[Fedora-directory-users] pk12util error
by ken oh
I'm trying to get Windows Sync working on FDS 1.1. I am stuck at the step where you export the directory server's certificate to a file. I use this command in /etc/dirsrv/slapd-test2:
pk12util -d . -P slapd-test2- -o cacert.p12 -n Server-Cert
And I got this error :
pk12util-bin: find user certs from nickname failed: security library: bad
database.
I have used the FDS 1.1 script from here : http://directory.fedoraproject.org/wiki/Howto:SSL for setting up SSL in the directory server.
Everything looks ok.
When I use this command : certutil -L -d .
I got this :
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
CA certificate CTu,u,u
server-cert u,u,u
Server-Cert u,u,u
What can I do to get the pk12util working ? Or is there another way to export the files ?
Thanks
_____________________________________________________________________________
Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr
14 years, 9 months
[Fedora-directory-users] can't connect to PDC
by Merle Reine
I know this has been asked a million times but I read all the posts and none
answer my issue so I hope someone will know a fix.
I have fc9 with samba as PDC connecting to FDS.
Followed the how-to to the letter but can not get my windows machine to
connect to the domain.
My domain is : ldap
Windows machine is in random workgroup not associated with samba at all.
When I try to add to domain using root and pass (yes, it is setup on samba
server), I get the following:
"The following error occured attempting to join the domain "ldap":
A device attached to the system is not functioning.
in /var/log/samba/samba.log:
*[2008/06/23 13:53:44, 0] lib/util_sock.c:get_peer_addr_internal(1597)
getpeername failed. Error was Transport endpoint is not connected
[2008/06/23 13:53:44, 0] lib/util_sock.c:write_data(1059)
[2008/06/23 13:53:44, 0] lib/util_sock.c:get_peer_addr_internal(1597)
getpeername failed. Error was Transport endpoint is not connected
write_data: write failure in writing to client 0.0.0.0. Error Connection
reset
by peer
[2008/06/23 13:53:44, 0] smbd/process.c:srv_send_smb(74)
Error writing 4 bytes to client. -1. (Transport endpoint is not connected)
[2008/06/23 13:53:44, 0] lib/util_sock.c:get_peer_addr_internal(1597)
getpeername failed. Error was Transport endpoint is not connected
[2008/06/23 13:53:44, 0] lib/util_sock.c:write_data(1059)
[2008/06/23 13:53:44, 0] lib/util_sock.c:get_peer_addr_internal(1597)
getpeername failed. Error was Transport endpoint is not connected
write_data: write failure in writing to client 0.0.0.0. Error Connection
reset
by peer
[2008/06/23 13:53:44, 0] smbd/process.c:srv_send_smb(74)
Error writing 4 bytes to client. -1. (Transport endpoint is not connected)
[2008/06/23 13:53:44, 0] passdb/pdb_ldap.c:ldapsam_add_sam_account(2276)
ldapsam_add_sam_account: failed to modify/add user with uid = TEST$ (dn =
uid=
TEST$,ou=Computers,dc=gardenfreshcorp,dc=com)*
Any one have any ideas what I am missing?
Thanks.
Merle Reine
IT Manager Extraordinaire
Email Address: echo zreyr.ervar(a)tznvy.pbz | perl -pe 'y/a-z/n-za-m/'
14 years, 9 months
[Fedora-directory-users] Use of SLAPI_PLUGIN_BE_POST_MODIFY_FN
by Eric
I would like to perform an action if and only if a database operation succeeds, as well as revert that database operation if the action fails. From the documentation I understand I should wrap both in a transaction and implement it through these parameters: SLAPI_PLUGIN_BE_POST_MODIFY_FN, SLAPI_PLUGIN_BE_POST_ADD_FN, SLAPI_PLUGIN_BE_POST_DELETE_FN.
However I'm not sure how to write that transaction. Is there a code sample? How should I configure the plugin -- nsslapd-plugintype: postperation doesn't seem to be the right type...
14 years, 9 months
[Fedora-directory-users] can't connect to PDC
by Merle Reine
I know this has been asked a million times but I read all the posts and none
answer my issue so I hope someone will know a fix.
