"Re:Binding Directory Manager as default Bind when using SSL/TLS certificate (please help)"
by Fosiul alam
Hi
Thanks for reply.
Anonymous bind looks on to me
from dse.ldif
nsslapd-allow-anonymous-access: on
Bellow is the result :
I get result with this :------
/usr/bin/ldapsearch -xZZ -D 'cn=Directory Manager' -w 'xxxx' -b
'dc=fosiul,dc=lan'
But No result with :-----
-------------------------------
/usr/bin/ldapsearch -xZZ -D 'cn=Directory Manager' -b 'dc=fosiul,dc=lan'
example :
[root@test ~]# /usr/bin/ldapsearch -xZZ -D 'cn=Directory Manager' -b
'dc=fosiul,dc=lan'
# extended LDIF
#
# LDAPv3
# base <dc=fosiul,dc=lan> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# search result
search: 3
result: 0 Success
# numResponses: 1
Kind Regards
10 years, 3 months
Binding Directory Manager as default Bind when using SSL/TLS certificate (please help)
by Fosiul alam
Hi All,
I refer to my this question
https://lists.fedoraproject.org/pipermail/389-users/2013-December/016572....
I have setup fedora 389 Directory server to use SSL/TLS
and i can perfom search by using
/usr/bin/ldapsearch -xZZ -D 'cn=Directory Manager' -w 'xxxxx' -b
'dc=fosiul,dc=lan'
but when I am trying with this
/usr/bin/ldapsearch -xZZ -b 'dc=fosiul,dc=lan'
it does not return any thing.
which means, I need to bind cn=Directory Manager with default
ldapsearch , when i am searching by ssl/tls the default bindDirectory
should be cn=Directory Manager
but dont understand, which option do i need edit in dse.ldif for this.
Can any one please pleaes help me , I am just stuck on this now .
Many many thanks for this
10 years, 3 months
Re: [389-users] ldap authenticaion is not getting correct information (SSL/TLS) (all files, logs included- please give me light on this)
by Fosiul alam
Hi
Thanks for the quick Reply. I was thinking that same that some where
its missing the Bind dn
and I can conferm that, its working with definning
binddn and bindpw in ldap.conf
but ,
I confiered this before and I never had to define binddn and bindpw
in any where in ldap.conf and as you said that for production its not
appropriate.
which mean, something i have missed while configuring direcotory server,
I guess, I will have to tell Directory server to bind annonomouse
search with cn=Directory Manager or something like this.
but currnelty its not cliking on my head.
Any further help will really appreciate.
Kind Regards
10 years, 3 months
Re: [389-users] ldap authenticaion is not getting correct information (SSL/TLS) (all files, logs included- please give me light on this)
by Fosiul alam
Hi
Thanks for the quick Reply. I was thinking that same that some where
its missing the Bind dn
and I can conferm that, its working with definning
binddn and bindpw in ldap.conf
but ,
I confiered this before and I never had to define binddn and bindpw
in any where in ldap.conf and as you said that for production its not
appropriate.
which mean, something i have missed while configuring direcotory server,
I guess, I will have to tell Directory server to bind annonomouse
search with cn=Directory Manager or something like this.
but currnelty its not cliking on my head.
Any further help will really appreciate.
Kind Regards
10 years, 3 months
ldap authenticaion is not getting correct information (SSL/TLS) (all files, logs included- please give me light on this)
by Fosiul alam
Hi,
I need some help urgnelty.. as no idea why its acting funy.
as far I belive, I have setup ldap server properly in test
environment, but actiting wired.. no idea why ...
example
[root@test ~]# id tuser
id: tuser: No such user
bellow command shows the correct info :
[root@test ~]# /usr/bin/ldapsearch -xZZ -D 'cn=Directory Manager' -w
'xxxxx' -b 'dc=fosiul,dc=lan'
# extended LDIF
#
# LDAPv3
# base <dc=fosiul,dc=lan> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# fosiul.lan
dn: dc=fosiul,dc=lan
dc: fosiul
objectClass: domain
objectClass: top
# uk, fosiul.lan
dn: l=uk,dc=fosiul,dc=lan
l: uk
objectClass: locality
objectClass: top
# groups, uk, fosiul.lan
dn: ou=groups,l=uk,dc=fosiul,dc=lan
ou: groups
objectClass: organizationalUnit
objectClass: top
# users, uk, fosiul.lan
dn: ou=users,l=uk,dc=fosiul,dc=lan
ou: users
objectClass: organizationalUnit
objectClass: top
# IT, groups, uk, fosiul.lan
dn: cn=IT,ou=groups,l=uk,dc=fosiul,dc=lan
gidNumber: 3001
objectClass: posixGroup
objectClass: top
uniqueMember: uid=fosiula,ou=users,l=uk,dc=fosiul,dc=lan
cn: IT
