Re: [Fedora-directory-users] password history question
by Jo De Troy
Hi Susan,
I was using capital Z in the ldapsearch, I've uncommented "ssl on" in
/etc/ldap.conf
Still the same problem.
# ldapsearch -x -ZZ -h ldapserver -b 'dc=example,dc=com' '(uid=someuser)'
ldap_start_tls: Connect error (-11)
additional info: Start TLS request accepted.Server willing to
negotiate SSL.
Any other thought?
Thanks again,
Jo
18 years, 3 months
[Fedora-directory-users] Failover for PassworkSync
by Daniel Shackelford
It seems that the Windows Sync setup connects directly to a specific
DC. Is there any way to make it a little less of a weak link? Round
robin DNS? How does that effect the WinSync client on the DC? Has
anyone run into this type of setup? Any options for this?
--
Daniel Shackelford
Systems Administrator
Technology Services
Spring Arbor University
517 750-6648
"For even the Son of Man did not come to be served, but to serve, and to give His life a ransom for many"
Mark 10:45
18 years, 3 months
[Fedora-directory-users] NIS groups->LDAP migration and ACIs
by Jonathan Barber
Hi all,
I'm in the process of migrating from NIS to FDS and I'm running into
problems implementing our requirements for access control under Fedora.
The behaviour I'm trying to replicate is as follows; our current NIS
administration tool allows the creation of users who are designated as
group administrators. These are normal users who can modify user details
and create users in NIS, but only for users who are in the same group as
the group administrator.
The DIT we're currently using is currently flatish, with three branches
at the root; one for users (dn: ou=people,ou=foo), one for groups (dn:
ou=groups,ou=foo), and one for other NIS maps (dn: ou=nis, ou=foo).
Users and groups have been imported from NIS as RFC2307 posixAccounts
and posixGroups.
e.g.:
dn: uid=test,ou=people,ou=foo
givenName: Nemo
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
objectClass: posixAccount
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: shadowAccount
uid: test
cn: Nemo (GJB)
homeDirectory: /homes/test
dn: cn=servers,ou=groups,ou=foo
gidNumber: 1000
memberUid: bar
memberUid: baz
objectClass: posixgroup
objectClass: top
cn: servers
We plan to use PADL's ypldapd for legacy NIS.
In addition to the NIS groups, I've created a groupofUniqueNames object
(dn: cn=grp_admin,ou=groups,ou=foo) to list those users who are our
group administrators.
So far I've got the following (working) ACI on the ou=groups,ou=foo
entry:
(targetattr = "memberUid")
(target = "ldap:///cn=*,ou=groups,ou=foo")
(
version 3.0;
acl "group edit by admin's";
allow (write)
(
groupdn = "ldap:///cn=admin,ou=groups,ou=foo" and
userattr = "gidnumber#1000"
);
)
Which as long as users are in grp_admin and have a gidnumber of 1000,
allows addition/deletion of users from the group. But this doesn't
strike me as being very elegant as it requires a seperate ACI for each
group. What I'd prefer is something similar to the following:
(targetattr = "memberUid")
(target = "ldap:///cn=*,ou=groups,ou=foo")
(
version 3.0;
acl "group edit by admin's";
allow (write)
(
groupdn = "ldap:///cn=admin,ou=groups,ou=foo" and
userattr = "gidnumber#($attr.gidnumber)"
);
)
Using the ($attr.gidnumber) macro to matchup the user's GID and the
groups GID. Is it possible to do something like this, or am I missing an
obvious solution?
Likewise, I have an ACI for restricting the creation of users to have the same
group as the creator (in this case GID 1000):
(targetattrfilter = "add=gidnumber:(gidnumber=1000)")
(target = "ldap:///ou=people,ou=foo")
(
version 3.0;
acl "user edit by admin's - restrict GID to admin's";
allow (add)
(
groupdn = "ldap:///cn=admin,ou=groups,ou=foo" and
userattr = "gidnumber#1000"
);
)
But again it suffers from the problem affecting the group ACI, requiring an ACI
per group.
Any help would be welcomed.
--
Jonathan Barber
18 years, 3 months
Re: [Fedora-directory-users] password history question
by Jo De Troy
Hi Jamie,
thanks for the info. I'm trying to setup SSL now. I'm following the SSL
howto posted on the wiki. It seems like it's not totally accurate, I get a
failure when importing the ldif's mentioned in the document. Seems like I
cannot add the attributes
nsslapd-security and nsslapd-ssl-check-hostname
I think SSL is setup now but I cannot seem to get it working with ldapsearch
-zz, I keep getting
ldap_start_tls: Connect error (-11)
additional info: Start TLS request accepted.Server willing to
negotiate SSL.
I guess I need to point my ldap.conf to the ca certificate for trust, which
file is holding the ca certificate? I can however login on port 636 as
Directory Manager when using ldapbrowser (
http://www.mcs.anl.gov/~gawor/ldap/ <http://www.mcs.anl.gov/%7Egawor/ldap/>)
Another question I have wrt password history, it seems like the history
entries are all using crypt. I thought they would be using the same
encryption as setup for the userpassword (e.g. md5) or is there a particular
reason for using crypt?
