389-users February 2008

389-users@lists.fedoraproject.org

59 participants
100 discussions

[Fedora-directory-users] About Netgroup??
by Singh Raina, Ajeet 18 Feb '08

18 Feb '08

Hi Rich, I have followed the doc Howto: Netgroup and just for testing created netgroup.ldif for two entries: dn: cn=QASystems,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: QASystems nisNetgroupTriple: (BL60ACLS,,im.logica.com) nisNetgroupTriple: (pem,,im.logica.com) dn: cn=QAUsers,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: QAUsers nisNetgroupTriple: (,bobby,im.logica.com) nisNetgroupTriple: (,joey,,im.logica.com) I did imported into Fedora DS.Now I have few queries. 1. Joey and Bobby : Should I have to create these users ? 2. Are these LDAP users which author is talking about? 3. When I click on netgroup in console it shows no users (same as ou=People).I can only browse through #getent netgroup QAUSers and it works then only. 4. I followed access.netgroup.conf entry as : + : @QaUsers@@QASystems: 10. But Wonder what is this all about Pls Help me with this. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

1 0

[Fedora-directory-users] RE: ACI for Netgroup?????
by Singh Raina, Ajeet 18 Feb '08

18 Feb '08

Further to this , What I attempted is I added a netgroup entry like the same: dn: cn=QAUsers,ou=Netgroup,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: QAUsers nisNetgroupTriple: (,bobby,im.logica.com) nisNetgroupTriple: (,joey,im.logica.com) description: All QA users in my organization Next, I created another netgroup QASytsems like this : dn: cn=QASystems,ou=Netgroup,dc=example,dc=com objectClass: nisNetgroup objectClass: top cn: QASystems nisNetgroupTriple: (pem,,im.logica.com) nisNetgroupTriple: (pemy,,im.logica.com) description: All QA systems on our network The above example I took from the same link http://directory.fedoraproject.org/wiki/Howto:Netgroups but couldn't understand further about setting up access.conf..Is this for client or server?Confused !!! I tried this too. Ok...Say, I created a user skour and set up acls on QASystems : ------------------------------------------------------------------------ --------------------------------------- (targetattr = "*") (target = "ldap:///cn=QASystems,ou=netgroups,dc=im,dc=logica,dc=com") (version 3.0;acl "No Access to skour";deny (all)(userdn = "ldap:///uid=skour,ou=People,dc=im,dc=logica,dc=com") and (ip="10.14.242.93");) It should work Right. But when I am trying loggig from 10.14.242.93 system as skour and password it is allowing to login. Any idea why its not working?? ________________________________ From: Singh Raina, Ajeet Sent: Monday, February 18, 2008 10:52 AM To: 'fedora-directory-users(a)redhat.com' Subject: ACI for Netgroup????? My Senior system Admin who has left the organization has NIS configured with /etc/netgroups file. All I can see he has all together 11 entries as netgroups as: ------------------------------------------------------------------------ - File : /etc/netgroups ------------------------------------------------------------------------ - 24 homegrp grp1 homegrp2 25 26 grp1 (bl015470, ,goeast), (bl025470, ,goeast) 27 #homegrp2 bl065470 bl035470 28 29 linux lynx_bm lynx_psa lynx_uic lynx_uone lynx_omg lynx_desk 30 unix (bl015470, ,goeast) (bl025470, ,goeast) (bl035470, ,goeast) (bl 065470, ,goeast) (bl312470, ,goeast) (blrccase, ,goeast) (arsenic, ,goeast) (nio