[Fedora-directory-devel] Clients can not logging in FDS.
by Shahzad Abid
Hello All
I have installed FDS on FC5. Services are running on the server but
clients have not able to logged in though directory server.
All I want to know the procedure for logging clints into my newly
installed FDS.
Regards,
--
Shahzad Abid
17 years, 5 months
[Fedora-directory-devel] fedora DS website design
by Seth Nickell
I've been tweaking the DS wiki skin to remove a lot of the noise
produced by media wiki tooling. If anyone is interested, you can take
a look at what I've got so far by:
1) signing into the wiki
2) going to preferences (at the top right of the screen)
3) going to the "skin" section
4) selecting the "FDS" skin
Its still got some serious bugs (like the tabs end up mis-laid-out on
big pages like http://directory.fedora.redhat.com/wiki/FAQ), but if
anyone has general feedback I'd be interested.
I've also been focusing the text on some of the pages (particularly
the home page), so take a look at that too.
-Seth
17 years, 5 months
[Fedora-directory-devel] Console not starting.
by Shahzad Abid
Dear All
I have installed DS on FC5 all installation process completed
successfully, when start console i am getting follwong error message;
/opt/fedora-ds/startconsole -u root -a http://127.0.0.1:13640
Exception in thread "main" java.lang.NoClassDefFoundError:
com.netscape.management.client.console.Console
at gnu.java.lang.MainThread.run (libgcj.so.7)
Caused by: java.lang.ClassNotFoundException:
com.netscape.management.client.console.Console not found in
gnu.gcj.runtime.SystemClassLoader{urls=[],
parent=gnu.gcj.runtime.ExtensionClassLoader{urls=[], parent=null}}
at java.net.URLClassLoader.findClass (libgcj.so.7)
at java.lang.ClassLoader.loadClass (libgcj.so.7)
at java.lang.ClassLoader.loadClass (libgcj.so.7)
at java.lang.Class.forName (libgcj.so.7)
at gnu.java.lang.MainThread.run (libgcj.so.7)
netstat -ltp
tcp 0 0 *:ldap *:* LISTEN 4949/ns-slapd
tcp 0 0 *:13640 *:* LISTEN 5064/httpd.worker
but i can access via web page http://127.0.0.1:13640
--
Shahzad Abid
Network Engineer
17 years, 5 months
[Fedora-directory-devel] opening up the wiki
by Seth Nickell
On the principle of providing for the possibility general community
openness (i.e. lets not have barriers even if we're not getting a bunch
of people jumping in quite yet), I'd like to propose opening up the
wiki... i.e. not requiring manually approved accounts.
I think this raises some legitimate security concerns... about the best
response I can provide is that these just haven't been major practical
issues amongst wikis in the open source world. Defacing of wikis, about
the worst I've actually heard of in any projects I'm connected to (and
even this is rare), is very easy to revert.
Sometimes I think prudence and responsibility can be bad for having
functioning open source projects, which are inherently a little hacky
and fly-by-night in nature (even the very important ones that end up
running critical systems, ahem) ;-)
-Seth
17 years, 5 months
[Fedora-directory-devel] [Fwd: FDS over SSL with PassSync -- How I did it]
by Rob Crittenden
Is this something that should be translated into a FAQ or How-to on the
wiki? I'd be happy to write it up I just don't have the means to test
whether his method works in general.
rob
-------- Original Message --------
Subject: [Fedora-directory-users] FDS over SSL with PassSync -- How I did it
Date: Thu, 08 Jun 2006 11:33:39 -0700
From: Jeff Gamsby <JFGamsby(a)lbl.gov>
Reply-To: General discussion list for the Fedora Directory server
project. <fedora-directory-users(a)redhat.com>
To: General discussion list for the Fedora Directory server project.
<fedora-directory-users(a)redhat.com>
Thanks to everyone who helped me.
Since it was a struggle for me, I thought that I would post how I did it
in case others have the same problems that I had. Maybe it will help
someone else.
