[Fedora-directory-users] Trouble with NSS and Fedora-ds
by Agnaldo Freitas
Hi List!
Ldapsearch returns data from "Fedora-DS" but "getent group/passwd" and "id user" commands can not get them. They just can get data from "/etc/passwd" and "/etc/group".
What is wrong?
Please, can someone help me?
Agnaldo
P.S.: Some configuration files
# /etc/pam.d/system-auth
####################
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required /lib/security/$ISA/pam_env.so
auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok
auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass
auth required /lib/security/$ISA/pam_deny.so
account required /lib/security/$ISA/pam_unix.so broken_shadow
account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
account [default=bad success=ok user_unknown=ignore] /lib/security/$ISA/pam_ldap.so
account required /lib/security/$ISA/pam_permit.so
password requisite /lib/security/$ISA/pam_cracklib.so retry=3
password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow
password sufficient /lib/security/$ISA/pam_ldap.so use_authtok
password required /lib/security/$ISA/pam_deny.so
session required /lib/security/$ISA/pam_limits.so
session required /lib/security/$ISA/pam_unix.so
session optional /lib/security/$ISA/pam_ldap.so
# /etc/nsswitch.conf
#################
passwd: files ldap
shadow: files ldap
group: files ldap
hosts: files dns
bootparams: files
ethers: files
netmasks: files
networks: files
protocols: files ldap
rpc: files
services: files ldap
netgroup: files ldap
publickey: files
automount: files ldap
aliases: files
# ldap.conf
#########
host 192.168.2.3
base dc=sei,dc=intranet
bindpw passwd
rootbinddn cn=Directory Manager,dc=sei,dc=intranet
timelimit 50
pam_lookup_policy yes
nss_base_passwd ou=People,dc=sei,dc=intranet?one
nss_base_shadow ou=People,dc=sei,dc=intranet?one
nss_base_group ou=Groups,dc=sei,dc=intranet?one
pam_password exop
ssl off
# /etc/pam.d/login
################
#%PAM-1.0
auth required pam_securetty.so
auth required pam_stack.so service=system-auth
auth required pam_nologin.so
#auth sufficient /lib/security/pam_ldap.so use_first_pass
#account sufficient /lib/security/pam_ldap.so
account sufficient pam_stack.so service=system-auth
password required pam_stack.so service=system-auth
# pam_selinux.so close should be the first session rule
# session required pam_selinux.so close
session required pam_stack.so service=system-auth
session required pam_loginuid.so
session optional pam_console.so
# pam_selinux.so open should be the last session rule
# session required pam_selinux.so open
[root@netuno1 ~]# strings /lib/libnss_ldap.so.2 | grep conf
_nss_ldap_readconfig
_nss_ldap_readconfigfromdns
_nss_ldap_init_config
sysconf
-conf
/etc/ldap.conf
/etc/openldap/ldap.conf
version conflict in sasl_client_add_plugin for %s
%.*s%c%s.conf
auth-conf
DB environment not configured for transactions
Database environment not configured for encryption
%s interface requires an environment configured for the %s subsystem
DB_ENV->set_lk_conflicts
Environment not configured as replication master or client
an index not configured to support duplicates
Primary databases may not be configured with duplicates
ssl session id conflict
confounded by authenticator.
configuration file routines
id-it-confirmWaitTime
id-cmc-confirmCertAcceptance
no sign function configured
no verify function configured
no config database
X509V3_EXT_conf
no conf
no conf or environment variable
conflicting engine id
v3_conf.c
conf_lib.c
conf_api.c
conf_def.c
/etc/krb5.conf:/etc/krb5.conf
Can't open/find Kerberos configuration file
Improper format of Kerberos configuration file
No supported encryption types (config file error?)
16 years, 2 months
RE: [Fedora-directory-users] FDS, SNMP & Cacti...
by HAWKER, Dan
And another attempt...
Have separated out the three files in the tarball as it seems my company
filter was killing the perl script.
To use, simply follow the Howto on the wiki, but you'll all need to rename
*openldap_response_time.txt* to openldap_response_time.pl*. The other two
files are as required.
Thanks
Dan
#####
Hmmm, had a bounce back from this address. Will try it again and forward to
the FDS list also...
#####
Hi Richard,
As requested please find attached a tarball with my template and its
accompanying perl script. If you can pop that onto the wiki so that I can
link to it, that'd be great.
