[Fedora-directory-users] access control lists help needed
by Eric Beda
Hi,
i am trying to setup dovecot, with virtual domains to authenticate via
ldap, through the tutorial i was reading i had to setup access list that
will allow dovecot-auth user privelage to read passwords, how do i set
that up ?
17 years, 4 months
[Fedora-directory-users] Extracting details from Active Directory to FDS
by Paxton, Darren
Hi all,
I've been tinkering with integrating our Linux devices into our AD
domain for some time and I've hit a few brick walls, however I've
recently discovered FDS and the synchronisation features with AD.
I've managed to set up a few replication jobs, however due to the
extensive nature of our AD, I've realised that the sync only takes the
group and user objects from the OU or CN being specified.
Is there any way I can specify that it should traverse all subtrees of
an OU and extract all that information back into FDS?
Thanks
Darren
--
Darren Paxton
EMEA Tier2
Red Hat Certified Engineer
VMware Certified Professional
MGTI Centralised ops
17 years, 5 months
[Fedora-directory-users] PassSync with Multi global catalog
by Jean-Baptiste CHARPENTIER
Hello,
I have three domain controllers. Each controller has global catalog but
there are on the same domain.
I use PassSync only to synchronise password from Active Directory to Fedora
Directory.
Syncro it's ok only when I deploy PassSync on each domain controller .
Is it normal?
Thanks for your help.
Jean-Baptiste CHARPENTIER
17 years, 5 months
[Fedora-directory-users] LDAP search issue.
by A G
Hello;
I am using Fedora Directory Server 1.0.2.
I have a question on LDAP search issue.
I want to disable full search on the LDAP tree.
Eg:
My LDAP Tree is:
cn=John Smith, o=Dept1, c=US
cn=Ann Adams, o=Dept1, c=US
I want to deny to read full listing of the tree but only allow when
the search condition meets only the required person.
In the example above I want nobody to be listed. But when the search
criteria is "c=US, o=Dept1, cn=Ann Adams" this entry must be listed.
When a search on "c=US" comes, nothing must be listed.
What is the correct Access Control Information for this request??
>You also posted this question to the OpenLDAP list. Fedora DS and
>OpenLDAP have very different ACI models. What is your server vendor and
>version?
Thanks.
17 years, 5 months
[Fedora-directory-users] AD problem
by Nicholas Byrne
A am fairly new to FDS, I am using fedora-ds-1.0.2-1.RHEL4 and my goal
is to setup a syncronisation against a W2K3 based active directory
domain controller. I've followed the Howto:SSL to setup SSL on the
fedora server which works correctly and i've also followed the "Enabling
SSL with Active Directory" section in Howto:WindowsSync using the TinyCA
method.
On the AD server I've imported the CA cert and AD server cert i created
following the instructions in the howto. I've used ldp (running on the
AD server) to query the AD system using SSL and it works after i create
a connection on port 636, bind and run a search.
Before complicating matters with PassSync i wanted to try remotely
querying the server over SSL to see if that works (non-SSL queries work
fine), so i can be sure that the standard sync agreement between FDS and
AD will work. I've tried a number of methods, but i always get
"ldap_bind: Can't contact LDAP server (-1)". On the system i'm making
queries from, i've installed the my CA cert in /etc/openssl/cacerts and
configured the following /etc/openldap/ldap.conf with:
TLS_CACERTDIR /etc/openldap/cacerts/
TLS_REQCERT allow
I'd be very grateful for some advice, it's driving me nutty... output of
command below -
ldapsearch -v -b dc=tech -s sub -H ldaps://w2k3virtual01.tech -x -W -LLL
'(objectclass=user)' -D winsync@tech -d 9
ldap_initialize( ldaps://w2k3virtual01.tech )
ldap_create
ldap_url_parse_ext(ldaps://w2k3virtual01.tech)
Enter LDAP Password:
ldap_bind
ldap_simple_bind
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP w2k3virtual01.tech:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 10.103.20.50:636
ldap_connect_timeout: fd: 3 tm: -1 async: 0
TLS trace: SSL_connect:before/connect initialization
TLS trace: SSL_connect:SSLv2/v3 write client hello A
TLS trace: SSL_connect:SSLv3 read server hello A
TLS certificate verification: depth: 1, err: 0, subject:
/C=UK/ST=Berkshire/L=Reading/O=Quadriga/OU=Technology/CN=Quadriga
Certificate Authority/emailAddress=sysadmin(a)quadriga.com, issuer:
/C=UK/ST=Berkshire/L=Reading/O=Quadriga/OU=Technology/CN=Quadriga
Certificate Authority/emailAddress=sysadmin(a)quadriga.com
TLS certificate verification: depth: 0, err: 0, subject:
/C=UK/ST=Berkshire/L=Reading/O=Quadriga/OU=Technology/CN=w2k3virtual01.tech,
issuer:
/C=UK/ST=Berkshire/L=Reading/O=Quadriga/OU=Technology/CN=Quadriga
Certificate Authority/emailAddress=sysadmin(a)quadriga.com
TLS trace: SSL_connect:SSLv3 read server certificate A
TLS trace: SSL_connect:SSLv3 read server certificate request A
TLS trace: SSL_connect:SSLv3 read server done A
TLS trace: SSL_connect:SSLv3 write client certificate A
TLS trace: SSL_connect:SSLv3 write client key exchange A
TLS trace: SSL_connect:SSLv3 write change cipher spec A
TLS trace: SSL_connect:SSLv3 write finished A
TLS trace: SSL_connect:SSLv3 flush data
TLS trace: SSL_connect:failed in SSLv3 read finished A
TLS: can't connect.
ldap_perror
ldap_bind: Can't contact LDAP server (-1)
This e-mail is the property of Quadriga Worldwide Ltd, intended for the addressee only and confidential. Any dissemination, copying or distribution of this message or any attachments is strictly prohibited.