Thanks again,
Jo
18 years, 3 months
[Fedora-directory-users] password history question
by Jo De Troy
Hello,
I'm using FDS 1.0.1 on RHEL 4
I've setup a global password policy and I've enabled password history of 5
passwords via the console.
When I login through ssh with and LDAP user and I change the user's password
via 'passwd' it seems I am able to use older password. Can anybody point me
to what I'm probably doing wrong? Has anyone experienced the same problem?
What am I doing wrong?
Or does the password history not work when changing the password through
passwd?
Thanks in advance,
Jo
18 years, 3 months
[Fedora-directory-users] NSS/SSL oddities
by Mark McLoughlin
Hi,
A couple of quick questions about things that have been bugging me:
- If I import a server certificate and a CA certificate with pk12util
and change the trust attributes on the CA cert to "C,," - i.e. that
it should be a trusted CA for server certificates - and then start
slapd I get:
[05/Jan/2006:17:21:57 +0000] conn=0 op=-1 fd=64 closed - No certificate authority is trusted for SSL client authentication.
Which seems strange to me - I would have thought the CA certs in
nssckbi would be trusted for client auth?
- Unless /opt/fedora-ds/alias is owned by nobody:nobody you get
[05/Jan/2006:17:43:40 +0000] - SSL alert: Security Initialization: NSS initialization failed (Netscape Portable Runtime error -8192 - An I/O error occurred during security authorization.): path: /opt/fedora-ds/alias/, certdb prefix: slapd-foo-, keydb prefix: slapd-foo-.
[05/Jan/2006:17:43:40 +0000] - ERROR: NSS Initialization Failed.
Couldn't we not make the directory owned by nobody:nobody by
default in the RPM? root:root doesn't seem like a useful default.
Cheers,
Mark.
18 years, 3 months
[Fedora-directory-users] Host based access control
by Bliss, Aaron
Just a quick question, as referenced in this doc
http://directory.fedora.redhat.com/wiki/Howto:Posix to control server logins
using hostobject, to specify more than 1 host for an object, how should list
be formatted in the object?; as a list of hosts separated by a spaces or by
commas? For example, to allow user aaron to login into serverA and serverB,
would list look like serverA serverB or serverA,serverB ? Thanks very much.
Aaron
www.preferredcare.org
"An Outstanding Member Experience," Preferred Care HMO Plans -- J. D. Power and Associates
Confidentiality Notice:
The information contained in this electronic message is intended for the exclusive use of the individual or entity named above and may contain privileged or confidential information. If the reader of this message is not the intended recipient or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that dissemination, distribution or copying of this information is prohibited. If you have received this communication in error, please notify the sender immediately by telephone and destroy the copies you received.
18 years, 3 months
[Fedora-directory-users] account lockout and sshd
by Jo De Troy
Hello,
I've setup FDS 1.0.1 on CentOs4 and configured this box to use ldap for
authentication.
I am able to login through SSH with an ldap user but I can't seem to figure
out how to get account lockouts to work.
Also password history doesn't seem to work, I followed the different
documents on the Wiki though.
Did anyone get this to work fine? Could someone give me a hint as to where
I've messed things up?
Thanks in advance,
Jo
18 years, 3 months
RE: [Fedora-directory-users] Server-Side ACLs for pam_ldap logins.
by Jason Hane
I second that. Dan if you can provide any resources you used to set up
your netgroups I would hail at your feet. I've been playing with
netgroups unsuccessfully for the past month and a half and haven't been
able to get it to work. All my clients are RedHat ES 3&4.
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Richard
Megginson
Sent: Tuesday, January 03, 2006 4:06 PM
To: General discussion list for the Fedora Directory server project.
Subject: Re: [Fedora-directory-users] Server-Side ACLs for pam_ldap
logins.
This looks very interesting and useful. Would you mind writing up
something I can post on the Fedora DS wiki? Don't worry about
formatting, spelling, etc. I can fix that up.
Dan Cox wrote:
>
> As an alternative, I've used the ldap/netgroup integration for many
> years and it seems the cleanest way of doing it when used in
> conjunction with pam's access.conf. It allows me to push the same
> /etc/passwd and /etc/security/access.conf to all machines on the
> network via something like CFEngine.
>
> The access.conf consists of something like (allow all QA users access
> to QA systems):
> + : @QA@@QAServers : ALL
>
> Then I just add or remove the user or machine in the ldap netgroup
> entry. The real power with using ldap based netgroups is when you
> realize all of the services that can consume netgroup information,
> unlike the simple user based host attribute. For example, you can push
> a global /etc/sudoers and specify certain groups of users can run
> certain commands on particular groups of machines all on one line.
> CFEngine itself can query netgroups to know what config files to push,
> tools like dsh (distributed ssh) can use netgroups as machine targets
> for commands, etc. I've administered some very large networks of
> machines with these tools and it makes it very easy to control.
