[Fedora-directory-users] adding some object and atribute
by sigid@JINLab
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Dear Members,
How to add some additional objects and atributes to all/some existing
user on FDS instead of opening and adding one by one on fds console.
thanks
swu
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD4DBQFFocSla2bg8QmXta0RAqpWAJ4kEwMkQrvffsvC9d8mESAkzjs81QCYx+fR
hErUJK0BrkblhlJ5zcvqJA==
=gbzX
-----END PGP SIGNATURE-----
16 years, 2 months
[Fedora-directory-users] Directory sync with Windows 2003 Server x64
by Richard Hesse
Has anyone had any luck getting Windows 2003 Server x64 edition to sync with
FDS? FDS will successfully pull down new objects from AD, but the passwords
are not synchronized. Also, it appears that passhook.dll isn't functioning.
The logfile indicates perpetual waiting for an event. It doesn't catch any
password changes that occur. Yes, password complexity is enabled at the
domain level (it is on by default in 2003 x64).
There are a few events in the Application log from Password Synchronization,
but there is no event text. The event ids are mostly 105 and 144.
Thanks,
-richard
16 years, 2 months
RE: [Fedora-directory-users] FDS, SNMP & Cacti...
by HAWKER, Dan
>
> >
> >Have had a quick surf and there are couple of OpenLDAP and SunOne DS
> >templates out there I can use as a starting point, but nothing
> >specifically for FDS.
> >
> >
> The SunOne template should work, since the SNMP MIB is identical.
>
Thanks for the info Dave.
I'll have a look at it tomorrow and let you all know.
Dan
This email (including any attachments) may contain confidential and/or privileged information or information otherwise protected from disclosure.
If you are not the intended recipient, please notify the sender immediately, do not copy this message or any attachments and do not use it for any purpose or disclose its content to any person, but delete this message and any attachments from your system.
Astrium disclaims any and all liability if this email transmission was virus corrupted, altered or falsified.
---------------------------------------------------------------------
Astrium Limited, Registered in England and Wales No. 2449259
Registered Office: Gunnels Wood Road, Stevenage, Hertfordshire, SG1 2AS, England
16 years, 2 months
[Fedora-directory-users] Apache Auth/pam_check_host_attr?
by Brian Kosick
Hi All,
I've been using FDS for quite a while now, and I'd just like to say I
love it great job! I'm posting this question because I've been banging
my head for awhile about it.
I'm using FDS as the central Auth server in a pretty much all RH/FC
environment, and currently use pam_check_host_attr to control which
users are allowed to login to which servers. All was working great
until I upgraded our internal WWW server from RHEL3 to FC6. The WWW
server is/was using mod_authz_ldap apache module to control what groups
were allowed to login to certain sections of the website, after the
upgrade to FC6, group restrictions stopped working. Basically, apache
+mod_authz_ldap started denying users that didn't have the WWW server in
the hosts attribute.
My goal is to allow/dis-allow SSH/telnet etc etc using
pam_check_host_attr, but still allow them to login to the http areas of
the server using ldap groups.
Here's my authz_ldap conf
<Directory /var/TEMP/>
AuthType Basic
AuthName "Temporary Folder to Disseminate files"
AuthzLDAPAuthoritative On
AuthzLDAPMethod ldap
AuthzLDAPProtocolversion 3
#AuthzLDAPLogLevel debug
AuthzLDAPServer server.domain.com
AuthzLDAPUserBase ou=People,dc=corp,dc=domain,dc=com
AuthzLDAPUserKey uid
AuthzLDAPGroupBase ou=Groups,dc=corp,dc=domain,dc=com
AuthzLDAPGroupkey cn
AuthzLDAPMemberKey uniquemember
AuthzLDAPSetGroupAuth ldapdn
Require group qausers dev ops psg threat se
</Directory>
Like I said this used to work the way I wanted with RHEL3 and an older
version of mod_authz_ldap, can anyone point the way for me? Now with
FC6 and the authz_ldap that comes with it, I get the error in the
httpd_error.log:
[error] [client 10.30.0.200] PAM: user 'test' - invalid account:
Permission denied
Now, it only works when I add the FQDN for the WWW server to the users
hosts attribute. But then the user can SSH to the server also (which I
don't want).
Also asking a second question, can you use hostobject or account with
groups in order to restrict logins using pam_check_host_attr?
I thank you in advance for any pointers, suggestions, or kicks to the
head that will help me resolve my problem.
--
Brian Kosick
16 years, 2 months
[Fedora-directory-users] FDS, SNMP & Cacti...
by HAWKER, Dan
Hi All,
Am in the process of setting up some monitoring for my two FDS (1.0.2)
boxes. We mostly use Nagios & Cacti for these kinds of things.
Nagios is done, however am about to start Cacti and hance SNMP). Reading the
RedHat docs, it seems FDS can use SNMP (cool), so it *should* be fairly
simple.
Have had a quick surf and there are couple of OpenLDAP and SunOne DS
templates out there I can use as a starting point, but nothing specifically
for FDS.
So am wondering if anyone has done so before and has a handy Cacti data
query/template they'd like to share, before I go ahead and start making a go
of it myself. Am only really after some simple stats like no of
transactions, throughput, response time, etc.
TIA
Dan
--
Dan Hawker
Linux System Administrator
Astrium
--
This email (including any attachments) may contain confidential and/or privileged information or information otherwise protected from disclosure.
If you are not the intended recipient, please notify the sender immediately, do not copy this message or any attachments and do not use it for any purpose or disclose its content to any person, but delete this message and any attachments from your system.
Astrium disclaims any and all liability if this email transmission was virus corrupted, altered or falsified.