My Setup:
Fedora Core 4
Fedora Directory Server 1.0.2
Windows 2000 Server
Install FDS ( or reinstall: rpm -qa | grep fedora-ds | xargs rpm -e; rm
-rf /opt/fedora-ds ; rpm -i fedora-ds-1.0.2 )
create certificates, etc..
I used this simple script that I wrote: (cd to /opt/fedora-ds/alias)
-----------------------------------------------------------------------
echo -n "Creating password and noise file..."
echo "8904859034905834-580943502385430958430958049385" >
/opt/fedora-ds/alias/pwdfile.txt
echo "8374893jkhsdfjkhdjksfah89dskjfkdghkjdfhguiert9348khkfhgkjfd79" >
/opt/fedora-ds/alias/noise.txt
echo -n "Creating Databases..."
$serverroot/shared/bin/certutil -N -d . -f pwdfile.txt
echo -n "Generating encryption key..."
$serverroot/shared/bin/certutil -G -d . -z noise.txt -f pwdfile.txt
echo -n "Generating self-signed certificate..."
$serverroot/shared/bin/certutil -S -n "CA certificate" -s "cn=CAcert" -x
-t "CT,," -m 1000 -v 120 -d . -z noise.txt -f pwdfile.txt
echo -n "Generating server certificate.."
$serverroot/shared/bin/certutil -S -n "Server-Cert" -s
"cn=msas.msd.lbl.gov" -c "CA certificate" -t "u,u,u" -m 1001 -v 120 -d
. -z noise.txt -f pwdfile.txt
mv key3.db slapd-msas-key3.db
mv cert8.db slapd-msas-cert8.db
ln -s slapd-msas-key3.db key3.db
ln -s slapd-msas-cert8.db cert8.db
echo -n "Setting permissions.."
chown nobody.nobody /opt/fedora-ds/alias/slapd-msas*
echo -n "Exporting certificate.."
$serverroot/shared/bin/certutil -L -d . -n "CA certificate" -r > cacert.der
echo "Converting certificate.."
openssl x509 -inform DER -in cacert.der -outform PEM -out cacert.pem
echo "Copying cacert.pem to /etc/openldap/cacerts.."
cp cacert.pem /etc/openldap/cacerts/
echo -n "Enabling SSL in FDS"
echo ""
echo -n "Please enter Manager password..(twice)"
ldapmodify -x -D cn=Manager -W -f /tmp/ssl_enable.ldif
ldapmodify -x -D cn=Manager -W -a -f /tmp/addRSA.ldif
---------------------------------------------------------
restart FDS
Test SSL connections and ldapsearch
netstat -an | grep 636
Install Active Directory on Windows Server
Install Certificate Services --> Enterprise root CA
reboot
Enable SSL on AD
1. Install Certificate Services on Windows 2000 Server and an
Enterprise Certificate Authority in the Active Directory Domain.
Make sure you install an Enterprise Certificate Authority.
2. Create a Security (Group) Policy to direct Domain Controllers to
get an SSL certificate from the Certificate Authority (CA).
1. Open the Active Directory Users and Computers Administrative
tool.
2. Under the domain, right-click on Domain Controllers.
3. Select Properties.
4. In the Group Policy tab, click to edit the Default Domain
Controllers Policy.
5. Go to Computer Configuration->Windows Settings->Security
Settings->Public Key Policies.
6. Right click Automatic Certificate Request Settings.
7. Select New.
8. Select Automatic Certificate Request.
9. Run the wizard. Select the Certificate Template for a Domain
Controller.
10. Select your Enterprise Certificate Authority as the CA.
Selecting a third-party CA works as well.
11. Complete the wizard.
12. All Domain Controllers now automatically request a
certificate from the CA, and support LDAP using SSL on port 636.
3. Retrieve the Certificate Authority Certificate
1. Open a Web browser on the AD machine
2. Go to http://localhost/certsrv/
3. Select the task Retrieve the CA certificate or certificate
revocation list.
