Question about 389-ds and Solaris
by Jean-Francois Saucier
Hi everyone,
I just installed 389-ds on Fedora and have a problem with Solaris clients.
Everything works well on the Linux side (Fedora, CentOS and RHEL clients
works fine).
On the Solaris side, I got everything to work too (pam, ssh, getent passwd,
getent group, ldaplist -l paswd, ldaplist -l group, etc). I used the native
Solaris ldapclient tool to make everything work.
The problem I have is with the Group attribute. In 389-ds, the group are
created with the objectClass "groupofuniquenames" and the members are
listed with the attribute "uniqueMember". I manually add the objectClass
"posixgroup" to allow the group to be visible on the client.
With this configuration, everything work fine in Linux. In Solaris, I can
see the group with "getent group" but there are no member. What I have
found is that Solaris need it's member to be in the "memberUid" attribute
and not in the "uniqueMember" attribute.
Also, I found that while uniqueMember require a full qualification
(uid=jeff,ou=people,dc=test,dc=com), the memberUid just require the uid
(jeff).
What should I do to make this work easy on Solaris? Adding the memberUid by
hand is not an option because it's sure there will be a difference between
the uniqueMember and memberUid list in some point in time.
Thank you!
--
Jean-Francois Saucier (djf_jeff)
GPG key : 0xA9E6E953
11 years, 4 months
excluding attributes/objectclasses belonging to a specific schema from export to ldif
by Timo Ballin
Hy,
I have only limited knowledge about ldap and desperately trying to keep
sings simple:
I am trying to set up a replication from OpenLDAP to an external 389-LDAP.
To get started I have done a manual LDIF export. On the external LDAP I
only need the inetOrgPerson class/attributes. I really want to avoid
importing/replicating the "auxiliary" samba Account Information.
of course I could write a bash/perl script for a "filter" ... but I dont
like the idea of it - maintaining another script.
since I would switch the internal OpenLDAP to a 389-LDAP perhaps there
is a better way to separate these information?
With kind regards
Timo Ballin
11 years, 4 months
Re: [389-users] Password + anything works ?
by Dan Lavu
In regards to a password policy? Just 389 or are you using winsync with AD?
Because the password policy from AD does not transfer over. Also they are
some extra steps if you want to setup an OU based password policy but if
you just do it for the entire directory through ‘configuration’ it works
with no issues.
Dan
*From:* Ali Jawad <ali.jawad(a)splendor.net>
*Sent:* November 12, 2012 6:00 AM
*To:* General discussion list for the 389 Directory server project.
*Subject:* [389-users] Password + anything works ?
Hi
I just noticed that you can use the password+ANYLetters and it will work,
I.e. if the password is xyz xyz99 or xyzABC will work as well, is this a
misconfiguration on my part or a bug ?
Regards
*
*
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
11 years, 4 months
Nested group and ssh login against 389-dir
by thomas
Hello,
I have an issue when I try to authenticate my openssh against 389-dir
when using nested groups.
If I add an user to one group only there aren't issues, but if I use
nested groups it doesn't work !
This is the log I copied from 389-dir server :
[12/Nov/2012:23:05:03 +0100] conn=147 fd=81 slot=81 SSL connection
from 192.168.xxx.117 to 192.168.xxx.216
[12/Nov/2012:23:05:03 +0100] conn=147 SSL 256-bit AES
[12/Nov/2012:23:05:03 +0100] conn=147 op=0 BIND
dn="uid=binduser,cn=config" method=128 version=3
[12/Nov/2012:23:05:03 +0100] conn=147 op=0 RESULT err=0 tag=97
nentries=0 etime=0 dn="uid=binduser,cn=config"
[12/Nov/2012:23:05:03 +0100] conn=147 op=1 SRCH
base="dc=xxxx,dc=local" scope=2 filter="(uid=demo)" attrs=ALL
[12/Nov/2012:23:05:03 +0100] conn=147 op=1 RESULT err=0 tag=101
nentries=1 etime=0
[12/Nov/2012:23:05:03 +0100] conn=147 op=2 BIND
dn="uid=demo,ou=IT_Operation,ou=Company,dc=xxxx,dc=local" method=128
version=3
[12/Nov/2012:23:05:03 +0100] conn=147 op=2 RESULT err=0 tag=97
nentries=0 etime=0
dn="uid=demo,ou=it_operation,ou=company,dc=xxxx,dc=local"
[12/Nov/2012:23:05:03 +0100] conn=147 op=3 BIND
dn="uid=binduser,cn=config" method=128 version=3
[12/Nov/2012:23:05:03 +0100] conn=147 op=3 RESULT err=0 tag=97
nentries=0 etime=0 dn="uid=binduser,cn=config"
[12/Nov/2012:23:05:03 +0100] conn=147 op=4 CMP
dn="cn=lin17_access,ou=production,ou=hosts,dc=xxxx,dc=local"
attr="uniquemember"
[12/Nov/2012:23:05:03 +0100] conn=147 op=4 RESULT err=16 tag=111
nentries=0 etime=0
[12/Nov/2012:23:05:05 +0100] conn=147 op=5 UNBIND
This is my /etc/ldap.conf :
host 389-svr01.xxxx.local 389-svr02.xxxx.local
port 636
base dc=xxxx,dc=local
pam_password md5
ssl yes
tls_cacertdir /etc/openldap/cacerts
tls_checkpeer no
bind_policy soft
bind_timelimit 15
timelimit 15
pam_groupdn cn=lin17_access,ou=production,ou=hosts,dc=xxxx,dc=local
ldap_version 3
binddn uid=binduser,cn=config
bindpw yyyy
Can you help me please ?
