectes sudorunasuser and sudorunasgroup rather 
> > than sudorunas, for example).
> >
> > On Wed, May 22, 2013 at 7:54 PM, Dan Lavu <dan(a)lavu.net 
> > <mailto:[e-mail]>> wrote:
> >
> >     John,
> >
> >     Thats the last thing I wanted to hear. What attributes do you
> >     have, sudouser, sudooptions, sudorun? Also are you using sssd or
> >     pam ldap?
> >
> >     Dan
> >
> >
> >     On May 22, 2013, at 7:52 PM, Jonathan Vaughn
> >     <jonathan(a)creatuity.com <mailto:[e-mail]>> wrote:
> >
> >>     Works for us fine without any fancy treatment:
> >>     sudouser: %Global System Administrators
> >>
> >>     using sudo 1.8.something on centos.
> >>
> >>     On Wed, May 22, 2013 at 7:36 PM, Dan Lavu <dan(a)lavu.net
> >>     <mailto:[e-mail]>> wrote:
> >>
> >>         Has anybody successfully created a sudoers group in 389 that
> >>         contains a space? Whatever way I try to escape the space in
> >>         my sudouser attribute it just doesn't like it. I'm able to
> >>         escape the space in /etc/sudoers by using \ .
> >>
> >>         So..
> >>
> >>         sudouser: %domain\ admins
> >>         sudouser: %domain admins
> >>         sudouser: \%domain\ admins
> >>         sudouser: "%domain admins"
> >>         sudouser: '%domain admins'
> >>
> >>         have not worked, thanks in advance.
> >>
> >>         Dan
> >>         --
> >>         389 users mailing list
> >>         389-users(a)lists.fedoraproject.org
> >>         <mailto:[e-mail]>
> >>         https://admin.fedoraproject.org/mailman/listinfo/389-users
> >>
> >>
> >>     --
> >>     389 users mailing list
> >>     389-users(a)lists.fedoraproject.org
> >>     <mailto:[e-mail]>
> >>     https://admin.fedoraproject.org/mailman/listinfo/389-users
> >
> >
> >     --
> >     389 users mailing list
> >     389-users(a)lists.fedoraproject.org
> >     <mailto:[e-mail]>
> >     https://admin.fedoraproject.org/mailman/listinfo/389-users
> >
> >
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org <mailto:[e-mail]>
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
>
>
>
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users

Fresh instalation problem

[Alan Orlič Belšak]

Found the problem, 389-console on Windows computer. Reinstalled it, 
cleared all .jar files and now it's working correctly.

