389-users March 2007

389-users@lists.fedoraproject.org

59 participants
64 discussions

[Fedora-directory-users] Comments on the setupssl.sh enabling SSL script
by Andy Schofield 30 Mar '07

30 Mar '07

Well, I have succeeding in getting SSL going and the howto is very helpful for this: http://directory.fedora.redhat.com/wiki/Howto:SSL and in particular the script: setupssl.sh http://directory.fedora.redhat.com/download/setupssl.sh In doing so I came across a number of gotchas which might help others. (1) The script uses "ldapmodify" from the openldap-clients package and not from the fedora-ds/shared/bin supplied one. The options are different and ldapmodify needs to be in the path. I've no idea why. (2) The script almost does everything for you. In particular you will find in /opt/fedora-ds/alias the cacert.asc file which you need to give to the clients. You do not need to export it which was just as well as the command given in the howto did not work for me. (3) The default names of the certificates are not correct if you want to ensure that the administrator console is encrypted too. You need to cd /opt/fedora-ds/alias cp admin-serv-serverID-cert8.db admin-serv-hostname-cert8.db cp admin-serv-serverID-key3.db admin-serv-hostname-key3.db where you replace serverID by your serverID name and hostname by the first part of your hostname. If I was confident that these points were not my mistakes, or were peculiarities of my setup then I'd update the wiki. Andy

1 0

[Fedora-directory-users] Failover between masters
by Coe, Colin C. (Unix Engineer) 30 Mar '07

30 Mar '07

Hi all We are currently using Sun's Directory server and have had some problems with clients failing over to the other master if one fails. The clients are a minxute of RHEL 3 WS and Solaris 8 (SPARC), and the Sun Directory servers are both Solars 9 (SPARC) running Directory One 5.1. /etc/ldap.conf host 1.1.1.1 2.2.2.2 port 636 ldap_version 3 base o=unix,dc=company,dc=com scope sub timelimit 5 bind_timelimit 3 ssl on pam_filter objectclass=posixAccount pam_login_attribute uid pam_member_attribute memberUid pam_password crypt idle_timelimit 3600 /etc/openldap/ldap.conf BASE o=unix,dc=company,dc=com HOST ldap1.company.com ldap2.company.com PORT 636 SASL_SECPROPS "noanonymous,noplain" SIZELIMIT 0 TIMELIMIT 0 DEREF never TLS_CACERT /etc/ssl/ldap/cacert.pem TLS_REQCERT demand We're using the bog standard nscd daemons provided by the OS vendors. We also use IDSync to synchronise user passwords from AD to LDAP but not from LDAP to AD. What we're finding is if ldap1 dies for some reason, the clients don't failover to ldap2. We don't know if the problem is client side or server side. Would Fedora Directory Server, set up in a similar manner, also not failover properly? While we're prepared to look at Fed DS, there is a feeling that it too will behave in the same manner, given they are both forks of the same project. Comments? Thanks CC NOTICE: This email and any attachments are confidential. They may contain legally privileged information or copyright material. You must not read, copy, use or disclose them without authorisation. If you are not an intended recipient, please contact us at once by return email and then delete both messages and all attachments.

5 6

[Fedora-directory-users] Fedora Directry as a domain controller
by Peter Biggerstaff 30 Mar '07

30 Mar '07

Is it possible to use Fedora DS as a windows PDC? so I can manage windows and Linux clients from the same directory? Kind Regards, Peter Biggerstaff Linux Desktop Development Specialist P 09 276 00 00 F 09 276 0256 Ext 2478 M 021 784 167 peter.biggerstaff(a)healthalliance.co.nz www.healthalliance.co.nz healthAlliance New Zealand - = Visit the HealthAlliance website at http://www.healthalliance.co.nz = - This e-mail message and any accompanying attachments may contain information that is confidential and subject to legal privilege. If you are not the intended recipient, do not read, use, disseminate, distribute or copy this message or attachments. If you have received this message in error, please notify the sender immediately and delete this message.

