RE: [Fedora-directory-users] solaris, dtlogin, and FDS
by Paul Clayton
Try this option on the pam.conf file.
dtlogin auth sufficient pam_unix.so.1 try_first_pass
dtlogin auth sufficient pam_ldap.so.1
dtlogin account requisite pam_roles.so.1
dtlogin account sufficient pam_projects.so.1
dtlogin account sufficient pam_unix.so.1 try_first_pass
dtlogin account sufficient pam_ldap.so.1
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Paul
Clayton
Sent: 26 May 2006 05:17 PM
To: General discussion list for the Fedora Directory server project.
Subject: RE: [Fedora-directory-users] solaris, dtlogin, and FDS
But can you use files based users with this method 'cause I can't.
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Susan
Sent: 26 May 2006 05:07 PM
To: General discussion list for the Fedora Directory server project.
Subject: Re: [Fedora-directory-users] solaris, dtlogin, and FDS
I have this and my dtlogin works fine:
# Default definitions for Authentication management # Used when service
name is not explicitly mentioned for authentication #
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
other auth required pam_unix_cred.so.1
other auth sufficient pam_unix_auth.so.1
other auth required pam_ldap.so.1
#
--- Sam Smith <sam.smith(a)ece.gatech.edu> wrote:
> I have a bunch of fully patched and up-to-date Solaris 2.9 machines,
> using an FDS ldap server. I just converted them over from NIS, thanks
> to the help from the documentation on the web site.
>
> I can login at the command line, I can ssh to them, I thought
> everything was working great.
>
> But when I sit down in front of the console, and try to login with
> dtlogin to CDE (the gui), it kicks me out.
>
> It's using the "other" lines from my pam.conf, which look like this:
>
> #
> # Default definitions for Authentication management # Used when
> service name is not explicitly mentioned for authentication #
> other auth requisite pam_authtok_get.so.1
> other auth required pam_dhkeys.so.1
> other auth binding pam_unix_auth.so.1 server_policy
> other auth required pam_ldap.so.1
>
> If I look at the log file in the FDS server ("access"), everything
> looks fine.
>
> Has anyone else had a problem with dtlogin?
>
> Thanks for any help,
> Sam
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
--------------------------------------------------------
This e-mail and any attachments are confidential and may also be legally
privileged and/or copyright material of Intec Telecom Systems PLC (or
its affiliated companies). If you are not an intended or authorised
recipient of this e-mail or have received it in error, please delete it
immediately and notify the sender by e-mail. In such a case, reading,
reproducing, printing or further dissemination of this e-mail or its
contents is strictly prohibited and may be unlawful.
Intec Telecom Systems PLC does not represent or warrant that an
attachment hereto is free from computer viruses or other defects. The
opinions expressed in this e-mail and any attachments may be those of
the author and are not necessarily those of Intec Telecom Systems PLC.
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
17 years, 10 months
RE: [Fedora-directory-users] solaris, dtlogin, and FDS
by Paul Clayton
Yep. Busy with it right now. Got the same issue. Seems telnet,ftp rlogin
work ok, but not dtlogin. I am thinking maybe dtlogin needs a special
authetnciation section in the pam.conf file.
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Sam
Smith
Sent: 26 May 2006 04:53 PM
To: General discussion list for the Fedora Directory server project.
Subject: [Fedora-directory-users] solaris, dtlogin, and FDS
I have a bunch of fully patched and up-to-date Solaris 2.9 machines,
using an FDS ldap server. I just converted them over from NIS, thanks to
the help from the documentation on the web site.
I can login at the command line, I can ssh to them, I thought everything
was working great.
But when I sit down in front of the console, and try to login with
dtlogin to CDE (the gui), it kicks me out.
It's using the "other" lines from my pam.conf, which look like this:
#
# Default definitions for Authentication management # Used when service
name is not explicitly mentioned for authentication #
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
other auth binding pam_unix_auth.so.1 server_policy
other auth required pam_ldap.so.1
If I look at the log file in the FDS server ("access"), everything looks
fine.
Has anyone else had a problem with dtlogin?
Thanks for any help,
Sam
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
--------------------------------------------------------
This e-mail and any attachments are confidential and may also be legally
privileged and/or copyright material of Intec Telecom Systems PLC (or its
affiliated companies). If you are not an intended or authorised recipient
of this e-mail or have received it in error, please delete it immediately
and notify the sender by e-mail. In such a case, reading, reproducing,
printing or further dissemination of this e-mail or its contents is strictly
prohibited and may be unlawful.