I have fc9 with samba as PDC connecting to FDS.
Followed the how-to to the letter but can not get my windows machine to
connect to the domain.
My domain is : ldap
Windows machine is in random workgroup not associated with samba at all.
When I try to add to domain using root and pass (yes, it is setup on samba
server), I get the following:
"The following error occured attempting to join the domain "ldap":
A device attached to the system is not functioning.
in /var/log/samba/samba.log:
*[2008/06/23 13:53:44, 0] lib/util_sock.c:get_peer_addr_internal(1597)
getpeername failed. Error was Transport endpoint is not connected
[2008/06/23 13:53:44, 0] lib/util_sock.c:write_data(1059)
[2008/06/23 13:53:44, 0] lib/util_sock.c:get_peer_addr_internal(1597)
getpeername failed. Error was Transport endpoint is not connected
write_data: write failure in writing to client 0.0.0.0. Error Connection
reset
by peer
[2008/06/23 13:53:44, 0] smbd/process.c:srv_send_smb(74)
Error writing 4 bytes to client. -1. (Transport endpoint is not connected)
[2008/06/23 13:53:44, 0] lib/util_sock.c:get_peer_addr_internal(1597)
getpeername failed. Error was Transport endpoint is not connected
[2008/06/23 13:53:44, 0] lib/util_sock.c:write_data(1059)
[2008/06/23 13:53:44, 0] lib/util_sock.c:get_peer_addr_internal(1597)
getpeername failed. Error was Transport endpoint is not connected
write_data: write failure in writing to client 0.0.0.0. Error Connection
reset
by peer
[2008/06/23 13:53:44, 0] smbd/process.c:srv_send_smb(74)
Error writing 4 bytes to client. -1. (Transport endpoint is not connected)
[2008/06/23 13:53:44, 0] passdb/pdb_ldap.c:ldapsam_add_sam_account(2276)
ldapsam_add_sam_account: failed to modify/add user with uid = TEST$ (dn =
uid=
TEST$,ou=Computers,dc=gardenfreshcorp,dc=com)*
Any one have any ideas what I am missing?
Thanks.
Merle Reine
IT Manager Extraordinaire
Email Address: echo zreyr.ervar(a)tznvy.pbz | perl -pe 'y/a-z/n-za-m/'
14 years, 9 months
Re: [Fedora-directory-users] FDS + Samba +smbtools
by Felipe Alencastro - LM²
Beto,
By default FDS uses "cn=Directory Manager" instead of "cn=Directory Manager,dc=$suffix", try binding with:
slaveDN="cn=Directory Manager"
slavePw="passwd"
masterDN="cn=Directory Manager"
masterPw="passwd"
----- Mensagem original -----
De: "beto .." <betito2208(a)hotmail.com>
Para: fedora-directory-users(a)redhat.com
Enviadas: Domingo, 22 de Junho de 2008 20:52:54 (GMT-0300) Auto-Detected
Assunto: [Fedora-directory-users] FDS + Samba +smbtools
Hello everybody
When I put this command:
#smbldap-useradd -w
I got this error message:
Error: Insufficient 'write' privilege to the 'uidNumber' attribute of entry 'sambadomainname=ejemplo.com,dc=ejemplo,dc=com'.
The configuration for /etc/smbldap-tools/smbldap_bind.conf is:
###########################################
slaveDN="cn=Directory Manager,dc=ejemplo,dc=com"
slavePw="passwd"
masterDN="cn=Directory Manager,dc=ejemplo,dc=com"
masterPw="passwd"
###########################################
Pleasee!!! help me with this problem.
pd: I try to use fdstools but i can't install perl dependencies!!!
If anybody had a manual!! help me please. I'am desperate :S
Sorry for my English, isn't very good.
_________________________________________________________________
Tecnología, moda, motor, viajes,…suscríbete a nuestros boletines para estar siempre a la última
http://newsletters.msn.com/hm/maintenanceeses.asp?L=ES&C=ES&P=WCMaintenan...