Regarding a Howto:SNMPMonitoring, have rustled up a quick one on the wiki.
Should be at http://directory.fedora.redhat.com/wiki/Howto:SNMPMonitoring
Think its all there, but no doubt there will be ommissions and errors :)
Thanks
Dan
--
Dan Hawker
Linux System Administrator
Astrium
--
This email (including any attachments) may contain confidential and/or privileged information or information otherwise protected from disclosure.
If you are not the intended recipient, please notify the sender immediately, do not copy this message or any attachments and do not use it for any purpose or disclose its content to any person, but delete this message and any attachments from your system.
Astrium disclaims any and all liability if this email transmission was virus corrupted, altered or falsified.
---------------------------------------------------------------------
Astrium Limited, Registered in England and Wales No. 2449259
Registered Office: Gunnels Wood Road, Stevenage, Hertfordshire, SG1 2AS, England
16 years, 2 months
[Fedora-directory-users] Red Hat capacacity planning guidelines
by Ankur Agarwal
Hi,
Are there any capacity planning guidelines available for Red Hat directory server? I am specifically looking for planning my disk size and RAM requirements based on my userbase and frequent operations.
regards,
Ankur
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
16 years, 2 months
RE: [Fedora-directory-users] FDS, SNMP & Cacti...
by HAWKER, Dan
Hmmm, nice :)
Will resubmit...
Dan
> -----Original Message-----
> From: Kimmo Koivisto [mailto:koippa@gmail.com]
> Sent: Monday, January 08, 2007 4:43 PM
> To: fedora-directory-users(a)redhat.com
> Cc: HAWKER, Dan
> Subject: Re: [Fedora-directory-users] FDS, SNMP & Cacti...
>
>
> On Monday 08 January 2007 18:20, HAWKER, Dan wrote:
> > Hmmm, had a bounce back from this address. Will try it again and
> > forward to the FDS list also...
>
> Dan, I did not see any attached files, it seems that your
> company filters out
> tarball:
>
> >File fds_cacti_template.tar.gz(openldap_response_time.pl) has been
> >removed
> because this file type may be used to transmit viruses.
>
> Can you rename your tarball and resend it?
>
> Regards
> Kimmo
>
> > #####
> >
> > Hi Richard,
> >
> > As requested please find attached a tarball with my
> template and its
> > accompanying perl script. If you can pop that onto the wiki
> so that I
> > can link to it, that'd be great.
> >
> > Regarding a Howto:SNMPMonitoring, have rustled up a quick
> one on the
> > wiki. Should be at
> > http://directory.fedora.redhat.com/wiki/Howto:SNMPMonitoring
> >
> > Think its all there, but no doubt there will be ommissions
> and errors
> > :)
> >
> > Thanks
> >
> > Dan
> > --
> >
> > Dan Hawker
> > Linux System Administrator
> > Astrium
>
This email (including any attachments) may contain confidential and/or privileged information or information otherwise protected from disclosure.
If you are not the intended recipient, please notify the sender immediately, do not copy this message or any attachments and do not use it for any purpose or disclose its content to any person, but delete this message and any attachments from your system.
Astrium disclaims any and all liability if this email transmission was virus corrupted, altered or falsified.
---------------------------------------------------------------------
Astrium Limited, Registered in England and Wales No. 2449259
Registered Office: Gunnels Wood Road, Stevenage, Hertfordshire, SG1 2AS, England
16 years, 2 months
[Fedora-directory-users] Windows Sync Errors
by Glenn
Hello again. I'm still trying to get Windows Sync working between Directory
Server 7.1sp3 and Active Directory on a Windows 2003 server. I thought I
would narrow down the problem by trying to add a user in the DS and see if it
would replicate to AD. It does not, and the error message is:
[02/Jan/2007:09:58:31 -0600] NSMMReplicationPlugin - agmt="cn=ldap-ad"
(adserver:636): windows_replay_update: Looking at add operation local
dn="uid=PApostle,ou=People,o=txwes.edu" (not ours,not user,not group)
The replication agreement specifies that ou=People,o=txwes.edu in the DS
should be synchronized with ou=Domain Users,dc=ad,dc=txwesleyan,dc=edu in
AD. Both ous exist as specified.
Can anyone please suggest what I might try to get this working? Thanks. -
Glenn.
