[Fedora-directory-users] Problem running console on Windows
by Glenn
I'm trying to get the Fedora DS 1.0.4 console working on a Windows computer,
using the instructions in the Howto. When I try to start the console, I get
this error message:
Exception in thread "main" java.lang.NoClassDefFoundError:
com/netscape/management/client/console/Console
Any idea what could cause this? Thanks. -Glenn.
17 years
[Fedora-directory-users] Replica has no update vector . . . .
by Glenn
When I get Windows Sync running between Fedora Directory Server 1.0.3 and
Active Directory on a Windows 2003 server, it logs an error message every
four seconds: "Replica has no update vector. It has never been
initialized." I've tried restarting the directory server and the admin
server, and I've tried initiating a full resyncronization, but the error
messages continue.
Also, in case it is related, I've noticed that out of 600 or so users in the
Fedora directory, only five have replicated to the AD server.
Hoping someone can tell me how to get this working. Thanks. -G.
17 years
[Fedora-directory-users] TLS issues during screen lock
by Brian Zuromski
Hello,
I'm having an issue with TLS certificates. On the client
side, it seems that when I have TLS enabled it works fine. When I
screen lock the computer, I have to disable TLS to get back in. Has
anyone else experienced this before?
Thanks,
--
--
Brian Z.
17 years
[Fedora-directory-users] ssl certificate problem
by Paolo Ercolani
Hi. I'm new to this list and it's a week i'm really fighting with
directory server. I followed some howtos, i downloaded a lot of
documents but i can't get out of trouble.
I need to make login from my linux boxes on ldap directory server. If i
try to use my test user in clear mode i can do that. The problem is when
i try to configure a self-signed certificate. I'll not describe all the
tests i've done, i'll tell you just the last!!
I created my cacert.pem on the ldapserver and i installed from the
console. It goes and it's ok. Then i used openssl to generate a private
key and a certificate request then i signed it. That's what i did:
openssl genrsa -out privkey.pem 2048
openssl req -new -key privkey.pem -out PEM.csr
openssl ca -cert cacert.pem -in PEM.csr -out cert.pem
I copied cacert.pem, privkey.pem and cert.pem on the client and i
configured ldap.conf on it:
URI ldaps://<ldapserver>:636
BASE ou=UTENTI,o=postel,c=com
host kingu.postel.com
TLS_REQCERT allow
TLS_CHECKPEER yes
TLS_CACERTDIR /etc/ssl
TLS_CACERT /etc/ssl/cacert.pem
TLS_CERT /etc/ssl/cert.pem
TLS_KEY /etc/ssl/privkey.pem
I activated ssl on my ldap server and i installed my cacert.pem on it. i
didn't anything else.
I tried also to generate a certificate request from directory server and
to sign it with my cacert.pem. Then i imported it like my server-cert.
It imported it but login still didn't go.
I followed the manuals i found on directory.fedora.org (managing SSL and
SASL), but i saw a lot of documents too.
