Re: [Fedora-directory-users] Solaris9 client problems / questions
by Jo De Troy
Hello,
in the wiki it's written to use http://ldapserver:636 to get the
certificates, it should be https://ldapserver:636 I managed to get the
certificate on an old Solaris box using netscape.
Wrt the locking of the proxy DN used by the Solaris client, I already had
added an entry for the passwordexpirationtime. I have the impression that
it's not expiration that's the problem but it's locking, due to failed
logins. So I'm not sure that setting the passwordexpiration attribute of the
proxyDN to 20380119031407Z will solve the problem. But of course I will try.
Do I actually need a proxyDN or can I setup a solaris LDAP client without
it?
Best Regards,
Jo
17 years, 11 months
[Fedora-directory-users] Unknown attribute syntax OID...
by Alex aka Magobin
Hi at all, I'm trying to import qmail.schema in Fedora DS, but during
importation it says:
[17/May/2006:10:09:53 +0000] dse - The entry cn=schema in
file /opt/fedora-ds/slapd-nodo1/config/schema/55ns-qmail.ldif is
invalid, errorcode 21 (Invalid syntax) - attribute type qmailUID:
Unknown attribute syntax OID "1.3.6.1.4.1.1466.115.121.1.36"
[17/May/2006:10:09:53 +0000] dse - Please edit the file to correct the
reported problems and then restart the server.
I used ol-schema-migrate.pl to convert qmail.schema for fedoraDS
according with in www.qmail-ldap.org wiki page
Thanks in advance!
Alex
Below my 55ns-qmail.ldif:
[root@nodo1 ~] #./ol-schema-migrate.pl
-b /opt/fedora-ds/slapd-nodo1/config/schema/55ns-qmail.ldif
#
################################################################################
#
dn: cn=schema
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.7914.1.2.1.1
NAME 'qmailUID'
DESC 'UID of the user on the mailsystem'
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.36
SINGLE-VALUE
)
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.7914.1.2.1.2
NAME 'qmailGID'
DESC 'GID of the user on the mailsystem'
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.36
SINGLE-VALUE
)
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.7914.1.2.1.3
NAME 'mailMessageStore'
DESC 'Path to the maildir/mbox on the mail system'
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE
)
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.7914.1.2.1.4
NAME 'mailAlternateAddress'
DESC 'Secondary (alias) mailaddresses for the same user'
EQUALITY caseIgnoreIA5Match
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.7914.1.2.1.5
NAME 'mailQuota'
DESC 'The amount of space the user can use until all further messages
get bounced.'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.44
SINGLE-VALUE
)
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.7914.1.2.1.6
NAME 'mailHost'
DESC 'On which qmail server the messagestore of this user is located.'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.44
SINGLE-VALUE
)
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.7914.1.2.1.7
NAME 'mailForwardingAddress'
DESC 'Address(es) to forward all incoming messages to.'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.7914.1.2.1.8
NAME 'deliveryProgramPath'
DESC 'Program to execute for all incoming mails.'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE
)
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.7914.1.2.1.9
NAME 'qmailDotMode'
DESC 'Interpretation of .qmail files: both, dotonly, ldaponly,
ldapwithprog, none'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.44
SINGLE-VALUE
)
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.7914.1.2.1.10
NAME 'deliveryMode'
DESC 'multi field entries of: normal, forwardonly, nombox,
localdelivery, reply, echo'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.44
)
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.7914.1.2.1.11
NAME 'mailReplyText'
DESC 'A reply text for every incoming message'
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{4096}
SINGLE-VALUE
)
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.7914.1.2.1.12
NAME 'accountStatus'
DESC 'The status of a user account: active, nopop, disabled'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.44
SINGLE-VALUE
)
#
################################################################################
#
objectClasses: (
1.3.6.1.4.1.7914.1.2.2.1
NAME 'qmailUser'
DESC 'QMail-LDAP User'
SUP top
AUXILIARY
MUST ( mail $ uid )
MAY ( mailMessageStore $ homeDirectory $ userPassword $
mailAlternateAddress $ qmailUID $ qmailGID $ mailQuota $ mailHost $
mailForwardingAddress $ deliveryProgramPath $ qmailDotMode $
deliveryMode $ mailReplyText $ accountStatus )
)
#
################################################################################
#
17 years, 11 months
[Fedora-directory-users] Solaris9 client problems / questions
by Jo De Troy
Hello,
I have setup a Solaris9 server as LDAP client to FedoraDS 1.0.2 on CentOS4.
