[Fedora-directory-users] Shadow account vs. password policy
by Jason Russler
Hi all,
I imported our Unix/Linux password and shadow files into FDS recently
(using LdapImport.pl) and I'm trying to figure out the difference or
conflicts between the shadowaccount object class attributes (shdowmax,
shadowwarning etc.) and the passwordexpiriationtime and
passwordexpiredwarned etc. attributes that I assume come from the
Password policy settings features of the directory.
I'm having trouble getting inconsistent results when expiring accounts
to test whether or not the PAM ldap client (on RedHat Enterprise 4
systems) weighs one set of attributes more more over the other or even
cares about them at all. Does anyone have experience with the PAM
clients and the directory's password policy settings vs. the
shadowaccount attributes? Should I quit using the password and password
expiration features and just use the shadowaccount attributes or ditch
the shadowaccount object class altogether?
If PAM will honor the password expiration policy then I may just write a
little something to set the policy attributes from the shadow attributes
of the imported files and then remove shadowaccount OC altogether. Any
thoughts?
18 years
Re: [Fedora-directory-users] account lockout and proxy DN Solaris
by Jo De Troy
Hi Rich,
I'm pretty sure the proxyDN is using the correct password. Could the
password enryption scheme be the problem? I've selected MD5 in the
directory.
When doing an ldap bind as proxyDN I use the same password as I specified
when setting up the Solaris client using ldapinit.
If the password would be wrong, would I not always get the "Object not found
(Session error no available conn)" error instead of only after a few
minutes?
Best Regards,
Jo
18 years
[Fedora-directory-users] Samba/Posix password sync problem
by Plant, Dean
Hello list,
I am fairly new to FDS and my head is starting to hurt trying to get
things working correctly. I am having a problem syncing passwords using
FDS from Samba to the posix password on Centos 3. When I change the
password on my XP sp2 test machine I get "The username or old password
is incorrect. Letters in passwords must be typed using the correct
case". The password change is successful in samba, as I can logoff and
the use the new password. The password change does not propagate into
the Posix account details.
SSL is configured and seems to be working. "ldapsearch -x -ZZ uid=test"
returns the test user information.
I have used Authconfig to configure LDAP with TLS on the test server to
test the Posix account details.
I am using the IdealX scripts, the /opt/IDEALX/sbin/smbldap-passwd works
without TLS but I think I have a problem when enabling TLS within these
scripts as smbldap-passwd fails to run. Below is my TLS settings from
the /etc/opt/IDEALX/smbldap-tools/smbldap.conf Do this look correct?
If anyone can give me a kick in the right direction I would appreciate
the help.
# Use TLS for LDAP
# If set to 1, this option will use start_tls for connection
# (you should also used the port 389)
# If not defined, parameter is set to "1"
#ldapTLS="0"
ldapTLS="1"
# How to verify the server's certificate (none, optional or require)
# see "man Net::LDAP" in start_tls section for more details
verify=""
# CA certificate
# see "man Net::LDAP" in start_tls section for more details
cafile="/opt/fedora-ds/alias/cacert.asc"
# certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientcert="/opt/fedora-ds/alias/slapd-myhost-cert8.db"
# key certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientkey="/opt/fedora-ds/alias/slapd-myhost-key3.db"
The samba log for the XP connection shows
2006/05/09 09:53:08, 0] passdb/pdb_ldap.c:ldapsam_modify_entry(1587)
ldapsam_modify_entry: LDAP Password could not be changed for user
test: Confidentiality required
Operation requires a secure connection.
[2006/05/09 09:53:08, 0]
passdb/pdb_ldap.c:ldapsam_update_sam_account(1731)
ldapsam_update_sam_account: failed to modify user with uid = test,
error: Operation requires a secure connection.
(Success)
[2006/05/09 09:53:08, 0] libsmb/smbencrypt.c:decode_pw_buffer(539)
decode_pw_buffer: incorrect password length (1600733334).
