[Fedora-directory-users] About Netgroup??
by Singh Raina, Ajeet
Hi Rich,
I have followed the doc Howto: Netgroup and just for testing created
netgroup.ldif for two entries:
dn: cn=QASystems,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: QASystems
nisNetgroupTriple: (BL60ACLS,,im.logica.com)
nisNetgroupTriple: (pem,,im.logica.com)
dn: cn=QAUsers,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: QAUsers
nisNetgroupTriple: (,bobby,im.logica.com)
nisNetgroupTriple: (,joey,,im.logica.com)
I did imported into Fedora DS.Now I have few queries.
1. Joey and Bobby : Should I have to create these users ?
2. Are these LDAP users which author is talking about?
3. When I click on netgroup in console it shows no users (same as
ou=People).I can only browse through #getent netgroup QAUSers and it
works then only.
4. I followed access.netgroup.conf entry as :
+ : @QaUsers@@QASystems: 10.
But Wonder what is this all about
Pls Help me with this.
This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
16 years, 2 months
[Fedora-directory-users] RE: ACI for Netgroup?????
by Singh Raina, Ajeet
Further to this , What I attempted is I added a netgroup entry like the
same:
dn: cn=QAUsers,ou=Netgroup,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: QAUsers
nisNetgroupTriple: (,bobby,im.logica.com)
nisNetgroupTriple: (,joey,im.logica.com)
description: All QA users in my organization
Next, I created another netgroup QASytsems like this :
dn: cn=QASystems,ou=Netgroup,dc=example,dc=com
objectClass: nisNetgroup
objectClass: top
cn: QASystems
nisNetgroupTriple: (pem,,im.logica.com)
nisNetgroupTriple: (pemy,,im.logica.com)
description: All QA systems on our network
The above example I took from the same link
http://directory.fedoraproject.org/wiki/Howto:Netgroups but couldn't
understand further about setting up access.conf..Is this for client or
server?Confused !!!
I tried this too.
Ok...Say, I created a user skour and set up acls on QASystems :
------------------------------------------------------------------------
---------------------------------------
(targetattr = "*") (target =
"ldap:///cn=QASystems,ou=netgroups,dc=im,dc=logica,dc=com") (version
3.0;acl "No Access to skour";deny (all)(userdn =
"ldap:///uid=skour,ou=People,dc=im,dc=logica,dc=com") and
(ip="10.14.242.93");)
It should work Right. But when I am trying loggig from 10.14.242.93
system as skour and password it is allowing to login.
Any idea why its not working??
________________________________
From: Singh Raina, Ajeet
Sent: Monday, February 18, 2008 10:52 AM
To: 'fedora-directory-users(a)redhat.com'
Subject: ACI for Netgroup?????
My Senior system Admin who has left the organization has NIS configured
with /etc/netgroups file. All I can see he has all together 11 entries
as netgroups as:
------------------------------------------------------------------------
-
File : /etc/netgroups
------------------------------------------------------------------------
-
24 homegrp grp1 homegrp2
25
26 grp1 (bl015470, ,goeast), (bl025470, ,goeast)
27 #homegrp2 bl065470 bl035470
28
29 linux lynx_bm lynx_psa lynx_uic lynx_uone lynx_omg lynx_desk
30 unix (bl015470, ,goeast) (bl025470, ,goeast) (bl035470,
,goeast) (bl
065470, ,goeast) (bl312470, ,goeast) (blrccase, ,goeast) (arsenic,
,goeast) (nio
bids, ,goeast) (ogygia, ,goeast) (bl49acls, ,goeast) (bl46acls, ,goeast)
(agnes,
, goeast) (bl43acls, ,goeast)
