[Fedora-directory-users] PassSync setup still not working
by Jeff Gamsby
Please help me, I cannot get this to work. It's driving me crazy.
This is what I did:
Setup FDS over SSL using certutil.
Windows 2000 AD server with "Enterprise Certificate Authority"
Can search AD over SSL ( using ldp.exe, people search over ssl, and
openldap ldapsearch over ssl -H ldaps://)
Installed PassSync ( used FDS host, port 636, FDS Manager account
cn=Manager, FDS cert db password, FDS base )
Exported FDS certs ( per howto:ssl ) and imported them into AD (
certutil databases on windows side )
Setup changelog ( default ) and single master replication
Setup windows sync agreement ( bind as AD administrator account
cn=administrator,cn=users,....)
Then I test SSL connection from FDS to AD:
../shared/bin/ldapsearch -X -h ad-host -p 636 -D
"cn=administrator,cn=users,... -w - -s base -b "" "objectclass=*"
ldap_init( ad.server.xxx.xxx, 636 )
ldaptool_getcertpath -- .
ldaptool_getkeypath -- .
ldaptool_getmodpath -- (null)
ldaptool_getdonglefilename -- (null)
ldap_simple_bind: Can't contact LDAP server
SSL error -8179 (Peer's Certificate issuer is not recognized.)
OpenLDAP ldapsearch
ldapsearch -x -H ldaps://ad-host works
On Windows Machine:
certutil -L -d .
CA certificate CT,C,C
Server-Cert Pu,Pu,Pu
On FDS server (FC4):
# ../shared/bin/certutil -L -d .
CA certificate CTu,u,u
Server-Cert u,u,u
I have no idea what to try next. Please help
17 years, 10 months
[Fedora-directory-users] Admin server TLS error
by Matthias Saou
Hi,
I'm setting up FDS 1.0.2 on RHEL4 x86_64, and everything was going
rather well, until I started trying to use SSL/TLS everywhere.
Following the instructions in the Wiki I got the certificates created
and installed using the provided script. I can now see the FDS
listening on port 636. But I think I also enabled SSL or TLS for the
admin server... which now refuses to start.
All I see in the admin-serv/logs/error file is this :
[Wed Jun 07 13:16:30 2006] [crit] buildUGInfo(): unable to initialize
TLS connection to LDAP host ldap.mydomain port 636: 4
[Wed Jun 07 13:16:30 2006] [crit] mod_admserv_post_config(): unable to
build user/group LDAP server info:
Configuration Failed
And I really don't know how to fix this... I think I've really tried
everything I could think of already. Setting the LogLevel to debug
doesn't give any more useful output.
Is there any way I can revert to a plain connection to port 389? I
don't really understand the problem in the first place since I've put
this in adm.conf but it didn't change the error :
ldapHost: ldap.mydomain
ldapPort: 389
Matthias
--
Clean custom Red Hat Linux rpm packages : http://freshrpms.net/
Fedora Core release 5.89 (Rawhide) - Linux kernel 2.6.16-1.2232_FC6
Load : 1.51 1.39 1.22
17 years, 10 months
[Fedora-directory-users] window sync certificate and Passsync
by nattapon viroonsri
RHEL 4.0
redhat-ds-7.1SP1-3
Window 2003
Passync-1.msi from directory.fedora.com
/opt/redhat-ds/alias
certutil -N -d .
certutil -G -d .certutil -S -n "my ca" -s "cn=ice" -x -t "CT,CT,CT" -m 1000
-v 120 -d .
certutil -S -n "ice cert" -s "cn=ice.icesolution.com" -c "my ca" -t "u,u,u"
-m 1001 -v 120 -d .
ln -s cert8.db slap-ice-cert8.db
ln -s key3.db slap-ice-key3.db
pk12util -d . -o ca.pfx -n "my ca"
pk12util -d . -o ice.pfx -n "ice cert"
import on Win2003
certutil.exe -d . -N
pk12util -d . -i ca.pfx
pk12util -d . -i ice.pfx
restart "password" sync service
test with /opt/redhat-ds/share/bin/ldapsearch
DS# ldapsearch -v -Z -D
"cn=administrator,cn=users,dc=win2003,dc=icesolution,dc=com" -w 123456 -P
/etc/redhat-ds/alias -h <ip_of_ADS> -p 636
-b "cn=users,dc=win2003,dc=icesolution,dc=com" objectClass=*
return: -8156 isuer certificate is invalid
DS# openssl s_client -connect -showcerts
its return different CA certificate that not import from my self sign
certificate.