bids, ,goeast) (ogygia, ,goeast) (bl49acls, ,goeast) (bl46acls, ,goeast) (agnes, , goeast) (bl43acls, ,goeast) 31 sun (laurel, ,goeast) (u1-sb01, ,goeast) (BLVM04, ,goeast) (BLVM07, ,goeast) (BLVM08, ,goeast) (BLVM09, ,goeast) (STAMFORD, ,goeast) 32 33 lynx_bm (BL21DL385, ,goeast) 34 lynx_psa (Linuxdev106, ,goeast) (BL48DL385, ,goeast) 35 lynx_uic (bl01ln-dev, ,goeast) (bl02ln-bld, ,goeast) 36 lynx_uone (BLVM01, ,goeast) (BLVM02, ,goeast) (BLVM03, ,goeast) ( BLVM05, ,goeast) (BLVM06, ,goeast) (ccase-u1, ,goeast) 37 lynx_omg (BL14DL385, ,goeast) 38 lynx_desk (agile8, ,goeast) --------------------------------------------------------------- All I did is tried running the migration script simply and imported it to the Fedora DS Database. The excerpt of the ldif file is : ------------------------------------------------------------------------ -- File : netgroup.ldif ------------------------------------------------------------------------ -- dn: cn=homegrp,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: homegrp memberNisNetgroup: grp1 memberNisNetgroup: homegrp2 dn: cn=grp1,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: grp1 nisNetgroupTriple: (bl015470, nisNetgroupTriple: (bl025470, memberNisNetgroup: ,goeast) memberNisNetgroup: ,goeast), dn: cn=linux,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: linux memberNisNetgroup: lynx_bm memberNisNetgroup: lynx_desk memberNisNetgroup: lynx_omg memberNisNetgroup: lynx_psa memberNisNetgroup: lynx_uic memberNisNetgroup: lynx_uone dn: cn=unix,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: unix nisNetgroupTriple: (agnes, nisNetgroupTriple: (arsenic, nisNetgroupTriple: (bl015470, nisNetgroupTriple: (bl025470, nisNetgroupTriple: (bl035470, nisNetgroupTriple: (bl065470, nisNetgroupTriple: (bl312470, nisNetgroupTriple: (bl43acls, nisNetgroupTriple: (bl46acls, nisNetgroupTriple: (bl49acls, nisNetgroupTriple: (blrccase, nisNetgroupTriple: (niobids, memberNisNetgroup: , memberNisNetgroup: ,goeast) memberNisNetgroup: goeast) dn: cn=sun,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: sun nisNetgroupTriple: (BLVM04, nisNetgroupTriple: (BLVM07, nisNetgroupTriple: (BLVM08, nisNetgroupTriple: (BLVM09, nisNetgroupTriple: (STAMFORD, nisNetgroupTriple: (laurel, nisNetgroupTriple: (u1-sb01, memberNisNetgroup: ,goeast) dn: cn=lynx_bm,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: lynx_bm nisNetgroupTriple: (BL21DL385, memberNisNetgroup: ,goeast) dn: cn=lynx_psa,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: lynx_psa nisNetgroupTriple: (BL48DL385, nisNetgroupTriple: (Linuxdev106, memberNisNetgroup: ,goeast) dn: cn=lynx_uic,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: lynx_uic nisNetgroupTriple: (bl01ln-dev, nisNetgroupTriple: (bl02ln-bld, memberNisNetgroup: ,goeast) dn: cn=lynx_uone,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top ------------------------------------------------------- I changed the ou=NetGoup to ou=netgroups as my Directory Server > Directory Tab > im > netgroups folder was there.(Will NetGroup will work?I don't think so) I imported it to fedora DS and it showed no error in that process. The getent netgroup <netgroupname> is also working. Can you help me Now How can I create ACL...Say I have one project named lynx_uone and all I want not to let it to access the other projects.Pls Help me in this regard. Will it work? This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

