certificate with subjectAltName
by muzzol
hi,
i've created a cert request with "-8" parameter (subjectAltName),
signed with my own openssl CA and installed on a 389 node.
when i perform an ldapsearch with TLS (-ZZ) i get
TLS: hostname (ldap.example.com) does not match common name in
certificate (node1.example.com).
i've double checked all steps but no success.
any advice?
regards.
--
========================
^ ^
O O
(_ _)
muzzol(a)muzzol.com
========================
jabber id: muzzol(a)jabber.dk
========================
No atribueixis qualitats humanes als ordinadors.
No els hi agrada.
========================
"El gobierno español sólo habla con terroristas, homosexuales y
catalanes, a ver cuando se decide a hablar con gente normal"
Jiménez Losantos
========================
<echelon spamming>
bomb terrorism bush aznar teletubbies
</echelon spamming>
14 years, 3 months
Backup Script for complete 389 Server?
by Ajeet S Raina
Guys,
If anyone who have ever written a script which will complete backup of the
389 Server.
Do 389 Server have such inbuilt tool?
Pls Suggest.
14 years, 3 months
FDS + SVN on Apache fails with error 500
by Alin Ilie
Hi,
I have installed 389-DS on Fedora 12 x86_64.
I can authenticate other services against the DS.
Unfortunately I cannot authenticate SVN over DS.
It returns error 500.
My config file is:
<VirtualHost *:80>
DocumentRoot /var/www/svn
ServerName svn.matrixrom.ro
# Work around authz and SVNListParentPath issue
#RedirectMatch ^(/svn)$ $1/
# Enable Subversion logging
CustomLog logs/svn_logfile "%t %u %{SVN-ACTION}e" env=SVN-ACTION
LoadModule dav_svn_module modules/mod_dav_svn.so
LoadModule authz_svn_module modules/mod_authz_svn.so
#
# Example configuration to enable HTTP access for a directory
# containing Subversion repositories, "/var/www/svn". Each repository
# must be both:
#
# a) readable and writable by the 'apache' user, and
#
# b) labelled with the 'http_sys_content_rw_t' context if using
# SELinux
#
#
# To create a new repository "http://localhost/repos/stuff" using
# this configuration, run as root:
#
# # cd /var/www/svn
# # svnadmin create stuff
# # chown -R apache.apache stuff
# # chcon -R -t -t http_sys_content_rw_t stuff
#
<Location /repos>
DAV svn
SVNParentPath /var/www/svn
# List repositories colleciton
#SVNListParentPath On
# Enable WebDAV automatic versioning
SVNAutoversioning On
# Repository Display Name
SVNReposName "Subversion Repository"
# Limit write permission to list of valid users.
<LimitExcept PROPFIND OPTIONS REPORT>
# Require SSL connection for password protection.
SSLRequire false
AuthType Basic
AuthName "Subversion Repository"
# AuthUserFile /path/to/passwdfile
# AuthUserFile /etc/httpd/passwdfile
#Alin
# Make LDAP the authentication mechanism
AuthBasicProvider ldap
AuthzLDAPMethod ldap
# AuthzLDAPAuthoritative on
# AuthLDAPBindDN "cn=Directory manager,dc=matrixrom,dc=ro"
# This is the password for the AuthLDAPBindDN user in Active Directory
# AuthLDAPBindPassword cascade123
AuthzLDAPServer localhost
AuthzLDAPUserBase ou=People,dc=matrixrom,dc=ro
AuthzLDAPUserKey uid
AuthzLDAPUserScope base
# AuthLDAPURL
"ldap://localhost:389/ou=People,dc=matrixrom,dc=ro?uid?base?(ObjectClass=person)"
#Alin
Require valid-user
</LimitExcept>
</Location>
<Directory /svn>
Options +Indexes FollowSymLinks
AllowOverride All
Order Allow,Deny
Allow from all
</Directory>
</VirtualHost>
The output in the httpd error log is:
[Wed Jan 06 23:06:41 2010] [info] Init: Seeding PRNG with 144 bytes of
entropy
[Wed Jan 06 23:06:41 2010] [info] Init: Seeding PRNG with 144 bytes of
entropy
[Wed Jan 06 23:06:41 2010] [debug] proxy_util.c(1806): proxy: grabbed
scoreboard slot 0 in child 31358 for worker proxy:reverse
[Wed Jan 06 23:06:41 2010] [debug] proxy_util.c(1825): proxy: worker
proxy:reverse already initialized
[Wed Jan 06 23:06:41 2010] [debug] proxy_util.c(1922): proxy:
initialized single connection worker 0 in child 31358 for (*)
[Wed Jan 06 23:06:41 2010] [debug] proxy_util.c(1806): proxy: grabbed
scoreboard slot 0 in child 31359 for worker proxy:reverse
[Wed Jan 06 23:06:41 2010] [debug] proxy_util.c(1825): proxy: worker
proxy:reverse already initialized
[Wed Jan 06 23:06:41 2010] [debug] proxy_util.c(1922): proxy:
initialized single connection worker 0 in child 31359 for (*)
Thank you very much,
Alin Ilie
--
This message has been scanned for viruses and dangerous content
by MailScanner on Yellow! GNU server, and is believed to be clean.
14 years, 3 months
Re: [389-users] Announcing 389 Directory Server 1.2.5 Release Candidate 4
by Anne (juniper) Cross
It looks like the Install_Guide (http://directory.fedoraproject.org/wiki/Install_Guide) needs to be updated for the testing entries.