16 years, 2 months
[Fedora-directory-users] Virtual Views entries only as leaves?
by Ewen Cumming
Hi all,
We've recently been migrating our data from an OpenLDAP server to FDS.
The data import went smoothly, very impressed.
However, I am currently experimenting with using a virtual view to
allow a flat directory structure to be displayed as a hierachical
view. Through experimentation I've only found it possible to add
virtual entries as leaves. Is it possible to have virtual entries in
an organizational unit that contains another organizational unit with
other virtual entries.
I'm sure that makes no sense so I've attempted to draw the tree
stucture I'm trying to achieve. ou=view contains the virtual view and
ou=entries contains the actual entries.
dc=root
- ou=view
- - ou=group
- - - ou=subgroup
- - - - o=org1
- - - - o=org2
- - - o=org3
- ou=entries
- - o=org1
- - o=org2
- - o=org3
In the virtual view ou=group contains both ou=subgroup (with it's own
virtual entries org1&2) and a virtual entry (org3) of its own. At the
moment I only seem able to get the deepest OU to display virtual
entries (ou=subgroup in this example).
Does anyone know if what I am trying is possible or are virtual
entries only able to be added at the deepest container?
16 years, 2 months
[Fedora-directory-users] How to detect if user password has expired?
by Ankur Agarwal
Hi,
Is there any in-built attribute that can tell me if user password has expired?
I do get an appropriate exception if i try to authenticate such a user but i want to identify such users by looking at their saved profile data.
regards,
Ankur
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
16 years, 2 months
RE: [Fedora-directory-users] FDS, SNMP & Cacti...
by HAWKER, Dan
Hmmm, had a bounce back from this address. Will try it again and forward to
the FDS list also...
#####
Hi Richard,
As requested please find attached a tarball with my template and its
accompanying perl script. If you can pop that onto the wiki so that I can
link to it, that'd be great.
Regarding a Howto:SNMPMonitoring, have rustled up a quick one on the wiki.
Should be at http://directory.fedora.redhat.com/wiki/Howto:SNMPMonitoring
Think its all there, but no doubt there will be ommissions and errors :)
Thanks
Dan
--
Dan Hawker
Linux System Administrator
Astrium
--
This email (including any attachments) may contain confidential and/or privileged information or information otherwise protected from disclosure.
If you are not the intended recipient, please notify the sender immediately, do not copy this message or any attachments and do not use it for any purpose or disclose its content to any person, but delete this message and any attachments from your system.
Astrium disclaims any and all liability if this email transmission was virus corrupted, altered or falsified.
---------------------------------------------------------------------
Astrium Limited, Registered in England and Wales No. 2449259
Registered Office: Gunnels Wood Road, Stevenage, Hertfordshire, SG1 2AS, England
Astrium Security Policy
File fds_cacti_template.tar.gz(openldap_response_time.pl) has been removed because this file type may be used to transmit viruses.
If you believe this is a valid attachment from a known and trusted source:
* Non Astrium recipients should contact the sender
* The Astrium sender/recipient should contact their helpdesk
Please include this notice and reference code.
[Ref:CA1-GBL-FEMP]
16 years, 2 months
RE: [Fedora-directory-users] FDS, SNMP & Cacti...
by HAWKER, Dan
>
> Hi Richard,
>
> I'll give it a go. I'm no SNMP or Cacti guru in any way, but
> it was thankfully quite simple to setup and I managed to get
> it to work, so it can't be that tricky :)
All,
Have created a quick and dirty Howto for SNMP Monitoring on the wiki
(http://directory.fedora.redhat.com/wiki/Howto:SNMPMonitoring) as requested
by Richard. Am hoping its OK, but no doubt there will be ommissions and
errors :)
Enjoy
Dan
--
Dan Hawker
Linux System Administrator
Astrium
--
This email (including any attachments) may contain confidential and/or privileged information or information otherwise protected from disclosure.
If you are not the intended recipient, please notify the sender immediately, do not copy this message or any attachments and do not use it for any purpose or disclose its content to any person, but delete this message and any attachments from your system.
Astrium disclaims any and all liability if this email transmission was virus corrupted, altered or falsified.
---------------------------------------------------------------------
Astrium Limited, Registered in England and Wales No. 2449259
Registered Office: Gunnels Wood Road, Stevenage, Hertfordshire, SG1 2AS, England
16 years, 2 months