Doubt regarding the 389 Client Root access?
by Ajeet S Raina
Hello Guys,
I have a doubt regarding the 389 Server Client Architecture. Say, I have 389
Server working and I have few Linux Clients. Now you say that if 389 client
is configured it will login through credentials which is configured in
Server. So what about the local Users on that Client.
How will normal users in the Client login?
14 years, 3 months
AD user moves vs. 389 user moves.
by Anne (juniper) Cross
Our AD admins want to move users from our ou=Users tree to a new tree called ou=Departed, after we've locked the accounts, so that we know when a user has left the company and we've completed the cleanup process. We've discovered through trial and error that when they do this on the AD server, it doesn't actually move the user out of the ou=Users tree on the 389 server. The accounts stay synced - passwords transmit and so forth - but the state of affairs is somewhat confusing.
If I delete the user and then recreate them in the correct tree on my side, the AD server blows the user away and we lose all history - old passwords, AD preferences, etc, which is annoying when the person in question is an intern who might come back.
Anyone have any suggestions on a workaround for this state of affairs? It doesn't look like a *bug* to me so much as a complete difference of opinion on how a user "move" should be accomplished between 389 and AD 2008.
-- juniper
14 years, 3 months
Setting up a 389 Server on my Organization?
by Ajeet S Raina
Hello Guys,
I am going to setup a 389 Server for my organization. I have nothing to do
with Active Directory Server as I don't to be under the Windows Sysadmin
shoes.
We are Infrastructure Team of around 30 Linux and Unix Sysadmins.All I want
to know is what organization structure I need to follow.I have been assigned
with preparing mid-level plan for the setting up of 389 Directory
Server(without ADS stuffs).
Do you have any slides/ links discussing quick look at the 389 Server
structure and architecture from Start.
Pls Help me with the same.
14 years, 3 months
Making changes to the DN attribute of an LDAP object
by Kenneth Holter
Hi.
Is it possible to change the value of an LDAP object's DN attribute? I'd
like to be able to change from uppercase to lowercase, but I'm not sure if
it's supposed to work being the DN attribute and all.. My inital attempts
have failed, so just thought I'd ask you guys if it's supposed to work in
the first place.
Regards,
Kenneth Holter
14 years, 3 months
Re: [389-users] 389-adminutil error
by Prashanth Sundaram
Here it is
/usr/lib64/libldap60.so
/usr/lib64/libldif60.so
/usr/lib64/libprldap60.so
/usr/lib64/libssldap60.so
/usr/share/doc/mozldap-6.0.5
/usr/share/doc/mozldap-6.0.5/README.rpm
Prashanth Sundaram wrote:
>
> Mozldap pkgs are available and installed.
>
> mozldap-tools-6.0.5-1.el5
> mozldap-6.0.5-1.el5
rpm -ql mozldap
>
>
> Prashanth Sundaram wrote:
14 years, 3 months
Re: [389-users] 389-adminutil error
by Prashanth Sundaram
Mozldap pkgs are available and installed.
mozldap-tools-6.0.5-1.el5
mozldap-6.0.5-1.el5
Prashanth Sundaram wrote:
> Rich,
>
> Centos 5.4(Final) 64-bit 2.6.18-164.9.1.el5
>
> Repos
> Rpmforge, EPEL,EPEL-Testing, pgdg-84 CentOS-Base CentOS-Media
Hmm - is the mozldap package available from CentOS?
>
>
> Hi Rich,
>
>
> I am getting this error when I install 389-adminutil. Any idea
> which package gives these dependencies?
>
14 years, 3 months
Re: [389-users] 389-adminutil error
by Prashanth Sundaram
Rich,
Centos 5.4(Final) 64-bit 2.6.18-164.9.1.el5
Repos
Rpmforge, EPEL,EPEL-Testing, pgdg-84 CentOS-Base CentOS-Media
Hi Rich,
>
> I am getting this error when I install 389-adminutil. Any idea which package
> gives these dependencies?
What is your platform? RHEL 5? CentOS 5? Something else? What version?
32-bit or 64-bit?