31 sun (laurel, ,goeast) (u1-sb01, ,goeast) (BLVM04, ,goeast)
(BLVM07,
,goeast) (BLVM08, ,goeast) (BLVM09, ,goeast) (STAMFORD, ,goeast)
32
33 lynx_bm (BL21DL385, ,goeast)
34 lynx_psa (Linuxdev106, ,goeast) (BL48DL385, ,goeast)
35 lynx_uic (bl01ln-dev, ,goeast) (bl02ln-bld, ,goeast)
36 lynx_uone (BLVM01, ,goeast) (BLVM02, ,goeast) (BLVM03,
,goeast) (
BLVM05, ,goeast) (BLVM06, ,goeast) (ccase-u1, ,goeast)
37 lynx_omg (BL14DL385, ,goeast)
38 lynx_desk (agile8, ,goeast)
---------------------------------------------------------------
All I did is tried running the migration script simply and imported it
to the Fedora DS Database. The excerpt of the ldif file is :
------------------------------------------------------------------------
--
File : netgroup.ldif
------------------------------------------------------------------------
--
dn: cn=homegrp,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: homegrp
memberNisNetgroup: grp1
memberNisNetgroup: homegrp2
dn: cn=grp1,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: grp1
nisNetgroupTriple: (bl015470,
nisNetgroupTriple: (bl025470,
memberNisNetgroup: ,goeast)
memberNisNetgroup: ,goeast),
dn: cn=linux,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: linux
memberNisNetgroup: lynx_bm
memberNisNetgroup: lynx_desk
memberNisNetgroup: lynx_omg
memberNisNetgroup: lynx_psa
memberNisNetgroup: lynx_uic
memberNisNetgroup: lynx_uone
dn: cn=unix,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: unix
nisNetgroupTriple: (agnes,
nisNetgroupTriple: (arsenic,
nisNetgroupTriple: (bl015470,
nisNetgroupTriple: (bl025470,
nisNetgroupTriple: (bl035470,
nisNetgroupTriple: (bl065470,
nisNetgroupTriple: (bl312470,
nisNetgroupTriple: (bl43acls,
nisNetgroupTriple: (bl46acls,
nisNetgroupTriple: (bl49acls,
nisNetgroupTriple: (blrccase,
nisNetgroupTriple: (niobids,
memberNisNetgroup: ,
memberNisNetgroup: ,goeast)
memberNisNetgroup: goeast)
dn: cn=sun,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: sun
nisNetgroupTriple: (BLVM04,
nisNetgroupTriple: (BLVM07,
nisNetgroupTriple: (BLVM08,
nisNetgroupTriple: (BLVM09,
nisNetgroupTriple: (STAMFORD,
nisNetgroupTriple: (laurel,
nisNetgroupTriple: (u1-sb01,
memberNisNetgroup: ,goeast)
dn: cn=lynx_bm,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: lynx_bm
nisNetgroupTriple: (BL21DL385,
memberNisNetgroup: ,goeast)
dn: cn=lynx_psa,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: lynx_psa
nisNetgroupTriple: (BL48DL385,
nisNetgroupTriple: (Linuxdev106,
memberNisNetgroup: ,goeast)
dn: cn=lynx_uic,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: lynx_uic
nisNetgroupTriple: (bl01ln-dev,
nisNetgroupTriple: (bl02ln-bld,
memberNisNetgroup: ,goeast)
dn: cn=lynx_uone,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
-------------------------------------------------------
I changed the ou=NetGoup to ou=netgroups as my Directory Server >
Directory Tab > im > netgroups folder was there.(Will NetGroup will
work?I don't think so)
I imported it to fedora DS and it showed no error in that process.
The getent netgroup <netgroupname> is also working.
Can you help me Now How can I create ACL...Say I have one project named
lynx_uone and all I want not to let it to access the other projects.Pls
Help me in this regard.
Will it work?
This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
16 years, 2 months
[Fedora-directory-users] ACI for Netgroup?????
