[Fedora-directory-users] db2ldif hangs
by Jo De Troy
Hello,
I have a daily cron job to run db2ldif. But one day last week it kept on
running and during that time I couldn't write any changes.
When I killed the job I could again write changes. When I rerun db2ldif it
completes quickly as before.
Has anyone else seen this behavior? I'm running FedoraDS1.0.2 on RHEL4.
Thanks in advance,
Jo
17 years, 4 months
[Fedora-directory-users] Multiple Servers. Multiple Consoles?
by Dave Augustus
Hello All,
I have 2 LDAP servers running in MultiMaster behind a load balancer. I
also have FDS management consoles running on both.
Is the management console required for each install of FDS ?
Is there a way to consolidate them?
Thanks,
Dave
17 years, 4 months
[Fedora-directory-users] Re: Multiple Servers. Multiple Consoles? (Richard Megginson)
by Phil Lembo
When we first started with the old iPlanet product all our prod directories
were connected to a common admin server config instance. Over time, I found
that made things difficult when something would "happen" to that admin
server (whether intentionally or unintentionally). As a result, my practice
now is to have a separate config instance for each physical server. I've
often wanted to go back to using a single config instance, but never had the
time to really think through what you'd need to do to recover if, for
example, the admin server stopped working for some reason. I think i once
saw a way to attach a running directory to a different admin server, just
can't remmember where. Something covering that would make a great HOWTO.
Phil Lembo
On 12/8/06, fedora-directory-users-request(a)redhat.com <
fedora-directory-users-request(a)redhat.com> wrote:
>
> Send Fedora-directory-users mailing list submissions to
> fedora-directory-users(a)redhat.com
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
> or, via email, send a message with subject or body 'help' to
> fedora-directory-users-request(a)redhat.com
>
> You can reach the person managing the list at
> fedora-directory-users-owner(a)redhat.com
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Fedora-directory-users digest..."
>
>
> Today's Topics:
>
> 1. RE: Error: Database is read-only (Greg Copeland)
> 2. Multiple Servers. Multiple Consoles? (Dave Augustus)
> 3. Re: Multiple Servers. Multiple Consoles? (Richard Megginson)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Thu, 7 Dec 2006 11:16:58 -0600
> From: "Greg Copeland" <GCopeland(a)efjohnson.com>
> Subject: RE: [Fedora-directory-users] Error: Database is read-only
> To: "General discussion list for the Fedora Directory server project."
> <fedora-directory-users(a)redhat.com>
> Message-ID:
> <273A72C669F45B4996896A031B88CCEF3E17BB(a)EFJDFWMX01.EFJDFW.local>
> Content-Type: text/plain; charset="us-ascii"
>
> I had this happen to me too. I came in one day and found the database
> was suddenly marked read-only. I had to find the read-only setting and
> make it read/write and everything was happy again.
>
> Cheers,
>
> Greg Copeland
>
> ________________________________
>
> From: fedora-directory-users-bounces(a)redhat.com
> [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Ersin Er
> Sent: Wednesday, December 06, 2006 3:43 PM
> To: Fedora-directory-users mailing list
> Subject: [Fedora-directory-users] Error: Database is read-only
>
> Hi all,
>
> After I played a little bit Fedora Directory Server I started to get an
> error message: "Database is read-only", when I tried to modify anything.
> Did I change any setting accidently?
>
> Thanks.
>
> --
> Ersin
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> https://www.redhat.com/archives/fedora-directory-users/attachments/200612...
>
> ------------------------------
>
> Message: 2
> Date: Thu, 07 Dec 2006 17:17:54 -0600
> From: Dave Augustus <davea(a)support.kcm.org>
> Subject: [Fedora-directory-users] Multiple Servers. Multiple Consoles?
> To: "General discussion list for the Fedora Directory server project."
