PassSync has been working fine for me in production on a couple
different systems, but has stopped working on one for some reason.
I've tried reinstalling the PassSync software, removed the passhook.log
and passhook.dat between installations, verified passwords and user info
is correct for the service, still nothing.
When I restart the service, I get the following in my access log file on
the LDAP server (IPs and user info removed):
[12/Jun/2006:14:42:48 -0500] conn=896 fd=178 slot=178 SSL connection
from 192.168.X.X to 192.168.X.X
[12/Jun/2006:14:42:48 -0500] conn=896 SSL 128-bit RC4
[12/Jun/2006:14:42:48 -0500] conn=896 op=0 BIND dn="userinfo" method=128
[12/Jun/2006:14:42:48 -0500] conn=896 op=0 RESULT err=0 tag=97
nentries=0 etime=0 dn="userinfo"
[12/Jun/2006:14:42:48 -0500] conn=896 op=1 UNBIND
[12/Jun/2006:14:42:48 -0500] conn=896 op=1 fd=178 closed - U1
After the service has started, I get nothing else in either the access
or errors log files.
The passhook.log never shows any info, and the log file in the PassSync
directory only contains info regarding the service stopping and
Any hints as to where else I need to be looking to fix this issue?
The SSL Howto on the wiki doesn't really cover a procedure for what to do
when your root CA has to be renewed, along with your server certs.
I have 3 servers whose server certs are all signed with our own root CA, but
that root CA is expiring, and needs to be replaced. Presumably this means I
also need to replace the server certs, since they were signed with this
expiring root CA.
What I was able to do was just blow away /opt/fedora-ds/alias/*.db, and then
###### CREATE NEW *.db FILES ########
/opt/fedora-ds/share/bin/certutil -N -d /opt/fedora-ds/alias -P slapd-ldap-
###### INSTALL NEW ROOT CA ########
/opt/fedora-ds/share/bin/certutil -A -n "My Dept. Root CA" -P slapd-ldap- -d
/opt/fedora-ds/alias -t "CT,," -a -i ./cacert.pem
###### CREATE NEW SERVER CERT REQUEST #######
/opt/fedora-ds/share/bin/certutil -R -d /opt/fedora-ds/alias -a -P
slapd-ldap- -s "cn=ldap.my-domain.com" -o /tmp/csr.der.txt -g 1024
###### SIGN THE NEW SERVER CERT REQUEST ########
openssl ca -config openssl.cnf -policy policy_anything -out
certs/ldapcert.pem -infiles csr.der.txt
###### INSTALL NEW SERVER CERT #########
/opt/fedora-ds/shared/bin/certutil -A -d /opt/fedora-ds/alias -n
"ldap-server-cert" -P slapd-ldap- -t u,u,u -a -i
At this point, my server starts up just fine and all appears to be well, but
it doesn't seem like it should be absolutely necessary to start over from
scratch on each server when our root CA expires. Can someone detail a
shorter method to replace expired root CAs *and* server certificates?
I'd like to know if there's a common way to manage account expiration
by specifying an expiration date ?
In my case, I have some accounts which have to be renewed each year.
They should by default be disactivated automatically.
I've considered adding a dedicated attribute and running a script via
cron but I'd welcome any suggestion.
I am running the fedora directory server version 1.0.2
on debian gnu linux version 3.1 (debian sarge)
The ldap server itself (ns-slapd) worked alright, but upon increased usage,
the ns-slapd process is ever increasing memory usage.
ps shows size (SZ col) of 220669,
top show virt 863m, res 407m, shr 47m
Is this normal behavior? Any way to restrict memory usage in any form?
I have setup passSync and replication, but I get this error:
Replica has no update vector. It has never been initialized.
I have run the "Initiate full re-initialization" and restarted the
PassSync service on AD.
I'm not sure what to do.
I had it working before, but had to re-install. I had this problem before,
but it seemed to solve itself.
I'm using FDS as a component in a software development project.
up until now I've had no problems but what puzzles me is the status of
attribute uniqueness. FDS is based on Netscape iPlanet and or Sun ONE
directory from what I read.
if I look at the documentation of FDS (iPlanet 7.0 based) I see clearly no
support for multiple unique attributes (page 594 of the admin manual):
If I on the other hand look at the Sun documenation:
see section: "Configuring the Plug-In From the Command-Line"
I see that there is a way! only I can't get it to work which suggests what
I read in the FDS documentation.
My question: Can FDS now or in the future support multiple unique
attributes? I'm using it to keep integrity intact of some objects stored
both in FDS and in a RDBMS.
I have been a linux user for sometime, but have only recently started working with LDAP after hearing about the Fedora Directory Server. I have been using it primarily with integration into Samba as a replacement for Active Directory, and it has been working well thus far. I have deployed a servers into a production environment, and it's working great.
I followed the howto for Samba found on the main page, and the server is setup in this way.
My question though relates to group security. Since I wish to delegate access to files on the samba fileserver via group membership, how can I accomplish this using FDS and Samba? Am I able to create a group using the Admin Console, add the user accounts to be members of the group, and then set security on shares based on group? Or is there a specific procedure to follow? I'm becoming fairly versed at samba, but LDAP is still quite new to me. Obviously the more I can do using the Admin console, the happier I, and my customers are.
I have tried creating a share in samba, allowing only access to the group that I created in the directory, then adding a user to that group, but the user is unable to access the share, as samba doesn't seem to be aware of the group created in the directory.
A bit of searching has told me that samba wants the group to be a posix group, or to exist in the /etc/group file on the system. Several LDAP/Samba howtos have also suggested at needing to run a net groupmap command to map the ldap group to a posix id. This makes sense, as in the Fedora howto this is necessary to create the well-known groups which users are added to later on, but then how is group membership managed? The well-known groups that are created during the initial howto appear differently in the administration console, and double clicking them only opens the advanced the properties, and not the ability to add additional members to the group.
