Re: [389-users] win sync error
by solarflow99
I'm using self signed certs, did I miss something?
Probably. There are many steps involved in getting winsync to use TLS/SSL
>> to talk to AD, and getting AD PassSync to use TLS/SSL to talk to DS. Which
>>
>
> From the Docs listed online:
> http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.1/html/Admin...
>
> and I went over everything else I could possibly find too. It seems in the
> case of self signed certificates, the windows CA has to exported as a .cer
> file, and imported in 389 with: certutil -d . -A -n "AD Cert" -t "CTu,u,u"
> -i ad-cert.cer
>
12 years, 10 months
win sync error
by solarflow99
I have setup a windows sync agreement, and have followed the instructions,
however I am seeing this error, even when I do an ldapsearch command from
the 389 server:
ldap_simple_bind: Can't contact LDAP server
SSL error -8179 (Peer's Certificate issuer is not recognized.)
I'm using self signed certs, did I miss something?
12 years, 10 months
Re: [389-users] Multimaster replication query
by s.varadha rajan
Hi,
Thanks for the reply.that's ok.but if i create one new user in supplier
side,it's not replicating to consumer side.i think ubuntu 10.04 LTS supports
fedora-ds 1.1.x and dont have updated ppa links. for this case, shall i
upgrade the latest version, will give the solution? After upgrade, how can i
migrate my existing data.
or give me a solution for this.
Regards,
Varad
On Tue, Jun 14, 2011 at 8:26 PM, Rich Megginson <rmeggins(a)redhat.com> wrote:
> On 06/14/2011 08:23 AM, s.varadha rajan wrote:
>
> Hi,
>
> I followed the procedure to configure "multi-master replication" as per
> http://directory.fedoraproject.org/wiki/Howto:MultiMasterReplication. but
> i got an error as
>
> *From consumer side:*
>
> 14/Jun/2011:19:25:41 +051800] NSMMReplicationPlugin -
> multimaster_be_state_change: replica o=netscaperoot is coming online;
> enabling replication
> [14/Jun/2011:19:25:41 +051800] NSMMReplicationPlugin - replica_reload_ruv:
> Warning: new data for replica o=netscaperoot does not match the data in the
> changelog.
> Recreating the changelog file. This could affect replication with
> replica's consumers in which case the consumers should be reinitialized.
>
> This is not an error. It just means the consumer has been initialized with
> data from the master, and it had old data (probably from setup) which was
> wiped out.
>
>
> *From Supplier side:*
>
> [14/Jun/2011:19:26:12 +051800] NSMMReplicationPlugin - Beginning total
> update of replica "agmt="cn="Replication from varad.xxx.xxx.com port 389
> to sam.xxx.xxx.com port 389"" (sam:389)".
> [14/Jun/2011:19:26:15 +051800] NSMMReplicationPlugin - Finished total
> update of replica "agmt="cn="Replication from varad.xxx.xxx.com port 389
> to sam.xxx.xxx.com port 389"" (sam:389)". Sent 120 entries.
>
>
> We are using the OS-Ubuntu 10.04. I searched in google and got the some
> result in "https://bugzilla.redhat.com/show_bug.cgi?id=388021". but i dont
> know how to fix this.Please help on this.
>
> Regards,
> Varad
>
>
>
>
>
>
>
>
> On Mon, May 30, 2011 at 12:27 PM, s.varadha rajan <rajanvaradhu(a)gmail.com>
> wrote:
> >
> > Hi,
> >
> > Thanks for the reply.I will try and update you further.
> >
> > Regards,
> > Varad
> >
> >
> >
> > On Fri, May 27, 2011 at 8:30 PM, Rich Megginson <rmeggins(a)redhat.com>
> wrote:
> >>
> >> On 05/27/2011 12:11 AM, s.varadha rajan wrote:
> >>
> >> Hi,
> >>
> >> Can i get any update on my below query ?
> >>
> >> Regards,
> >> Varad
> >>
> >> On Tue, May 24, 2011 at 6:17 PM, s.varadha rajan <
> rajanvaradhu(a)gmail.com> wrote:
> >>>
> >>> Hi,
> >>> We are using Ubuntu 10.04 server OS and all the web applications are
> running on that.We have already implemented fedora-ds for ldap auth.now we
> are planning to go some up-gradation.kindly let me know the following,
> >>> 1.How to migrate running fedora-ds server to another server ?
> >>> 2.i have taken all the user/group+etc in ldif format.is it enough for
> migration or any other db (/var/lib/dirsrv/slapd-<instance>) also need to
> bacup ?
> >>
> >> LDIF should be fine.