(I have followed the Solaris client howto and the documentation on
http://web.singnet.com.sg/~garyttt/ )
Every few minutes the proxyagent, that is used to connect from Solaris to
the LDAP server, gets locked out, I have a global pwdpolicy that enables
lockouts after 3 login failures. After this account gets locked out I cannot
connect any more [ldaplist returns Object not found (Session error no
available conn.) ] If I delete the accountunlocktime attribute of the
proxyagent I'm back in business. Is there a way to stop the locking of this
account? I've tried to setup a special pwdpolicy for the proxyagent, without
success.
Secondly I don't see how I can get TLS working, in the Solaris client howto
document it's written to start up netscape and connect to
http://ldapserver:636 to somehow get the certifcates for the Solaris client.
I must be doing something wrong, since this just doesn't work. Is there
another way of getting the required certificates on the Solaris client? I
guess I only need the CA certificates on the Solaris client or not?
Best Regards,
Jo
17 years, 11 months
[Fedora-directory-users] Still struggling with MS Outlook sorting issue
by Khalid Mehmood Khan
Any one out there running this thing successfully with FDS? Is there any pre-requisite, some OID to make this shit work properly with FDS? I'm running nut in here :(
---------------------------------
Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ countries) for 2¢/min or less.
17 years, 11 months
[Fedora-directory-users] Solaris 10 build - has anybody done it?
by Graham Leggett
Hi all,
I have just given a FDS v1.0.2 build another try under Solaris 10, and
again I get build failures all over the show.
The machine I have has both SUNWspro installed, and gcc installed.
In this case, the build seems to arbitrarily build with cc, then gcc.
Eventually the build breaks as below.
I tried removing /usr/ccs/bin, the SUN compiler and /usr/ucb from the
path, but the build then broke complaining that it could not find cc.
Has anybody got FDS to build on Solaris 10?
gcc -shared -Wl,-soname -Wl,libldap50.so -o libldap50.so ./abandon.o
./add.o ./bind.o ./cache.o ./charray.o ./charset.o ./compare.o
./compat.o ./control.o ./countvalues.o ./delete.o ./disptmpl.o
./dsparse.o ./error.o ./extendop.o ./free.o ./freevalues.o ./friendly.o
./getattr.o ./getdn.o ./getdxbyname.o ./getentry.o ./getfilter.o
./getoption.o ./getvalues.o ./memcache.o ./message.o ./modify.o ./open.o
./os-ip.o ./proxyauthctrl.o ./psearch.o ./referral.o ./regex.o
./rename.o ./request.o ./reslist.o ./result.o ./saslbind.o ./sbind.o
./search.o ./setoption.o ./sort.o ./sortctrl.o ./srchpref.o ./tmplout.o
./ufn.o ./unbind.o ./unescape.o ./url.o ./utf8.o ./vlistctrl.o
-L../../../../../dist/lib -llber50ld: warning: option -o appears more
than once, first setting taken
ld: fatal: file libldap50.so: unknown file type
ld: fatal: File processing errors. No output written to libldap50.so
collect2: ld returned 1 exit status
Regards,
Graham
--
17 years, 11 months
RE: [Fedora-directory-users] Solaris9 client problems / questions
by Tay, Gary
# cd config/schema
# grep -i passwordexpirationtime *
00core.ldif:attributeTypes: ( 2.16.840.1.113730.3.1.91 NAME 'passwordExpirationTime' DESC 'Sun ONE defined password policy attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE USAGE directoryOperation X-DS-USE 'internal' X-ORIGIN 'Sun ONE Directory Server' )
00core.ldif:objectClasses: ( 2.16.840.1.113730.3.2.12 NAME 'passwordObject' DESC 'Sun ONE defined password policy objectclass' SUP top AUXILIARY MAY ( passwordExpirationTime $ passwordExpWarned $ passwordRetryCount $ retryCountResetTime $ accountUnlockTime $ passwordHistory $ passwordAllowChangeTime ) X-DS-USE 'internal' X-ORIGIN 'Sun ONE Directory Server' )
#
I am not sure if FDS 1.0.2 provides the "passwordexpirationtime" attribute, just like SUN DS5.2, if so, pls read:
http://docs.sun.com/app/docs/doc/817-0962/6mgnp4m9s?a=view
...
