[Fedora-directory-users] SASL-GSSAPI - KRB5
by Barry R. Ribbeck
SASL-GSAPPI - Kerberos
When I attempt to bind to the directory and search for the same
> information with the command line below.
>
> ldapsearch -Y GSSAPI -X u:<valid uid> -b "" -s base -LLL -H
> ldaps://FQDN supportedSASLMechanism
Did you really mean to initiate a SASL/GSSAPI bind over SSL ?
I'm not sure that will work. It might, but it may not be supported.
I know for sure that encrypted gssapi will _not_ work. It uses the
same layered I/O hooks that SSL does, and you can't have both
active at the same time (nor would you want to AFAIK).
Try the non-ssl port and see what happens.
The new and improved error after changing from -H ldaps://..... to -H ldap://... follows
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Invalid credentials
additional info: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context
[28/Nov/2005:07:47:47 -0600] - new connection on 68
[28/Nov/2005:07:47:47 -0600] - activity on 68r
[28/Nov/2005:07:47:47 -0600] - read activity on 68
[28/Nov/2005:07:47:47 -0600] - conn 10 activity level = 0
[28/Nov/2005:07:47:47 -0600] - sasl(2): GSSAPI Error: Miscellaneous failure (Bad encryption type)[28/Nov/2005:07:47:47 -0600] - listener got signaled
[28/Nov/2005:07:47:47 -0600] - activity on 68r
[28/Nov/2005:07:47:47 -0600] - read activity on 68
[28/Nov/2005:07:47:47 -0600] - listener got signaled
Thanks for the hint. I did read that it would not be supported over SSL the competing port would be a valid reason. I did get the mapping pieces completed but had some difficulty understanding the REALMS docs. http://www.redhat.com/docs/manuals/dir-server/ag/7.1/ssl.html#1083165
The docs state that GSS-API must be enabled as a SASL mechanism in the Directory to make this work, but it does not state how if this is the default or if not how to enable GSS-API. The Realms section reads as if I have to change the DN of all users in the directory to be under cn=gssapi,cn=auth and therefore the confusion.
Thanks again for any clarity given
Barry
18 years, 4 months
[Fedora-directory-users] Creating Replication Agreements at the Command Line
by Philip Lembo
If anyone has successfully set up replication end-to-end (starting with
configuring the replicas and on to creating and enabling a replication
agreement) from the command line as opposed to using the GUI console,
I'd appreciate seeing any notes they may have on the subject. While the
Red Hat doc does a terrific job of covering replication (someone should
get a medal for the troubleshooting section ...), there's no discussion
there on how to administer this from the command line. For reliability
and efficiency reasons I've been doing more and more of my directory
management using command line tools, and would like to extend this into
replication management. Thanks in advance.
Phil Lembo
18 years, 4 months
[Fedora-directory-users] What does "Cert Token" mean?
by joe
Dear all
When I tried to fill all of fields of passSync service in windows
2000. I didn't really know what should I put in Cert Token field.
The Document answer is "password". But I want to understand what it
means? Thanks a lot.
Joe
18 years, 4 months
[Fedora-directory-users] Apps switched in SysV admin init script
by Kevin M. Myer
The SysV init script at:
http://www.directory.fedora.redhat.com/download/fedora-ds-admin-init.d
has the apps for stopping and restarting the admin service switched.
Can someone update the Wiki with the following change?
--- fedora-ds-admin-init.d 2005-11-26 15:38:24.000000000 -0500
+++ fedora-ds-admin-init.d 2005-11-26 15:38:36.000000000 -0500
@@ -14,8 +14,8 @@
# Set up some common variables before we launch into what might be
# considered boilerplate by now.
path_start=/opt/fedora-ds/start-admin
-path_restart=/opt/fedora-ds/stop-admin
-path_stop=/opt/fedora-ds/restart-admin
+path_restart=/opt/fedora-ds/restart-admin
+path_stop=/opt/fedora-ds/stop-admin
path=./ns-httpd
prog="Fedora-DS Admin"
Kevin
--
Kevin M. Myer
Senior Systems Administrator
Lancaster-Lebanon Intermediate Unit 13 http://www.iu13.org
18 years, 4 months
[Fedora-directory-users] SASL-GSSAPI and KRB5
by Barry R Ribbeck
I am trying to use SASL-GSSAPI to leverage our Kerberos V authentication
REALM with Fedora Directory server. When I search anonymously for
supported SASL mechanisms, I get the following response. Seeing GSSAPI
is comforting, but I am sure that is not the whole story. I am running
the directory on RHL E3 with SASL2. What I am looking for are some
docs for the entire process. Turbo Fredriksson has some excellent docs
on Open LDAP, but they don't seem to map well to the Fedora Directory.