I think logs say nothing bad. That's my access log:
/
/
/[10/Apr/2007:14:59:54 +0200] conn=15 fd=65 slot=65 SSL connection
from <ldap client> to <ldap server>/
/[10/Apr/2007:14:59:54 +0200] conn=15 SSL 256-bit AES/
/[10/Apr/2007:14:59:54 +0200] conn=15 op=0 BIND dn="" method=128
version=3/
/[10/Apr/2007:14:59:54 +0200] conn=15 op=0 RESULT err=0 tag=97
nentries=0 etime=0 dn=""/
/[10/Apr/2007:14:59:54 +0200] conn=15 op=1 SRCH
base="ou=UTENTI,o=postel,c=com" scope=2
filter="(&(objectClass=posixAccount)(uid=utente))" attrs="uid
userPassword uidNumber gidNumber cn homeDirectory loginShell gecos
description objectClass"/
/[10/Apr/2007:14:59:54 +0200] conn=15 op=1 RESULT err=0 tag=101
nentries=1 etime=0/
/[10/Apr/2007:14:59:56 +0200] conn=15 op=2 SRCH
base="ou=UTENTI,o=postel,c=com" scope=2
filter="(&(objectClass=posixAccount)(uid=utente))" attrs="uid
userPassword uidNumber gidNumber cn homeDirectory loginShell gecos
description objectClass"/
/[10/Apr/2007:14:59:56 +0200] conn=15 op=2 RESULT err=0 tag=101
nentries=1 etime=0/
/[10/Apr/2007:14:59:56 +0200] conn=15 op=3 SRCH
base="ou=UTENTI,o=postel,c=com" scope=2
filter="(&(objectClass=shadowAccount)(uid=utente))" attrs="uid
userPassword shadowLastChange shadowMax shadowMin shadowWarning
shadowInactive shadowExpire shadowFlag"/
/[10/Apr/2007:14:59:56 +0200] conn=15 op=3 RESULT err=0 tag=101
nentries=1 etime=0/
/[10/Apr/2007:14:59:56 +0200] conn=15 op=4 SRCH
base="ou=UTENTI,o=postel,c=com" scope=2
filter="(&(objectClass=posixAccount)(uid=utente))" attrs="uid
userPassword uidNumber gidNumber cn homeDirectory loginShell gecos
description objectClass"/
/[10/Apr/2007:14:59:56 +0200] conn=15 op=4 RESULT err=0 tag=101
nentries=1 etime=0/
/[10/Apr/2007:14:59:56 +0200] conn=16 fd=66 slot=66 SSL connection
from <ldap client> to <ldap server>/
To me it seems it says nothing bad. I can't get out of it and i don't
understand what is wrong. The directory server version is 1.0.4. I
installed it from RPM on redhat enterprise 4.
If i try to log on URI ldap://<ldapserver> (not ssl !!) it goes and i
can authenticate using ldap!!!
Anyone can help me, please???
Thanks everyone.
Paolo.
--
Paolo Ercolani
Postel
Gestione Servizi e Accessi Telematici
Erogazione Servizi e Gestione Infrastrutture Mass Communication
Viale Guglielmo Massaia 31 – 00154 Roma
Tel 06 51426 549 Fax 06 51426 553
e-mail: paolo.ercolani(a)postel.com
17 years
[Fedora-directory-users] Errors in error log on startup
by Philip Kime
Starts up ok (although last week, twice it says it started but the
server wasn't talking LDAP at all and the load-balancer ignored it for a
day) ... are these anything to worry about?
[09/Apr/2007:03:30:24 -0700] - attrcrypt_unwrap_key: failed to unwrap
key for ci
pher AES
[09/Apr/2007:03:30:24 -0700] - Failed to retrieve key for cipher AES in
attrcryp
t_cipher_init
[09/Apr/2007:03:30:24 -0700] - Failed to initialize cipher AES in
attrcrypt_init
[09/Apr/2007:03:30:24 -0700] - attrcrypt_unwrap_key: failed to unwrap
key for ci
pher AES
[09/Apr/2007:03:30:24 -0700] - Failed to retrieve key for cipher AES in
attrcryp
t_cipher_init
[09/Apr/2007:03:30:24 -0700] - Failed to initialize cipher AES in
attrcrypt_init
PK
--
Philip Kime
NOPS Systems Architect
310 401 0407
17 years
[Fedora-directory-users] Error viewing Encryption settings tab
by Philip Kime
When I click the Encryption tab in the Configuration page for one of our
FDS 1.0.2 servers, I get this popup error:
org.mozilla.jss.ssl.SSLSocketException: Unable to connect (-5981)
Connection refused by peer
And the cipher/cert section is missing on the page after I click OK on
this dialog. We had some issues with this server recently, refusing to
serve LDAP after its nightly restarts. Any ideas?