by Singh Raina, Ajeet
My Senior system Admin who has left the organization has NIS configured
with /etc/netgroups file. All I can see he has all together 11 entries
as netgroups as:
------------------------------------------------------------------------
-
File : /etc/netgroups
------------------------------------------------------------------------
-
24 homegrp grp1 homegrp2
25
26 grp1 (bl015470, ,goeast), (bl025470, ,goeast)
27 #homegrp2 bl065470 bl035470
28
29 linux lynx_bm lynx_psa lynx_uic lynx_uone lynx_omg lynx_desk
30 unix (bl015470, ,goeast) (bl025470, ,goeast) (bl035470,
,goeast) (bl
065470, ,goeast) (bl312470, ,goeast) (blrccase, ,goeast) (arsenic,
,goeast) (nio
bids, ,goeast) (ogygia, ,goeast) (bl49acls, ,goeast) (bl46acls, ,goeast)
(agnes,
, goeast) (bl43acls, ,goeast)
31 sun (laurel, ,goeast) (u1-sb01, ,goeast) (BLVM04, ,goeast)
(BLVM07,
,goeast) (BLVM08, ,goeast) (BLVM09, ,goeast) (STAMFORD, ,goeast)
32
33 lynx_bm (BL21DL385, ,goeast)
34 lynx_psa (Linuxdev106, ,goeast) (BL48DL385, ,goeast)
35 lynx_uic (bl01ln-dev, ,goeast) (bl02ln-bld, ,goeast)
36 lynx_uone (BLVM01, ,goeast) (BLVM02, ,goeast) (BLVM03,
,goeast) (
BLVM05, ,goeast) (BLVM06, ,goeast) (ccase-u1, ,goeast)
37 lynx_omg (BL14DL385, ,goeast)
38 lynx_desk (agile8, ,goeast)
---------------------------------------------------------------
All I did is tried running the migration script simply and imported it
to the Fedora DS Database. The excerpt of the ldif file is :
------------------------------------------------------------------------
--
File : netgroup.ldif
------------------------------------------------------------------------
--
dn: cn=homegrp,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: homegrp
memberNisNetgroup: grp1
memberNisNetgroup: homegrp2
dn: cn=grp1,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: grp1
nisNetgroupTriple: (bl015470,
nisNetgroupTriple: (bl025470,
memberNisNetgroup: ,goeast)
memberNisNetgroup: ,goeast),
dn: cn=linux,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: linux
memberNisNetgroup: lynx_bm
memberNisNetgroup: lynx_desk
memberNisNetgroup: lynx_omg
memberNisNetgroup: lynx_psa
memberNisNetgroup: lynx_uic
memberNisNetgroup: lynx_uone
dn: cn=unix,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: unix
nisNetgroupTriple: (agnes,
nisNetgroupTriple: (arsenic,
nisNetgroupTriple: (bl015470,
nisNetgroupTriple: (bl025470,
nisNetgroupTriple: (bl035470,
nisNetgroupTriple: (bl065470,
nisNetgroupTriple: (bl312470,
nisNetgroupTriple: (bl43acls,
nisNetgroupTriple: (bl46acls,
nisNetgroupTriple: (bl49acls,
nisNetgroupTriple: (blrccase,
nisNetgroupTriple: (niobids,
memberNisNetgroup: ,
memberNisNetgroup: ,goeast)
memberNisNetgroup: goeast)
dn: cn=sun,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: sun
nisNetgroupTriple: (BLVM04,
nisNetgroupTriple: (BLVM07,
nisNetgroupTriple: (BLVM08,
nisNetgroupTriple: (BLVM09,
nisNetgroupTriple: (STAMFORD,
nisNetgroupTriple: (laurel,
nisNetgroupTriple: (u1-sb01,
memberNisNetgroup: ,goeast)
dn: cn=lynx_bm,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: lynx_bm
nisNetgroupTriple: (BL21DL385,
memberNisNetgroup: ,goeast)
dn: cn=lynx_psa,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: lynx_psa
nisNetgroupTriple: (BL48DL385,
nisNetgroupTriple: (Linuxdev106,
memberNisNetgroup: ,goeast)
dn: cn=lynx_uic,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
cn: lynx_uic
nisNetgroupTriple: (bl01ln-dev,
nisNetgroupTriple: (bl02ln-bld,
memberNisNetgroup: ,goeast)
dn: cn=lynx_uone,ou=netgroups,dc=im,dc=logica,dc=com
objectClass: nisNetgroup
objectClass: top
-------------------------------------------------------
I changed the ou=NetGoup to ou=netgroups as my Directory Server >
Directory Tab > im > netgroups folder was there.(Will NetGroup will
work?I don't think so)
I imported it to fedora DS and it showed no error in that process.
The getent netgroup <netgroupname> is also working.
