389-users April 2007

389-users@lists.fedoraproject.org

50 participants
57 discussions

[Fedora-directory-users] What is syncronized?
by Dennis Crissman 13 Jul '07

13 Jul '07

The name PassSync would indicate that this utility synchronizes passwords, can anything else be sync'd? I need to be able to sync all of the following: users, groups, systems, email addresses, and passwords, etc. Can PassSync do all that? If not is there another utility you might recommend, either using FDS or not? -- The sender of this email subscribes to Perimeter Internetworking's email anti-virus service. This email has been scanned for malicious code and is believed to be virus free. For more information on email security please visit: http://www.perimeterusa.com/email-defense-content.html This communication is confidential, intended only for the named recipient(s) above and may contain trade secrets or other information that is exempt from disclosure under applicable law. Any use, dissemination, distribution or copying of this communication by anyone other than the named recipient(s) is strictly prohibited. If you have received this communication in error, please delete the email and immediately notify our Command Center at 203-541-3444.

2 5

[Fedora-directory-users] Automatically inactivate accounts after a certain time or on a certain date?
by Philip Kime 23 May '07

23 May '07

It looks like this isn't possible at the moment as this plug-in seems to still be in development: http://directory.fedoraproject.org/wiki/Account_Policy_Design Or is there a neat way with roles? It seems tricky, even with a filtered role. PK -- Philip Kime NOPS Systems Architect 310 401 0407

3 3

[Fedora-directory-users] fds 1.0.4 on Gentoo 64-bit
by David Stutzman 01 May '07

01 May '07

I have built and installed fedora-ds 1.0.4 twice now using the dsbuild script. Once with a jdk of 1.5.0.11 (64bit) and once with a jdk of 1.4.2.03 (64bit). The ds builds fine, I run the setup and go through the wizard, everything is installed, started up and running. When I try to connect using the console I get: "Cannot connect to the directory server: netscape.ldap.LDAPException: error result (32); No such object" I then look in the access log of the ldap server and see: [27/Apr/2007:10:42:13 -0400] conn=7 fd=65 slot=65 connection from 192.168.1.162 to 192.168.1.222 [27/Apr/2007:10:42:13 -0400] conn=7 op=0 BIND dn="(null)" method=128 version=3 [27/Apr/2007:10:42:13 -0400] conn=7 op=0 RESULT err=32 tag=97 nentries=0 etime=0 I know that what is *supposed* to be in the BIND dn field is more along the lines of: [27/Apr/2007:10:34:29 -0400] conn=135705 fd=76 slot=76 connection from 192.168.1.162 to 192.168.1.121 [27/Apr/2007:10:34:29 -0400] conn=135705 op=0 BIND dn="uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot" method=128 version=3 [27/Apr/2007:10:34:29 -0400] conn=135705 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot" It seems like the java console is not properly passing the uid that I type into the console login to the directory server. I have attempted to login both locally on the server (again with system vm JDK 1.5 and with the whole thing rebuilt using 1.4.2) and get the same error. I also am using a remote console on a windowsxp machine (that works fine going to my other FDS server, running fedora os, 1.0.2 @ 192.168.1.121) and get the error. I am using the system versions of net-snmp and cyrus-sasl which are: net-analyzer/net-snmp-5.4 dev-libs/cyrus-sasl-2.1.22-r2 All the other deps are: dev-lang/perl-5.8.8-r2 (URI 1.35) dev-util/cvs-1.12.12-r4 sys-devel/make-3.81 app-arch/tar-1.16.1 app-arch/gzip-1.3.11 app-arch/zip-2.31-r1 net-www/apache-2.0.58-r2 dev-java/ant-core-1.6.5-r14 Back when Fedora DS 1.0.2 was the current version I successfully built and installed it on a 64-bit gentoo system and home and everything is working great. I imagine 1.0.4 doesn't like a newer version of one of the system utils/libraries? I know the ldap server is functioning properly: # cd /opt/fedora-ds/shared/bin # ./ldapsearch -b o=netscaperoot -D "cn=directory manager" -w password "objectclass=nsAdminConfig" dn Gives me: version: 1 dn: cn=configuration, cn=admin-serv-mbn, cn=Fedora Administration Server, cn=S erver Group, cn=mbn.pki, ou=pki, o=NetscapeRoot Any help would be much appreciated. Thanks, Dave