1 0

[Fedora-directory-users] ACI for Netgroup?????
by Singh Raina, Ajeet 18 Feb '08

18 Feb '08

My Senior system Admin who has left the organization has NIS configured with /etc/netgroups file. All I can see he has all together 11 entries as netgroups as: ------------------------------------------------------------------------ - File : /etc/netgroups ------------------------------------------------------------------------ - 24 homegrp grp1 homegrp2 25 26 grp1 (bl015470, ,goeast), (bl025470, ,goeast) 27 #homegrp2 bl065470 bl035470 28 29 linux lynx_bm lynx_psa lynx_uic lynx_uone lynx_omg lynx_desk 30 unix (bl015470, ,goeast) (bl025470, ,goeast) (bl035470, ,goeast) (bl 065470, ,goeast) (bl312470, ,goeast) (blrccase, ,goeast) (arsenic, ,goeast) (nio bids, ,goeast) (ogygia, ,goeast) (bl49acls, ,goeast) (bl46acls, ,goeast) (agnes, , goeast) (bl43acls, ,goeast) 31 sun (laurel, ,goeast) (u1-sb01, ,goeast) (BLVM04, ,goeast) (BLVM07, ,goeast) (BLVM08, ,goeast) (BLVM09, ,goeast) (STAMFORD, ,goeast) 32 33 lynx_bm (BL21DL385, ,goeast) 34 lynx_psa (Linuxdev106, ,goeast) (BL48DL385, ,goeast) 35 lynx_uic (bl01ln-dev, ,goeast) (bl02ln-bld, ,goeast) 36 lynx_uone (BLVM01, ,goeast) (BLVM02, ,goeast) (BLVM03, ,goeast) ( BLVM05, ,goeast) (BLVM06, ,goeast) (ccase-u1, ,goeast) 37 lynx_omg (BL14DL385, ,goeast) 38 lynx_desk (agile8, ,goeast) --------------------------------------------------------------- All I did is tried running the migration script simply and imported it to the Fedora DS Database. The excerpt of the ldif file is : ------------------------------------------------------------------------ -- File : netgroup.ldif ------------------------------------------------------------------------ -- dn: cn=homegrp,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: homegrp memberNisNetgroup: grp1 memberNisNetgroup: homegrp2 dn: cn=grp1,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: grp1 nisNetgroupTriple: (bl015470, nisNetgroupTriple: (bl025470, memberNisNetgroup: ,goeast) memberNisNetgroup: ,goeast), dn: cn=linux,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: linux memberNisNetgroup: lynx_bm memberNisNetgroup: lynx_desk memberNisNetgroup: lynx_omg memberNisNetgroup: lynx_psa memberNisNetgroup: lynx_uic memberNisNetgroup: lynx_uone dn: cn=unix,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: unix nisNetgroupTriple: (agnes, nisNetgroupTriple: (arsenic, nisNetgroupTriple: (bl015470, nisNetgroupTriple: (bl025470, nisNetgroupTriple: (bl035470, nisNetgroupTriple: (bl065470, nisNetgroupTriple: (bl312470, nisNetgroupTriple: (bl43acls, nisNetgroupTriple: (bl46acls, nisNetgroupTriple: (bl49acls, nisNetgroupTriple: (blrccase, nisNetgroupTriple: (niobids, memberNisNetgroup: , memberNisNetgroup: ,goeast) memberNisNetgroup: goeast) dn: cn=sun,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: sun nisNetgroupTriple: (BLVM04, nisNetgroupTriple: (BLVM07, nisNetgroupTriple: (BLVM08, nisNetgroupTriple: (BLVM09, nisNetgroupTriple: (STAMFORD, nisNetgroupTriple: (laurel, nisNetgroupTriple: (u1-sb01, memberNisNetgroup: ,goeast) dn: cn=lynx_bm,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: lynx_bm nisNetgroupTriple: (BL21DL385, memberNisNetgroup: ,goeast) dn: cn=lynx_psa,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: lynx_psa nisNetgroupTriple: (BL48DL385, nisNetgroupTriple: (Linuxdev106, memberNisNetgroup: ,goeast) dn: cn=lynx_uic,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top cn: lynx_uic nisNetgroupTriple: (bl01ln-dev, nisNetgroupTriple: (bl02ln-bld, memberNisNetgroup: ,goeast) dn: cn=lynx_uone,ou=netgroups,dc=im,dc=logica,dc=com objectClass: nisNetgroup objectClass: top ------------------------------------------------------- I changed the ou=NetGoup to ou=netgroups as my Directory Server > Directory Tab > im > netgroups folder was there.(Will NetGroup will work?I don't think so) I imported it to fedora DS and it showed no error in that process. The getent netgroup <netgroupname> is also working. Can you help me Now How can I create ACL...Say I have one project named lynx_uone and all I want not to let it to access the other projects.Pls Help me in this regard. Will it work? This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

1 0

[Fedora-directory-users] Multiple masters and Round Robin DNS
by Doug Chapman 15 Feb '08