> <fedora-directory-users(a)redhat.com>
> Message-ID: <1165533474.16528.3.camel(a)kcm40202.kcmhq.org>
> Content-Type: text/plain
>
> Hello All,
>
> I have 2 LDAP servers running in MultiMaster behind a load balancer. I
> also have FDS management consoles running on both.
>
> Is the management console required for each install of FDS ?
>
> Is there a way to consolidate them?
>
>
> Thanks,
> Dave
>
>
>
> ------------------------------
>
> Message: 3
> Date: Thu, 07 Dec 2006 16:34:42 -0700
> From: Richard Megginson <rmeggins(a)redhat.com>
> Subject: Re: [Fedora-directory-users] Multiple Servers. Multiple
> Consoles?
> To: "General discussion list for the Fedora Directory server project."
> <fedora-directory-users(a)redhat.com>
> Message-ID: <4578A512.5030507(a)redhat.com>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Dave Augustus wrote:
> > Hello All,
> >
> > I have 2 LDAP servers running in MultiMaster behind a load balancer. I
> > also have FDS management consoles running on both.
> >
> > Is the management console required for each install of FDS ?
> >
> No.
> > Is there a way to consolidate them?
> >
> When you installed the first instance of FDS, it should have created it
> as the configuration DS. When you run setup subsequent times, in
> Typical mode, you will be given the opportunity to register the new
> instance with the configuration DS.
> >
> > Thanks,
> > Dave
> >
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: smime.p7s
> Type: application/x-pkcs7-signature
> Size: 3245 bytes
> Desc: S/MIME Cryptographic Signature
> Url :
> https://www.redhat.com/archives/fedora-directory-users/attachments/200612...
>
> ------------------------------
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
>
> End of Fedora-directory-users Digest, Vol 19, Issue 11
> ******************************************************
>
--
Phil Lembo
e-mail: phil.lembo(a)gmail.com
17 years, 4 months
[Fedora-directory-users] Error: Database is read-only
by Ersin Er
Hi all,
After I played a little bit Fedora Directory Server I started to get an
error message: "Database is read-only", when I tried to modify anything. Did
I change any setting accidently?
Thanks.
--
Ersin
17 years, 4 months
[Fedora-directory-users] Windows Sync without Domain Admin?
by Nicholas Byrne
Hi all,
Is it possible to do a syncronisation of a windows peer without the
windows user who i use to bind being a domain admin? I have a read
only user with which i can run ldapsearch and find all users data in the
AD directory but using the same user to sync with fails. The
replication status says "total update completed" but i see no updates to
the my FDS directory.
If i modify this user in AD to be a domain admin it works correctly, but
what i want to know is why can't i use a read-only user to sync? Is
there any way around this?
Thanks
Nick
This e-mail is the property of Quadriga Worldwide Ltd, intended for the addressee only and confidential. Any dissemination, copying or distribution of this message or any attachments is strictly prohibited.
If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer.
Messages sent to and from Quadriga may be monitored.
Quadriga cannot guarantee any message delivery method is secure or error-free. Information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses.
We do not accept responsibility for any errors or omissions in this message and/or attachment that arise as a result of transmission.
You should carry out your own virus checks before opening any attachment.
Any views or opinions presented are solely those of the author and do not necessarily represent those of Quadriga.
17 years, 4 months
[Fedora-directory-users] RE: pam_ldap with SSL/TLS
by t b
>From: fedora-directory-users-request(a)redhat.com
>Reply-To: fedora-directory-users(a)redhat.com
>To: fedora-directory-users(a)redhat.com
>Subject: Fedora-directory-users Digest, Vol 19, Issue 3
>Date: Sat, 2 Dec 2006 12:00:05 -0500 (EST)
>
>Send Fedora-directory-users mailing list submissions to
> fedora-directory-users(a)redhat.com
>
>To subscribe or unsubscribe via the World Wide Web, visit
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>or, via email, send a message with subject or body 'help' to
> fedora-directory-users-request(a)redhat.com
>
>You can reach the person managing the list at
> fedora-directory-users-owner(a)redhat.com
>
>When replying, please edit your Subject line so it is more specific
>than "Re: Contents of Fedora-directory-users digest..."
