389-users December 2011

389-users@lists.fedoraproject.org

20 participants
26 discussions

Stop user being replicated with Active Directory
by Juan Asensio Sánchez 19 Dec '11

19 Dec '11

Hi After one user has been replicated from 389 DS to Active Directory, is there any way to stop replicating it? I want the user, after deleting some attrs in 389 DS (ntUser objectClass, ...), be deleted in Active Directory, but already exists in 389 DS. Is this possible? Thanks in advance.

3 4

console issues
by Josh Ellsworth 15 Dec '11

15 Dec '11

I am working on deploying 389 in my organization but I'm having an issue with the Windows console. After I log in, the console looks like the screenshot here: http://imgur.com/W1hVd When I click on the Directory Server tree it changes to say "this server component has not yet been downloaded, or it could not be activated. Press Download to retry." I need to be able to access the Directory Server properties, any idea why I can't? -- Joshua Ellsworth System Administrator, Primatics Financial Phone: 571.765.7528 jellsworth(a)primaticsfinancial.com

2 7

MMR referral list questions.
by Shardul Kerkar 14 Dec '11

14 Dec '11

Hi , I am testing MMR on our QA ldap servers using version 1.1.2. Currently I have setup Master-1 and Master-2 as the two read-write suppliers. Hub-1 has replication agreements with Master-1 and Master-2. Rep-1 has replication to Hub-1. Consequently Hub-1 has Master-1 and Master-2 in its referral list. Anytime I do a write on rep, the change always takes place on Master-1 and flows down the tree. Only if I bring Master-1 down, does Master-2 take over. How do I tell Hub-1 to distribute writes equally to both Masters. Also if I want to intentionally do all changes on Master-2, is there a way for Hub to prefer one referral over the other? Thank you, Shar

2 1

Password sync
by Viento . 14 Dec '11

14 Dec '11

Hi all,I have installed a 389ds which sync entries from an Active Directory running on Windows 2003 R2 Enterprise Server. Everything works fine even Password Sync. But I have still 1 problems I don't get solved: 11/30/11 00:35:46: There are no entries that match: test3 11/30/11 00:35:46: Deferring password change for test3

2 1

Re: [389-users] How do I configure Solaris 10 as a LDAP client.
by Carsten Grzemba 13 Dec '11