2 1

[Fedora-directory-users] Suse client PAM setting
by Diwakoe 30 Mar '07

30 Mar '07

Dear all, I'm new using FDS, right now the server is used for Global Address List for thunderbird, and I want to expand for central login with suse client. Could you please give me some hint how to configure my suse 10.1 as client can login using FDS on FC6. Any help is appreciated. Regards, Diwa

1 0

[Fedora-directory-users] How to change password storage method?
by Andy Schofield 29 Mar '07

29 Mar '07

I must be missing something here but I tried following the instructions here http://www.csse.uwa.edu.au/~ashley/fedora-ds/fedora-ds-26072006.html but to no avail. I want the passwords for all Users in People to be stored in md5. Everything I have done (like selecting a user and "Managing passwords" leaves them in SSHA which is presumably some default. My real problem is that clients are broadcasting passwords in the clear (despite pam being told to use md5 with ldap). I am assuming that is because the ldap server is using SSHA and pam is using md5 so they negotiate to send passwords in the clear. Does that sound right? Thanks Andy

4 6

[Fedora-directory-users] samba CTRL ALT DEL password sync problem
by Stephane ARMANET 29 Mar '07

29 Mar '07

2 1

[Fedora-directory-users] Trying to set up a simple authentication and file server
by Andy Schofield 28 Mar '07

28 Mar '07

Please excuse the obvious newbie posting: I am struggling to get my head round fedora-ds and what I am trying to do must be so standard. I am trying to set up a simple server for about 20 users that allows clients running Redhat Enterprise 4 to authenticate over ldap and find the automounter map which tells them how to automount a users home space. We are moving from a solaris NIS server which from a clients perspective is trivial to setup: you just run system-config-authentication + enable "configure NIS" + fill in the NIS domain and the NIS server and it just works. Running system-config-authentication also has an option to enable "configure LDAP" where you fill in the LDAP Search Base DN and the LDAP Server. I would like to create the server that will respond appropriately. So my questions: (1) Is fedora-ds the right tool for the job? Perhaps it is using a sledgehammer to crack a nut. (2) I've more or less got the authentication bit working but the console seems counter intuitive. The opening screen has a tab "Users and Group" which allows you to search and add users but this, as far as I can see, as nothing to do with the users that the server will authenticate. They need to be added way down the tree, by opening the Directory Server, choosing the suffix and rightclicking the "People" and adding new. Is this the correct method of adding users? (I don't want to import them from the passwd file - there are so few of them I want to do things by hand). (3) How do I add the automap? Various websites talk about "automountInformation:" entry, but where does that come in? It does not appear as an attribute I can add to a person. (4) Does anyone know of a simple walk-through documentation to do this as I am surely not the first person to try and do this with FDS? Thanks for your help Andy

3 3

[Fedora-directory-users] Conditional Cos/Roles?
by Philip Kime 28 Mar '07

28 Mar '07

Is it possible to do this - Include a user in a dynamic group/assign a role/add a CoS attribute if some arbitrary other attribute contains the uid? I can't quite see a way to do this. I have a load of nisnetgrouptriple attributes containing usernames in the form "(,uid,)" and I need to make a dynamic group or add a CoS attribute to enable a NIS unware app to check basic netgroup membership - everything just seems to fall short of being able to do this. PK -- Philip Kime NOPS Systems Architect 310 401 0407

2 1

[Fedora-directory-users] How to disable anonymous bind to LDAP?
by Ankur Agarwal 28 Mar '07

28 Mar '07

Hi, Would like to know how to disable anonymous bind? Is there any configuration level change to be done? regards, Ankur --------------------------------- Never miss an email again! Yahoo! Toolbar alerts you the instant new Mail arrives. Check it out.

2 1

[Fedora-directory-users] How to disable anonymous bind to LDAP?
by Ankur Agarwal 28 Mar '07

28 Mar '07

Hi, Would like to know how to disable anonymous bind? Is there any configuration level change to be done? regards, Ankur --------------------------------- Don't be flakey. Get Yahoo! Mail for Mobile and always stay connected to friends.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users March 2007