[2006/05/09 09:53:08, 0] libsmb/smbencrypt.c:decode_pw_buffer(540)
decode_pw_buffer: check that 'encrypt passwords = yes'
The directory server logs show
[09/May/2006:09:53:07 +0100] conn=247 fd=67 slot=67 connection from
127.0.0.1 to 127.0.0.1
[09/May/2006:09:53:07 +0100] conn=247 op=0 BIND dn="cn=Directory
Manager" method=128 version=3
[09/May/2006:09:53:07 +0100] conn=247 op=0 RESULT err=0 tag=97
nentries=0 etime=0 dn="cn=directory manager"
[09/May/2006:09:53:07 +0100] conn=247 op=1 SRCH
base="dc=roke,dc=co,dc=uk" scope=2
filter="(&(uid=test)(objectClass=sambaSamAccount))" attrs="uid uidNumber
gidNumber homeDirectory sambaPwdLastSet sambaPwdCanChange
sambaPwdMustChange sambaLogonTime sambaLogoffTime sambaKickoffTime cn
displayName sambaHomeDrive sambaHomePath sambaLogonScript
sambaProfilePath description sambaUserWorkstations sambaSID
sambaPrimaryGroupSID sambaLMPassword sambaNTPassword sambaDomainName
objectClass sambaAcctFlags sambaMungedDial sambaBadPasswordCount
sambaBadPasswordTime sambaPasswordHistory modifyTimestamp
sambaLogonHours modifyTimestamp"
[09/May/2006:09:53:07 +0100] conn=247 op=1 RESULT err=0 tag=101
nentries=1 etime=0
[09/May/2006:09:53:07 +0100] conn=248 fd=71 slot=71 connection from
127.0.0.1 to 127.0.0.1
[09/May/2006:09:53:07 +0100] conn=246 op=4 UNBIND
[09/May/2006:09:53:07 +0100] conn=246 op=4 fd=68 closed - U1
[09/May/2006:09:53:07 +0100] conn=248 op=0 EXT
oid="1.3.6.1.4.1.1466.20037" name="startTLS"
[09/May/2006:09:53:07 +0100] conn=248 op=0 RESULT err=0 tag=120
nentries=0 etime=0
[09/May/2006:09:53:07 +0100] conn=248 SSL 256-bit AES
[09/May/2006:09:53:07 +0100] conn=248 op=1 BIND dn="" method=128
version=3
[09/May/2006:09:53:07 +0100] conn=248 op=1 RESULT err=0 tag=97
nentries=0 etime=0 dn=""
[09/May/2006:09:53:07 +0100] conn=248 op=2 SRCH
base="dc=roke,dc=co,dc=uk" scope=2
filter="(&(objectClass=posixAccount)(uid=test))" attrs="uid userPassword
uidNumber gidNumber cn homeDirectory loginShell gecos description
objectClass"
[09/May/2006:09:53:07 +0100] conn=248 op=2 RESULT err=0 tag=101
nentries=1 etime=0
[09/May/2006:09:53:07 +0100] conn=249 fd=68 slot=68 connection from
127.0.0.1 to 127.0.0.1
[09/May/2006:09:53:07 +0100] conn=248 op=3 UNBIND
[09/May/2006:09:53:07 +0100] conn=248 op=3 fd=71 closed - U1
[09/May/2006:09:53:07 +0100] conn=249 op=0 EXT
oid="1.3.6.1.4.1.1466.20037" name="startTLS"
[09/May/2006:09:53:07 +0100] conn=249 op=0 RESULT err=0 tag=120
nentries=0 etime=0
[09/May/2006:09:53:07 +0100] conn=249 SSL 256-bit AES
[09/May/2006:09:53:07 +0100] conn=249 op=1 BIND dn="" method=128
version=3
[09/May/2006:09:53:07 +0100] conn=249 op=1 RESULT err=0 tag=97
nentries=0 etime=0 dn=""
[09/May/2006:09:53:07 +0100] conn=249 op=2 SRCH
base="dc=roke,dc=co,dc=uk" scope=2 filter="(uid=test)" attrs=ALL
[09/May/2006:09:53:07 +0100] conn=249 op=2 RESULT err=0 tag=101
nentries=1 etime=0
[09/May/2006:09:53:07 +0100] conn=249 op=3 SRCH
base="dc=roke,dc=co,dc=uk" scope=2
filter="(&(objectClass=posixGroup)(|(memberUid=test)(uniqueMember=uid=te
st,ou=People,dc=roke,dc=co,dc=uk)))" attrs="cn userPassword memberUid
uniqueMember gidNumber"
[09/May/2006:09:53:07 +0100] conn=249 op=3 RESULT err=0 tag=101
nentries=1 etime=0
[09/May/2006:09:53:07 +0100] conn=247 op=2 SRCH
base="dc=roke,dc=co,dc=uk" scope=2
filter="(&(uid=test)(objectClass=sambaSamAccount))" attrs="uid uidNumber
gidNumber homeDirectory sambaPwdLastSet sambaPwdCanChange
sambaPwdMustChange sambaLogonTime sambaLogoffTime sambaKickoffTime cn
displayName sambaHomeDrive sambaHomePath sambaLogonScript
sambaProfilePath description sambaUserWorkstations sambaSID
sambaPrimaryGroupSID sambaLMPassword sambaNTPassword sambaDomainName
objectClass sambaAcctFlags sambaMungedDial sambaBadPasswordCount
sambaBadPasswordTime sambaPasswordHistory modifyTimestamp
sambaLogonHours modifyTimestamp"
[09/May/2006:09:53:07 +0100] conn=247 op=2 RESULT err=0 tag=101
nentries=1 etime=0
[09/May/2006:09:53:07 +0100] conn=249 op=4 SRCH
base="dc=roke,dc=co,dc=uk" scope=2
filter="(&(objectClass=posixAccount)(uid=test))" attrs="uid userPassword
uidNumber gidNumber cn homeDirectory loginShell gecos description
objectClass"
[09/May/2006:09:53:07 +0100] conn=249 op=4 RESULT err=0 tag=101
nentries=1 etime=0