1 1

[Fedora-directory-users] I have 2 masters in MM mode- how do I add a 3rd and 4th?
by Dave Augustus 01 May '07

01 May '07

Currently, I have 2 FDS in production in Multimaster mode. I want to bring 2 more up as well and put them at a remote site so eventually they will replicate via WAN. Then I will have 2 sets of my data- one at each location. So I plan to bring up 2 new servers in MMR mode with the first 2 servers. Once they are synced up I would then move the new ones to the remote site and use SSH tunnels to re-establish the replication connection. Can someone chime in on the viability of this? Is this possible? What are the steps? I have looked and have not found anything yet. Any help appreciated. Thanks, Dave

4 7

[Fedora-directory-users] Fedora Directory Service and Java error
by BAPPA MALLICK 30 Apr '07

30 Apr '07

Dear List, I am very new in FDS and install my first FDS server on my RHEL-4 ES system. The installation goes smooth and I am able to start the FDS and Administration server. But the problem arises when I try to open FD console, I have googled net and found one related topic at "http://fedoranews.org/mediawiki/index.php/JPackage_Java_for_FC4". But I found the instruction is premative and all the specified files are not there. Below is the screen dump of the error I am getting. If you please give me the detail instruction, it will be a lifesaver for me. ======================================================= Warning: -ms8m not understood. Ignoring. Warning: -mx64m not understood. Ignoring. Exception in thread main java.lang.NoSuchMethodError: method com.netscape.mana gement.client.util.RemoteImage.setImage was not found. at _Jv_ResolvePoolEntry(java.lang.Class, int) (/usr/lib/libgcj.so.5.0.0) at com.netscape.management.client.util.RemoteImage.RemoteImage(java.lang.Stri ng) (Unknown Source) at com.netscape.management.nmclf.SuiLookAndFeel.initComponentDefaults(javax.s wing.UIDefaults) (Unknown Source) at com.netscape.management.nmclf.SuiLookAndFeel.getDefaults() (Unknown Source ) at javax.swing.UIManager.put(java.lang.Object, java.lang.Object) (/usr/lib/li bgcj.so.5.0.0) at com.netscape.management.client.components.FontFactory.initializeLFFonts() (Unknown Source) at com.netscape.management.client.console.Console.common_init(java.lang.Strin g) (Unknown Source) at com.netscape.management.client.console.Console.Console(java.lang.String, j ava.lang.String, java.lang.String, java.lang.String, java.lang.String, java.lang .String) (Unknown Source) at com.netscape.management.client.console.Console.main(java.lang.String[]) (Unknown Source) ======================================================= Regards, Tapas Mallick bappa_tapas(a)yahoo.com tapas.mallick(a)gmail.com __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

[Fedora-directory-users] Issues with TLS, password modify operation, and password expiration
by François Beretti 30 Apr '07

30 Apr '07

Hi, I am implementing password policy in my LDAP-based software. When using Fedora DS I encountered several problems (or questions) : 1) when password expired, no request other than modifying its userPassword attribute is allowed. Two requests would have been usefull in my opinion : * Start TLS : I want to enable TLS just before changing my password, but : - Start TLS is not allowed, since it is not the only allowed modify request on userpassword - After Start TLS (when the password is not expired), it seems that the connection become sometimes anonymous, and needs a new bind. I thought only the Stop TLS operation must disable the authentication on the LDAP connection * Password Modify Extended operation : I just thought it would be a good idea to use it to change a password, but it is not allowed 2) when changing the password using a standard ldap modify request, if I send two modify operations in the same request, the first one to remove the old password and the second one to add the new password, do I need to hash the old password for it to be in the same format than in the directory ? 3) when using the Password Modify Extended operation, then at the next logon the server requires the user to change its password ! So I definitly can't use this operation on a server implementing password policy. I believe that in the Fedora DS password policy code this operation is only seen as an administration request, not intended to be done by a user : it is handled as a "force password" request, not a "change password" request. 4) I use the Novell LDAP client API. Any call to ldap_stop_tls_s blocks the calling thread. I don't know if it comes from the server, the client API, or both. It is not too bad since I can just call ldap_unbind and ldap_init instead. François