Configuring the Directory Server to Enable Password Management
See the “User Account Management” chapter in the Sun ONE Directory Server 5.1 Administrator's Guide for how to use the Directory Server Console or ldapmodify to configure the password management policy for the LDAP directory. In order for pam_ldap to work properly, the password and account lockout policy must be properly configured on the server.
Passwords for proxy users should never be allowed to expire. If proxy passwords expire, clients using the proxy credential level cannot retrieve naming service information from the server. To ensure that proxy users have passwords that do not expire, modify the proxy accounts with the following script.
# ldapmodify -h ldapserver —D administrator DN \
-w administrator password <<EOF
dn: proxy user DN
DNchangetype: modify
replace: passwordexpirationtime
passwordexpirationtime: 20380119031407Z
EOF
_____
Note –
pam_ldap password management relies on Sun ONE Directory Server 5.1 to maintain and provide password aging and account expiration information for users. The directory server does not interpret the corresponding data from shadow entries to validate user accounts. pam_unix, however, examines the shadow data to determine if accounts are locked or if passwords are aged. Since the shadow data is not kept up to date by the LDAP naming services or the directory server, pam_unix should not grant access based on the shadow data. The shadow data is retrieved using the proxy identity. Therefore, do not allow proxy users to have read access to the userPassword Attribute. Denying proxy users read access to userPassword prevents pam_unix from making an invalid account validation.
...
The above may not be applicable if FDS 1.0.2. Password Policy features are NOT identical to SUN DS5.2.
Gary
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com on behalf of Jo De Troy
Sent: Tue 5/16/2006 11:19 PM
To: fedora-directory-users(a)redhat.com
Cc:
Subject: [Fedora-directory-users] Solaris9 client problems / questions
Hello,
I have setup a Solaris9 server as LDAP client to FedoraDS 1.0.2 on CentOS4. (I have followed the Solaris client howto and the documentation on http://web.singnet.com.sg/~garyttt/ )
Every few minutes the proxyagent, that is used to connect from Solaris to the LDAP server, gets locked out, I have a global pwdpolicy that enables lockouts after 3 login failures. After this account gets locked out I cannot connect any more [ldaplist returns Object not found (Session error no available conn.) ] If I delete the accountunlocktime attribute of the proxyagent I'm back in business. Is there a way to stop the locking of this account? I've tried to setup a special pwdpolicy for the proxyagent, without success.
Secondly I don't see how I can get TLS working, in the Solaris client howto document it's written to start up netscape and connect to http://ldapserver:636 to somehow get the certifcates for the Solaris client. I must be doing something wrong, since this just doesn't work. Is there another way of getting the required certificates on the Solaris client? I guess I only need the CA certificates on the Solaris client or not?
