[Fedora-directory-users] SNMP monitoring issues
by Philip Kime
The AgentX subagent config file is supposed to take a config line
agentx-logdir
I have set this but the agent still logs to the same dir at the config
file is in (which is the default location) - any ideas?
--
Philip Kime
NOPS Systems Architect
310 401 0407
17 years, 9 months
[Fedora-directory-users] SNMP monitoring
by Philip Kime
My knowledge of SNMP is only fair, bear with me ...
I've set up the subagent for SNMP monitoring and can snmpwalk the rhds
stuff, with the output below. I have a few questions though:
1. what is the ".389" suffix on the variables? Looks like the port
number of the server?
2. If I query the DS, none of the counters change?
3. The dsIntTable part of the MIB has no entries (I tried with
snmptable) - how does this get populated?
4. Do I need to do anything to "enable" SNMP on the servers? The
checkbox mentioned in the docs doesn't exist but dse.ldif does have
"nsSNMPEnabled: on"
RHDS-MIB::dsAnonymousBinds.389 = Counter32: 0
RHDS-MIB::dsUnAuthBinds.389 = Counter32: 0
RHDS-MIB::dsSimpleAuthBinds.389 = Counter32: 21
RHDS-MIB::dsStrongAuthBinds.389 = Counter32: 0
RHDS-MIB::dsBindSecurityErrors.389 = Counter32: 0
RHDS-MIB::dsInOps.389 = Counter32: 306
RHDS-MIB::dsReadOps.389 = Counter32: 0
RHDS-MIB::dsCompareOps.389 = Counter32: 0
RHDS-MIB::dsAddEntryOps.389 = Counter32: 0
RHDS-MIB::dsRemoveEntryOps.389 = Counter32: 0
RHDS-MIB::dsModifyEntryOps.389 = Counter32: 53
RHDS-MIB::dsModifyRDNOps.389 = Counter32: 0
RHDS-MIB::dsListOps.389 = Counter32: 0
RHDS-MIB::dsSearchOps.389 = Counter32: 81
RHDS-MIB::dsOneLevelSearchOps.389 = Counter32: 6
RHDS-MIB::dsWholeSubtreeSearchOps.389 = Counter32: 7
RHDS-MIB::dsReferrals.389 = Counter32: 0
RHDS-MIB::dsChainings.389 = Counter32: 0
RHDS-MIB::dsSecurityErrors.389 = Counter32: 0
RHDS-MIB::dsErrors.389 = Counter32: 72
RHDS-MIB::dsMasterEntries.389 = Gauge32: 0
RHDS-MIB::dsCopyEntries.389 = Gauge32: 0
RHDS-MIB::dsCacheEntries.389 = Gauge32: 0
RHDS-MIB::dsCacheHits.389 = Counter32: 0
RHDS-MIB::dsSlaveHits.389 = Counter32: 0
--
Philip Kime
NOPS Systems Architect
310 401 0407
17 years, 9 months
[Fedora-directory-users] Question re: {KERBEROS} syntax
by Tom Ryan
I am in the midst of migrating from openldap to fedora ds.
In openldap, I could specify the userpassword as
{KERBEROS}kerberosprinc@REALM
And openldap would utilize that for bind verification..
Is this possible under fedora ds? Would a plugin be required (is one
currently available?)
Thanks!
Tom
17 years, 9 months
[Fedora-directory-users] Plugin configuration
by Justin Crawford
Howdy-
We use P-synch, a password synchronization tool. It has a plugin that works on Netscape and Sun LDAP servers, so I'm hoping it'll work with Fedora, and I'm testing that now. I have configured the plugin in dse.ldif as specified by the vendor (and as it has worked on SunOne). When I try to start the directory instance, I get an error right away:
$ sudo ./start-slapd
[26/Jul/2006:17:27:19 -0600] - Netscape Portable Runtime error -5977: /opt/fedora-ds/lib/passwdop.nsldap.linux.x86: cannot open shared object file: No such file or directory
[26/Jul/2006:17:27:19 -0600] - Could not open library "/opt/fedora-ds/lib/passwdop.nsldap.linux.x86" for plugin Psynch Check Password
[26/Jul/2006:17:27:19 -0600] - Unable to load plugin "cn=Psynch Check Password,cn=plugins,cn=config"
But the file is there, and its real accessible:
$ ls -l /opt/fedora-ds/lib/passwdop.nsldap.linux.x86
-rwxrwxrwx 1 ldap ldap 87127 Jul 26 17:25 /opt/fedora-ds/lib/passwdop.nsldap.linux.x86
So I'm trying to figure out what might cause this.