Intec Telecom Systems PLC does not represent or warrant that an attachment
hereto is free from computer viruses or other defects. The opinions
expressed in this e-mail and any attachments may be those of the author and
are not necessarily those of Intec Telecom Systems PLC.
17 years, 10 months
RE: [Fedora-directory-users] /etc/init.d startup script issuesonreboot
by Paul Clayton
Apologies, blonde moment here. That was what I meant. Have you thought
of simplyfing your script. Do you see any messages that your script is
being acted upon. By this I mean taking out variables and putting in
full paths to where you want to go.
cheers
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Joe
Sheehan
Sent: 26 May 2006 03:24 PM
To: fedora-directory-users(a)redhat.com
Subject: RE: [Fedora-directory-users] /etc/init.d startup script
issuesonreboot
Little confused - do you mean in the directory
/opt/fedora-ds/slapd-'hostname' - run ./start-slapd If so I've done that
and it works on command line - I still receive a failure during reboot
using that command within my startup script. Trying to get more info out
of the ldap during reboot but all I receive is a failure statment.
>From: "Paul Clayton" <Paul.Clayton(a)intecbilling.com>
>Reply-To: "General discussion list for the Fedora Directory server
>project." <fedora-directory-users(a)redhat.com>
>To: "General discussion list for the Fedora Directory server project."
><fedora-directory-users(a)redhat.com>
>Subject: RE: [Fedora-directory-users] /etc/init.d startup script issues
>onreboot
>Date: Fri, 26 May 2006 13:58:51 +0200
>
>Have tried running the command as ./slapd-`hostname` in your
>/opt/fedora_ds directory.
>
>-----Original Message-----
>From: fedora-directory-users-bounces(a)redhat.com
>[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Joe
>Sheehan
>Sent: 26 May 2006 01:28 PM
>To: fedora-directory-users(a)redhat.com
>Subject: [Fedora-directory-users] /etc/init.d startup script issues on
>reboot
>
>We are using the startup script for Fedora as shown below with the
>corresponding /etc/sysconfig/ns-slapd The problem is during a reboot
>ns-slapd doesn't start. (the run levels are set to 3,4,5).
> >From the command line though using this script it starts.
>
>In the /var/log/messages for a reboot we see sql_select option missing
>auxpropfunc error no mechanism available ns-slapd failed
>
>For a command line start we see
>sql_select option missing
>auxpropfunc error no mechanism available ns-slapd started successfully.
>
>Those two errors seem to be consist with a permission problem similar
>to
>
>openldap
>but we haven't had any luck with that yet BUT is there a way to figure
>out why during a reboot it doesn't start besides getting a "ns-slapd
>failed".
>
>Thanks (scripts below)
>
>Joe
># Source function library.
>. /etc/init.d/functions
>
>SLAPD_HOST=`hostname -a`
>SLAPD_DIR=/opt/fedora-ds/bin/slapd/server
>PIDFILE=$SLAPD_DIR/logs/pid
>STARTPIDFILE=$SLAPD_DIR/logs/startpid
>
>if [ -f /etc/sysconfig/ns-slapd ]; then
> . /etc/sysconfig/ns-slapd
>fi
>
>
>start() {
> echo -n "Starting Fedora Directory Server: "
> if [ -f $STARTPIDFILE ]; then
> PID=`cat $STARTPIDFILE`
> echo ns-slapd already running: $PID
> exit 2;
> elif [ -f $PIDFILE ]; then
> PID=`cat $PIDFILE`
> echo ns-slapd already running: $PID
> exit 2;
> else
> echo Here we go...
> cd $SLAPD_DIR
> daemon ./ns-slapd $OPTIONS
> RETVAL=$?
> echo
> [ $RETVAL -eq 0 ] && touch /var/lock/subsys/ns-slapd
> return $RETVAL
> fi
>
>}
>
>stop() {
> echo -n "Shutting down Fedora Directory Server: "
> echo
> killproc ns-slapd
> echo
> rm -f /var/lock/subsys/ns-slapd
> return 0
>}
>
>case "$1" in
> start)
> start
> ;;
> stop)
> stop
> ;;
> status)
> status ns-slapd
> ;;
> restart)
> stop
> start
> ;;
> *)
> echo "Usage: <servicename> {start|stop|status|restart}"
> exit 1
> ;;
>esac
>exit $?