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
--
Felipe Alencastro
Consultor de TI
RHCE
51 8145-3443
MSN: felipe(a)lm2.com.br
Skype: felipe.alencastro
LM² Consulting®
http://www.lm2.com.br
Porto Alegre: 51 3018-1007
Florianópolis: 48 4052-9545
São Paulo: 11 3522-5606
Plantão 24hs: 51 8145-2002
14 years, 9 months
[Fedora-directory-users] Trying to follow the howto ssl from wiki
by Edward Capriolo
I was attempting to follow...http://directory.fedoraproject.org/wiki/Howto:SSL
I first ran the script
http://directory.fedoraproject.org/download/setupssl2.sh After
completing fds would not start. I rein
I eventually ended up reading the script and running every operation
stp by step. That was quite an ordeal. All the steps ran however no
errors.
[root@ldapslave1 slapd-ldapslave1]# /etc/init.d/dirsrv start
Starting dirsrv:
ldapslave1...Warning: Incorrect PIN may result in disabling the token
Enter PIN for Internal (Software) Token:
I replaced the data inside pin.txt with :
Internal (Software) Token:dirserv_cert_password
But I am still getting the same message. Is this just a bogus message.
The problem could be elsewhere?
Thanks in advance.
(ps -ef ; w) | sha1sum > /etc/dirsrv/slapd-ldapslave1/pwdfile.txt
chown fds:fds /etc/dirsrv/slapd-ldapslave1/pwdfile.txt
(w ; ps -ef ; date ) | sha1sum | awk '{print $1}' >
/etc/dirsrv/slapd-ldapslave1/noise.txt
chown fds:fds /etc/dirsrv/slapd-ldapslave1/noise.txt
certutil -N -P new- -d /etc/dirsrv/slapd-ldapslave1 -f
/etc/dirsrv/slapd-ldapslave1/pwdfile.txt
chown fds:fds /etc/dirsrv/slapd-ldapslave1/key3.db
chown fds:fds /etc/dirsrv/slapd-ldapslave1/cert8.db
chmod 600 /etc/dirsrv/slapd-ldapslave1/key3.db
chmod 600 /etc/dirsrv/slapd-ldapslave1/cert8.db
certutil -G -P new- -d /etc/dirsrv/slapd-ldapslave1 -z
/etc/dirsrv/slapd-ldapslave1/noise.txt -f
/etc/dirsrv/slapd-ldapslave1/pwdfile.txt
certutil -S -P new- /etc/dirsrv/slapd-ldapslave1/ -n "CA certificate"
-s "cn=CAcert" -x -t "CT,," -m 1000 -v 120 -d
/etc/dirsrv/slapd-ldapslave1 -z /etc/dirsrv/slapd-ldapslave1/noise.txt
-f /etc/dirsrv/slapd-ldapslave1/pwdfile.txt
certutil -L -P new- -d /etc/dirsrv/slapd-ldapslave1 -n "CA
certificate" -a > /etc/dirsrv/slapd-ldapslave1/cacert.asc
pk12util -d /etc/dirsrv/slapd-ldapslave1 -P new- -o
/etc/dirsrv/slapd-ldapslave1/cacert.p12 -n "CA certificate" -w
/etc/dirsrv/slapd-ldapslave1/pwdfile.txt -k
/etc/dirsrv/slapd-ldapslave1/pwdfile.txt
certutil -S -P new- -n "Server-Cert" -s
"cn=ldapslave1.ops.ec.com,ou=Fedora Directory Server" -c "CA
certificate" -t "u,u,u" -m 1001 -v 120 -d
/etc/dirsrv/slapd-ldapslave1/ -z
/etc/dirsrv/slapd-ldapslave1/noise.txt -f
/etc/dirsrv/slapd-ldapslave1/pwdfile.txt
certutil -S -P new- -n "server-cert" -s
"cn=ldapslave1.ops.ec.com,ou=Fedora Administration Server" -c "CA
certificate" -t "u,u,u" -m 1002 -v 120 -d
/etc/dirsrv/slapd-ldapslave1/ -z
/etc/dirsrv/slapd-ldapslave1/noise.txt -f
/etc/dirsrv/slapd-ldapslave1/pwdfile.txt