Best Regards,
Jo
17 years, 11 months
Re: [Fedora-directory-users] best practice for uid
by Phil Lembo
Pierangelo has it exactly right. The place to fix this is at the application
that's attempting to authenticate. A few years ago, I had to push back on a
certain vendor of portfolio/project management software and got their
development team to admit they'd hardcoded their LDAP config to work with a
certain fixed DIT scheme. My response to them was that they should be
ashamed of themselves for such shoddy programming. Subsequent versions of
the same software now do The Right Thing (TM) and allow you to define the
user ID attribute to be used and then do a search on LDAP to pull back the
dn of the corresponding entry before attempting to authenticate. As others
have said on this thread, which you could use a custom attribute for the
user ID, down the road you'll regret it because you're inevitably going to
have integration problems with COTS applications you may need to integrate
with.
The scheme I've found most useful is to assign a unique identifier to each
user. Something completely meaningless, like a lowercase letter followed by
a bunch of digits (that pattern will work as an ID in most NOS or non
directory systems like AD, NDS, Unix, NT SAM, etc). Just increment the
numeric suffix as you assign each new ID. Using e-mail like aliases is
generally a pain because it requires you to change the ID every time you
have a name change. Same is true for IDs that are tied to a user's role
(like using different letter prefixes for employees and temps). It's usually
pretty easy to build a routine into your user provisioning software that
will increment the ID value automatically. Any provisioning software that
won't let you do this should get rejected out of hand (with a pointed memo
to the vendor giving the reason for the rejection). Getting any enterprise,
especially one where system administration is decentralized, to adopt a
common ID scheme is almost always difficult and usually requires
considerable effort on the 8th layer of the OSI model -- Politics.
Phil Lembo
17 years, 11 months
[Fedora-directory-users] fedora-ds-1.0.2-1 Server Group Administration Server Unable to Configure
by foo foo
Hi There,
This is a new install on FC5 - nothing imported. The problem is that in the
console, the Administration Server Icon is blank. There is no "Configuration
Tab".
Also, until I created a new instance of the Directory Server, that icon was
blank also. It now appears in the console, but I am unable to open it. This
is hard to describe, but basically I can't configure any of the server
attributes from the console. A direct connection to the web page (ie
firefox http://localhost:19939) allows browsing and editing. The java admin
console appears to be somehow unuseable. Any thoughts would be appreciated.
BTW, when I startconsole and login:
[Sun May 14 16:17:09 2006] [notice] Apache/2.2 configured -- resuming
normal operations
[Sun May 14 16:17:48 2006] [notice] [client 127.0.0.1]
admserv_check_authz(): passing [/admin-serv/authenticate] to the userauth
handler
So that looks OK.
Thanx,
Chris
17 years, 11 months
RE: [Fedora-directory-users] mounting openafs/nfs home dirs
by Bliss, Aaron
If your goal is just to have the box create home dirs for your users
(default action of useradd), then put this in your /etc/pam.d/sshd and
Login files:
session required pam_mkhomedir.so skel=/etc/skel/ umask=0007
If your using redhat es 4, you will also need that entry in system-auth
as well. Don't forget to define where your users home directory is for
each user you have in fds (POSIX info tab).
Aaron
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Pete
Rowley
Sent: Sunday, May 14, 2006 12:47 AM
To: General discussion list for the Fedora Directory server project.
Subject: Re: [Fedora-directory-users] mounting openafs/nfs home dirs
Jose Guevarra wrote:
> Hi,
>
> I just started using FDS. I've got my linux box authenticating to
> FDS but, when I login the user's home directory isn't there. I know
> that the home directories can be nfs(openafs?). How do you set this
> up? Can you mount openafs home directories?
>
> Any useful tuts/links would be appreciated.
>
>
The directory server is not responsible for that stuff, though it might
contain the needed information.
Investigate pam_mount.
--
Pete
Confidentiality Notice:
The information contained in this electronic message is intended for the exclusive use of the individual or entity named above and may contain privileged or confidential information. If the reader of this message is not the intended recipient or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that dissemination, distribution or copying of this information is prohibited. If you have received this communication in error, please notify the sender immediately by telephone and destroy the copies you received.
17 years, 11 months