13 Dec '11

For SSHA Passwords needs Solaris a proper pam configuration, for SSH especially the section : other auth requisite pam_authtok_get.so.1 other auth required pam_dhkeys.so.1 other auth required pam_unix_cred.so.1 other auth binding pam_unix_auth.so.1 server_policy other auth required pam_ldap.so.1 Because there are some variations in the config between the Solaris versions, the best source for the right stack is # man pam_ldap Carsten Am 13.12.11, schrieb Arpit Tolani <arpittolani(a)gmail.com>: > Below are the configuration i configured, able to see the user in getent passwd output > see user in ldaplist output. > > but cant login. it fails using ssh > > bash-3.2# cat /etc/nsswitch.conf |grep -v "^#" > > passwd: files ldap > > group: files ldap > hosts: files dns # Added by DHCP > ipnodes: files dns # Added by DHCP > networks: files > protocols: files > rpc: files > ethers: files > netmasks: files > bootparams: files > > > publickey: files > netgroup: files > automount: files > aliases: files > services: files > printers: user files > auth_attr: files > prof_attr: files > project: files > tnrhtp: files > tnrhdb: files > > > > bash-3.2# cat /etc/pam.conf |grep -v "^#" > login auth requisite pam_authtok_get.so.1 > login auth required pam_dhkeys.so.1 > login auth required pam_unix_cred.so.1 > > login auth required pam_unix_auth.so.1 > > login auth required pam_dial_auth.so.1 > login auth required pam_ldap.so.1 > rlogin auth sufficient pam_rhosts_auth.so.1 > rlogin auth requisite pam_authtok_get.so.1 > rlogin auth required pam_dhkeys.so.1 > > > rlogin auth required pam_unix_cred.so.1 > rlogin auth required pam_unix_auth.so.1 > rlogin auth required pam_unix_auth.so.1 > krlogin auth required pam_unix_cred.so.1 > krlogin auth required pam_krb5.so.1 > > > rsh auth sufficient pam_rhosts_auth.so.1 > rsh auth required pam_unix_cred.so.1 > rsh auth required pam_ldap.so.1 > krsh auth required pam_unix_cred.so.1 > krsh auth required pam_krb5.so.1 > > > ktelnet auth required pam_unix_cred.so.1 > ktelnet auth required pam_krb5.so.1 > ppp auth requisite pam_authtok_get.so.1 > ppp auth required pam_dhkeys.so.1 > ppp auth required pam_unix_cred.so.1 > > > ppp auth required pam_unix_auth.so.1 > ppp auth required pam_dial_auth.so.1 > ppp auth required pam_ldap.so.1 > other auth requisite pam_authtok_get.so.1 > other auth required pam_dhkeys.so.1 > > > other auth required pam_unix_cred.so.1 > other auth required pam_unix_auth.so.1 > other auth required pam_ldap.so.1 > passwd auth required pam_passwd_auth.so.1 > passwd auth required pam_ldap.so.1 > > > cron account required pam_unix_account.so.1 > other account sufficient pam_ldap.so.1 > other account requisite pam_roles.so.1 > other account required pam_unix_account.so.1 > other session required pam_unix_session.so.1 > > > other password required pam_dhkeys.so.1 > other password requisite pam_authtok_get.so.1 > other password requisite pam_authtok_check.so.1 force_check > other password required pam_authtok_store.so.1 > > > > bash-3.2# cat /var/ldap/ldap_client_file > NS_LDAP_FILE_VERSION= 2.0 > NS_LDAP_SERVERS= 192.168.122.155 > NS_LDAP_SEARCH_BASEDN= dc=example,dc=com > NS_LDAP_AUTH= simple > NS_LDAP_SEARCH_REF= TRUE > NS_LDAP_SEARCH_SCOPE= sub > > > NS_LDAP_SEARCH_TIME= 30 > NS_LDAP_CACHETTL= 43200 > NS_LDAP_PROFILE= default > NS_LDAP_CREDENTIAL_LEVEL= proxy > NS_LDAP_SERVICE_SEARCH_DESC= passwd: ou=People,dc=example,dc=com?sub > NS_LDAP_SERVICE_SEARCH_DESC= group: ou=Groups,dc=example,dc=com?sub > > > NS_LDAP_SERVICE_SEARCH_DESC= shadow: ou=People,dc=example,dc=com?sub > NS_LDAP_BIND_TIME= 2 > > bash-3.2# cat /var/ldap/ldap_client_cred > NS_LDAP_BINDDN="cn=Directory Manager" > NS_LDAP_BINDPASSWD=redhat123 > > > > bash-3.2# /etc/init.d/ldap.client start > bash-3.2# svcadm enable network/ldap/client > bash-3.2# /usr/lib/ldap/ldap_cachemgr -g > > bash-3.2# getent passwd test > test:x:1001:1001::/home/test:/bin/bash > > > > bash-3.2# ldaplist -l passwd test > dn: uid=test,ou=People,dc=example,dc=com > uidNumber: 1001 > sn: test > gidNumber: 1001 > loginShell: /usr/bin/bash > shadowMax: 99999 > > objectClass: person > > objectClass: organizationalPerson > objectClass: inetOrgPerson > objectClass: posixAccount > objectClass: shadowAccount > objectClass: top > uid: test > shadowLastChange: 12994 > > > cn: test > homeDirectory: /home/test > shadowWarning: 7 > userPassword: {SSHA}6qy0z4cffk6tZdbh0IaOSOJgAqlmCq/zCtAX+g== > > > -- > > Thanks & Regards > Arpit Tolani > > > > -- Carsten Grzemba Tel.: +49 3677 64740 Mobil: +49 171 9749479 Fax:: +49 3677 6474111 Email: carsten.grzemba(a)contac-dt.de contac Datentechnik GmbH