---------------------------------------------------------------------
Astrium Limited, Registered in England and Wales No. 2449259
Registered Office: Gunnels Wood Road, Stevenage, Hertfordshire, SG1 2AS, England
16 years, 2 months
[Fedora-directory-users] LDIF modify syntax
by Kyle Tucker
Hi all,
Simple issue here perhaps. I had set up my LDIF
files like this example (variables get set of course) to
change a users shadowAccount password under FDS 1.0.4 and
all my updates seem to work just fine using ldapmodify.
dn: uid=$UID, ou=People, $DNDOMAIN
changetype: modify
shadowLastChange: $TODAY
userPassword: $PWHASH
But recent research into LDIF revealed that the proper way
to update attributes is using this "replace" method.
dn: uid=$UID, ou=People, $DNDOMAIN
changetype: modify
replace: shadowLastChange
shadowLastChange: $TODAY
dn: uid=$UID, ou=People, $DNDOMAIN
changetype: modify
replace: userPassword
userPassword: $PWHASH
Are both legal or permitted or did I just get lucky or is it
not really doing what I think? All ldapsearch results look the
same after using either?
--
- Kyle
16 years, 3 months
[Fedora-directory-users] New install with Admin Server issues
by Duncan McGreggor
Hey all,
I'm having some troubles with the Admin Server (web). First, some
details:
* This is my first experience with FDS
* I'm running Debian and followed the install instructions here:
http://directory.fedora.redhat.com/wiki/Howto:DebianUbuntu
* I created/installed the debian package from fedora-
ds-1.0.4-1.RHEL3.i386.opt.rpm
* I can run the java console application, login, create entries, etc.
* I'm a python coder, not a java one, so I have no idea about the
java stuff.
Here are the issues I am seeing:
1) clicking on the "help" buttons on the java console results in a
download dialog with the following message:
The file "help" is of type application/octect-stream...
2) Clicking the "Restart" button (admin tasks) on the java console
results in a 404
3) Attempting to visit the url http://myhost:62332/ results in a
download dialog
4) If I download the file, open it and read it, it's a binary file.
The file begins with the following:
ELF
16 years, 3 months
Re: [Fedora-directory-users] Can't connect to admin server as Directory Manager
by Bob Rossi
Could it be uninterruptible sleep? Just think about it.
> On Sat, Dec 23, 2006 at 05:18:42AM -0500, Mike Mueller wrote:
> > I just did a fresh install of FDS 1.0.4 on a Gentoo Linux workstation
> > (built manually, not from RPM). After running the setup script to
> > install it, everything appears to be working, except I can't login to
> > the admin console. I can connect to the server via the web browser on
> > my admin port (9419) and authenticate fine there.
> >
> > However, when I start the console up, I do:
> >
> > User ID: cn=Directory Manager
> > Password: <my password>
> > Administration URL: http://hostname.domain.com:9419/
> >
> > The dialog that I get says:
> >
> > "Cannot logon because of an incorrect User ID,
> > Incorrect password or Directory problem.
> >
> > HttpException
> > Response: HTTP/1.1 401 Authorization Required
> > Status: 401
> > URL: http://hostname.domain.com:9419/admin-serv/authenticate"
> >
> > I made sure that the admin server isn't configured to block any hosts
> > or IP addresses (set them both to '*' in the local.conf file).
> >
> > Here's what the error log says:
> >
> > [Sat Dec 23 05:09:46 2006] [notice] [client 192.168.2.1]
> > admserv_host_ip_check: ap_get_remote_host could not resolve
> > 192.168.2.1
> > [Sat Dec 23 05:09:46 2006] [error] [client 192.168.2.1] user
> > cn=Directory Manager not found: /admin-serv/authenticate
> >
> > How could the "cn=Directory Manager" user be not found? Doesn't it
> > always exist? Yes, I used the default name for this user when I ran
> > setup.
> >
> > Any input would be appreciated!
> >
> > Thanks,
> > Mike
>
16 years, 3 months
[Fedora-directory-users] FDS dies on SSL - How do I rescue installation?
by Ian Holroyd
I have been setting up Fedora Directory Server for use with Samba PDC
etc. I had most aspects of this working, with SSL transport operating
correctly, having followed the HowTo.
However, I have now restarted whole system and the start-slapd will not
work, generating the following errors: (retyped as email sent from
another system, excuse any typos)
[timestamp] - SSL alert: Security Initialization: Can't find certificate
(Server-Cert) for family cn=RSA,cn=encryption,cn=config (Netscape
Portable Runtime error -8174 - security library: bad database.)
[timestamp] - SSL alert: Security Initialization: Unable to retrieve
private key for ert Server-Cert of family cn=RSA,cn=encryption,cn=config
(Netscape Portable Runtime error -8174 - security library: bad
database.)
[timestamp] - SSL failure: None of the cipher are valid
Now, if (big if) I am reading this correctly, this means that it has
failed to find the certificate named Server-Cert. I believe that this
may be as a result of me having 'used my initiative' and changed all
references to 'Server-Cert' in the HowTo to a personalised version of
this (i.e. I created the certs with my own names).
Start-admin fails without leaving any message (I assume because it can't
read config information from the LDAP server).
The problem, however, is that ALL documentation I have found on how to
solve problems like this (or indeed delete and start over) refers to
either using the console (which I cannot start without my slapd-instance
running) or utilities like certutil which appear to fail for the same
reason.
If I understand this correctly, I am in a catch22 - I cannot start the
LDAP server until I change the config, but I cannot change the config
without the LDAP directory being available. So, is there ANY way to
start FDS without SSL support (which I don't need right now anyway!) so
that I can put-right the damage I have done by following the HowTo
properly this time??? If not, is there any way to reinstall /
reconfigure without scrapping my data (which took some time to build).
Thanks for any thoughts,
Ian Holroyd
16 years, 3 months