Any suggestion would be greatly apprectiated and I would love to
document the process for others.
ldapsearch -H ldaps://FQDN/ -x -b "" -s base -LLL supportedSASLMechanisms
dn:
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: PLAIN
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: DIGEST-MD5
supportedSASLMechanisms: CRAM-MD5
supportedSASLMechanisms: ANONYMOUS
When I attempt to bind to the directory and search for the same
information with the command line below.
ldapsearch -Y GSSAPI -X u:<valid uid> -b "" -s base -LLL -H
ldaps://FQDN supportedSASLMechanism
I get the following command line error
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Invalid credentials
additional info: SASL(-13): authentication failure: GSSAPI
Failure: gss_accept_sec_context
and the following directory error log error
[27/Nov/2005:20:21:18 -0600] - new SSL connection on 69
[27/Nov/2005:20:21:18 -0600] - activity on 69r
[27/Nov/2005:20:21:18 -0600] - read activity on 69
[27/Nov/2005:20:21:18 -0600] - conn 12 activity level = 0
[27/Nov/2005:20:21:18 -0600] - sasl(2): GSSAPI Error: Miscellaneous
failure (Bad encryption type)[27/Nov/2005:20:21:18 -0600] - listener got
signaled
The directory seems to support SASL, and SASL2 is installed, I am just
not sure if anything else is required. A blank ldapsearch reveals the
following ldapsearch
SASL/DIGEST-MD5 authentication started
The directory docs are pretty thin. Any help would be appreciated.
18 years, 4 months
Re: [Fedora-directory-users] Winsync Problem with NT4
by Elliot Schlegelmilch
> Maybe it is because I used the wrong password at the first try (PDC side)? I
> read in the manual that
> "After the service is installed and started the first time the password can
> only be changed via an LDAP modify operation, not the configuration file."
I'm glad to hear someone is giving this a try.
A ldapmodify command similar to this can change the default password:
ldapmodify -D 'uid=admin,ou=system' -h pdc.my.domain -p 389 -w secret
dn: uid=admin,ou=system
changetype: modify
replace: userpassword
userpassword: foob4r
Then I believe you use this user and password (uid=admin,ou=system,
foob4r) in the replication agreement.
Regards,
Elliot
18 years, 4 months
Re: [Fedora-directory-users] Winsync Problem with NT4
by Hartmut Wöhrle
Am Mittwoch, 23. November 2005 16:57 schrieb David Boreham:
> Hi, can you post the entire log segment where this shows up please ?
I have to setup the Loglevel to Replication to debug first... hope I can do
it tomorrow.
BTW. where can I set the loglevel for the usersync.log?
The wrapper.conf entries about loglevels just make the wrapper.log bigger and
more informative, but not the usersync.log
> Wrong password would just mean that the connection would fail. It
> wouldn't have any
> persistent effect.
Hmm, as I understand the "hardcoded" user at the PDC side is
cn=admin,ou=system
When I started the first time this user didn't exist - of security reasons
our Admin is called different (Superroot for example). Does this have any
effects?
> Anyway, the ldapmodify operation will be to the userpassword attribute
> on the ApacheDS root entry. I'll look that up and post the command...
Would be nice :)
And where is this ApacheDS? In the usual
C:\Program Files\Red Hat Directory Synchronization
> You shouldn't need to reinstall.
Ufff....
Thanks
--
===========================================
Hartmut Woehrle
EMail: hartmut.woehrle(a)mail.pcom.de
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
18 years, 4 months
[Fedora-directory-users] Require SSL/TLS Only Connections
by Thomas Cramer
I would like to require that *only* SSL/TLS connections be allowed to my
server. This is not to be confused with wanting SSL client
authentication. I had initially thought I could do this with ACI using
the authmethod="ssl", however after looking at the documentation closely
and experimentation this refers to do client based SSL authentication as
well. I do have SSL/TLS set up correctly, I just want to disallow
non-encrypted traffic.
In OpenLDAP I would merely state "security ssf=128" to require SSL/TLS
only connections.
Anyone know how to do this in FDS?
==
tc
18 years, 4 months
[Fedora-directory-users] Active Directory Interaction
by Scott Boggs
I have recently started working with the fedora directory server and I
think the
project totally rocks!. I am hoping that a seasoned directory server
veteran can
educate me on where I am going wrong with setting a Fedora-ds and Active
directory
server to sync passwords. The following is my configuration and
observations:
I am running Fedora Core 4 loaded with the
fedora-ds-7.1-2.RHEL4.i386.opt.rpm that
the project provided for evaluation.
Part of my evaluation is to demonstrate how the the directory sever will
interact with
a active directory system. I have followed the instructions listed in
chapter 18 of the
Red Hat Directory Server Administration Guide. Where I am running into
issues is that
the step 6 of the setup instructions states that once the suffix is
selected within the console
configuration area that sync can be chosen and a New Synchronization
Agreement created.
This area seems to be missing on my version. I am guessing that I have
hit a limitation of the
evaluation version and I need to now build my own to enable this
functionality. Am I correct?
If not, could someone please point me in the correct direction.
Thank you for you time.
18 years, 4 months
[Fedora-directory-users] Consult about experience with Red Hat Directory Server
by Wilmer Jaramillo M.
i want know cases of study and experiences of installation and
implantation of form satisfactory of software in other institutions
and/or companies the part of Red Hat Inc.
around the world or in Latinoamerica in the framework of yours
extensive trajectory in this matter.
Thanks and Greetings.
Wil.
18 years, 4 months