> >>>
> >>> if any procedure please share with me ? how to import/export .ldif file
> >>
> >> /usr/lib[64]/dirsrv/slapd-INSTNAME/db2ldif - export database to ldif
> >> /usr/lib[64]/dirsrv/slapd-INSTNAME/ldif2db - import database from ldif
> >>>
> >>> 3.in our setup,one server is in public network.so i am planning to do
> replication through "ldaps", i.e local server to public server replication
> through highly secure how to ?
> >>
> >> Not exactly, but there is plenty of documentation - see
> http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html-singl...
> >>>
> >>> Please help me on the above topics.
> >>> Regards,
> >>> Varad
> >>
> >> --
> >> 389 users mailing list
> >> 389-users(a)lists.fedoraproject.org
> >> https://admin.fedoraproject.org/mailman/listinfo/389-users
> >
>
>
>
12 years, 10 months
sshd/pam_ldap not honoring passwordMustChange
by David Barr
I know this is outside the scope of the 389 list, but my Google-fu is
failing me on this one.
If I change the password to the account on the LDAP server and verify
"passwordmustchange: on," I can ssh in to the test host with the new
password all day long, and never get asked to change it.
I'm hoping someone has seen a document recently that they could link to.
I've seen the "PAM Configuration for LDAP Client Systems" page on the
wiki. That deals more with setting password expiration, though.
Thanks!
David
--
David - Offbeat http://dafydd.livejournal.com
dafydd - Online http://pgp.mit.edu/
Battalion 4 - Black Rock City Emergency Services Department
Integrity*Commitment*Communication*Support
12 years, 10 months
About Kerberos and dirsrv
by Gioachino Bartolotta
Hi all,
I have a problem in setup kerberos with 389 and I tried to do using
the documents available on 389 site and RedHat.
I followed everything, but I am unable to get the initial ticket from
kerberos. Have I to add these records as I have always done with
openldap??
dn: ou=KerberosPrincipals,ou=Users,dc=domain
ou: KerberosPrincipals
objectClass: top
objectClass: organizationalUnit
dn: krb5PrincipalName=ldapmaster/admin@DOMAN,ou=KerberosPrincipals,ou=Users,dc=domain
objectClass: top
objectClass: person
objectClass: krb5Principal
objectClass: krb5KDCEntry
krb5PrincipalName: ldapmaster/admin@DOMAIN
krb5KeyVersionNumber: 1
krb5MaxLife: 86400
krb5MaxRenew: 604800
krb5KDCFlags: 126
cn: ldapmaster/admin@domain
sn: ldapmaster/admin@domain
userPassword: {MD5}5S2YxFmBmhF3WTbY37t5KQ==
Thanks
--
-------------------------------------------
Gioachino Bartolotta
12 years, 10 months
saslauthd won't work
by Gioachino Bartolotta
Hi!
Just a little problem about saslauthd with 389.
When I try to execute:
ldapsearch -d 1 -D "cn=Directory Manager" -h dirsrv01.dominio -w
secret -ZZ '(uid=u01209)'
it returns
ldap_sasl_interactive_bind_s: server supports: EXTERNAL GSSAPI PLAIN
LOGIN CRAM-MD5 ANONYMOUS DIGEST-MD5
ldap_int_sasl_bind: EXTERNAL GSSAPI PLAIN LOGIN CRAM-MD5 ANONYMOUS DIGEST-MD5
ldap_int_sasl_open: host=dirsrv01.dominio
SASL/EXTERNAL authentication started
ldap_perror
ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
additional info: SASL(-4): no mechanism available:
I configured /etc/sysconfig/saslauthd in this way
-------------------------
# Directory in which to place saslauthd's listening socket, pid file, and so
# on. This directory must already exist.
SOCKETDIR=/var/run/saslauthd
# Mechanism to use when checking passwords. Run "saslauthd -v" to get a list
# of which mechanism your installation was compiled with the ablity to use.
# MECH=pam
MECH=ldap
START=yes
# Additional flags to pass to saslauthd on the command line. See saslauthd(8)
# for the list of accepted flags.
FLAGS=
---------------------------------------------------
What it's wrong??
This is the configuration of /etc/openldap/ldap.conf
------------------------------------------
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
URI ldap://dirsrv01.dominio/
BASE dc=dominio
TLS_CACERTDIR /etc/openldap/cacerts
TLS_REQCERT allow
ssl tls_start
---------------------------------------------------------
Any Idea?
Regards
--
-------------------------------------------
Gioachino Bartolotta
ICQ #: 9103167
MSN Messenger: astraroth(a)email.it
Yahoo & Skype: gioachino_bartolotta
12 years, 10 months
Re: [389-users] saslauthd won't work
by Rich Megginson
On 06/15/2011 09:45 AM, Gioachino Bartolotta wrote:
> Hi,
>
> no, I don't wanna use saslauthd with kerberos, but just authenticate
> users against ldap using tls or ssl ...
> Tried to configure samba using ldaps --- and it didn't work.