Bye, Alan


On 23.5.2013 8:08, Alan Orlič Belšak wrote:
>  Just tried to make fresh install, but when I try to manage it with
> 389 
>  Console (Configuration), I got the following error:
>  The user 
>  uid=admin,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot does 
>  not have permission to perform this operation.
>
>  OS is Centos 6.4, 389 are the following versions:
>  389-admin-console-1.1.8-1.el6.noarch
>  389-adminutil-1.1.15-1.el6.i686
>  389-ds-base-1.2.11.15-11.el6.i686
>  389-admin-1.1.29-1.el6.i686
>  389-ds-console-doc-1.2.6-1.el6.noarch
>  389-dsgw-1.1.10-1.el6.i686
>  389-admin-console-doc-1.1.8-1.el6.noarch
>  389-console-1.1.7-1.el6.noarch
>  389-ds-base-libs-1.2.11.15-11.el6.i686
>  389-ds-1.2.2-1.el6.noarch
>  389-ds-console-1.2.6-1.el6.noarch
>
>  I found this:
>  http://lists.fedoraproject.org/pipermail/389-users/2011-January/012718.html
>
>  But this is old error. The interesting thing is that the upgrades are 
>  working ok.
>
>  Alan
>
>  On 23.5.2013 4:15, Dan Lavu wrote:
> > John,
> >
> > Thanks for all the info. I'm running a very similar setup but I'm 
> > still using the legacy sudo-ldap.conf for my sudo info, I'll install 
> > sudo-sss and give that a whirl.
> >
> > Dan
> >
> > On May 22, 2013, at 8:09 PM, Jonathan Vaughn <jonathan(a)creatuity.com 
> > <mailto:[e-mail]>> wrote:
> >
> >> we're using sssd for Kerberos logins with LDAP user account details, 
> >> and it's caching sudo LDAP for us too. I'm not sure off hand if 
> >> it'll work with nested groups if you use them - we haven't used 
> >> nested groups on any of the groups we've used with sudo (due to 
> >> other various programs failing to support either recursing through 
> >> groups or using the memberof attribute on the user).
> >>
> >> For that example I gave before, the other sudo values are:
> >> sudocommand: ALL
> >> sudohost: ALL
> >>
> >> On other sudoroles we have specific commands and hosts too. We're 
> >> not using any other sudo attributes on our sudoroles at the moment 
> >> (we actually need to update the schema for the version of sudo we're 
> >> running, since it expectes sudorunasuser and sudorunasgroup rather 
> >> than sudorunas, for example).
> >>
> >> On Wed, May 22, 2013 at 7:54 PM, Dan Lavu <dan(a)lavu.net 
> >> <mailto:[e-mail]>> wrote:
> >>
> >>     John,
> >>
> >>     Thats the last thing I wanted to hear. What attributes do you
> >>     have, sudouser, sudooptions, sudorun? Also are you using sssd or
> >>     pam ldap?
> >>
> >>     Dan
> >>
> >>
> >>     On May 22, 2013, at 7:52 PM, Jonathan Vaughn
> >>     <jonathan(a)creatuity.com <mailto:[e-mail]>> wrote:
> >>
> >>>     Works for us fine without any fancy treatment:
> >>>     sudouser: %Global System Administrators
> >>>
> >>>     using sudo 1.8.something on centos.
> >>>
> >>>     On Wed, May 22, 2013 at 7:36 PM, Dan Lavu <dan(a)lavu.net
> >>>     <mailto:[e-mail]>> wrote:
> >>>
> >>>         Has anybody successfully created a sudoers group in 389
> >>>         that contains a space? Whatever way I try to escape the
> >>>         space in my sudouser attribute it just doesn't like it. I'm
> >>>         able to escape the space in /etc/sudoers by using \ .
> >>>
> >>>         So..
> >>>
> >>>         sudouser: %domain\ admins
> >>>         sudouser: %domain admins
> >>>         sudouser: \%domain\ admins
> >>>         sudouser: "%domain admins"
> >>>         sudouser: '%domain admins'
> >>>
> >>>         have not worked, thanks in advance.
> >>>
> >>>         Dan
> >>>         --
> >>>         389 users mailing list
> >>>         389-users(a)lists.fedoraproject.org
> >>>         <mailto:[e-mail]>
> >>>         https://admin.fedoraproject.org/mailman/listinfo/389-users
> >>>
> >>>
> >>>     --
> >>>     389 users mailing list
> >>>     389-users(a)lists.fedoraproject.org
> >>>     <mailto:[e-mail]>
> >>>     https://admin.fedoraproject.org/mailman/listinfo/389-users
> >>
> >>
> >>     --
> >>     389 users mailing list
> >>     389-users(a)lists.fedoraproject.org
> >>     <mailto:[e-mail]>
> >>     https://admin.fedoraproject.org/mailman/listinfo/389-users
> >>
> >>
> >> --
> >> 389 users mailing list
> >> 389-users(a)lists.fedoraproject.org <mailto:[e-mail]>
> >> https://admin.fedoraproject.org/mailman/listinfo/389-users
> >
> >
> >
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
>
>
>
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users

sudo group with a space

[Dan Lavu]

Just an update, the sudo rules using groups worked in SSSD but not pam ldap. 