PK
--
Philip Kime
NOPS Systems Architect
310 401 0407
17 years
RE: [Fedora-directory-users] TLS issues during screen lock
by Brian Zuromski
Rich,
No, I'm not using client based auth with this setup. I am sharing out the server certificate to the network client.
Date: Tue, 10 Apr 2007 08:35:00 -0700
From: Rich Megginson <rmeggins(a)redhat.com>
Subject: Re: [Fedora-directory-users] TLS issues during screen lock
To: "General discussion list for the Fedora Directory server project."
<fedora-directory-users(a)redhat.com>
Message-ID: <461BAEA4.5080708(a)redhat.com>
Content-Type: text/plain; charset="iso-8859-1"
Brian Zuromski wrote:
> > Hello,
> > I'm having an issue with TLS certificates. On the client
> > side, it seems that when I have TLS enabled it works fine. When I
> > screen lock the computer, I have to disable TLS to get back in. Has
> > anyone else experienced this before?
>
Are you using client cert based auth?
> >
> > Thanks,
> >
>
--
--
Brian R. Z
17 years
[Fedora-directory-users] FDS-ADS Sync
by Kris S. Amundson
So I got the Windows Sync Agreement working.
Windows side:
cn=Users,dc=foo,dc=org
FDS side:
ou=Users,l=Portland,c=US,dc=foo,dc=org
SSL certs are properly exchanged between the two, user passwords sync
correctly, and accounts removed or added on either side are sync'd
correctly.
Then suddenly less than 24hrs later, users on the ADS side suddenly
start being removed from email distribution groups. Client panics and
shuts down the FDS server, which appears to be the only change in the
last few days. The accounts had been stable for much time.
Aside from asking the obvious of what would cause this, I'm curious
where I should start hunting (log level tweaks.. ADS logs, etc).
Here are some errors I found on the ADS side. These might be the client
correcting the errors, not the original error itself:
errors:[04/Apr/2007:09:44:53 -0700] - add value
"uid=Finintern,ou=Users,l=Portland,c=US, dc=foo,dc=org" to
attribute type "uniqueMember" in entry
"cn=FINANCE,ou=Users,l=Portland,c=US, dc=foo,dc=org" failed:
value exists
errors:[04/Apr/2007:10:54:53 -0700] - add value
"uid=Finintern,ou=Users,l=Portland,c=US, dc=foo,dc=org" to
attribute type "uniqueMember" in entry
"cn=MAS90,ou=Users,l=Portland,c=US, dc=foo,dc=org" failed: value
exists
errors:[04/Apr/2007:11:54:53 -0700] - add value
"uid=sharrison,ou=Users,l=Portland,c=US, dc=foo,dc=org" to
attribute type "uniqueMember" in entry "cn=Raisers
Edge,ou=Users,l=Portland,c=US, dc=foo,dc=org" failed: value exists
--
Kris S. Amundson
Founder, CIO GPG Key: D6D39F2C
OpenSourcery, LLC. http://www.opensourcery.com/
17 years
[Fedora-directory-users] PassSync and SSL
by Dennis Crissman
I am experimenting with Fedora Directory Server and trying to hook up
PassSync to synchronize with Active Directory. I have found a walk
through on how to set this up
(http://directory.fedoraproject.org/wiki/Howto:WindowsSync#Configuring_Pas...),
but it seems to require using SSL. Is there a way to set this up without
SSL for quick testing.
Thanks,
Dennis
--
The sender of this email subscribes to Perimeter Internetworking's email
anti-virus service. This email has been scanned for malicious code and is
believed
to be virus free. For more information on email security please
visit:
http://www.perimeterusa.com/email-defense-content.html
This communication is
confidential, intended only for the named recipient(s)
above and may contain trade secrets
or other information that is exempt from
disclosure under applicable law. Any use,
dissemination, distribution or
copying of this communication by anyone other than the named
recipient(s) is
strictly prohibited. If you have received this communication in error,
please
delete the email and immediately notify our Command Center at 203-541-3444.
17 years