[Fedora-directory-users] FDS logins after reboot
by Joe W. Byers
I have FDS install on a EL 5 server. I also have a Fedora 6 desktop and
a
Fedora 8 laptop.
I can reboot the F6 desktop and enter any of my users set up in FDS on
the
EL5 server and login with all their correct information. ( I use NFS to
mount the home dirs). This is good.
The F8 laptop is a different story. After a reboot, I have to login as
root
and switch desktops to be able to see the FDS users. The initial
startup
of gdm has slowed down tremendously. I can log in as root and to a
ldapsearch and see my FDS and all info.
If I log off root, FDS seems to go away. I can only log in as root or
the
one user I have set up on the laptop. Again, I log in as root, then I
can
log in as a user in FDS.
Any thoughts?
Thank you all for you help.
Joe
16 years
[Fedora-directory-users] aci with group dn and self read
by C.S.R.C.Murthy
Hello,
I need an aci such that when a user of a group binds, he will be able to
see only his attribute but not others. I tried the following but it
gives syntax error. Please suggest
(target = "ldap:///self") (targetattr = "*") (version = 3.0; acl "test
acl"; allow (read,search) (groupdn =
"ldap:///cn=internet,ou=groups,dc=example,dc=com") ; )
-thanks
murthy
16 years
[Fedora-directory-users] could not open admin-serv-XXX-cert8.db
by Richard Larson
All;
Apologize if this has been answered and I could not find it.
Setting up a new install of Fedora DS 1.0.4 to use SSL.
Followed the Howto:SSL on the site and the original written by Ashley
Chew; everything goes fine until it comes to initializing the admin-serv
cert8 and key dbs prior to importing the certs.
Directory server works fine but everytime I try to manage the admin serv
certificates, I get the error: Could not open admin...cert8.db
Checked file permissions. Alias folder is owned by nobody/nobody and
admin server is running as root. I even chmod the alias folder just to
make sure.
Is there a flag I need to change to get the admin server to build the
initial db or maybe it's not necessary?
Thanks in advance
Rich
Rich Larson
Systems Engineer
Stinger Ghaffarian Technologies (SGT)
Contractor to the USGS Earth Resources Observation and Science
47914 252nd Street, Sioux Falls, SD 57198
605.594.2795 (Phone)
605.594.6940 (Fax)
E-mail: rlarson(a)usgs.gov
It is apparent that no lifetime is long enough in which
to explore the resources of a few square yards of ground.
- Alice M. Coats
NOTICE: This email may contain confidential, proprietary, or competition
sensitive bid or proposal procurement information. Unauthorized
disclosure of
this information may carry criminal penalties as set forth in the
Procurement Integrity Act, 41 U.S.C. 423, as amended. Further, the
unauthorized disclosure
of certain commercial information by civil servants may result in fines or
imprisonment under the Trade Secrets Act (18 U.S.C. 1905). If you have
received
this information in error, please delete it, including all copies, and
notify the sender of the error immediately.
16 years
[Fedora-directory-users] Where to go to find more information on using FDS's builtin mail schema...
by Brian Kosick
Hi All,
I'm trying to find out more information on using FDS's builtin Mail
schema's mentioned in
http://directory.fedoraproject.org/wiki/Howto:Postfix
It appears to be mailgroup from 50ns-mail.ldif
I'm in a QA Dept, and I'm trying to accomplish a setup where I have a
large number of virtual domains, virtual users as well as aliases to to
both virtual users and actual users..
I can add the mailgroup object type to a user but then get to
mgrpDeliverTo attribute.
I've also tried MailRecipient and nsmessagingserveruser (Which I think
is from a different schema) but can't figure out the mgrpDeliverTo
attribute for this schema.
I've searched google extensively for information on how to do this and
have found it lacking... can someone please point me in the right
direction? RFC's, manuals, howto's etc etc etc. I'd greatly
appreciate it.
Thanks,
Brian Kosick
16 years
[Fedora-directory-users] Removing a Smart Referral
by Daniel Cristian Cruz
Hi All,
Is there any way to remove a smart referral?
We had some users which are in a replicated tree, and we need to use it
on our own tree. I can't find any way to remove the reference, without
removing the user in the replicated tree.
Example:
o=My Org
ou=Unit 1
uid=Replicated Account (consumer suffix)
ou=Unit 2
uid=My Account
uid=Replicated Account (Smart Referral to "uid=Replicated Account,ou=Unit 1,o=My Org")
Any help?