its look like default certificate for window2003
passync not not bind nss certificate to ADS' port 636 ? i try to reboot
window2003 but still same result
and from directory console i try to config sync agreement but it return
cannot contact ADS
Regards,
Nattapon
_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
17 years, 10 months
[Fedora-directory-users] PassSync problems (Peer's Certificate issuer is not recognized)
by Jeff Gamsby
I have followed RHDS Admin guide and Howto:WindowsSync several times, but I keep getting this error:
ldapsearch -Z -P . -h ad-host -p 636 -D "cn=administrator,cn=users,dc=xxx,dc=xxx,dc=xxx" -w - -s base -b "" "objectclass=*" -v
Enter bind password:
ldapsearch: started Tue Jun 6 11:28:46 2006
ldap_init( ad-host, 636 )
ldaptool_getcertpath -- .
ldaptool_getkeypath -- .
ldaptool_getmodpath -- (null)
ldaptool_getdonglefilename -- (null)
ldap_simple_bind: Can't contact LDAP server
SSL error -8179 (Peer's Certificate issuer is not recognized.)
I can search FDS over SSL. I have exported the Server-Cert from FDS and imported it into AD (PassSync).
I have changed the trust attributes per the Howto, eventhough the attributes only change to "CT,C,C (CA certificate)" and "Pu,Pu,Pu Server-Cert"
17 years, 10 months
[Fedora-directory-users] TLS trace: SSL3 alert write:fatal:unknown CA
by Jeff Gamsby
I am trying to get FDS 1.0.2 working in SSL mode. I am using a OpenSSL
CA, I have installed the Server Cert and the CA Cert, can start FDS in
SSL mode, but when I run
ldapsearch -x -ZZ I get TLS trace: SSL3 alert write:fatal:unknown CA.
In /etc/ldap.conf, I have put in
TLS_CACERT /path/to/cert
TLSREQCERT allow
ssl on
ssl start_tls
If I run
openssl s_client -connect localhost:636 -showcerts -state -CAfile
/path/to/cacert.pem
It looks OK
Please help
Thanks
--
Jeff Gamsby
Center for X-Ray Optics
Lawrence Berkeley National Laboratory
(510) 486-7783
17 years, 10 months
[Fedora-directory-users] fedora directory server on Windows
by paul barnes
Hello,
I've compiled,installed,run,configured FDS with no pb so far, for a simple applicative schema, on Linux.
I wish to do same things on Windows 2003, then to begin with, to compile.
I've tried with MKS (see 1 below) but some pbs, I've tried with cygwin (see 2 below) but some pbs as well...
I wonder what is the best strategy: going on with MKS, going on with cygwin,
What must I check to succeed in compiling FDS on windows ?
Or can I find "somewhere" a binary version for windows....
Thank you very much in advance
Paul Barnes
1) MKS (gmake), but quite quickly, make fails the following way
****************************************************************************
> make
[ : ]
make: execvp: true: Invalid argument
make: *** [pre-everything] Error 127
2) I've tried on cygwin, I do face an other pb :
******************************************************
cd md; make export
make[5]: Entering directory `/home/desgranp/fedora/dsbuild-fds102/ds/mozilla/wor
k/mozilla/nsprpub/OPT.OBJ/pr/include/md'
sh ../../../../build/cygwin-wrapper nsinstall -m 444 ../../../../pr/include/md/_
aix32.cfg ../../../../pr/include/md/_aix64.cfg ../../../../pr/include/md/_beos.c
fg ../../../../pr/include/md/_bsdi.cfg ../../../../pr/include/md/_darwin.cfg ../
../../../pr/include/md/_dgux.cfg ../../../../pr/include/md/_freebsd.cfg ../../..
/../pr/include/md/_hpux32.cfg ../../../../pr/include/md/_hpux64.cfg ../../../../
pr/include/md/_irix32.cfg ../../../../pr/include/md/_irix64.cfg ../../../../pr/i
nclude/md/_linux.cfg ../../../../pr/include/md/_ncr.cfg ../../../../pr/include/m
d/_nec.cfg ../../../../pr/include/md/_netbsd.cfg ../../../../pr/include/md/_next
step.cfg ../../../../pr/include/md/_nto.cfg ../../../../pr/include/md/_openbsd.c
fg ../../../../pr/include/md/_openvms.cfg ../../../../pr/include/md/_os2.cfg ../
../../../pr/include/md/_osf1.cfg ../../../../pr/include/md/_qnx.cfg ../../../../
pr/include/md/_reliantunix.cfg ../../../../pr/include/md/_rhapsody.cfg ../../../
../pr/include/md/_scoos.cfg ../../../../pr/include/md/_solaris.cfg ../../../../p
r/include/md/_sony.cfg ../../../../pr/include/md/_sunos4.cfg ../../../../pr/incl
ude/md/_unixware.cfg ../../../../pr/include/md/_unixware7.cfg ../../../../pr/inc
lude/md/_win16.cfg ../../../../pr/include/md/_win95.cfg ../../../../pr/include/m
d/_winnt.cfg ../../../../pr/include/md/_aix.h ../../../../pr/include/md/_beos.h
../../../../pr/include/md/_bsdi.h ../../../../pr/include/md/_darwin.h ../../../.