# tuser, users, uk, fosiul.lan
dn: uid=tuser,ou=users,l=uk,dc=fosiul,dc=lan
givenName: Tuser
sn: User
uidNumber: 2001
gidNumber: 3001
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: posixAccount
cn: test User
homeDirectory: /home/tuser
userPassword:: e1NTSEF9cGlZclc1NjBaOXdtSGxkdVVKcGJ3TUhHZjN4eG55a2lUQUxhSVE9PQ=
=
uid: tuser
# search result
search: 3
result: 0 Success
# numResponses: 7
# numEntries: 6
My : /etc/ldap.conf
------------------------------------
[root@test ~]# cat /etc/ldap.conf
# @(#)$Id: ldap.conf,v 1.38 2006/05/15 08:13:31 lukeh Exp $
#
# This config is managed by puppet, all changes will be reverted
base dc=fosiul,dc=lan
bind_policy soft
# Search timelimit
#timelimit 30
timelimit 1
# Bind/connect timelimit
#bind_timelimit 30
bind_timelimit 1
#idle_timelimit 3600
idle_timelimit 1
bind_timeout 1
nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon
uri ldap://puppet-1.fosiul.lan
ssl start_tls
tls_cacertfile /etc/openldap/cacerts/CRT.crt
pam_password md5
pam_groupdn cn=IT,ou=groups,l=uk,dc=fosiul,dc=lan
pam_member_attribute uniqueMember
tls_cacertdir /etc/openldap/cacerts
my /etc/openldap/ldap.conf :
------------------------------------
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#BASE dc=example, dc=com
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
URI ldap://puppet-1.fosiul.lan/
BASE dc=fosiul,dc=lan
TLS_CACERTDIR /etc/openldap/cacerts
tls_cacertfile /etc/openldap/cacerts/CRT.crt
The Log From ldap server for bellow command
---------------------------------------------------------------------
[root@test ~]# id tuser
id: tuser: No such user
[root@test ~]#
[29/Dec/2013:14:49:14 +0000] conn=111 op=3 UNBIND
[29/Dec/2013:14:49:14 +0000] conn=111 op=3 fd=76 closed - U1
[29/Dec/2013:14:49:14 +0000] conn=115 fd=76 slot=76 connection from
192.168.0.40 to 192.168.0.35
[29/Dec/2013:14:49:14 +0000] conn=115 op=0 EXT
oid="1.3.6.1.4.1.1466.20037" name="startTLS"
[29/Dec/2013:14:49:14 +0000] conn=115 op=0 RESULT err=0 tag=120
nentries=0 etime=0
[29/Dec/2013:14:49:14 +0000] conn=115 SSL 256-bit AES
[29/Dec/2013:14:49:14 +0000] conn=115 op=1 BIND dn="" method=128 version=3
[29/Dec/2013:14:49:14 +0000] conn=115 op=1 RESULT err=0 tag=97
nentries=0 etime=0 dn=""
[29/Dec/2013:14:49:14 +0000] conn=115 op=2 SRCH
base="dc=fosiul,dc=lan" scope=2
filter="(&(objectClass=posixAccount)(uid=tuser))" attrs="uid
userPassword uidNumber gidNumber cn homeDirectory loginShell gecos
description objectClass"
[29/Dec/2013:14:49:14 +0000] conn=115 op=2 RESULT err=0 tag=101
nentries=0 etime=0
10 years, 3 months
How to create CA into PEM format
by Fosiul alam
Hi,
I have created the certificate by using
"https://raw.github.com/richm/scripts/master/setupssl2.sh"
and it working fine,
But I need to get the CA certificate in pem format which will have to
in /etc/openldap/cacertificate directory as I get this when trying to
setup ldap authentiation
To connect to a LDAP server with TLS │
│ protocol
enabled you need a CA certificate │
│ which signed
your server's certificate. │
│ Copy the
certificate in the PEM format to │
│ the
'/etc/openldap/cacerts' directory. │
│ Then press OK.
Can any one pleaese tel me, how will i get the certificate ??
Please advise.
10 years, 3 months
How to Allow UniqueMember to add under PosiGroup (UniqueueMemberof Plugins)
by Fosiul alam
Hi,
I have installed this test ldap and I am trying to add UniqueMember
under a PosixGroup
but its saying, i am not allowed bellow is error:
"according to the schema attribute uniqueMember is not allowed"
I guess, I need to add UniqueueMemberof plugins,
But dont understande the Syntax.
Can any one please help me with the syntax.
Kind Regards
10 years, 3 months
Re: [389-users] 389-users Digest, Vol 103, Issue 15
by Fosiul alam
Hi
Thanks, yes, it works fine now
I had to stop the script before it was asking the password
then turn on ssl from Gui interface
this tricks works for me
Thanks
On 24 December 2013 12:00, <389-users-request(a)lists.fedoraproject.org> wrote:
> Send 389-users mailing list submissions to
> 389-users(a)lists.fedoraproject.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://admin.fedoraproject.org/mailman/listinfo/389-users
> or, via email, send a message with subject or body 'help' to
> 389-users-request(a)lists.fedoraproject.org
>
> You can reach the person managing the list at
> 389-users-owner(a)lists.fedoraproject.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of 389-users digest..."