pk12util -d /etc/dirsrv/slapd-ldapslave1 -P new- -o
/etc/dirsrv/slapd-ldapslave1/adminserver.p12 -n server-cert -w
/etc/dirsrv/slapd-ldapslave1/pwdfile.txt -k
/etc/dirsrv/slapd-ldapslave1/pwdfile.txt
chown fds:fds /etc/dirsrv/slapd-ldapslave1/adminserver.p12
chmod 400 /etc/dirsrv/slapd-ldapslave1/adminserver.p12
cat /etc/dirsrv/slapd-ldapslave1/pwdfile.txt >
/etc/dirsrv/slapd-ldapslave1/pin.txt
chmod 400 /etc/dirsrv/slapd-ldapslave1/pin.txt
mv /etc/dirsrv/slapd-ldapslave1/cert8.db
/etc/dirsrv/slapd-ldapslave1/orig-cert8.db
mv /etc/dirsrv/slapd-ldapslave1/key3.db
/etc/dirsrv/slapd-ldapslave1/orig-key3.db
certutil -N -d /etc/dirsrv/slapd-ldapslave1 -P admin-serv- -f
/etc/dirsrv/slapd-ldapslave1/pwdfile.txt
chown fds:fds /etc/dirsrv/slapd-ldapslave1/admin-serv-*.db
[root@ldapslave1 tmp]# chmod 600 /etc/dirsrv/slapd-ldapslave1/admin-serv-*.db
pk12util -d /etc/dirsrv/slapd-ldapslave1/ -P admin-serv- -n
server-cert -i /etc/dirsrv/slapd-ldapslave1/adminserver.p12 -w
/etc/dirsrv/slapd-ldapslave1/pwdfile.txt -k
/etc/dirsrv/slapd-ldapslave1/pwdfile.txt
certutil -A -d /etc/dirsrv/slapd-ldapslave1/ -P admin-serv- -n "CA
certificate" -t "CT,," -a -i /etc/dirsrv/slapd-ldapslave1/cacert.asc
cat /etc/dirsrv/slapd-ldapslave1/pwdfile.txt >
/etc/dirsrv/slapd-ldapslave1/password.conf
chmod 400 /etc/dirsrv/slapd-ldapslave1/password.conf
chown fds:fds /etc/dirsrv/slapd-ldapslave1/password.conf
sed -e "s@^NSSPassPhrasDialog .*@NSSPassPhraseDialog
file:/etc/dirsrv/slapd-ldapslave1/password/conf
mv /etc/dirsrv/slapd-ldapslave1/new-key3.db
/etc/dirsrv/slapd-ldapslave1/key3.db
mv /etc/dirsrv/slapd-ldapslave1/new-cert8.db
/etc/dirsrv/slapd-ldapslave1/cert8.db
ldapmodify -x -h localhost -p 389 -D "cn=directory manager" -W <<EOF
dn: cn=encryption,cn=config
changetype: modify
replace: nsSSL3
nsSSL3: on
-
replace: nsSSLClientAuth
nsSSLClientAuth: allowed
-
add: nsSSL3Ciphers
nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5,
+rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,+fortezza,
+fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_with_rc4_56_sha,
+tls_rsa_export1024_with_des_cbc_sha
dn: cn=config
changetype: modify
add: nsslapd-security
nsslapd-security: on
-
replace: nsslapd-ssl-check-hostname
nsslapd-ssl-check-hostname: off
dn: cn=RSA,cn=encryption,cn=config
changetype: add
objectclass: top
objectclass: nsEncryptionModule
cn: RSA
nsSSLPersonalitySSL: Server-Cert
nsSSLToken: internal (software)
nsSSLActivation: on
EOF
[root@ldapslave1 slapd-ldapslave1]# /etc/init.d/dirsrv start
Starting dirsrv:
ldapslave1...Warning: Incorrect PIN may result in disabling the token
Enter PIN for Internal (Software) Token:
Any hints thanks!
14 years, 9 months
Re: Re: [Fedora-directory-users] MMR issue
by debu
Hi Chris,
Thanks for your round about way.
As you suggested we have removed everything, along with that we have reinstalled the latest version in two machines, and kept one machine as is (in total we have 3 machines).