15 Feb '08

After setting up 2 servers with multi-master replication, I added them both to a DNS record so users will go to either server. Both servers are replicating the NetscapeRoot DB to each other. I made a schema change to one and restarted it- only to see it hang. I waited some 15minutes, and then discovered with netstat that it had a bunch of open ldap connections to itself, which weren't timing out or going away. After I removed the IP from DNS (disabled round robin dns) for the server I was trying to shutdown , the server shutdown right away. I'm guessing somewhere there's a configuration that needs to be pointed to the other master server? How are others doing load balancing/fail over ? tia

4 4

[Fedora-directory-users] Question about making ldapmodify to be silent
by Chun Tat David Chu 15 Feb '08

15 Feb '08

Hello! I'm currently running an older version of Fedora Directory Server 1.0.2. I need to import a bunch of ldif files via ldapmodify. I was wondering if there's anyway to make ldapmodify to be silent instead of echoing every add entry. I tried to pass in "-q" instructed from the "RH DS 7.1 Configuration, Command and File Reference" manual, but it complained that it is not a valid option. I also tried to look into man page but no luck. Any help would be appreciated Thanks!! - dc

2 2

[Fedora-directory-users] Fedora DS in a Xen DomU?
by Chris St. Pierre 15 Feb '08

15 Feb '08

I've been reading some things lately -- see, for instance, http://lists.xensource.com/archives/html/xen-users/2006-05/msg00853.html -- that suggests that running Fedora DS (or OpenLDAP, or, theoretically, any Berkeley-DB-reliant app) in a Xen DomU might not be the best idea. The thread mentioned above has a few people claiming it works fine for them, but both are at _very_ small sites. Can anyone either corroborate or debunk these claims? Thanks! Chris St. Pierre Unix Systems Administrator Nebraska Wesleyan University

2 1

[Fedora-directory-users] Attributes for ACLs???
by Singh Raina, Ajeet 15 Feb '08

15 Feb '08

Can anyone tel me what really Targets column under ACLs setting means? It shows lots of options like nsmsgConfigversion, changeType,ipNetworkNumber,nsmdsFolderurl etc etc ... What type of ACIs we can set for Group and People??? This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

1 0

[Fedora-directory-users] 'mailHost' not allowed during the NIS Migration ????
by Singh Raina, Ajeet 15 Feb '08

15 Feb '08

Its Working.... One more thing to ask you. I missed to add one entry related to krbName and its throwing error as: dn: uid=apache,ou=People,dc=im,dc=logica,dc=com uid: apache cn: Apache sn: Apache mail: apache(a)logica.com mailRoutingAddress: apache(a)mail.logica.com mailHost: mail.logica.com objectClass: inetLocalMailRecipient objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: kerberosSecurityObject objectClass: shadowAccount userPassword: {crypt}!! shadowLastChange: 13801 shadowMax: 99999 shadowWarning: 7 krbName: apache(a)LOGICA.COM loginShell: /sbin/nologin uidNumber: 48 gidNumber: 48 homeDirectory: /var/www gecos: Apache And the error: uid=apache,ou=People,dc=im,dc=logica,dc=com: Error adding object 'dn: uid=apache,ou=People,dc=im,dc=logica,dc=com'. The error sent by the server was 'Object class violation. unknown object class "kerberosSecurityObject" '. The object is: LDAPEntry: uid=apache,ou=People,dc=im,dc=logica,dc=com; LDAPAttributeSet: LDAPAttribute {type='sn', values='Apache'} LDAPAttribute {type='loginshell', values='/sbin/nologin'} LDAPAttribute {type='userpassword', values='{crypt}!!'} LDAPAttribute {type='gidnumber', values='48'} LDAPAttribute {type='uidnumber', values='48'} LDAPAttribute {type='mail', values='apache(a)logica.com'} LDAPAttribute {type='krbname', values='apache(a)LOGICA.COM'} LDAPAttribute {type='shadowmax', values='99999'} LDAPAttribute {type='objectclass', values='inetLocalMailRecipient,person,organizationalPerson,inetOrgPerson ,posixAccount,top,kerberosSecurityObject,shadowAccount,mailRecipient'} LDAPAttribute {type='uid', values='apache'} LDAPAttribute {type='gecos', values='Apache'} LDAPAttribute {type='shadowlastchange', values='13801'} LDAPAttribute {type='mailhost', values='mail.logica.com'} LDAPAttribute {type='mailroutingaddress', values='apache(a)mail.logica.com'} LDAPAttribute {type='cn', values='Apache'} LDAPAttribute {type='homedirectory', values='/var/www'} LDAPAttribute {type='shadowwarning', values='7'}. How Can I get it work? This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 1