>
>
>--
>Fedora-directory-users mailing list
>Fedora-directory-users(a)redhat.com
>https://www.redhat.com/mailman/listinfo/fedora-directory-users
>--------------------------------------------------------
>
>This e-mail and any attachments are confidential and may also be
>legally privileged and/or copyright material of Intec Telecom Systems
>PLC (or its affiliated companies). If you are not an intended or
>authorised recipient of this e-mail or have received it in error,
>please delete it immediately and notify the sender by e-mail. In such a
>case, reading, reproducing, printing or further dissemination of this
>e-mail or its contents is strictly prohibited and may be unlawful.
>Intec Telecom Systems PLC does not represent or warrant that an
>attachment hereto is free from computer viruses or other defects. The
>opinions expressed in this e-mail and any attachments may be those of
>the author and are not necessarily those of Intec Telecom Systems PLC.
>
>--
>Fedora-directory-users mailing list
>Fedora-directory-users(a)redhat.com
>https://www.redhat.com/mailman/listinfo/fedora-directory-users
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
17 years, 10 months
RE: [Fedora-directory-users] /etc/init.d startup script issues on reboot
by Paul Clayton
Have tried running the command as ./slapd-`hostname` in your
/opt/fedora_ds directory.
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Joe
Sheehan
Sent: 26 May 2006 01:28 PM
To: fedora-directory-users(a)redhat.com
Subject: [Fedora-directory-users] /etc/init.d startup script issues on
reboot
We are using the startup script for Fedora as shown below with the
corresponding /etc/sysconfig/ns-slapd The problem is during a reboot
ns-slapd doesn't start. (the run levels are set to 3,4,5).
>From the command line though using this script it starts.
In the /var/log/messages for a reboot we see
sql_select option missing
auxpropfunc error no mechanism available
ns-slapd failed
For a command line start we see
sql_select option missing
auxpropfunc error no mechanism available
ns-slapd started successfully.
Those two errors seem to be consist with a permission problem similar to
openldap
but we haven't had any luck with that yet BUT is there a way to figure
out
why during a reboot it doesn't start besides getting a "ns-slapd
failed".
Thanks (scripts below)
Joe
# Source function library.
. /etc/init.d/functions
SLAPD_HOST=`hostname -a`
SLAPD_DIR=/opt/fedora-ds/bin/slapd/server
PIDFILE=$SLAPD_DIR/logs/pid
STARTPIDFILE=$SLAPD_DIR/logs/startpid
if [ -f /etc/sysconfig/ns-slapd ]; then
. /etc/sysconfig/ns-slapd
fi
start() {
echo -n "Starting Fedora Directory Server: "
if [ -f $STARTPIDFILE ]; then
PID=`cat $STARTPIDFILE`
echo ns-slapd already running: $PID
exit 2;
elif [ -f $PIDFILE ]; then
PID=`cat $PIDFILE`
echo ns-slapd already running: $PID
exit 2;
else
echo Here we go...
cd $SLAPD_DIR
daemon ./ns-slapd $OPTIONS
RETVAL=$?
echo
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/ns-slapd
return $RETVAL
fi
}
stop() {
echo -n "Shutting down Fedora Directory Server: "
echo
killproc ns-slapd
echo
rm -f /var/lock/subsys/ns-slapd
return 0
}
case "$1" in
start)
start
;;
stop)
stop
;;
status)
status ns-slapd
;;
restart)
stop
start
;;
*)
echo "Usage: <servicename> {start|stop|status|restart}"
exit 1
;;
esac
exit $?
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
--------------------------------------------------------
This e-mail and any attachments are confidential and may also be legally
privileged and/or copyright material of Intec Telecom Systems PLC (or its
affiliated companies). If you are not an intended or authorised recipient
of this e-mail or have received it in error, please delete it immediately
and notify the sender by e-mail. In such a case, reading, reproducing,
printing or further dissemination of this e-mail or its contents is strictly
prohibited and may be unlawful.
Intec Telecom Systems PLC does not represent or warrant that an attachment
hereto is free from computer viruses or other defects. The opinions
expressed in this e-mail and any attachments may be those of the author and
are not necessarily those of Intec Telecom Systems PLC.