>
>
>Today's Topics:
>
> 1. Re: RE: Fedora-directory-users Digest, Vol 19, Issue 1
> (Richard Megginson)
> 2. Re: AD + FDS sync stops working? (To Ngan)
> 3. Re: Memory usage (koniczynek)
>
>
>----------------------------------------------------------------------
>
>Message: 1
>Date: Fri, 01 Dec 2006 12:55:24 -0700
>From: Richard Megginson <rmeggins(a)redhat.com>
>Subject: Re: [Fedora-directory-users] RE: Fedora-directory-users
> Digest, Vol 19, Issue 1
>To: "General discussion list for the Fedora Directory server project."
> <fedora-directory-users(a)redhat.com>
>Message-ID: <457088AC.1030004(a)redhat.com>
>Content-Type: text/plain; charset="iso-8859-1"
>
>t b wrote:
> > My logs seem to indicate that the connection is being encrypted; I can
> > ssh to a client server and get the password prompt, but when I enter
> > the password it just returns me to the password prompt again
> >
> > [01/Dec/2006:19:47:44 -0500] conn=650 fd=69 slot=69 connection from
> > xxx.xxx.xxx.xxx to xxx.xxx.xxx.xxx
> > [01/Dec/2006:19:47:44 -0500] conn=650 op=0 EXT
> > oid="1.3.6.1.4.1.1466.20037" name="startTLS"
> > [01/Dec/2006:19:47:44 -0500] conn=650 op=0 RESULT err=0 tag=120
> > nentries=0 etime=0
> > [01/Dec/2006:19:47:44 -0500] conn=650 SSL 256-bit AES
>All of this means the client was able to successfully perform the
>startTLS extended operation and start using SSL.
> > [01/Dec/2006:19:47:44 -0500] conn=650 op=1 UNBIND
> > [01/Dec/2006:19:47:44 -0500] conn=650 op=1 fd=69 closed - U1
>The UNBIND means the client had a problem and closed the connection.
>Does the client print any errors? Are there any messages in the server
>error log?
> >
> > If I disable TLS everything works fine, the client server can query
> > the FDS and auth the client properly
> >
> > I am not sure if the problem has to do with the pam_ldap not properly
> > formatted or the cert file not in proper format
> >
> > Does anyone have an example of what the pam_ldap config should look
> > like? or suggestions on checking whether the cert file is in proper
> > format
>I'm not sure. PAM needs the ca cert of the CA that issued the directory
>server server cert. See
>http://directory.fedora.redhat.com/wiki/Howto:SSL for more information.
> >
> > Also what's the UNBIND shown in the logs?
> >
> > Thanks
> >
Problem solved, the following link added the missing part to the puzzle,
http://www.fedoraforum.org/forum/archive/index.php/t-1997.html
The problem turns out to be that when you run the command
/usr/bin/authconfig as recommended at,
http://directory.fedora.redhat.com/wiki/Howto:PAM it does not make all of
the necessary adjustments to /etc/ldap.conf -- you need to also add the
settings mentioned in the link above
Hopes this helps anyone having the same issues, and thanks to everyone for
their suggestions
As an addition, I am trying to download the posixuser auto creation script
from, http://www.netauth.com/~jacksonm/ldap/newuser.pl.txt but the port
seems to be blocked; does anyone know where I can get a hold of that script
Thanks
> >> From: fedora-directory-users-request(a)redhat.com
> >> Reply-To: fedora-directory-users(a)redhat.com
> >> To: fedora-directory-users(a)redhat.com
> >> Subject: Fedora-directory-users Digest, Vol 19, Issue 1
> >> Date: Fri, 1 Dec 2006 12:00:06 -0500 (EST)
> >>
> >> Send Fedora-directory-users mailing list submissions to
> >> fedora-directory-users(a)redhat.com
> >>
> >> To subscribe or unsubscribe via the World Wide Web, visit
> >> https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >> or, via email, send a message with subject or body 'help' to
> >> fedora-directory-users-request(a)redhat.com
> >>
> >> You can reach the person managing the list at
> >> fedora-directory-users-owner(a)redhat.com
> >>
> >> When replying, please edit your Subject line so it is more specific
> >> than "Re: Contents of Fedora-directory-users digest..."