--
Daniel Cristian Cruz
Analista de Sistemas - Administrador de Banco de Dados
SENAI/SC - Servico Nacional de Aprendizagem Industrial
NTI - Núcleo de Tecnologia da Informação
Fone: (48) 3239-1422
16 years
[Fedora-directory-users] access rights to pc resources
by Maurizio Marini
I am using FDS as PDC,
In AD, they can decide which user can logon in which workstation (and his is
available in NT Account fds gui admin, it's ok); but network admin can decide
that a user can or cannot use an usb device, an application, and so on.
How can i configure resources access profiles?
tia
-m
16 years
[Fedora-directory-users] NSPR "Certificate type not approved for application" error when a TLS-enabled proxy LDAP OpenLDAP server connects to Fedora Directory Server
by Aleksander Adamowski
Hi!
I have a proxy OpenLDAP server (based on slapd-ldap) backend that
connects to Fedora Directory server.
All is fine if OpenLDAP is configured to connect using non-SSL URI
without TLS.
However, whenever I try TLS on port 389 or SSL on port 636, OpenLDAP
uses its server certificate during TLS/SSL negotiation and Fedora
Directory decides that this certificate usage isn't good because it's
not a client certificate. In FDS logs I can see:
[14/Apr/2008:11:33:33 +0200] conn=1474 fd=65 slot=65 SSL connection from
IP_OF_OPENLDAP to IP_OF_FDS
[14/Apr/2008:11:33:33 +0200] conn=1474 Netscape Portable Runtime error
-8101 (Certificate type not approved for application.); unauthenticated
client E=some_email,CN=hostname,ETC,ETC,; issuer E=ISSUER_DATA
[14/Apr/2008:11:33:33 +0200] conn=1474 op=-1 fd=65 closed - Certificate
type not approved for application.
Is there a way to relax those requirements in Fedora Directory for this
particular case (LDAP client that uses a server certificate)? Like, say
some tweaks in nss.conf?
--
Best Regards,
Aleksander Adamowski
GG#: 274614
ICQ UIN: 19780575
http://olo.org.pl
--
Aleksander Adamowski
Administrator systemów korporacyjnych; Instruktor
Altkom Akademia S.A. http://www.altkom.pl
Warszawa, ul. Chłodna 51
tel. brak
kom. +48 601-318-080
Sąd Rejonowy dla m.st. Warszawy w Warszawie, XII Wydział Gospodarczy Krajowego Rejestru Sądowego,
KRS: 0000120139, NIP 118-00-08-391, Kapitał zakładowy: 1000 000 PLN. Adres rejestrowy Firmy - ul. Stawki 2, 00-193 Warszawa.
Niniejsza wiadomość zawiera informacje zastrzeżone i stanowiące tajemnicę przedsiębiorstwa firmy Altkom Akademia S.A.
Ujawnianie tych informacji osobom trzecim lub nieuprawnione wykorzystanie ich do własnych celów jest zabronione.
Jeżeli otrzymaliście Państwo niniejszą wiadomość omyłkowo, prosimy o niezwłoczne skontaktowanie się z nadawcą oraz usunięcie wszelkich kopii niniejszej wiadomości.
This message contains proprietary information and trade secrets of Altkom Akademia S.A. company.
Unauthorized use or disclosure of this information to any third party is prohibited.
If you received this message by mistake, please contact the sender immediately and delete all copies of this message.
16 years
[Fedora-directory-users] pam_ldap support dynamic groups
by Joel Heenan
Fedora Directory Users,
Very quick question I hope - does pam_ldap support dynamic groups? I
couldn't find anything in google and my tests say no.
Thanks
Joel
The information contained in this e-mail message and any accompanying files is or may be confidential. If you are not the intended recipient, any use, dissemination, reliance, forwarding, printing or copying of this e-mail or any attached files is unauthorised. This e-mail is subject to copyright. No part of it should be reproduced, adapted or communicated without the written consent of the copyright owner. If you have received this e-mail in error please advise the sender immediately by return e-mail or telephone and delete all copies. Fairfax does not guarantee the accuracy or completeness of any information contained in this e-mail or attached files. Internet communications are not secure, therefore Fairfax does not accept legal responsibility for the contents of this message or attached files.