On May 22, 2013, at 10:15 PM, Dan Lavu <dan(a)lavu.net&gt; wrote:

>  John,
>  
>  Thanks for all the info. I'm running a very similar setup but I'm still using the
> legacy sudo-ldap.conf for my sudo info, I'll install sudo-sss and give that a whirl. 
>  
>  Dan
>  
>  On May 22, 2013, at 8:09 PM, Jonathan Vaughn <jonathan(a)creatuity.com&gt; wrote:
>  
> > we're using sssd for Kerberos logins with LDAP user account details, and it's
> caching sudo LDAP for us too. I'm not sure off hand if it'll work with nested
> groups if you use them - we haven't used nested groups on any of the groups we've
> used with sudo (due to other various programs failing to support either recursing through
> groups or using the memberof attribute on the user).
> > 
> > For that example I gave before, the other sudo values are:
> > sudocommand: ALL
> > sudohost: ALL
> > 
> > On other sudoroles we have specific commands and hosts too. We're not using any
> other sudo attributes on our sudoroles at the moment (we actually need to update the
> schema for the version of sudo we're running, since it expectes sudorunasuser and
> sudorunasgroup rather than sudorunas, for example).
> > 
> > On Wed, May 22, 2013 at 7:54 PM, Dan Lavu <dan(a)lavu.net&gt; wrote:
> > John,
> > 
> > Thats the last thing I wanted to hear. What attributes do you have, sudouser,
> sudooptions, sudorun? Also are you using sssd or pam ldap?
> > 
> > Dan
> > 
> > 
> > On May 22, 2013, at 7:52 PM, Jonathan Vaughn <jonathan(a)creatuity.com&gt; wrote:
> > 
> >> Works for us fine without any fancy treatment:
> >> sudouser: %Global System Administrators
> >> 
> >> using sudo 1.8.something on centos.
> >> 
> >> On Wed, May 22, 2013 at 7:36 PM, Dan Lavu <dan(a)lavu.net&gt; wrote:
> >> Has anybody successfully created a sudoers group in 389 that contains a space?
> Whatever way I try to escape the space in my sudouser attribute it just doesn't like
> it. I'm able to escape the space in /etc/sudoers by using \ .
> >> 
> >> So..
> >> 
> >> sudouser: %domain\ admins
> >> sudouser: %domain admins
> >> sudouser: \%domain\ admins
> >> sudouser: "%domain admins"
> >> sudouser: '%domain admins'
> >> 
> >> have not worked, thanks in advance.
> >> 
> >> Dan
> >> --
> >> 389 users mailing list
> >> 389-users(a)lists.fedoraproject.org
> >> https://admin.fedoraproject.org/mailman/listinfo/389-users
> >> 
> >> --
> >> 389 users mailing list
> >> 389-users(a)lists.fedoraproject.org
> >> https://admin.fedoraproject.org/mailman/listinfo/389-users
> > 
> > 
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
> > 
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
>

changelog

[Denise Cosso]

Hi,


Description of problem:
When a userPassword is changed in a server with changelog, the hashed password
is logged and also a cleartext pseudo-attribute version.  It looks like this:
change::
replace: userPassword
userPassword: {SHA256}vqtiN2LHdrEUOJUKu+IBVqAVFsAlvFw+11kD/Q==
-
replace: unhashed#user#password
unhashed#user#password: secret12

This unhashed version is used in winsync where the cleartext version of the
password must be written to the AD.

Now if the DS is involved in replication with another DS, the change will be
replayed exactly as it is logged to the other DS replicas, including the
cleartext pseudo-attribute password.

thanks,

Denise

changelog

[Rich Megginson]

On 06/04/2013 12:39 PM, Denise Cosso wrote:
>  Hi,
>
>
>  Description of problem:
>  When a userPassword is changed in a server with changelog, the hashed password
>  is logged and also a cleartext pseudo-attribute version.  It looks like this:
>  change::
>  replace: userPassword
>  userPassword: {SHA256}vqtiN2LHdrEUOJUKu+IBVqAVFsAlvFw+11kD/Q==
>  -
>  replace: unhashed#user#password
>  unhashed#user#password: secret12
>
>  This unhashed version is used in winsync where the cleartext version of the
>  password must be written to the AD.
>
>  Now if the DS is involved in replication with another DS, the change will be
>  replayed exactly as it is logged to the other DS replicas, including the
>  cleartext pseudo-attribute password.
>  
What platform?  What version of 389-ds-base are you using?
>  thanks,
>
>  Denise
>
>
>
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users