> >>
> >>
> >> Today's Topics:
> >>
> >> 1. pam_ldap with SSL/TLS (t b)
> >> 2. RE: pam_ldap with SSL/TLS (Morris, Patrick)
> >> 3. Re: pam_ldap with SSL/TLS (Richard Megginson)
> >> 4. Problem with SSL console in X in specific circumstances
> >> (Philip Kime)
> >> 5. FW: [Fedora-directory-users] Extracting details from
> >> ActiveDirectoryto FDS (Paxton, Darren)
> >> 6. alias in fedora directory server (patrick ndjientcheu ngandjui)
> >> 7. Re: FW: [Fedora-directory-users] Extracting details from
> >> ActiveDirectoryto FDS (Nicholas Byrne)
> >> 8. Re: Memory usage (koniczynek)
> >> 9. Re: Memory usage (David Boreham)
> >> 10. Re: Memory usage (koniczynek)
> >>
> >>
> >> ----------------------------------------------------------------------
> >>
> >> Message: 1
> >> Date: Thu, 30 Nov 2006 12:31:50 -0500
> >> From: "t b" <mxheadroom(a)hotmail.com>
> >> Subject: [Fedora-directory-users] pam_ldap with SSL/TLS
> >> To: fedora-directory-users(a)redhat.com
> >> Message-ID: <BAY116-F322745E96D702ED748B1D0CDDB0(a)phx.gbl>
> >> Content-Type: text/plain; format=flowed
> >>
> >> I am trying to setup pam_ldap to use TLS to communicate with the FDS,
> >> but
> >> having lots of problems doing so; it works if I use the unencrypted
> >> way but
> >> not if I use ldaps ( port 636 )
> >>
> >> I used the instructions at,
> >> http://directory.fedora.redhat.com/wiki/Howto:PAM
> >>
> >> Has anyone gotten PAM to work TLS
> >>
> >>
> >> Thanks
> >>
> >> _________________________________________________________________
> >> Buy, Load, Play. The new Sympatico / MSN Music Store works seamlessly
> >> with
> >> Windows Media Player. Just Click PLAY.
> >>
>http://musicstore.sympatico.msn.ca/content/viewer.aspx?cid=SMS_Sept192006
> >>
> >>
> >>
> >>
> >> ------------------------------
> >>
> >> Message: 2
> >> Date: Thu, 30 Nov 2006 13:00:56 -0500
> >> From: "Morris, Patrick" <patrick.morris(a)hp.com>
> >> Subject: RE: [Fedora-directory-users] pam_ldap with SSL/TLS
> >> To: "General discussion list for the Fedora Directory server project."
> >> <fedora-directory-users(a)redhat.com>
> >> Message-ID:
> >>
><CD18C81835E18A40A64C4A0D16A237BE05FE850D(a)ATAEXC01.americas.cpqcorp.net>
> >>
> >>
> >> Content-Type: text/plain; charset="US-ASCII"
> >>
> >> > I am trying to setup pam_ldap to use TLS to communicate with
> >> > the FDS, but having lots of problems doing so; it works if I
> >> > use the unencrypted way but not if I use ldaps ( port 636 )
> >>
> >> Someone should jump in here and correct me if I'm wrong, but I believe
> >> it's normal for TLS connections to happen on the standard LDAP port.
> >> You should be able to tell from your logs whether the connection is
> >> encrypted or not.