1. It's a 64-bit linux box, but the plugin binary is 32-bit? (I'd expect a different error)
2. The plugin is not working with the directory software? (I'd expect a different error)
3. There is a secret about installing Fedora plugins that my experience with SunOne hasn't taught me?
4. ??
Anyone have any great ideas?
Thanks.
Justin
17 years, 9 months
[Fedora-directory-users] passync log entries
by Brian Smith
What do these messages mean in the passync log, the services starts up
and I see 1 successful auth on the directory server but all i get is
this in the passync log:
07/26/06 14:19:10: PassSync service started
07/26/06 14:19:10: Failed to load entries from file
07/26/06 14:19:12: Password list is empty. Waiting for passhook event
if i change a password or add a user, nothing happens.
Thanks in advance
Brian
17 years, 9 months
[Fedora-directory-users] Dos issue in fedora directory server
by Tom Ryan
I have noticed that I can crash fds remotely pretty easily..
I have pam_passthru setup (obvious to those reading my recent emails)..
Anyway, if I run the following from a remote system
Ldapsearch -x uid=anything -H ldaps://fds-server -x -W -D uid=+
And enter anything for a password,
It goes away..
Here's a strace of the pid
poll([{fd=22, events=POLLIN}, {fd=6, events=POLLIN}, {fd=7, events=POLLIN}],
3, 250) = 0
gettimeofday({1153945615, 879597}, NULL) = 0
poll([{fd=22, events=POLLIN}, {fd=6, events=POLLIN}, {fd=7, events=POLLIN,
revents=POLLIN}], 3, 250) = 1
accept(7, {sa_family=AF_INET6, sin6_port=htons(51128), inet_pton(AF_INET6,
"::ffff:CLIENTIP", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) =
24
fcntl64(24, F_GETFL) = 0x2 (flags O_RDWR)
fcntl64(24, F_SETFL, O_RDWR|O_NONBLOCK) = 0
brk(0x88cf000) = 0x88cf000
fcntl64(24, F_DUPFD, 64) = 64
close(24) = 0
setsockopt(64, SOL_TCP, TCP_NODELAY, [0], 4) = 0
getsockname(64, {sa_family=AF_INET6, sin6_port=htons(636),
inet_pton(AF_INET6, "::ffff:FDSSERVERIP", &sin6_addr), sin6_flowinfo=0,
sin6_scope_id=0}, [28]) = 0
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1267, ...}) = 0
getpeername(7, 0xbfecf5c0, [108]) = -1 ENOTCONN (Transport endpoint is
not connected)
gettimeofday({1153945615, 974890}, NULL) = 0
poll([{fd=22, events=POLLIN}, {fd=6, events=POLLIN}, {fd=7, events=POLLIN},
{fd=64, events=POLLIN, revents=POLLIN}], 4, 250) = 1
futex(0x8613a78, FUTEX_WAKE, 1) = 1
getpeername(7, 0xbfecf5c0, [108]) = -1 ENOTCONN (Transport endpoint is
not connected)
gettimeofday({1153945615, 978689}, NULL) = 0
poll([{fd=22, events=POLLIN, revents=POLLIN}, {fd=6, events=POLLIN}, {fd=7,
events=POLLIN}], 3, 250) = 1
read(22, "\0", 200) = 1
getpeername(7, 0xbfecf5c0, [108]) = -1 ENOTCONN (Transport endpoint is
not connected)
gettimeofday({1153945615, 992926}, NULL) = 0
poll([{fd=22, events=POLLIN}, {fd=6, events=POLLIN}, {fd=7, events=POLLIN},
{fd=64, events=POLLIN}], 4, 250) = -1 EINTR (Interrupted system call)
+++ killed by SIGSEGV +++
Process 20095 detached
Bummer..
17 years, 9 months
[Fedora-directory-users] Password Policy enforcement mechanism question
by Lebsack, Eliot
Good morning.