>
>
> [root ldap02 psundaram]# yum install 389-adminutilLoaded plugins:
> fastestmirror Loading mirror speeds from cached hostfile
> Setting up Install Process
> Resolving Dependencies
> --> Running transaction check
> ---> Package 389-adminutil.i386 0:1.1.8-4.el5 set to be updated
> --> Processing Dependency: libssl3.so for package: 389-adminutil
> --> Processing Dependency: libplc4.so for package: 389-adminutil
> --> Processing Dependency: libldap60.so for package: 389-adminutil
> --> Processing Dependency: libnss3.so for package: 389-adminutil
> --> Processing Dependency: libnss3.so(NSS_3.5) for package: 389-adminutil
> --> Processing Dependency: libldif60.so for package: 389-adminutil
> --> Processing Dependency: libssl3.so(NSS_3.2) for package: 389-adminutil
> --> Processing Dependency: libnspr4.so for package: 389-adminutil
> --> Processing Dependency: libnss3.so(NSS_3.2) for package: 389-adminutil
> --> Processing Dependency: libprldap60.so for package: 389-adminutil
> --> Processing Dependency: libssldap60.so for package: 389-adminutil
> ---> Package 389-adminutil.x86_64 0:1.1.8-4.el5 set to be updated
> --> Running transaction check
> ---> Package 389-adminutil.i386 0:1.1.8-4.el5 set to be updated
> --> Processing Dependency: libldap60.so for package: 389-adminutil
> --> Processing Dependency: libldif60.so for package: 389-adminutil
> --> Processing Dependency: libprldap60.so for package: 389-adminutil
> --> Processing Dependency: libssldap60.so for package: 389-adminutil
> ---> Package nspr.i386 0:4.7.6-1.el5_4 set to be updated
> ---> Package nss.i386 0:3.12.3.99.3-1.el5.centos.2 set to be updated
> --> Finished Dependency Resolution
> 389-adminutil-1.1.8-4.el5.i386 from epel has depsolving problems
> --> Missing Dependency: libldap60.so is needed by package
> 389-adminutil-1.1.8-4.el5.i386 (epel)
> 389-adminutil-1.1.8-4.el5.i386 from epel has depsolving problems
> --> Missing Dependency: libssldap60.so is needed by package
> 389-adminutil-1.1.8-4.el5.i386 (epel)
> 389-adminutil-1.1.8-4.el5.i386 from epel has depsolving problems
> --> Missing Dependency: libldif60.so is needed by package
> 389-adminutil-1.1.8-4.el5.i386 (epel)
> 389-adminutil-1.1.8-4.el5.i386 from epel has depsolving problems
> --> Missing Dependency: libprldap60.so is needed by package
> 389-adminutil-1.1.8-4.el5.i386 (epel) *Error: Missing Dependency:
> libprldap60.so is needed by package 389-adminutil-1.1.8-4.el5.i386 (epel)
> Error: Missing Dependency: libssldap60.so is needed by package
> 389-adminutil-1.1.8-4.el5.i386 (epel) Error: Missing Dependency: libldap60.so
> is needed by package 389-adminutil-1.1.8-4.el5.i386 (epel) Error: Missing
> Dependency: libldif60.so is needed by package 389-adminutil-1.1.8-4.el5.i386
> (epel)
> * You could try using --skip-broken to work around the problem
> You could try running: package-cleanup --problems
> package-cleanup --dupes
> rpm -Va --nofiles nodigest
>
14 years, 3 months
ADS <==> FedoraDS <==> Linux/Unix Clients?
by Ajeet S Raina
I have a certain query regarding the following structure:
Code:
Active Directory Server
||
||
Fedora Directory Server <=> Client(Linux | Fedora | Ubuntu | Solaris | HP)
Let me explain you what I want:
1.There is a company Active Directory Server under domain intinfra.com.As of
now there are limited Windows Desktop Machine under that domain.I have few
Linux / Unix Machines which I want to authenticate through ADS(which are
presently not under ADS).Why? Becoz' everytime I need to delete the users
whenver they leave the project.Thats Cumbersome.
So what I want is Setup Fedora DS(Wonder if We can do that without Fedora
DS).Now I can ads join to Fedora DS(I have administrative privileges for
ADS).What I really want to know is:
If I join Fedora DS to ADS then all employee can login to the Linux Machine
through their login credentials. I dont want that to happen.We have 3000
employee in intinfra Domain but We are only 30 Admins. I only want those
30-40 admins to login restrictly.Is it possible to restrict at FedoraDS
level.
2.Say, I joined ADS and fedora DS and say after 30 days one of System Admin
left the company.So his name will be removed from ADS. Is it possible that
ADS and Fedora DS are synchronized in such a way that a user whose name gets
deleted in ADS, gets deleted too from fedora .Do fedora DS has the
capability to synchronize to ADS everytime.
Pls Suggest.
14 years, 3 months
Re: [389-users] SubjectAltName MMR question
by Prashanth Sundaram
Rich,
I specify the individual host¹s FQDN in the replication agreement. I use
haproxy for LB, so the hosts are in ACTIVE-PASSIVE state.
Prashanth Sundaram wrote:
> Hi All,
>
> Which one of the case below is suitable for a Multi-Master replication. I have
> a load balancer with/ ldap.domain.com,/ which is what clients will use to
> authenticate.
>
> *_Question:
> _*Which one is a better implementation? What are the trade-offs? Please input
> your feedback as it might be useful for someone coming this way later. This
> can serve as a knowledge bank.
>
> Case-I
> ldap01: server-cert with cn=ldap01.domain.com, subjAltName=ldap.domain.com
> ldap02: server-cert with cn=ldap02.domain.com, subjAltName=ldap.domain.com
> -MMR with tls throws error when ³*Check hostname against name in certificate
> for outbound SSL connections²* option is enabled. But RH recommends it to be
> turned ON.
What is the FQDN you specified in the replication agreement?
>
> Case-II
> ldap01: server-cert with cn=ldap.domain.com, subjAltName=ldap01.domain.com,
> ldap02.domain.com ldap01: server-cert with cn=ldap.domain.com,
> subjAltName=ldap01.domain.com,ldap02.domain.com -Does not comply with the
> requirement that ³server-cert² should have hostname as cn.I found this method
> working perfectly fine.
>
> *Knowledge Sharing:
> *Here¹s a useful link which I use all the time and look before posting to the
> list. This is the archive for the mailing list and has /search/ feature which
> very useful.
>
> http://www.mail-archive.com/fedora-directory-users redhat com/info.html
> ------------------------------------------------------------------------
>
> --
> 389 users mailing list
> 389-users redhat com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
[Date Prev
<https://www.redhat.com/archives/fedora-directory-users/2010-January/msg0000
6.html> ][Date Next
<https://www.redhat.com/archives/fedora-directory-users/2010-January/msg0000
8.html> ] [Thread Prev
<https://www.redhat.com/archives/fedora-directory-users/2010-January/msg0000
6.html> ][Thread Next
<https://www.redhat.com/archives/fedora-directory-users/2010-January/msg0000
8.html> ] [Thread Index
<https://www.redhat.com/archives/fedora-directory-users/2010-January/thread.
html#00007> ] [Date Index
<https://www.redhat.com/archives/fedora-directory-users/2010-January/date.ht
ml#00007> ] [Author Index
<https://www.redhat.com/archives/fedora-directory-users/2010-January/author.
html#00007> ]
14 years, 3 months