4. Click Next.
5. The next page automatically highlights the CA certificate.
Click Download CA certificate.
6. A new download window opens. Save the file to the hard drive.
Save in DER mode
Copy file to FDS server, convert to PEM format
openssl x509 -inform DER -in ad-cert.der -outform PEM -out ad-cert.pem
Import AD CA cert into FDS
certutil -A -d . -P slapd-instance- -t "CT,CT,CT" -a -i ad-cert.pem
check certs ( from /opt/fedora-ds/alias)
certutil -L -d . -P slapd-instance
Check ldapsearch from FDS to AD
ldapsearch -Z -P <RHDS-cert8.db> -h <AD/NT Hostname> -p <AD SSL port>
-D "<sync manager user> -w < sync manager password> -s <scope>
-b "<AD base>" "<filter>"
Install PassSync on Windows machine.
Follow directions from Howto:WindowsSync (certificate creation)
restart AD server
Enable Replication in Directory Server Console:
Go to configuration tab --> Replication --> enable changelog --> default
Expand Replication, click UserRoot
Check "Enable Replica" Single-master
Right Click UserRoot --> Create new windows sync agreement
Up log level in FDS:
dn: cn=config
changetype: modify
replace: nsslapd-errorlog-level
nsslapd-errorlog-level: 8192
ldapmodify -x -D "cn=directory manager" -a -f repl_log.ldif
restart FDS
right click win sync agreement --> Initiate Full Sync
check error logs (/opt/fedora/slapd-instance/logs/errors)
In order for users to be created on the Windows side, users must have
certain attributes.
e.g.
dn: uid=TBird,ou=People, dc=server,dc=com
givenName: Tweetie
ntUserCreateNewAccount: true
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: ntuser
objectClass: posixAccount
facsimileTelephoneNumber: 510-555-5555
uid: TBird
mail: tbird(a)server.com
uidNumber: 71209
cn: Tweetie Bird
ntUserComment: Tweetie Bird User Account
telephoneNumber: 510-555-5555
loginShell: /bin/bash
ntUserDomainId: tbird
gidNumber: 5000
ntUserDeleteAccount: true
gecos: Tweetie Bird
homeDirectory: /home/tbird
sn: Bird
userPassword::
I hope that I have this right.
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
17 years, 5 months
[Fedora-directory-devel] re: apache ldap over SSL.
by Joe Baker
As I recall ssl enabled communications are very fussy about the hostname
that their certificates were created for. So try using your
hostname.localnet name to connect to the IP and see if that helps.
There is really little point in enabling ssl connections to localhost
anyway.
Good Luck!
-Joe Baker
> From: "Mickael Besse" <mickaelb(a)hotmail.com>
> Subject: [Fedora-directory-devel] apache ldap over SSL.
> To: fedora-directory-devel(a)redhat.com
> Message-ID: <BAY104-F3037FD70C02E1E7B3174A2C98B0(a)phx.gbl>
> Content-Type: text/plain; charset=iso-8859-1; format=flowed
>
> I have a problem to use apache ldap over SSL.
>
> os: fedora core 3 (updated with yum)
> tools :fedora directory server 1.0.2, HTTPd 2.0.53, mod_ssl 1:2.0.53,
> mod_auth_ldap, mod_ldap,
>
> errors :
> In /var/log/http/error_log: auth_ldap authenticate: user test
> authentication failed; URI / [LDAP: ldap_simple_bind_s() failed][Can't
> contact LDAP server]
>
> In /opt/fedora-ds/slapd-id/logs/access : SSL connection from 127.0.0.1 to
> 127.0.0.1
> closed - Encountered end of file
>
>
> I have no probleme without ssl.