./pr/include/md/_dgux.h ../../../../pr/include/md/_freebsd.h ../../../../pr/incl
ude/md/_hpux.h ../../../../pr/include/md/_irix.h ../../../../pr/include/md/_linu
x.h ../../../../pr/include/md/_macos.h ../../../../pr/include/md/_ncr.h ../../..
/../pr/include/md/_nec.h ../../../../pr/include/md/_netbsd.h ../../../../pr/incl
ude/md/_nextstep.h ../../../../pr/include/md/_nspr_pthread.h ../../../../pr/incl
ude/md/_nto.h ../../../../pr/include/md/_openbsd.h ../../../../pr/include/md/_op
envms.h ../../../../pr/include/md/_os2.h ../../../../pr/include/md/_os2_errors.h
../../../../pr/include/md/_osf1.h ../../../../pr/include/md/_pcos.h ../../../..
/pr/include/md/_pth.h ../../../../pr/include/md/_qnx.h ../../../../pr/include/md
/_reliantunix.h ../../../../pr/include/md/_rhapsody.h ../../../../pr/include/md/
_scoos.h ../../../../pr/include/md/_solaris.h ../../../../pr/include/md/_sony.h
../../../../pr/include/md/_sunos4.h ../../../../pr/include/md/_unix_errors.h ../
../../../pr/include/md/_unixos.h ../../../../pr/include/md/_unixware.h ../../../
../pr/include/md/_win16.h ../../../../pr/include/md/_win32_errors.h ../../../../
pr/include/md/_win95.h ../../../../pr/include/md/_winnt.h ../../../../pr/include
/md/prosdep.h ../../../../pr/include/md/sunos4.h /home/desgranp/fedora/dsbuild-f
ds102/ds/mozilla/work/mozilla/dist/OPT.OBJ/include/md
../../../../build/cygwin-wrapper: line 75: exec: nsinstall: not found
make[5]: *** [export] Error 127
__________________________________________________
Do You Yahoo!?
En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités
http://mail.yahoo.fr Yahoo! Mail
17 years, 10 months
[Fedora-directory-users] Windows Sync agreement supplier port
by Jeff Gamsby
Thanks for everyone's help to get my FDS server running in SSL mode.
I have another problem:
I'm trying to setup PassSync, and I have got to the point whwre I can run
ldapsearch over SSL to talk to AD.
I'm trying to setup the sync agreement but cannot change the suppliers
port from 389 to 636.
Does the admin console need to run in SSL mode in order to do this?
If I run the admin console in SSL mode, then will the suppliers port
change to 636? The suppliers field cannot be edited.
Thanks,
Jeff
17 years, 10 months
[Fedora-directory-users] Extending the New user objectclass
by Paul Clayton
Hi,
When adding a new user, we require additonal objectclasses to be added. We require the Account objectclasses and the account host attribute to be default.
Currently we add them manually, but how do you extend this so the objectclass and the required attributes are already there when you create a new user.
Regards
Paul Clayton
Global Unix Co-ordinator
Intec Billing
240 Main Rondebosch
Cape Town
Tel: +27(0)21 6588000
Fax: +27(0)21 6588001
Mobile: +27(0)83 2853403
--------------------------------------------------------
This e-mail and any attachments are confidential and may also be legally
privileged and/or copyright material of Intec Telecom Systems PLC (or its
affiliated companies). If you are not an intended or authorised recipient
of this e-mail or have received it in error, please delete it immediately
and notify the sender by e-mail. In such a case, reading, reproducing,
printing or further dissemination of this e-mail or its contents is strictly
prohibited and may be unlawful.
Intec Telecom Systems PLC does not represent or warrant that an attachment
hereto is free from computer viruses or other defects. The opinions
expressed in this e-mail and any attachments may be those of the author and
are not necessarily those of Intec Telecom Systems PLC.