[Fedora-directory-users] 'mailHost' not allowed during the NIS Migration ????
by Singh Raina, Ajeet 15 Feb '08

15 Feb '08

I migrated my # ypcat passwd > /tmp/passwd.ldif through the perl script and I had few entry of the same as below pasted: dn: uid=apache,ou=People,dc=im,dc=logica,dc=com uid: apache cn: Apache sn: Apache mail: apache(a)logica.com mailRoutingAddress: apache(a)mail.logica.com mailHost: mail.logica.com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}!! shadowLastChange: 13801 shadowMax: 99999 shadowWarning: 7 loginShell: /sbin/nologin uidNumber: 48 gidNumber: 48 homeDirectory: /var/www gecos: Apache When I am trying to import into the databases it is throwing error as below: uid=apache,ou=People,dc=im,dc=logica,dc=com: Error adding object 'dn: uid=apache,ou=People,dc=im,dc=logica,dc=com'. The error sent by the server was 'Object class violation. attribute "mailHost" not allowed '. The object is: LDAPEntry: uid=apache,ou=People,dc=im,dc=logica,dc=com; LDAPAttributeSet: LDAPAttribute {type='sn', values='Apache'} LDAPAttribute {type='loginshell', values='/sbin/nologin'} LDAPAttribute {type='userpassword', values='{crypt}!!'} LDAPAttribute {type='gidnumber', values='48'} LDAPAttribute {type='uidnumber', values='48'} LDAPAttribute {type='mail', values='apache(a)logica.com'} LDAPAttribute {type='shadowmax', values='99999'} LDAPAttribute {type='objectclass', values='person,organizationalPerson,inetOrgPerson,posixAccount,top,shado wAccount'} LDAPAttribute {type='uid', values='apache'} LDAPAttribute {type='gecos', values='Apache'} LDAPAttribute {type='shadowlastchange', values='13801'} LDAPAttribute {type='mailhost', values='mail.logica.com'} LDAPAttribute {type='mailroutingaddress', values='apache(a)mail.logica.com'} LDAPAttribute {type='cn', values='Apache'} LDAPAttribute {type='homedirectory', values='/var/www'} LDAPAttribute {type='shadowwarning', values='7'}. Now when I am deleting these lines: mail: apache(a)logica.com mailRoutingAddress: apache(a)mail.logica.com It seems to work. Any idea how I should configure my DS to stop these errors. Pls Help This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 1

[Fedora-directory-users] RHDS and winsync... how to sync disablement of users
by Aaron Oas 14 Feb '08

14 Feb '08

I have a Win2003 AD server and a RHDS 8.0 server, with a windows sync agreement between them. The SSL, win sync agreement and the password sync are all working fine. Our intent is to do core user management from one place: AD, and then have various apps and linux hosts using the RHDS server as needed. One of the key user management functions is disabling an account when the person leaves. We don't want to delete accounts, because you lose some ability to trace ownership after the fact etc. Using the "disable account" option in AD does not carry over, since AD just stores that flag in a bitmask type of attribute (userAccountControl), and winsync does not map that attribute (not surprisingly since the attribute is ugly). Expiring the account in AD also doesn't work. It seems to map improperly in the winsync mapping: the time value that ends up on the RHDS side is translated wildy inaccurately in the RHDS console (hundreds of years off). I am looking at writing a perl daemon to watch AD, pull the "user disabled" value from the userAccountControl attributes of all the users in AD, then map that to the nsaccountlock attribute in RHDS. This includes resulting woes of: do I try to track changes and see which side made the change first (i.e. AD -> DS versus DS -> AD)? Or do I just take the "easy" way out and assume AD is right, etc. etc. Is there any better way to sync the disabling of accounts between AD and RHDS/FDS? Aaron Oas

2 1

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users February 2008