17 years, 10 months
[Fedora-directory-users] SSHA Seed?
by Robert r. Sanders
We are attempting to sync (via ldap copy) the usernames and passwords of
our FDS LDAP users with an OpenLDAP server. The issue we are running
into is we are fairly new to FDS and can't figure out how to determine
the SSHA Seed value (which we could then set as the seed on the OpenLDAP
server).
I've been searching this morning and have failed to discover anything;
any info would be very useful.
Thanks,
--
Robert r. Sanders
Chief Technologist
iPOV
(334) 821-5412
www.ipov.net
17 years, 10 months
[Fedora-directory-users] Custom forms
by Pavel 'Blaze' Vinogradov
Hello fedora-directory-users,
I try to find more information about creating and use custon forms
for Fedora Directory Console. Example of this form we see in "Edit
user forms". They templates is stored in /clients/dswg/html...
But no useful documentation about their customization can be
found.
Can anyone give me more information about this?
--
Best regards,
Pavel mailto:blaze@elewise.com
17 years, 10 months
[Fedora-directory-users] password aging
by Steve Strong
I'm having some trouble with students who use my lab being forced to
change their password every time they log in. I should say that to
create the user accounts in fedora directory, I used LdapImport and used
/etc/passwd and /etc/shadow to create the new accounts. In addition,
we've been using NIS to authenticate prior to the import of user
accounts, so there probably was some difference in passwords. I thought
that they could change their password and that the aging of the password
would be updated correctly, but this doesn't seem to be happening.
any help would be greatly appreciated.
steve
--
Steve Strong
Math and Computer Science
Washington High School
2205 Forest Dr. SE
Cedar Rapids, IA 52403
http://crwash.org
mailto:strong.s@crwash.org
17 years, 10 months
[Fedora-directory-users] Securing the Pam Passthru plugin
by Paul Engle
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello all,
I've installed and configured the pam passthru plugin so that we can do
simple binds without having to store passwords in the directory. It's
working, but I can't seem to get the pamSecure attribute to take effect. My
entry in dse.ldif for the plugin is:
dn: cn=PAM Pass Through Auth,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: extensibleObject
objectClass: pamConfig
cn: PAM Pass Through Auth
nsslapd-pluginPath: /opt/fedora-ds/lib/pam-passthru-plugin.so
nsslapd-pluginInitfunc: pam_passthruauth_init
nsslapd-pluginType: preoperation
nsslapd-pluginEnabled: on
nsslapd-pluginloadglobal: true
nsslapd-plugin-depends-on-type: database
pamMissingSuffix: ALLOW
pamExcludeSuffix: o=NetscapeRoot
pamExcludeSuffix: cn=config
pamMapMethod: RDN
pamFallback: FALSE
pamSecure: TRUE
pamService: ldapserver
nsslapd-pluginId: pam_passthruauth
nsslapd-pluginVersion: 1.0.2
nsslapd-pluginVendor: Fedora Project
nsslapd-pluginDescription: PAM pass through authentication plugin
That's pretty much a cut & paste from the README that comes with the plugin
source. Docs are sketchy, but I thought that pamSecure was supposed to
prevent a non-SSL connection from being able to do the passthru bind? Even
though I have it set to true, I can bind to port 389 of my server with no
error. Obviously, that's not acceptable. Am I misunderstanding the purpose
of this attribute? If so, is there any other way to enforce TLS for simple
binds?
Also, is there any plan to include this plugin in the default build of FDS?
It's included with the source, but it's commented out of the Makefile, at
least for version 1.0.2.