17 years, 10 months
Re: [Fedora-directory-users] TLS trace: SSL3 alert write:fatal:unknown CA
by Howard Chu
fedora-directory-users-request(a)redhat.com wrote:
> Date: Fri, 02 Jun 2006 17:48:00 -0700
> From: Jeff Gamsby <JFGamsby(a)lbl.gov>
>
>
> Jeff Gamsby
> Center for X-Ray Optics
> Lawrence Berkeley National Laboratory
> (510) 486-7783
>
>
>
Geeze you guys, these messages could seriously use some trimming.
>>>>>
>>>>>>>>>
>>>>>>>>> Richard Megginson wrote:
>>>>>>>>>
>>>>>>>>>> Jeff Gamsby wrote:
>>>>>>>>>>
>>>>>>>>>>> I blew away the server and installed a new one, then I used
>>>>>>>>>>> the setupssl.sh script to setup SSL. The script completed
>>>>>>>>>>> successfully, and the server is listening on port 636, but
>>>>>>>>>>> I'm back to a familiar error:
>>>>>>>>>>>
>>>>>>>>>>> ldapsearch -x -ZZ -d -1
>>>>>>>>>>>
Listening on port 636 with SSL means you have an ldaps:// listener. The
ldapsearch -Z options are for LDAPv3 StartTLS, which is incompatible
with (LDAPv2+) ldaps://. Use either ldaps:// or StartTLS, you cannot use
both together. This is already noted in the manpages.
>>>
>> I'm not sure I understand what's going on either, but the message
>> "Peer does not recognize and trust the CA that issued your
>> certificate." means that ldapsearch did not verify your LDAP server
>> certificate (Server-Cert). This is usually due to one or both of the
>> following:
>> 1) The value of the cn attribute in the leftmost RDN of the subjectDN
>> in the LDAP server cert is not the fqdn of the LDAP server host, or
>> the client cannot resolve it.
>> 2) The /etc/openldap/cacerts/cacert.asc CA cert is not the cert of the
>> CA that issued the LDAP server certificate (Server-Cert)
>>
No, on the client side this error can only be caused by (2), there is a
completely different error message for (1). Also for (1), "client cannot
resolve it" is not a consideration; as mandated by RFC2830 the hostname
supplied by the user (on the command line) must exactly match the name
in the cert CN (or one of the subjectAltNames). No resolution procedures
are allowed.
--
-- Howard Chu
Chief Architect, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc
OpenLDAP Core Team http://www.openldap.org/project/
17 years, 11 months
[Fedora-directory-users] /etc/init.d startup script issues on reboot
by Joe Sheehan
We are using the startup script for Fedora as
shown below with the corresponding /etc/sysconfig/ns-slapd
The problem is during a reboot ns-slapd doesn't start. (the run levels are
set to 3,4,5).
>From the command line though using this script it starts.
In the /var/log/messages for a reboot we see
sql_select option missing
auxpropfunc error no mechanism available
ns-slapd failed
For a command line start we see
sql_select option missing
auxpropfunc error no mechanism available
ns-slapd started successfully.
Those two errors seem to be consist with a permission problem similar to
openldap
but we haven't had any luck with that yet BUT is there a way to figure out
why during a reboot it doesn't start besides getting a "ns-slapd failed".
Thanks (scripts below)
Joe
# Source function library.
. /etc/init.d/functions
SLAPD_HOST=`hostname -a`
SLAPD_DIR=/opt/fedora-ds/bin/slapd/server
PIDFILE=$SLAPD_DIR/logs/pid
STARTPIDFILE=$SLAPD_DIR/logs/startpid
if [ -f /etc/sysconfig/ns-slapd ]; then
. /etc/sysconfig/ns-slapd
fi
start() {
echo -n "Starting Fedora Directory Server: "
if [ -f $STARTPIDFILE ]; then
PID=`cat $STARTPIDFILE`
echo ns-slapd already running: $PID
exit 2;
elif [ -f $PIDFILE ]; then
PID=`cat $PIDFILE`
echo ns-slapd already running: $PID
exit 2;
else
echo Here we go...
cd $SLAPD_DIR
daemon ./ns-slapd $OPTIONS
RETVAL=$?
echo
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/ns-slapd
return $RETVAL
fi
}
stop() {
echo -n "Shutting down Fedora Directory Server: "
echo
killproc ns-slapd
echo
rm -f /var/lock/subsys/ns-slapd
return 0
}
case "$1" in
start)
start
;;
stop)
stop
;;
status)
status ns-slapd
;;
restart)
stop
start
;;
*)
echo "Usage: <servicename> {start|stop|status|restart}"
exit 1
;;
esac
exit $?
17 years, 11 months