>
>
> Today's Topics:
>
> 1. Unable to open 389 Console after running setupssl2.sh
> (fosiul alam)
> 2. Re: Unable to open 389 Console after running setupssl2.sh
> (Predrag Zecevic [Unix Systems Administrator])
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Tue, 24 Dec 2013 09:23:19 +0000
> From: fosiul alam <expertalert(a)gmail.com>
> To: 389-users(a)lists.fedoraproject.org
> Subject: [389-users] Unable to open 389 Console after running
> setupssl2.sh
> Message-ID:
> <CAOf__1PuVTb2JyL8thcpm8-eQwWJtqR8aakBETWRP3c5o5CF_A(a)mail.gmail.com>
> Content-Type: text/plain; charset=ISO-8859-1
>
> Hi
> I would really appreciated if any one can help me out here.
>
> I have installed fedora directory server
>
> 389-dsgw-1.1.10-1.el6.x86_64
> 389-ds-base-1.2.9.14-1.el6.x86_64
> 389-ds-console-doc-1.2.6-1.el6.noarch
> 389-ds-base-libs-1.2.9.14-1.el6.x86_64
> 389-ds-console-1.2.6-1.el6.noarch
> 389-ds-1.2.2-1.el6.noarch
>
> the problem:
> as soon as i ran bellow script, its executes fine witout any issues.
> https://github.com/richm/scripts/blob/master/setupssl2.sh
>
> dirsrv-admin, dirsrv is running,
> but i cant connect to console
>
>
> I am trying with
>
> username : admin/cn=Directory Manager
> http://ldapserver:9830
>
> also https://ldapserver:9830
>
> but no luck
>
> Dont understand why its failling to open 389.
>
> Thanks for your help.
>
>
> ------------------------------
>
> Message: 2
> Date: Tue, 24 Dec 2013 11:31:47 +0100
> From: "Predrag Zecevic [Unix Systems Administrator]"
> <predrag.zecevic(a)2e-systems.com>
> To: "General discussion list for the 389 Directory server project."
> <389-users(a)lists.fedoraproject.org>
> Subject: Re: [389-users] Unable to open 389 Console after running
> setupssl2.sh
> Message-ID: <52B96293.8090205(a)2e-systems.com>
> Content-Type: text/plain; charset=UTF-8; format=flowed
>
> Hi,
>
> maybe you have started (only) secure ldap port (TCP 636) **before** your
> console was configured to use it?
>
> Can you verify (look into logs, /var/log/dirsrv/slapd-NAME/access and
> /var/log/dirsrv/admin-serv/{error,access}) that you ldap server is using
> both unsecure and secure connection?
>
> You cannot use port 389 if it was disabled ("nsslapd-port: 0" in output
> below):
> $ sudo grep -E "nsslapd-port|nsslapd-secureport"
> /etc/dirsrv/slapd-NAME/dse.ldif
> nsslapd-port: 0
> nsslapd-secureport: 636
>
>
> Regards.
>
> On 12/24/13 10:23 AM, fosiul alam wrote:
>> Hi
>> I would really appreciated if any one can help me out here.
>>
>> I have installed fedora directory server
>>
>> 389-dsgw-1.1.10-1.el6.x86_64
>> 389-ds-base-1.2.9.14-1.el6.x86_64
>> 389-ds-console-doc-1.2.6-1.el6.noarch
>> 389-ds-base-libs-1.2.9.14-1.el6.x86_64
>> 389-ds-console-1.2.6-1.el6.noarch
>> 389-ds-1.2.2-1.el6.noarch
>>
>> the problem:
>> as soon as i ran bellow script, its executes fine witout any issues.
>> https://github.com/richm/scripts/blob/master/setupssl2.sh
>>
>> dirsrv-admin, dirsrv is running,
>> but i cant connect to console
>>
>>
>> I am trying with
>>
>> username : admin/cn=Directory Manager
>> http://ldapserver:9830
>>
>> also https://ldapserver:9830
>>
>> but no luck
>>
>> Dont understand why its failling to open 389.
>>
>> Thanks for your help.
>> --
>> 389 users mailing list
>> 389-users(a)lists.fedoraproject.org
>> https://admin.fedoraproject.org/mailman/listinfo/389-users
>>
>
> --
> Predrag Zečević, Technical Support Analyst, 2e Systems GmbH
>
> Telephone: +49 6196 9505 815, Facsimile: +49 6196 9505 894
> Mobile: +49 174 3109 288, Skype: predrag.zecevic
> E-mail: predrag.zecevic(a)2e-systems.com
>
> Headquarter: 2e Systems GmbH, Königsteiner Str. 87,
> 65812 Bad Soden am Taunus, Germany
> Company registration: Amtsgericht Königstein (Germany), HRB 7303
> Managing director: Phil Douglas
>
> http://www.2e-systems.com/ - Making your business fly!
>
> [***]===---
> I want EARS! I want two ROUND BLACK EARS to make me feel warm 'n secure!!
>
>
> ------------------------------
>
> --
> 389 users mailing list
> 389-users(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/389-users
>
> End of 389-users Digest, Vol 103, Issue 15
> ******************************************
10 years, 3 months