I needed to run the following:
yum upgrade --enablerepo=epel-testing 389-ds-base
instead of:
yum upgrade --enablerepo=updates-testing
Still testing the rest of it...
-- juniper
----- Original Message -----
From: "Rich Megginson" <rmeggins(a)redhat.com>
To: 389-announce(a)redhat.com, 389-users(a)redhat.com
Sent: Tuesday, January 5, 2010 6:26:42 PM GMT -05:00 US/Canada Eastern
Subject: [389-users] Announcing 389 Directory Server 1.2.5 Release Candidate 4
The 389 team is pleased to announce the availability of Release
Candidate 4 of version 1.2.5.
NOTE: Packages for Enterprise Linux are available from EPEL. We will no
longer have a separate yum repo for these packagse.
We need your help! Please help us test this software. It is a Release
Candidate, so it is fairly stable at this point. We have worked hard to
make sure upgrades from previous releases are as smooth as possible, and
we would really appreciate feedback about upgrades. The Fedora system
strongly encourages packages to be in Testing until verified and pushed
to Stable. If we don't get any feedback while the packages are in
Testing, the packages will remain in limbo, or get pushed to Stable.
The more testing we get, the faster we can release these packages to Stable.
The packages that need testing are:
* 389-ds-base-1.2.5.rc4
* Release Notes - http://port389.org/wiki/Release_Notes
* Install_Guide - http://port389.org/wiki/Install_Guide
* Download - http://port389.org/wiki/Download
=== New features ===
None - this release is primarily to fix the bug about Active Directory
password sync
=== Bugs Fixed ===
This release contains a couple of bug fixes. The complete list of bugs
fixed is found at the link below. Note that bugs marked as MODIFIED
have been fixed but are still in testing.
* Tracking bug for 1.2.5 release -
https://bugzilla.redhat.com/showdependencytree.cgi?id=533025&hide_resolved=0
* https://bugzilla.redhat.com/show_bug.cgi?id=537956 Password
replication from 389DS to AD2008(64bit) fails, all other replication
continues
--
389 users mailing list
389-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
14 years, 3 months
Web interface to the user directory console?
by Kenneth Holter
Hi.
We're setting up Red Hat Directory Server v8.1.0, and are able to access the
Directory Server console by issuing the redhat-idm-console script. I can
access the administration module by pointing my web browser to port 9830 on
the LDAP server. But is there a way to get access to the directory server
(i.e. user management and stuff) from a web interface? I would be great to
access the user directory via a web interface, instead of using SSH'ing into
the ldap server and use X forwarding to get the console up and running.
Best regards,
Kenneth Holter
14 years, 3 months
Unable to make changes on a server from the management console
by Erling Ringen Elvsrud
Hello,
I have this setup:
- One master directory server which also contains the configuration directory
- Two replicas, both use the configuration directory of the master.
I open the management console on the master like this:
/usr/bin/redhat-idm-console -a https://<fqdn of my master>:9830
When authenticated I get the "Console" window with two tabs, "Servers
and Application" and "Users and Groups"
in the "Servers and Applications" tab I have the tree of directory
server instances with my
suffix at the top. I click "+" on one of the replica instances, and
the "+" of the server group.
I then open the directory server instance by clicking "open".
The console window of that directory server instance then opens, with
tabs "Tasks", "Configuration", "Directory" and "Status".
I want to among other tasks enable encryption for that instance, so I
click the "Configuration" tab, and
"Encryption". I check the "Enable SSL for this server" box. The
problem is that both "Save" and "Reset" are grey, so I cannot commit
my changes. Other actions like stop and start under "Tasks" aborts
with messages like "Directory sever xyz could not be stopped".
Where should I look to correct this issue?
Thanks,
Erling Ringen Elvsrud
14 years, 3 months
Script to add
by Ajeet S Raina
Can anyone help me with automated script for 389 Clients to get
automatically be created?
all I need is run that script during boot time whenever any 389 Client gets
added.That will probably save my time.
14 years, 3 months
Trouble with upgrade
by Orion Poplawski
I'm trying to upgrade from fedora-ds-base-1.1.2 and admin-1.1.6 to
389-ds-base-1.2.4 and admin-1.1.9. Running setup-ds-admin.pl -u I get:
Are you ready to set up your servers? [yes]:
dn: cn=SMD5,cn=Password Storage Schemes,cn=plugins,cn=config
objectclass: top
objectclass: nsSlapdPlugin
cn: SMD5
nsslapd-pluginpath: libpwdstorage-plugin
nsslapd-plugininitfunc: smd5_pwd_storage_scheme_init
nsslapd-plugintype: pwdstoragescheme
nsslapd-pluginenabled: on
Error adding entry 'cn=SMD5,cn=Password Storage
Schemes,cn=plugins,cn=config'. Error: Object class violation
Could not reconfigure the admin server.
Exiting . . .
I'm guessing I need to copy the new /etc/dirsrv/schema files into
/etc/dirsrv/slapd-<serverid>/schema? Don't see that mentioned here:
http://directory.fedoraproject.org/wiki/Install_Guide#Upgrading
Should I file a bug?
Thanks!
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA/CoRA Division FAX: 303-415-9702
3380 Mitchell Lane orion(a)cora.nwra.com
Boulder, CO 80301 http://www.cora.nwra.com
14 years, 3 months
List address
by Orion Poplawski
----- The following addresses had permanent fatal errors -----
<389-users(a)redhat.com>
(reason: 550 5.2.1 <389-users(a)redhat.com>... Mailbox disabled for
this recipient)
But this is the address shown in the footer
|
\|/
14 years, 3 months