Thanks,
-paul
- --
Paul D. Engle | Rice University
Sr. Systems Administrator | Information Technology - MS119
(713) 348-4702 | P.O. Box 1892
pengle(a)rice.edu | Houston, TX 77251-1892
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
iD8DBQFEdbxkCpkISWtyHNsRApDyAKDoSSB0omRek5XhAdbsBJJ+ioP8DgCfWRsG
LClbobetOFgcM/U8gBFoOyQ=
=tgjh
-----END PGP SIGNATURE-----
17 years, 10 months
[Fedora-directory-users] dsbuild install error on Engarde Linux
by Justin Jones
I'm trying to build Fedora Directory Server on Engarde Linux (rapier)
using dsbuild. I've worked my way through most of the dependency
issues, but i'm stuck with this error:
gmake[6]: Leaving directory `/root/dsbuild-fds102/ds/ldapserver/work/
fedora-ds-1.0.2/ldap/servers/slapd'
/usr/bin/gcc -c -Wall -DNO_DBM -DLINUX -DLINUX2_2 -DLINUX2_4 -fPIC -
D_REENTRANT -DNO_NODELOCK -DDEBUG -DNO_LIBLCACHE -DXP_UNIX -DLinux -
DMCC_DEBUG -g -DMCC_HTTPD -DNS_DOMESTIC -DNET_SSL -DCLIENT_AUTH -
DSERVER_BUILD -DNSPR20 -DNS_DS -DSPAPI20 -DBUILD_NUM=\"2006.144.2028
\" -DUPGRADEDB -DLINUX -DLINUX2_0 -DLINUX2_2 -DLinux -
DLDAP_DEBUG -DLDAP_REFERRALS -DLDAP_LDBM -DLDAP_LDIF -
DLDBM_USE_DBBTREE -DSLAPD_PASSWD_SHA1 -DLDAP_SSLIO_HOOKS -
D__DBINTERFACE_PRIVATE -DNO_LIBLCACHE -DNS_DIRECTORY -g -I../../../
ldap/include -I../../../built/Linux2.6_x86_glibc_PTH_DBG.OBJ/include
-I/root/dsbuild-fds102/ds/db/work/db-4.2.52.NC/built -I. -I../../../
include/libaccess -I../../../lib -DLDAP_DONT_USE_SMARTHEAP -I../../../
include -I../../../include -I/root/dsbuild-fds102/ds/mozilla/work/
mozilla/dist/DBG.OBJ/include -I/root/dsbuild-fds102/ds/mozilla/work/
mozilla/dist/public/dbm -I/root/dsbuild-fds102/ds/mozilla/work/
mozilla/dist/public/nss -I/root/dsbuild-fds102/ds/mozilla/work/
mozilla/dist/public/svrcore -I/root/dsbuild-fds102/ds/mozilla/work/
mozilla/dist/public/ldap -I/usr/include/sasl bind.c -o ../../../built/
Linux2.6_x86_glibc_PTH_DBG.OBJ/servers/obj/bind.o
bind.c:62:18: sasl.h: No such file or directory
bind.c: In function `do_bind':
bind.c:322: error: `SASL_MECHNAMEMAX' undeclared (first use in this
function)
bind.c:322: error: (Each undeclared identifier is reported only once
bind.c:322: error: for each function it appears in.)
I'm simply running "make DEBUG=full NOJAVA=1". Does anyone have any
idea what it may be looking for or what's hanging it up?
Thanks!
Justin
17 years, 10 months
RE: [Fedora-directory-users] Fedora Directory Server Console on Mac OS X
by Paul Clayton
Felipe,
We had the same issue here were our DNS kept on dropping the entry
(microsoft sucks)for some obscure reason. Check that your DNS is working
properly otherwise odd things happen, or in your case don't happen.
regards
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Felipe
Alfaro Solana
Sent: 23 May 2006 04:49 PM
To: fedora-directory-users(a)redhat.com
Subject: [Fedora-directory-users] Fedora Directory Server Console on Mac
OS X
Hi!
Has anyone been able to make Fedora Directory Server console run on Mac
OS X 10.4? I copied the entire /opt/fedora-ds tree to my Mac, then ran
./startconsole. The login wndow comes up but, after entering the admin
credentials, it just hangs while trying to authenticate against the
admin service. Curiously, while sniffing traffic, I can see a DNS query
for the admin service machine, but no more traffic just comes in or out
from the machine.
I've tried using JRE 1.4.2 and JRE 1.5.0 with no success.
Any ideas?
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
--------------------------------------------------------
This e-mail and any attachments are confidential and may also be legally
privileged and/or copyright material of Intec Telecom Systems PLC (or its
affiliated companies). If you are not an intended or authorised recipient
of this e-mail or have received it in error, please delete it immediately
and notify the sender by e-mail. In such a case, reading, reproducing,
printing or further dissemination of this e-mail or its contents is strictly
prohibited and may be unlawful.
Intec Telecom Systems PLC does not represent or warrant that an attachment
hereto is free from computer viruses or other defects. The opinions
expressed in this e-mail and any attachments may be those of the author and
are not necessarily those of Intec Telecom Systems PLC.
17 years, 10 months