Now, we configured these two servers in multi-master mode and initialized one of them from the old machine. Then all the data got pushed into the new servers. These two new machines are replicating properly.
but the replication agreement between the old server and new server is breaking. But we used the console interface to push the delta of updates. But the process is very slow, may be because we haven't done db2ldif to dump the data.
We are planning to push delta of updates from old server to 2 new servers (using the console interface) and remove the old server from the system.
Then these two servers will become primary point of live interaction for read and write.
Since, we can't afford for downtime, we have done like this.
Till now the replication is happening fine.
hope this continues.
Thank you very much for your help.
Regards,
-Debu,vivek
On Fri, 20 Jun 2008 Chris St.Pierre wrote :
>Did you try the workaround in the bug report I sent to you on the
>Redhat list? What were your results?
>
>For reference, that bug is https://bugzilla.redhat.com/show_bug.cgi?id=233642
>
>Chris St. Pierre
>Unix Systems Administrator
>Nebraska Wesleyan University
>
>On Fri, 20 Jun 2008, debu wrote:
>
>>
>>
>>Hi Guys,
>>
>>I am stuck in a very crucial FDS server issue, it would be great if any one of you can help me somehow.
>>
>>We are upgrading from Fedora Directory Service from 1.0.4 to 1.1.0-3
>>
>>We have one existing Server with 1.0.4
>>
>>Now To one server we have initialized the data base and we were able to load the full DB. But, and when we start the replication we see the following error, and the incremental update is not happening.
>>
>>We are going for a multi master replication.
>>
>>
>>Here is the error.
>>
>>On Supplier: (FDS Version 1.0.4) OS: Red Hat Enterprise Linux ES release 4 (Nahant)
>>
>>
>>[17/Jun/2008:11:23:35 +051800] NSMMReplicationPlugin - agmt="cn=Replication_to_10.91.X.Y" (10:8888): Unable to acquire replica: Excessive clock skew between the supplier and the consumer. Replication is aborting.
>>
>>[17/Jun/2008:11:23:35 +051800] NSMMReplicationPlugin - agmt="cn=Replication_to_10.91.X.Y" (10:8888): Incremental update failed and requires administrator action
>>
>>
>>
>>On consumer: (FD version 1.1.0-3) OS: Red Hat Enterprise Linux Server release 5.1 (Tikanga)
>>
>>
>>
>>[17/Jun/2008:11:12:59 +051800] NSMMReplicationPlugin - conn=46251 op=1975 replica="o=TejaUsers": Unable to acquire replica: error: excessive clock skew
>>
>>[17/Jun/2008:11:23:34 +051800] - csngen_adjust_time: adjustment limit exceeded; value - 86401, limit - 86400
>>
>>[17/Jun/2008:11:23:34 +051800] NSMMReplicationPlugin - conn=46461 op=792 replica="o=TejaUsers": Unable to acquire replica: error: excessive clock skew
>>
>>
>>Now, My doubt is we succeded in a test environment with the same, with the only diference that we had the same OS in both the server, rest all same. Our servers are perfectly synced with NTP also.
>>
>>Please help in this scenario..
>>
>>Regards
>>~Debajit
14 years, 9 months
[Fedora-directory-users] FDS SSHA to md5
by debu
Hi ALL,
We are on a process of upgrading Fedora Directory Service from 1.0 to 1.1.
But now we have come across a situation where we need to enforce FDS to use md5 as the encryption schema and not SSHS for authentication purpose while storing userPassword.
Please comment/help/suggest.
Thanks You
debu
14 years, 9 months
[Fedora-directory-users] Where is Fedora DS 1.1.1?
by DANIEL CRISTIAN CRUZ
Hi all,
I didn't saw any change on the yum repositories for Fedora 6 (recommended
for RH 5.1). Where are the RPMS? Is there another repository?
If I ran yum install fedora-ds, nothing happens...
Thanks,
--
<span style="color: #000080">Daniel Cristian Cruz
</span>Administrador de Banco de Dados
Direção Regional - Núcleo de Tecnologia da Informação
SENAI - SC
Telefone: 48-3239-1422 (ramal 1422)
14 years, 9 months