> >>
> >>
> >>
> >> ------------------------------
> >>
> >> Message: 3
> >> Date: Thu, 30 Nov 2006 11:08:08 -0700
> >> From: Richard Megginson <rmeggins(a)redhat.com>
> >> Subject: Re: [Fedora-directory-users] pam_ldap with SSL/TLS
> >> To: "General discussion list for the Fedora Directory server project."
> >> <fedora-directory-users(a)redhat.com>
> >> Message-ID: <456F1E08.40601(a)redhat.com>
> >> Content-Type: text/plain; charset="iso-8859-1"
> >>
> >> Morris, Patrick wrote:
> >> >> I am trying to setup pam_ldap to use TLS to communicate with
> >> >> the FDS, but having lots of problems doing so; it works if I
> >> >> use the unencrypted way but not if I use ldaps ( port 636 )
> >> >>
> >> >
> >> > Someone should jump in here and correct me if I'm wrong, but I
>believe
> >> > it's normal for TLS connections to happen on the standard LDAP port.
> >> > You should be able to tell from your logs whether the connection is
> >> > encrypted or not.
> >> >
> >> Yes. The LDAP "preferred" way is to use the startTLS extended
>operation
> >> which starts a TLS session on the non-secure port. This will be logged
> >> in the access log.
> >> > --
> >> > Fedora-directory-users mailing list
> >> > Fedora-directory-users(a)redhat.com
> >> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >> >
> >>
17 years, 4 months
[Fedora-directory-users] Show Effective Rights via the console
by Ersin Er
Hi all,
I am trying to use the "Show Effective Rights" feature via the console,
however I get nothing when I check the box. Just an "Entry Level Rights:"
label is displayed at the bottom of the window but no value is displayed for
neither the Entry nor attributes.
Do I have to do some more configuration to make this work?
Thanks.
--
Ersin
17 years, 4 months
RE: [Fedora-directory-users] Adding admin users
by Jo De Troy
Hi Rich,
what exactly do you mean? Searching for the uid=admin?
So adding a user to the Directory Administrators is not good enough. What
extra rights does an extra admin user need? And how should I enable these
rights for this user? Can I do this from the console? Or do I better do it
via an ldif import?
Thanks in advance,
Jo
> Hello,
>
> I was wondering what the correct way is to add a extra admin user (not
> directory manager or admin) who could login via the console to do
> maintenance tasks. Add users/groups, reset passwords, unlock users,
> restore backups, do imports, etc
> I tried adding a user as uniquemember to the group Directory
> Administrators and I can login to the console but I can only see the
> domain in the default view I cannot select the server or the admin
> server or directory server console.
> I guess using an aci for every specific user that needs privileged
> access is not the best way.
>
No. I suggest searching for the uid=admin user that gets created during
setup.
Thanks in advance,
> Jo
>
--
Fedora-directory-users mailing list
Fedora-directory-users redhat com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
17 years, 4 months
[Fedora-directory-users] Adding admin users
by Jo De Troy
Hello,
I was wondering what the correct way is to add a extra admin user (not
directory manager or admin) who could login via the console to do
maintenance tasks. Add users/groups, reset passwords, unlock users,
restore backups, do imports, etc
I tried adding a user as uniquemember to the group Directory
Administrators and I can login to the console but I can only see the
domain in the default view I cannot select the server or the admin
server or directory server console.
I guess using an aci for every specific user that needs privileged
access is not the best way.
Thanks in advance,
Jo
17 years, 4 months
[Fedora-directory-users] Advanced button hidden when editing user and groups
by Renato Ribeiro da Silva
Hello,
I'm trying to edit users properties using the Fedora Management Console ( users and groups tab ), but I need to update advanced attributes too. The problem is that the "Advanced Button" doesn't appear. If I use the Directory Console I can access the button without problems. Any idea about what is happening?
Thanks in advance,
Renato.
17 years, 4 months