I have been playing with FDS 1.0.2 for some time, and have been
successful in getting the Directory Server to enforce password
policy by toggling the "nsslapd-pwpolicy-local" flag to "on", then
establishing a local policy for my "ou=People" subtree.
This enforcement appears to work only when I change the password
for a user through the Fedora Management Console interface when I'm
logged in as the Directory Manager (cn=Directory Manager).
When I attempt to change the "userPassword" attribute for my test user
via perl's Net::LDAP library using the smbldap-tools scripts
(smbldap-passwd),
smbldap-passwd takes the cleartext of the new password, and hashes it
using SSHA.
This hashed text (ciphertext) is then used to replace the
"userPassword" attribute for the user
in a subsequent LDAP bind operation. This process effectively bypasses
the password
policy defined for the user's subtree.
Is there a way (through Perl or Java) to supply the cleartext to the
server through SSL/TLS,
and have it apply the password policy on the cleartext before the
server hashes the cleartext?
Regards,
Eliot
======================================
Eliot Lebsack
Lead Communications Engineer
The MITRE Corporation Bedford, MA
17 years, 9 months
[Fedora-directory-users] PassSync sync password errors
by Jeff Gamsby
I am testing out the PassSync program, but the FDS logs throw an error
when trying to sync the passwords.
Can anyone translate this for me please?
[24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync"
(fds:636): windows_replay_update: Looking at modify operation local
dn="uid=user,ou=people,dc=ldap,dc=example,dc=com" (ours,user,not group)
[24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync"
(fds:636): windows_replay_update: Processing modify operation local
dn="uid=user,ou=people,dc=ldap,dc=example,dc=com" remote
dn="<GUID=21d434b17f592a4db7a6d5aa4b3a030e>"
[24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync"
(fds:636): Received result code 32 (0000208D: NameErr: DSID-031001A8,
problem 2001 (NO_OBJECT), data 0, best match of: '' ) for modify
operation
[24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync"
(fds:636): windows_replay_update: update password returned 1
[24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync"
(fds:636): Consumer failed to replay change (uniqueid
bfad6881-1dd111b2-8033cdea-25db0000, CSN 44c4f9e7000000010000): No such
object. Skipping.
[24/Jul/2006:09:48:15 -0700] agmt="cn=FDS Sync" (fds:636) - load=1 rec=2
csn=44c4f9e7000100010000
[24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync"
(fds:636): windows_replay_update: Looking at modify operation local
dn="uid=user,ou=people,dc=ldap,dc=example,dc=com" (ours,user,not group)
[24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync"
(fds:636): windows_replay_update: Processing modify operation local
dn="uid=user,ou=people,dc=ldap,dc=example,dc=com" remote
dn="<GUID=21d434b17f592a4db7a6d5aa4b3a030e>"
[24/Jul/2006:09:48:15 -0700] agmt="cn=FDS Sync" (fds:636) -
clcache_load_buffer: rc=-30990
[24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync"
(fds:636): No more updates to send (cl5GetNextOperationToReplay)
Thank you,
Jeff G.
17 years, 9 months
Re: [Fedora-directory-users] Fedora Directory server on Windows XP.Can it be done?
by Eugene M Liberman
Richard,
Is it possible to get the build files to use as a template for this new
build?
Thank you for good news and such a quick response!
Gene Liberman
Richard Megginson <rmeggins(a)redhat.com>
Sent by: fedora-directory-users-bounces(a)redhat.com
07/25/2006 04:04 PM
Please respond to "General discussion list for the Fedora Directory server
project."
To: "General discussion list for the Fedora Directory server project."
<fedora-directory-users(a)redhat.com>
cc:
Subject: Re: [Fedora-directory-users] Fedora Directory server on Windows XP. Can it
be done?
Eugene M Liberman wrote:
>
> I am trying to build FDS on the Windows XP platform. Can it be done?
> Has somebody done it?
Yes, about 18 months ago, and not since. The Windows port has rotted
quite a bit. You can probably do it, but it will take a couple of weeks
or more.
>
>
> Thank you in advance,
>
> Gene Liberman
> ------------------------------------------------------------------------
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
<< Attachment clipped: smime.p7s (4356 bytes ) >>
17 years, 9 months