16 years
[Fedora-directory-users] Having problems with the Admin Console
by Eric Brown
I am using FDS 1.0.4, installing from the RPM downloaded from the FDS
website for RHEL4
I used the silent install to setup the directory with the following information:
[General]
FullMachineName= blue.ds.server.com
ConfigDirectoryLdapURL= ldap://blue.ds.server.com:389/
SuiteSpotUserID= ldap
SuitespotGroup= ldap
ConfigDirectoryAdminID= admin
ConfigDirectoryAdminPwd= secret1234
ServerRoot= /opt/fedora-ds
Components= svrcore,base,slapd,admin,nsperl,perldap
AdminDomain= ds.server.com
[slapd]
Components= slapd,slapd-client
ServerPort= 389
ServerIdentifier= grid-identity
Suffix= dc=blue,dc=com
RootDN= cn=Directory Manager
RootDNPwd= 1apple
[admin]
SysUser= ldap
Port= 23611
ServerIpAddress= 10.105.1.188
ServerAdminID= admin
ServerAdminPwd= secret1234
Components= admin,admin-client
[base]
Components= base,base-client,base-jre
[nsperl]
Components= nsperl
[perlldap]
Components= perlldap14
The silent installation completed, and I can start the slapd server,
but all of the files I have seen referenced to starting the admin
server are not in my installation.
16 years
[Fedora-directory-users] defaultsearchbase and empty base dn subtree searches
by Aleksander Adamowski
Hi!
I'm migrating from OpenLDAP to Fedora Directory.
In the OpenLDAP infrastructure, I had used proxy LDAP servers (the
slapd-ldap backend) to direct requests to slapd-bdb backend OpenLDAP
instances with failover in case of failure.
In addition to that, using the rwm overlay, the slapd-ldap instance did
request rewriting of queries that specify empty base dn.
The configuration for slapd-ldap instance was:
database ldap
suffix ""
uri "ldap://localhost:392/,ldaps://otherserver:636/"
timeout 24
idle-timeout 16
overlay rwm
rwm-rewriteEngine on
rwm-rewriteContext searchBase
rwm-rewriteRule "$" "o=MyDefaultBase" ":"
I've read a thread from 2006-02 on this list
(https://www.redhat.com/archives/fedora-directory-users/2006-February/msg0...)
that it's possible to get a similar behaviour on FDS by modifying dse.ldif.
I've stopped the FDS instance, modified
/etc/dirsrv/slapd-instancename/dse.ldif and started FDS again:
dn:
objectClass: top
objectClass: extensibleObject
defaultsearchbase: o=MyDefaultBase
aci: (targetattr != "aci")(version 3.0; aci "rootdse anon read access";
allow(
read,search,compare) userdn="ldap:///anyone";)
creatorsName: cn=server,cn=plugins,cn=config
modifiersName: cn=server,cn=plugins,cn=config
createTimestamp: 20080411165538Z
modifyTimestamp: 20080411165538Z
However, it still doesn't return anything when clients search with empty
base:
# /usr/lib64/mozldap/ldapsearch -b 'o=MyDefaultBase' -s sub uid=olo uid
version: 1
dn: uid=olo,ou=People,o=MyDefaultBase
uid: olo
# /usr/lib64/mozldap/ldapsearch -b '' -s sub uid=olo uid
ldap_search: No such object
Maybe it's relevant that the host in question takes part in multi-master
replication setup of 3 FDS servers.
--
Best Regards,
Aleksander Adamowski
GG#: 274614
ICQ UIN: 19780575
http://olo.org.pl
--
Aleksander Adamowski
Administrator systemów korporacyjnych; Instruktor
Altkom Akademia S.A. http://www.altkom.pl
Warszawa, ul. Chłodna 51
tel. brak
kom. +48 601-318-080
Sąd Rejonowy dla m.st. Warszawy w Warszawie, XII Wydział Gospodarczy Krajowego Rejestru Sądowego,
KRS: 0000120139, NIP 118-00-08-391, Kapitał zakładowy: 1000 000 PLN. Adres rejestrowy Firmy - ul. Stawki 2, 00-193 Warszawa.
Niniejsza wiadomość zawiera informacje zastrzeżone i stanowiące tajemnicę przedsiębiorstwa firmy Altkom Akademia S.A.
Ujawnianie tych informacji osobom trzecim lub nieuprawnione wykorzystanie ich do własnych celów jest zabronione.
Jeżeli otrzymaliście Państwo niniejszą wiadomość omyłkowo, prosimy o niezwłoczne skontaktowanie się z nadawcą oraz usunięcie wszelkich kopii niniejszej wiadomości.
This message contains proprietary information and trade secrets of Altkom Akademia S.A. company.
Unauthorized use or disclosure of this information to any third party is prohibited.
If you received this message by mistake, please contact the sender immediately and delete all copies of this message.
16 years