>
> Dan-
>
> Jason Hane wrote:
>
>> I had a similar question a few weeks ago. I wanted to be able to
>> assign a list of users access to only a specific number of computers.
>> This is the response I got from Gary Tay:
>>
>> FDS is very similar to SUN ONE DS5.2, I think netgroup (+@netgroupXXX
>> in /etc/passwd and /etc/shadow and "compat" keyword in
>> /etc/nsswitch.conf) LDAP maps could be setup to achieve what you
>> want, it has been used by many DS5.2 administrators
>>
>> See:
>> http://web.singnet.com.sg/~garyttt/Installing%20and%20configuring%20O
>> pen LDAP%20for%20RedHat%20Enterprise%20Linux3.htm
>> Step 5Y: Configure "netgroup" to work with RedHat or Solaris Native
>> LDAP Clients (i.e. controlling user access to host using netgroup
>> LDAP maps)
>>
>> Also see:
>> http://swforum.sun.com/jive/thread.jspa?threadID=52764&messageID=2238
>> 46#
>> 223846
>> Configuring LDAP netgroups
>> Gary
>> -----Original Message-----
>> From: fedora-directory-users-bounces(a)redhat.com
>> [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of
>> Michael Montgomery
>> Sent: Tuesday, January 03, 2006 1:35 PM
>> To: General discussion list for the Fedora Directory server project.
>> Subject: Re: [Fedora-directory-users] Server-Side ACLs for pam_ldap
>> logins.
>>
>> Thanks for the response. I'll read up on this, and see if I can get
>> this working.
>>
>> On Tue, 2006-01-03 at 11:29 -0700, Richard Megginson wrote:
>>
>>
>>> Michael Montgomery wrote:
>>>
>>>
>>>
>>>> I do agree that this is closer to what I'm looking for, but the
>>>> first
>>>>
>>>
>>
>>
>>
>>>> problem I see is that I wanted to allow Groups of people to login
>>>> to Groups of servers like:
>>>>
>>>> cn=www,ou=Group,dc=example,dc=com is a group of www servers.
>>>> cn=Unix,ou=Group,dc=example,dc=com is a group of Unix users.
>>>>
>>>> So basically, on the people in the Unix group, can login to the www
>>>> servers, and so forth.
>>>>
>>>>
>>>>
>>>
>>> Right. The host attribute is per user. You could set up a Roles
>>> for your users, and use Class of Service to automatically add the
>>> host attribute to the role members.
>>>
>>
>>
>>
>> --
>> Fedora-directory-users mailing list
>> Fedora-directory-users(a)redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>>
>> --
>> Fedora-directory-users mailing list
>> Fedora-directory-users(a)redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>>
>>
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
18 years, 3 months
[Fedora-directory-users] Change Administrative Domain
by Yovko Ilchev Yovkov
Changing Admin Access Home for Fedora Direcotry Server
How to change the Administrative domain on already started FDS?
I have do the next:
1. Install lbe (ldap browser). Usualy you can use any Ldap Browser
software
2. Connected to o=NetscapeRoot as "cn=Directory Manager" with password
on targeted server (server.domain.com)
3. Browse to dn:
cn=configuration, cn=admin-serv-sion, cn=Fedora Administration Server,
cn
=Server Group, cn=server.domain.com, ou=domain.com, o=NetscapeRoot
Entry looks like:
--- cut start ---
dn: cn=configuration, cn=admin-serv-sion, cn=Fedora Administration
Server, cn=Server Group, cn=server.domain.com, ou=domain.com,
o=NetscapeRoot
nsClassname:
com.netscape.management.admserv.AdminServer@admserv10.jar(a)cn=admin-serv-sion, cn=Fedora Administration Server, cn=Server Group, cn=server.domain.com, ou=domain.com, o=NetscapeRoot
nsAccessLog: admin-serv/logs/access
modifyTimestamp: 20060105160826Z
objectClass: nsConfig
objectClass: nsAdminConfig
objectClass: nsAdminObject
objectClass: nsDirectoryInfo
objectClass: top
nsSuiteSpotUser: root
nsErrorLog: admin-serv/logs/error
nsAdminEnableEnduser: on
createTimestamp: 20060105151745Z
cn: Configuration
nsAdminUsers: admin-serv/config/admpw
nsAdminAccessAddresses: *
nsServerPort: 22275
modifiersName: cn=directory manager
nsDirectoryInfoRef: cn=Server Group, cn=server.domain.com,
ou=domain.com, o=NetscapeRoot
creatorsName:
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
nsAdminOneACLDir: adminacl
nsServerAddress:
nsPidLog: admin-serv/logs/pid
nsAdminCacheLifetime: 600
nsAdminEnableDSGW: on
nsAdminAccessHosts: *.domain.com
nsDefaultAcceptLanguage: en
--- cut end ---
To change administrative domain you need to change the value of the
attribute nsAdminAccessHosts. Then restart administrative server and
you're OK.
18 years, 3 months