Can you help me Now How can I create ACL...Say I have one project named
lynx_uone and all I want not to let it to access the other projects.Pls
Help me in this regard.
Will it work?
This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
16 years, 2 months
[Fedora-directory-users] Multiple masters and Round Robin DNS
by Doug Chapman
After setting up 2 servers with multi-master replication, I added them both
to a DNS record so users will go to either server.
Both servers are replicating the NetscapeRoot DB to each other. I made a
schema change to one and restarted it- only to see it hang. I waited some
15minutes, and then discovered with netstat that it had a bunch of open ldap
connections to itself, which weren't timing out or going away.
After I removed the IP from DNS (disabled round robin dns) for the server I
was trying to shutdown , the server shutdown right away.
I'm guessing somewhere there's a configuration that needs to be pointed to
the other master server?
How are others doing load balancing/fail over ?
tia
16 years, 2 months
[Fedora-directory-users] Question about making ldapmodify to be silent
by Chun Tat David Chu
Hello!
I'm currently running an older version of Fedora Directory Server 1.0.2.
I need to import a bunch of ldif files via ldapmodify.
I was wondering if there's anyway to make ldapmodify to be silent instead of
echoing every add entry.
I tried to pass in "-q" instructed from the "RH DS 7.1 Configuration,
Command and File Reference" manual, but it complained that it is not a valid
option.
I also tried to look into man page but no luck.
Any help would be appreciated
Thanks!!
- dc
16 years, 2 months
[Fedora-directory-users] Attributes for ACLs???
by Singh Raina, Ajeet
Can anyone tel me what really Targets column under ACLs setting means?
It shows lots of options like nsmsgConfigversion,
changeType,ipNetworkNumber,nsmdsFolderurl etc etc ...
What type of ACIs we can set for Group and People???
This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
16 years, 2 months
[Fedora-directory-users] 'mailHost' not allowed during the NIS Migration ????
by Singh Raina, Ajeet
Its Working....
One more thing to ask you.
I missed to add one entry related to krbName and its throwing error as:
dn: uid=apache,ou=People,dc=im,dc=logica,dc=com
uid: apache
cn: Apache
sn: Apache
mail: apache(a)logica.com
mailRoutingAddress: apache(a)mail.logica.com
mailHost: mail.logica.com
objectClass: inetLocalMailRecipient
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: kerberosSecurityObject
objectClass: shadowAccount
userPassword: {crypt}!!
shadowLastChange: 13801
shadowMax: 99999
shadowWarning: 7
krbName: apache(a)LOGICA.COM
loginShell: /sbin/nologin
uidNumber: 48
gidNumber: 48
homeDirectory: /var/www
gecos: Apache
And the error:
uid=apache,ou=People,dc=im,dc=logica,dc=com: Error adding object 'dn:
uid=apache,ou=People,dc=im,dc=logica,dc=com'. The error sent by the
server was 'Object class violation. unknown object class
"kerberosSecurityObject"
'. The object is: LDAPEntry:
uid=apache,ou=People,dc=im,dc=logica,dc=com; LDAPAttributeSet:
LDAPAttribute {type='sn', values='Apache'} LDAPAttribute
{type='loginshell', values='/sbin/nologin'} LDAPAttribute
{type='userpassword', values='{crypt}!!'} LDAPAttribute
{type='gidnumber', values='48'} LDAPAttribute {type='uidnumber',
values='48'} LDAPAttribute {type='mail', values='apache(a)logica.com'}
LDAPAttribute {type='krbname', values='apache(a)LOGICA.COM'} LDAPAttribute
{type='shadowmax', values='99999'} LDAPAttribute {type='objectclass',
values='inetLocalMailRecipient,person,organizationalPerson,inetOrgPerson
,posixAccount,top,kerberosSecurityObject,shadowAccount,mailRecipient'}
LDAPAttribute {type='uid', values='apache'} LDAPAttribute {type='gecos',
values='Apache'} LDAPAttribute {type='shadowlastchange', values='13801'}
LDAPAttribute {type='mailhost', values='mail.logica.com'} LDAPAttribute
{type='mailroutingaddress', values='apache(a)mail.logica.com'}
LDAPAttribute {type='cn', values='Apache'} LDAPAttribute
{type='homedirectory', values='/var/www'} LDAPAttribute
{type='shadowwarning', values='7'}.