My desire is to create groups where only some people can log on certain servers.
Regards .
11 years, 4 months
Password + anything works ?
by Ali Jawad
Hi
I just noticed that you can use the password+ANYLetters and it will work,
I.e. if the password is xyz xyz99 or xyzABC will work as well, is this a
misconfiguration on my part or a bug ?
Regards
*
*
11 years, 4 months
Sync with AD
by Andreas Kekkou
Hi all,
I'm currently running CentOS DS 8.1(CDS) in multi-master mode with two
servers. Recently I've decided to sync with Active Directory. 389
Password Sync utility has been installed on all Windows Domain
Controllers and it is configured to communicate with the same CDS
server. Sync is working, and password changes are sent from Windows to
CDS. Any password change in the LDAP environment is sync between the two
CDS, but is only sent to the Windows if the change is performed on the
CDS with the Windows Sync Agreement. Also in the error log I get the
following errors:
[09/Nov/2012:08:13:49 +0200] - add value "20120228131234.0Z" to
attribute type "dscorepropagationdata" in entry "CN=..." failed:
duplicate new value
[09/Nov/2012:10:38:50 +0200] - add value "20120228131028.0Z" to
attribute type "dscorepropagationdata" in entry "CN=..." failed:
duplicate new value
[09/Nov/2012:10:38:53 +0200] - add value "20120228131028.0Z" to
attribute type "dscorepropagationdata" in entry "CN=..." failed:
duplicate new value
[09/Nov/2012:11:43:53 +0200] - add value "20120228131234.0Z" to
attribute type "dscorepropagationdata" in entry "CN=..." failed:
duplicate new value
[09/Nov/2012:12:48:53 +0200] - add value "20120228131028.0Z" to
attribute type "dscorepropagationdata" in entry "CN=..." failed:
duplicate new value
[09/Nov/2012:12:48:53 +0200] - add value "20120228131028.0Z" to
attribute type "dscorepropagationdata" in entry "CN=..." failed:
duplicate new value
[09/Nov/2012:13:08:53 +0200] - add value "20120228131028.0Z" to
attribute type "dscorepropagationdata" in entry "CN=..." failed:
duplicate new value
[09/Nov/2012:13:08:53 +0200] - add value "20120228131028.0Z" to
attribute type "dscorepropagationdata" in entry "CN=..." failed:
duplicate new value
The dots after CN represent actual users. Any idea how this can be resolved?
Andreas
11 years, 4 months
Re: [389-users] samba+ldap
by Dan Lavu
I also found the samba/ldap docs lacking, when I first tried to setup this
up. Then I turned around and configured Kerberos/AD with samba and used
Kerberos auth for my Linux machines.
Now that I’ve done quite a few 389 implementations and going through that
doc again, it’s makes sense to me. What part are you having trouble with?
Dan
*From:* upen <upendra.gandhi(a)gmail.com>
*Sent:* November 8, 2012 5:33 PM
*To:* General discussion list for the 389 Directory server project.
*Subject:* [389-users] samba+ldap
Hello,
I am trying to setup Samba with existing 389-ds on the same server.
Following http://directory.fedoraproject.org/wiki/Howto:Samba didn't help.
Does anyone know if there is any other useful updated document for this
purpose?
Thanks.