2 1

How do I configure Solaris 10 as a LDAP client.
by Arpit Tolani 13 Dec '11

13 Dec '11

Below are the configuration i configured, able to see the user in getent passwd output see user in ldaplist output. but cant login. it fails using ssh bash-3.2# cat /etc/nsswitch.conf |grep -v "^#" passwd: files ldap group: files ldap hosts: files dns # Added by DHCP ipnodes: files dns # Added by DHCP networks: files protocols: files rpc: files ethers: files netmasks: files bootparams: files publickey: files netgroup: files automount: files aliases: files services: files printers: user files auth_attr: files prof_attr: files project: files tnrhtp: files tnrhdb: files bash-3.2# cat /etc/pam.conf |grep -v "^#" login auth requisite pam_authtok_get.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 login auth required pam_unix_auth.so.1 login auth required pam_dial_auth.so.1 login auth required pam_ldap.so.1 rlogin auth sufficient pam_rhosts_auth.so.1 rlogin auth requisite pam_authtok_get.so.1 rlogin auth required pam_dhkeys.so.1 rlogin auth required pam_unix_cred.so.1 rlogin auth required pam_unix_auth.so.1 rlogin auth required pam_unix_auth.so.1 krlogin auth required pam_unix_cred.so.1 krlogin auth required pam_krb5.so.1 rsh auth sufficient pam_rhosts_auth.so.1 rsh auth required pam_unix_cred.so.1 rsh auth required pam_ldap.so.1 krsh auth required pam_unix_cred.so.1 krsh auth required pam_krb5.so.1 ktelnet auth required pam_unix_cred.so.1 ktelnet auth required pam_krb5.so.1 ppp auth requisite pam_authtok_get.so.1 ppp auth required pam_dhkeys.so.1 ppp auth required pam_unix_cred.so.1 ppp auth required pam_unix_auth.so.1 ppp auth required pam_dial_auth.so.1 ppp auth required pam_ldap.so.1 other auth requisite pam_authtok_get.so.1 other auth required pam_dhkeys.so.1 other auth required pam_unix_cred.so.1 other auth required pam_unix_auth.so.1 other auth required pam_ldap.so.1 passwd auth required pam_passwd_auth.so.1 passwd auth required pam_ldap.so.1 cron account required pam_unix_account.so.1 other account sufficient pam_ldap.so.1 other account requisite pam_roles.so.1 other account required pam_unix_account.so.1 other session required pam_unix_session.so.1 other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 force_check other password required pam_authtok_store.so.1 bash-3.2# cat /var/ldap/ldap_client_file NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_SERVERS= 192.168.122.155 NS_LDAP_SEARCH_BASEDN= dc=example,dc=com NS_LDAP_AUTH= simple NS_LDAP_SEARCH_REF= TRUE NS_LDAP_SEARCH_SCOPE= sub NS_LDAP_SEARCH_TIME= 30 NS_LDAP_CACHETTL= 43200 NS_LDAP_PROFILE= default NS_LDAP_CREDENTIAL_LEVEL= proxy NS_LDAP_SERVICE_SEARCH_DESC= passwd: ou=People,dc=example,dc=com? sub NS_LDAP_SERVICE_SEARCH_DESC= group: ou=Groups,dc=example,dc=com?sub NS_LDAP_SERVICE_SEARCH_DESC= shadow: ou=People,dc=example,dc=com?sub NS_LDAP_BIND_TIME= 2 bash-3.2# cat /var/ldap/ldap_client_cred NS_LDAP_BINDDN="cn=Directory Manager" NS_LDAP_BINDPASSWD=redhat123 bash-3.2# /etc/init.d/ldap.client start bash-3.2# svcadm enable network/ldap/client bash-3.2# /usr/lib/ldap/ldap_cachemgr -g bash-3.2# getent passwd test test:x:1001:1001::/home/test:/bin/bash bash-3.2# ldaplist -l passwd test dn: uid=test,ou=People,dc=example,dc=com uidNumber: 1001 sn: test gidNumber: 1001 loginShell: /usr/bin/bash shadowMax: 99999 objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: top uid: test shadowLastChange: 12994 cn: test homeDirectory: /home/test shadowWarning: 7 userPassword: {SSHA}6qy0z4cffk6tZdbh0IaOSOJgAqlmCq/zCtAX+g== -- Thanks & Regards Arpit Tolani