I apologize for any parts that don't make sense, but hopefully someone will catch what I'm actually meaning and be able to offer some help. If any more information is required, please ask, and I will gladly provide.
Thanks to everyone who helped me.
Since it was a struggle for me, I thought that I would post how I did it
in case others have the same problems that I had. Maybe it will help
Fedora Core 4
Fedora Directory Server 1.0.2
Windows 2000 Server
Install FDS ( or reinstall: rpm -qa | grep fedora-ds | xargs rpm -e; rm
-rf /opt/fedora-ds ; rpm -i fedora-ds-1.0.2 )
create certificates, etc..
I used this simple script that I wrote: (cd to /opt/fedora-ds/alias)
echo -n "Creating password and noise file..."
echo "8904859034905834-580943502385430958430958049385" >
echo "8374893jkhsdfjkhdjksfah89dskjfkdghkjdfhguiert9348khkfhgkjfd79" >
echo -n "Creating Databases..."
$serverroot/shared/bin/certutil -N -d . -f pwdfile.txt
echo -n "Generating encryption key..."
$serverroot/shared/bin/certutil -G -d . -z noise.txt -f pwdfile.txt
echo -n "Generating self-signed certificate..."
$serverroot/shared/bin/certutil -S -n "CA certificate" -s "cn=CAcert" -x
-t "CT,," -m 1000 -v 120 -d . -z noise.txt -f pwdfile.txt
echo -n "Generating server certificate.."
$serverroot/shared/bin/certutil -S -n "Server-Cert" -s
"cn=msas.msd.lbl.gov" -c "CA certificate" -t "u,u,u" -m 1001 -v 120 -d
. -z noise.txt -f pwdfile.txt
mv key3.db slapd-msas-key3.db
mv cert8.db slapd-msas-cert8.db
ln -s slapd-msas-key3.db key3.db
ln -s slapd-msas-cert8.db cert8.db
echo -n "Setting permissions.."
chown nobody.nobody /opt/fedora-ds/alias/slapd-msas*
echo -n "Exporting certificate.."
$serverroot/shared/bin/certutil -L -d . -n "CA certificate" -r > cacert.der
echo "Converting certificate.."
openssl x509 -inform DER -in cacert.der -outform PEM -out cacert.pem
echo "Copying cacert.pem to /etc/openldap/cacerts.."
cp cacert.pem /etc/openldap/cacerts/
echo -n "Enabling SSL in FDS"
echo -n "Please enter Manager password..(twice)"
ldapmodify -x -D cn=Manager -W -f /tmp/ssl_enable.ldif
ldapmodify -x -D cn=Manager -W -a -f /tmp/addRSA.ldif
Test SSL connections and ldapsearch
netstat -an | grep 636
Install Active Directory on Windows Server
Install Certificate Services --> Enterprise root CA
Enable SSL on AD
1. Install Certificate Services on Windows 2000 Server and an
Enterprise Certificate Authority in the Active Directory Domain.
Make sure you install an Enterprise Certificate Authority.
2. Create a Security (Group) Policy to direct Domain Controllers to
get an SSL certificate from the Certificate Authority (CA).
1. Open the Active Directory Users and Computers Administrative
2. Under the domain, right-click on Domain Controllers.
3. Select Properties.
4. In the Group Policy tab, click to edit the Default Domain
5. Go to Computer Configuration->Windows Settings->Security
Settings->Public Key Policies.
6. Right click Automatic Certificate Request Settings.
7. Select New.
8. Select Automatic Certificate Request.
9. Run the wizard. Select the Certificate Template for a Domain
10. Select your Enterprise Certificate Authority as the CA.
Selecting a third-party CA works as well.
11. Complete the wizard.
12. All Domain Controllers now automatically request a
certificate from the CA, and support LDAP using SSL on port 636.
3. Retrieve the Certificate Authority Certificate
1. Open a Web browser on the AD machine
2. Go to http://localhost/certsrv/
3. Select the task Retrieve the CA certificate or certificate
4. Click Next.
5. The next page automatically highlights the CA certificate.
Click Download CA certificate.
6. A new download window opens. Save the file to the hard drive.
Save in DER mode
Copy file to FDS server, convert to PEM format
openssl x509 -inform DER -in ad-cert.der -outform PEM -out ad-cert.pem
Import AD CA cert into FDS
certutil -A -d . -P slapd-instance- -t "CT,CT,CT" -a -i ad-cert.pem
check certs ( from /opt/fedora-ds/alias)
certutil -L -d . -P slapd-instance
Check ldapsearch from FDS to AD
ldapsearch -Z -P <RHDS-cert8.db> -h <AD/NT Hostname> -p <AD SSL port>
-D "<sync manager user> -w < sync manager password> -s <scope>
-b "<AD base>" "<filter>"
Install PassSync on Windows machine.
Follow directions from Howto:WindowsSync (certificate creation)
restart AD server
Enable Replication in Directory Server Console:
Go to configuration tab --> Replication --> enable changelog --> default
Expand Replication, click UserRoot
Check "Enable Replica" Single-master
Right Click UserRoot --> Create new windows sync agreement
Up log level in FDS:
ldapmodify -x -D "cn=directory manager" -a -f repl_log.ldif
right click win sync agreement --> Initiate Full Sync
check error logs (/opt/fedora/slapd-instance/logs/errors)
In order for users to be created on the Windows side, users must have
dn: uid=TBird,ou=People, dc=server,dc=com
cn: Tweetie Bird
ntUserComment: Tweetie Bird User Account
gecos: Tweetie Bird
I hope that I have this right.