>
> In http.conf:
>
> LDAPTrustedCA /etc/httpd/conf/ssl.crt/certificat.pem
> LDAPTrustedCAType BASE64_FILE
>
>
> <Directory "/var/www/html">
>
> AuthLDAPEnabled on
> AuthLDAPURL ldaps://name_of_LDAPserver:636/dc=***,dc=***?uid
> require group dn_groupe
> </Directory>
>
>
> In fedora directory server, I use certutil -L -d . -P slapd-serverID- -n
> "CA certificate" -a > cacert.asc to export CA cert. Then, I copy the
> contents of cacert.asc in /etc/httpd/conf/ssl.crt/certificat.pem.
>
> So /etc/httpd/conf/ssl.crt/certificat.pem look like:
>
> -----BEGIN CERTIFICATE-----
> kjbfilqbvlsdbvlisdf........
> -----END CERTIFICATE-----
>
>
> Note this message in access log when the httpd server start
> LDAP: Built with OpenLDAP LDAP SDK
> LDAP: SSL support unavailable
>
>
> Did a solution for this problem ?
> Can I use apache / ssl / auth_mod_ldap / ldap(s) togheter ?
> Maybe a miss somethings ?
>
> Did I have to rebuild my module auth_ldap module ?
>
> I want to rebuild the srpm from fedora core 3 updates, and include
> --with-ldap-sdk=netscape for the auth_ldap module.
> But I have no idea where to specifie this. httpd.spec file defines core
> options, but not modules options.
> Where can I specied configure options for auth_ldap modules ? This hints
> would be very appreciated...
>
> The time you spend to me is very appreciated
> regards
>
> _________________________________________________________________
> Windows Live Mail : découvrez et testez la version bêta !
> http://www.ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9...
>
>
>
> ------------------------------
>
> --
> Fedora-directory-devel mailing list
> Fedora-directory-devel(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-devel
>
>
> End of Fedora-directory-devel Digest, Vol 12, Issue 1
> *****************************************************
>
17 years, 6 months
[Fedora-directory-devel] apache ldap over SSL.
by Mickael Besse
I have a problem to use apache ldap over SSL.
os: fedora core 3 (updated with yum)
tools :fedora directory server 1.0.2, HTTPd 2.0.53, mod_ssl 1:2.0.53,
mod_auth_ldap, mod_ldap,
errors :
In /var/log/http/error_log: auth_ldap authenticate: user test
authentication failed; URI / [LDAP: ldap_simple_bind_s() failed][Can't
contact LDAP server]
In /opt/fedora-ds/slapd-id/logs/access : SSL connection from 127.0.0.1 to
127.0.0.1
closed - Encountered end of file
I have no probleme without ssl.
In http.conf:
LDAPTrustedCA /etc/httpd/conf/ssl.crt/certificat.pem
LDAPTrustedCAType BASE64_FILE
<Directory "/var/www/html">
AuthLDAPEnabled on
AuthLDAPURL ldaps://name_of_LDAPserver:636/dc=***,dc=***?uid
require group dn_groupe
</Directory>
In fedora directory server, I use certutil -L -d . -P slapd-serverID- -n
"CA certificate" -a > cacert.asc to export CA cert. Then, I copy the
contents of cacert.asc in /etc/httpd/conf/ssl.crt/certificat.pem.
So /etc/httpd/conf/ssl.crt/certificat.pem look like:
-----BEGIN CERTIFICATE-----
kjbfilqbvlsdbvlisdf........
-----END CERTIFICATE-----
Note this message in access log when the httpd server start
LDAP: Built with OpenLDAP LDAP SDK
LDAP: SSL support unavailable
Did a solution for this problem ?
Can I use apache / ssl / auth_mod_ldap / ldap(s) togheter ?
Maybe a miss somethings ?
Did I have to rebuild my module auth_ldap module ?
I want to rebuild the srpm from fedora core 3 updates, and include
--with-ldap-sdk=netscape for the auth_ldap module.
But I have no idea where to specifie this. httpd.spec file defines core
options, but not modules options.
Where can I specied configure options for auth_ldap modules ? This hints
would be very appreciated...
The time you spend to me is very appreciated
regards
_________________________________________________________________
Windows Live Mail : découvrez et testez la version bêta !
http://www.ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9...
17 years, 6 months