How Can I get it work?
This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
16 years, 2 months
[Fedora-directory-users] 'mailHost' not allowed during the NIS Migration ????
by Singh Raina, Ajeet
I migrated my # ypcat passwd > /tmp/passwd.ldif through the perl script
and I had few entry of the same as below pasted:
dn: uid=apache,ou=People,dc=im,dc=logica,dc=com
uid: apache
cn: Apache
sn: Apache
mail: apache(a)logica.com
mailRoutingAddress: apache(a)mail.logica.com
mailHost: mail.logica.com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}!!
shadowLastChange: 13801
shadowMax: 99999
shadowWarning: 7
loginShell: /sbin/nologin
uidNumber: 48
gidNumber: 48
homeDirectory: /var/www
gecos: Apache
When I am trying to import into the databases it is throwing error as
below:
uid=apache,ou=People,dc=im,dc=logica,dc=com: Error adding object 'dn:
uid=apache,ou=People,dc=im,dc=logica,dc=com'. The error sent by the
server was 'Object class violation. attribute "mailHost" not allowed
'. The object is: LDAPEntry:
uid=apache,ou=People,dc=im,dc=logica,dc=com; LDAPAttributeSet:
LDAPAttribute {type='sn', values='Apache'} LDAPAttribute
{type='loginshell', values='/sbin/nologin'} LDAPAttribute
{type='userpassword', values='{crypt}!!'} LDAPAttribute
{type='gidnumber', values='48'} LDAPAttribute {type='uidnumber',
values='48'} LDAPAttribute {type='mail', values='apache(a)logica.com'}
LDAPAttribute {type='shadowmax', values='99999'} LDAPAttribute
{type='objectclass',
values='person,organizationalPerson,inetOrgPerson,posixAccount,top,shado
wAccount'} LDAPAttribute {type='uid', values='apache'} LDAPAttribute
{type='gecos', values='Apache'} LDAPAttribute {type='shadowlastchange',
values='13801'} LDAPAttribute {type='mailhost',
values='mail.logica.com'} LDAPAttribute {type='mailroutingaddress',
values='apache(a)mail.logica.com'} LDAPAttribute {type='cn',
values='Apache'} LDAPAttribute {type='homedirectory', values='/var/www'}
LDAPAttribute {type='shadowwarning', values='7'}.
Now when I am deleting these lines:
mail: apache(a)logica.com
mailRoutingAddress: apache(a)mail.logica.com
It seems to work.
Any idea how I should configure my DS to stop these errors.
Pls Help
This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
16 years, 2 months
[Fedora-directory-users] RHDS and winsync... how to sync disablement of users
by Aaron Oas
I have a Win2003 AD server and a RHDS 8.0 server, with a windows sync
agreement between them. The SSL, win sync agreement and the password
sync are all working fine.
Our intent is to do core user management from one place: AD, and then
have various apps and linux hosts using the RHDS server as needed.
One of the key user management functions is disabling an account when
the person leaves. We don't want to delete accounts, because you lose
some ability to trace ownership after the fact etc.
Using the "disable account" option in AD does not carry over, since AD
just stores that flag in a bitmask type of attribute
(userAccountControl), and winsync does not map that attribute (not
surprisingly since the attribute is ugly).
Expiring the account in AD also doesn't work. It seems to map
improperly in the winsync mapping: the time value that ends up on the
RHDS side is translated wildy inaccurately in the RHDS console (hundreds
of years off).
I am looking at writing a perl daemon to watch AD, pull the "user
disabled" value from the userAccountControl attributes of all the users
in AD, then map that to the nsaccountlock attribute in RHDS. This
includes resulting woes of: do I try to track changes and see which side
made the change first (i.e. AD -> DS versus DS -> AD)? Or do I just
take the "easy" way out and assume AD is right, etc. etc.
Is there any better way to sync the disabling of accounts between AD and
RHDS/FDS?
Aaron Oas
16 years, 2 months