If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer.
Messages sent to and from Quadriga may be monitored.
Quadriga cannot guarantee any message delivery method is secure or error-free. Information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses.
We do not accept responsibility for any errors or omissions in this message and/or attachment that arise as a result of transmission.
You should carry out your own virus checks before opening any attachment.
Any views or opinions presented are solely those of the author and do not necessarily represent those of Quadriga.
17 years, 5 months
[Fedora-directory-users] ldappasswd problem
by Eric Beda
Hi,
i am trying to set up virtual mailserver using postfix,dovecot and jamm,
i'm walking through a tutorial that is based on openldap, i am required to
make fedora ds use CRYPT password mechanism how do i set that up?
also i seem to fail to change users passwords, whenever i issue the command
ldappasswd -D "cn=manager,dc=example,dc=example" -x -w "secret" -s
"secret" "mail=ebeda@somedomain,jvd=somename,dc=example,dc=example"
i get the following error
Result: Confidentiality required (13)
Additional info: Operation requires a secure connection.
note that my directory manager dn is "cn=manager,dc=example,dc=example"
and i'm using fedora ds 7.1
please help
17 years, 5 months
[Fedora-directory-users] Is it possible to use events to create homedirs when user entry is created or deleted?
by Kimmo Koivisto
Hello
I have small environment with one FDS server and one application
server, both RHEL4ES. FDS server provides ldap authentication and home
directories for app server with ldap and nfs.
I administrate users and groups with phpldapadmin or windows based
ldapadmin, everything is working fine.
When I add new user to the FDS, I have to create home directory for
that user manually, set permissions and copy /etc/skel files.
I would like to do home directory administration tasks automatically
when user is added or deleted from FDS.
One solution (I don't like this) is that I use some command line ldap
capable adduser instead of ldapadmin or phpldapadmin.
Does FDS have any event support that I could use or are there any
existing solutions for this problem?
Best Regards
Kimmo Koivisto
17 years, 5 months
Re: [Fedora-directory-users] pass-thru questions
by MJD Shop Account
>> How does use of this plugin relate to setting the userPassword attribute to something like '{KERBEROS}user@REALM'? Is that a completely separate method for using kerberos?
>Yes. It is completely different and doesn't use a special userPassword
>value.
Where would it be appropriate to use the {KERBEROS}user@REALM method? Any pointers to read up on it? I think an earlier message thread indicated it was deprecated... I'm not sure which is the best for my situation. If it required saslauthd, for instance, that would not work for me.
>SASL mapping should work for SASL BINDs. The PAM passthru plugin should
>only be used in those cases where you have a client that only supports
>simple (i.e. username/password) BIND.
I guess I'm not 100% sure how this will work for, say, someone logging in via a console. Right now, I have a pam modules stack with pam_ldap.so followed by pam_krb5.so. How would a login at a console terminal (either text or RH graphical Xwindows login) result in an SASL bind to LDAP? My /etc/ldap.conf is set for anonymous binds. Perhaps I should reverse the order and have krb5 before ldap, as I want krb5 to be used ultimately for authentication. Right now, the user might have an LDAP password and a separate krb5 password, if they log in with the krb5 password they get KerberosV credentials as shown by klist.
To be clear again, I would still need the passthrough to support the cross-realm situation, I think. So maybe ldap before krb5 is just fine for that reason.
Another more general question. As I want to use the passthrough module strictly to do the the Kerberos logins, I assume the 'ldapserver' pam file would only need pam_krb5.so and not, for example, pam_unix.so. Is that right?
Thanks!
Marty
17 years, 5 months
Re: [Fedora-directory-users] pass-thru questions
by MJD Shop Account
>Fedora DS does not support the {KERBEROS}user@REALM method in the
>userPassword attribute. That is an OpenLDAP only feature, AFAIK.
Ah, well that makes my life easy!
>> Another more general question. As I want to use the passthrough module strictly to do the the Kerberos logins, I assume the 'ldapserver' pam file would only need pam_krb5.so and not, for example, pam_unix.so. Is that right?
>>
>I think so, but I'm not sure. You'll have to ask a PAM guru for that.
If anyone has pointers, please let me know. Thanks!
Marty
17 years, 5 months
[Fedora-directory-users] Host based ACI
by Greg Hetrick
I am trying to implement host based ACI for either users or groups.
Basic question can you acheive the same results as using the host ACI
as you would with host attributes per user.
I am trying to find a way not to specifically include each host in
each user that needs access to every host or multiple hosts.
Is it possible to add Host based ACI to a group and have the members
of that group be granted access to only those specific hosts? Say for
example having a group for admins with every host and adding users to
that group thus giving them access to all hosts, same with a
development group with only access to development hosts.
Any direction that you can give would be much appreciated. I have
attempted to setup ACIs for a particular user to a single host, but it
doesn't appear that it is working, seems like I am missing either a
client side LDAP setting or an Attribute on the user to handle the
ACI. I was able to setup host based access using the host attribute
per user, that just seems tedious.
Thanks,
Greg
17 years, 5 months