2 3

[Fedora-directory-users] Winsync - repeating password synchronization
by Dans 30 Apr '07

30 Apr '07

Hey, I have problem with password's synchronization between Fedora Directory Server (1.0.4) and Active Directory (2003). I read wiki (Howto:WindowsSync) and setup up synchronization arrangement. Without PassSync everything is ok. I can synchronize users both ways from AD -> FDS and FDS-> AD. But if I install PassSync I can notice strange behavior: 1. I change user's password in FDS 2. Password is populated to AD 3. !!! PassSync recognize that password was changed !!! 4. PassSync populate password to FDS 5. FDS recognize that password was changed and realize step 2 - and it's repeating ! Anybody has any idea what is wrong ? Dans

3 2

[Fedora-directory-users] Problem with Admin Console failover using FedoraDS
by Kyley Engle 27 Apr '07

27 Apr '07

Hello, I am having problems with the admin-serv when doing failure testing in my multi-master environmnet. What I have: 2 masters replicating the userRoot and NetscapeRoot directories various hub and consumer/search servers When I installed the instances on each of these servers, i pointed them at one of the masters, let's call it primary-master, for it's configuration directory. when both masters are up and running, i can connect my admin consoel to either directory and manage my fleet of servers While doing failure mode testing, I discovered that if the primary-master was turned off, that the secondary master admin-serv would not start properly. it gives the following in /opt/fedora-ds/admin-serv/logs/error: [Tue Apr 24 20:37:36 2007] [crit] mod_admserv_post_config(): unable to build user/group LDAP server info: unable to set User/Group baseDN Configuration Failed I followed the instructions found here: http://directory.fedoraproject.org/wiki/Howto:AdminServerLDAPMgmt#How_to_ch… to change the admin server running on secondary-master to point to itself instead of to the primary master. this did not resolve the issue. Has anyone out there gotten the configuration directory successfully working in a failover capacity in a multi-master environment? ke _________________________________________________________________ The average US Credit Score is 675. The cost to see yours: $0 by Experian. http://www.freecreditreport.com/pm/default.aspx?sc=660600&bcd=EMAILFOOTERAV…

2 6

[Fedora-directory-users] Re: Issues with TLS, password modify operation, and password expiration
by Philip Kime 27 Apr '07

27 Apr '07

As I remember, we had this problem with password policies and exop - doing password resets via exop would only see a global password policy and nothing more fine-grained. I believe this was logged as a bug in FDS against <= 1.0.4. Since were are using SSL for all connections, we switched to clear passwords and it all worked.

1 0

[Fedora-directory-users] Previous password still works?
by Chris Halstead 27 Apr '07

27 Apr '07

Hi folks, I've been googling 'til my eyes bleed but I can't find anything on this. We're using FDS 1.0.2 and I recently used the admin console (logged in as myself, not as the admin account) to change my personal account password. The new password worked, so far so good. The problem is that my *old* password still worked as well. Everywhere. Login through PAM, login to the FDS admin console, you name it. After doing some testing I've found that if I change my password logged in as myself the old password will still work, yet if I change it logged in with our admin user account only the new one works. What am I missing? I was planning on putting together a web-form for user password changes (using the user's credentials to bind), but if user password changes won't invalidate old passwords I'm going to have to change my approach. -chris

4 12

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users April 2007