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
11 years, 4 months
Re: [389-users] 389-users Digest, Vol 90, Issue 3
by albert.solaris
On 11/06/2012 07:00 AM, 389-users-request(a)lists.fedoraproject.org wrote:
> Send 389-users mailing list submissions to
> 389-users(a)lists.fedoraproject.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://admin.fedoraproject.org/mailman/listinfo/389-users
> or, via email, send a message with subject or body 'help' to
> 389-users-request(a)lists.fedoraproject.org
>
> You can reach the person managing the list at
> 389-users-owner(a)lists.fedoraproject.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of 389-users digest..."
>
>
> Today's Topics:
>
> 1. Re: 389-users Digest, Vol 90, Issue 2 (albert.solaris)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Mon, 05 Nov 2012 12:05:13 -0500
> From: "albert.solaris" <albert.solaris(a)gmail.com>
> To: 389-users(a)lists.fedoraproject.org
> Subject: Re: [389-users] 389-users Digest, Vol 90, Issue 2
> Message-ID: <5097F1C9.4070009(a)gmail.com>
> Content-Type: text/plain; charset=UTF-8; format=flowed
>
> On 11/02/2012 08:00 AM, 389-users-request(a)lists.fedoraproject.org wrote:
>> Send 389-users mailing list submissions to
>> 389-users(a)lists.fedoraproject.org
>>
>> To subscribe or unsubscribe via the World Wide Web, visit
>> https://admin.fedoraproject.org/mailman/listinfo/389-users
>> or, via email, send a message with subject or body 'help' to
>> 389-users-request(a)lists.fedoraproject.org
>>
>> You can reach the person managing the list at
>> 389-users-owner(a)lists.fedoraproject.org
>>
>> When replying, please edit your Subject line so it is more specific
>> than "Re: Contents of 389-users digest..."
>>
>>
>> Today's Topics:
>>
>> 1. LDAP authentication related - CANNOT change password by
>> running passwd on clients (albert.solaris)
>> 2. Re: LDAP authentication related - CANNOT change password by
>> running passwd on clients (Dan Lavu)
>> 3. Re: LDAP authentication related - CANNOT change password by
>> running passwd on clients (Grzegorz Dwornicki)
>>
>>
>> ----------------------------------------------------------------------
>>
>> Message: 1
>> Date: Thu, 01 Nov 2012 16:02:39 -0400
>> From: "albert.solaris" <albert.solaris(a)gmail.com>
>> To: 389 Mail list <389-users(a)lists.fedoraproject.org>
>> Subject: [389-users] LDAP authentication related - CANNOT change
>> password by running passwd on clients
>> Message-ID: <5092D55F.8020001(a)gmail.com>
>> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed"
>>
>> I am stuck in the 389 DS implementation, hope someone could help me out.
>>
>> My situation is that I am trying to establish a cute enterprise
>> environment with VMWorkstation and CentOS. All guest OSs are CentOS6.3
>> based. So far I have got DNS, DHCP, Gateway, File server worked
>> perfectly; However, the 389 LDAP server here, Hmm... I would say it is
>> partially working. And this is also where you come in.
>>
>> What does it mean by 'partially working' exactly? Let me tell you.
>>
>> What happened here is that I've installed and configured 389 DS without
>> SSL/TLS enable, migrated local users on my file server to the LDAP
>> already. Now, from my DHCP clients, also LDAP clients, I can retrieve
>> information within the LDAP server by running ldapsearch, I can even
>> change to regular users (i.e. user1/user2/.../user10 created on the file
>> server) with Autofs home directory mounted automatically. Somehow, I
>> cannot change password by running passwd command.
>>
>> Here is what I got when changing.
>> [root@dhcpclient sssd]# /su - user1/
>> [user1@dhcpclient ~]$
>> [user1@dhcpclient ~]$ /passwd/
>> Changing password for user user1.
>> Current Password:
>> passwd: Authentication token manipulation error
>> [user1@dhcpclient ~]$
>>
>> I am new to Linux, so have no idea about the reason behind that. Is it
>> a LDAP acl issue, or sssd configuration issue, or security pam issue, or
>> whatever else.
>>
>> If you could help me out, that would be great. Please let me know if
>> you want any configuration files from me. I don't want to attach
>> everything here to scare you.
>>
11 years, 4 months
Is there any paramter to configure replication retry time in case of fail over
by Divya Ravikumar
Hi all,
I have a redundant multi-master setup in which master A and master B are both primary and redundant to each other.
When B goes down A tries to reconnect to B for replication. This replication retry time increases with the number of attempts it tries to retry.
Is there any way to control this retry time?
Regards,
Divya.R
11 years, 4 months