1 0

389 DS on CentOS 6.1
by sigid＠JINLab 12 Dec '11

12 Dec '11

2 1

Re: [389-users] upgraded to latest 389, now anon binds return no results
by Brian High 08 Dec '11

08 Dec '11

Jeremy, Thanks for the suggestion. I have found that setting this to "off" or "on" (and restarting dirsrv) makes no difference. Any other ideas? --Brian On Thu, 8 Dec 2011, Jeremy A. Mates wrote: > El día 7 de diciembre de 2011 22:35, Brian High <high(a)uw.edu> escribió: >> Hi 389-users, >> >> Perhaps you can help solve a mystery for me. > > nsslapd-allow-unauthenticated-binds: on perhaps? > > Jeremy > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users

2 5

[Q] Automatic update of shadowLastChange attribute
by Iain Morgan 08 Dec '11

08 Dec '11

Hello, Is there any way to have 389 DS automatically update the shadowLastChange attribute when the userPassword attribute is changed for an entry? I know that pam_ldap will attempt to update the shadowLastChange attribute, but this either requires that the user has the privileges to update this attribute. What I would like is for the server to update the attribute directly without having to grant extra privileges to the user. Is there any way to do this? Thanks -- Iain Morgan

3 2

upgraded to latest 389, now anon binds return no results
by Brian High 07 Dec '11

07 Dec '11

Hi 389-users, Perhaps you can help solve a mystery for me. I just upgraded 389 Directory on RHEL5, 64bit from 389-ds-base 1.2.2 to 1.2.9.9. yum --enablerepo=epel upgrade setup-ds-admin.pl -u ... as prescribed in the release notes: http://directory.fedoraproject.org/wiki/Release_Notes Here is the problem. I used to be able to query using ldapsearch like this: ldapsearch -x -ZZ -h <HOST> -b <BASE> -LLL "(uid=<USER>)" gecos And I would see: dn: uid=<USER>,<BASE> gecos: System User Now, after the upgrade, this returns no results and no errors, but if I bind like this, then it works _fine_: ldapsearch -x -ZZ -D "cn=directory manager" -W -h <HOST> -b <BASE> -LLL "(uid=<USER>)" gecos Here is some log output showing the anon. bind search and the non-anon. bind search (sanitized): [07/Dec/2011:14:52:14 -0800] conn=120 SSL 256-bit AES [07/Dec/2011:14:52:14 -0800] conn=120 op=1 BIND dn="" method=128 version=3 [07/Dec/2011:14:52:14 -0800] conn=120 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [07/Dec/2011:14:52:14 -0800] conn=120 op=2 SRCH base="dc=EXAMPLE,dc=COM" scope=2 filter="(uid=USERNAME)" attrs="gecos" [07/Dec/2011:14:52:14 -0800] conn=120 op=2 RESULT err=0 tag=101 nentries=0 etime=0 [07/Dec/2011:14:52:14 -0800] conn=120 op=3 UNBIND [07/Dec/2011:14:52:14 -0800] conn=120 op=3 fd=71 closed - U1 [07/Dec/2011:14:53:37 -0800] conn=121 SSL 256-bit AES [07/Dec/2011:14:53:40 -0800] conn=121 op=2 BIND dn="cn=directory manager" method=128 version=3 [07/Dec/2011:14:53:40 -0800] conn=121 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [07/Dec/2011:14:53:40 -0800] conn=121 op=3 SRCH base="dc=EXAMPLE,dc=COM" scope=2 filter="(uid=USERNAME)" attrs="gecos" [07/Dec/2011:14:53:40 -0800] conn=121 op=3 RESULT err=0 tag=101 nentries=1 etime=0 [07/Dec/2011:14:53:40 -0800] conn=121 op=4 UNBIND [07/Dec/2011:14:53:40 -0800] conn=121 op=4 fd=71 closed - U1 The only difference I can see is the nentries=1 in the latter test. So, I looked into the latest features and see there are some more nsslapd-anonlimitsdn: nsslapd-allow-anonymous-access: on ... which I have left as defaults. It looks like anonymous binds should still work. So, I am wondering, why do anonymous binds no longer return results? Any ideas? --Brian

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users December 2011