>
> smbd[10001]: Failed to issue the StartTLS instruction: Operations error
>
> Any Idea??
>
> Thank you!
>
> 2011/6/15 Rich Megginson<rmeggins(a)redhat.com>:
>> On 06/15/2011 07:02 AM, Gioachino Bartolotta wrote:
>>> Hi!
>>>
>>> Just a little problem about saslauthd with 389.
>>> When I try to execute:
>>>
>>> ldapsearch -d 1 -D "cn=Directory Manager" -h dirsrv01.dominio -w
>>> secret -ZZ '(uid=u01209)'
>>>
>>> it returns
>>>
>>> ldap_sasl_interactive_bind_s: server supports: EXTERNAL GSSAPI PLAIN
>>> LOGIN CRAM-MD5 ANONYMOUS DIGEST-MD5
>>> ldap_int_sasl_bind: EXTERNAL GSSAPI PLAIN LOGIN CRAM-MD5 ANONYMOUS
>>> DIGEST-MD5
>>> ldap_int_sasl_open: host=dirsrv01.dominio
>>> SASL/EXTERNAL authentication started
>>> ldap_perror
>>> ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
>>> additional info: SASL(-4): no mechanism available:
You did not specify the -x option - are you trying to use some form of
SASL auth, or are you trying to use simple (i.e userDN/password) auth?
If the latter, you have to specify the -x option.
>>>
>>> I configured /etc/sysconfig/saslauthd in this way
>>> -------------------------
>>> # Directory in which to place saslauthd's listening socket, pid file, and
>>> so
>>> # on. This directory must already exist.
>>> SOCKETDIR=/var/run/saslauthd
>>>
>>> # Mechanism to use when checking passwords. Run "saslauthd -v" to get a
>>> list
>>> # of which mechanism your installation was compiled with the ablity to
>>> use.
>>> # MECH=pam
>>> MECH=ldap
>>> START=yes
>>> # Additional flags to pass to saslauthd on the command line. See
>>> saslauthd(8)
>>> # for the list of accepted flags.
>>> FLAGS=
>>> ---------------------------------------------------
>>>
>>> What it's wrong??
>> I'm not sure. What are you using saslauthd for? Are you trying to allow
>> clients to use simple bind with their Kerberos passwords, rather than use
>> the password in the LDAP server? If so, then you should use 389 with the
>> PAM Pass-Through Auth plugin, and setup pam_krb5.
>>> This is the configuration of /etc/openldap/ldap.conf
>>> ------------------------------------------
>>> #SIZELIMIT 12
>>> #TIMELIMIT 15
>>> #DEREF never
>>> URI ldap://dirsrv01.dominio/
>>> BASE dc=dominio
>>> TLS_CACERTDIR /etc/openldap/cacerts
>>> TLS_REQCERT allow
>>> ssl tls_start
>>> ---------------------------------------------------------
>>>
>>> Any Idea?
>>>
>>> Regards
>>
>
>
12 years, 10 months
ldap proxy and entry-based chaining: writing a plugin?
by Roberto Polli
Hi all, just a question.
Does 389 provide a proxy functionality that can be used to identify
immediately the right server to match?
In case it's not supported, is it possible to develop a 389 plugin to manage
it? Once developed, are you interested in merge that feature in the 389
upstream?
Imagine the following configuration:
U - user
P - ldap proxy with two chained server:
* R1- real server 1
* R2 - real server 2
Actually when U issue a search, on P forwards it on both the chained server.
I'd like to know if there's a plugin or some sort of dynamic configuration
that can be used to redirect the search directly on the right server using
some further information provided (eg. regex & co).
Here's a standard use case.
1- DIT:
o=company, ou=italy, { dc=domain1.it, dc=domain2.it, dc=domain3.it}
o=company, ou=france, { dc=domain1.fr, dc=domain2.fr, dc=domain3.fr}
2- Each county is managed by one cluster. The proxy is configured with two
dblink/chain:
ou=italy ->cluster1
ou=france->cluster2
3- the search is done on the proxy using one attribute "mail=user(a)domain1.it"
4- I'd like that all domain matching .it$ are searched first on cluster1, and
conversely if matching .fr$ on cluster2
Obviously if you're interested I'll clarify.
Peace,
R.
--
Roberto Polli
Project Manager
Babel S.r.l. - http://www.babel.it
T: +39.06.9826.9651 M: +39.340.6522736 F: +39.06.9826.9680
P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma)
CONFIDENZIALE: Questo messaggio ed i suoi allegati sono di carattere
confidenziale per i destinatari in indirizzo.
E' vietato l'inoltro non autorizzato a destinatari diversi da quelli indicati
nel messaggio originale.
Se ricevuto per errore, l'uso del contenuto e' proibito; si prega di
comunicarlo al mittente e cancellarlo immediatamente.
12 years, 10 months