[09/May/2006:09:53:07 +0100] conn=247 op=3 MOD
dn="uid=test,ou=People,dc=roke,dc=co,dc=uk"
[09/May/2006:09:53:07 +0100] conn=247 op=3 RESULT err=0 tag=103
nentries=0 etime=0
[09/May/2006:09:53:07 +0100] conn=247 op=4 SRCH base="" scope=0
filter="(objectClass=*)" attrs="supportedExtension"
[09/May/2006:09:53:08 +0100] conn=247 op=4 RESULT err=0 tag=101
nentries=1 etime=1
[09/May/2006:09:53:08 +0100] conn=247 op=5 EXT
oid="1.3.6.1.4.1.4203.1.11.1" name="passwd_modify_extop"
[09/May/2006:09:53:08 +0100] conn=247 op=5 RESULT err=13 tag=120
nentries=0 etime=0
[09/May/2006:09:53:08 +0100] conn=247 op=6 SRCH
base="dc=roke,dc=co,dc=uk" scope=2
filter="(&(uid=test)(objectClass=sambaSamAccount))" attrs="uid uidNumber
gidNumber homeDirectory sambaPwdLastSet sambaPwdCanChange
sambaPwdMustChange sambaLogonTime sambaLogoffTime sambaKickoffTime cn
displayName sambaHomeDrive sambaHomePath sambaLogonScript
sambaProfilePath description sambaUserWorkstations sambaSID
sambaPrimaryGroupSID sambaLMPassword sambaNTPassword sambaDomainName
objectClass sambaAcctFlags sambaMungedDial sambaBadPasswordCount
sambaBadPasswordTime sambaPasswordHistory modifyTimestamp
sambaLogonHours modifyTimestamp"
[09/May/2006:09:53:08 +0100] conn=247 op=6 RESULT err=0 tag=101
nentries=1 etime=0
My smb.conf
[global]
workgroup = TEST
security = user
passdb backend = ldapsam:ldap://localhost
ldap admin dn = cn=Directory Manager
ldap suffix = dc=roke,dc=co,dc=uk
ldap user suffix = ou=People
ldap machine suffix = ou=Computers
ldap group suffix = ou=Groups
encrypt passwords = yes
log file = /var/log/samba/%m.log
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
os level = 33
domain logons = yes
domain master = yes
local master = yes
preferred master = yes
wins support = yes
logon home = \\%L\%U\profiles
logon path = \\%L\profiles\%U
logon drive = H:
template shell = /bin/false
winbind use default domain = no
#ldap ssl = yes
ldap passwd sync = Yes
add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"
ldap delete dn = Yes
delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u"
add machine script = /opt/IDEALX/sbin/smbldap-useradd -t 5 -w "%u"
add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"
delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g"
add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u"
"%g"
delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x
"%u" "%g"
set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"
[netlogon]
path = /var/lib/samba/netlogon
read only = yes
browsable = no
[profiles]
path = /var/lib/samba/profiles
read only = no
create mask = 0600
directory mask = 0700
[homes]
browsable = no
writable = yes
Thanks
Dean Plant
18 years, 1 month
[Fedora-directory-users] Trouble setting up pam passthru plugin
by Paul Engle
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi all,
I'm trying to set up our FDS 1.0.2 server to do the PAM passthrough
authentication for simple binds so that we don't have to store passwords in
the DS. I'm new to FDS, but not to LDAP or kerberos. Something is wonky,
though, and I'm at a loss.
I've compiled the pam-passthru-plugin.so library, and configured it
according to the README doc for that plugin. The plugin is showing as
loaded, and the response I'm getting back indicates that it is trying to do
the check, so I don't think it's a config issue with the plugin.
However, I'm getting conflicting log entries as to the success of the
authentication. The slapd error logs are showing:
[15/May/2006:14:22:49 -0500] pam_passthru-plugin - Expired PAM password for
user id [pengle], bind DN [uid=pengle,ou=people,dc=rice,dc=edu]: reset
required
But, /var/log/messages is reporting:
May 15 14:22:49 ldap1 ns-slapd: pam_krb5[1832]: authentication succeeds for
'pengle' (pengle(a)RICE.EDU)
So, it looks like the kerberos auth is working, but whatever response the
ldap server is getting isn't being interpreted as a success.
I'm not a pam guru, so my /etc/pam.d/ldapserver is very basic:
#%PAM-1.0
auth required /lib/security/$ISA/pam_krb5.so debug no_user_check
In case it's an issue, this is a RHEL4 box. And the command I'm testing
with is
/usr/bin/ldapsearch -x -W -H 'ldaps://ldap1.rice.edu:636' -D
"uid=pengle,ou=People,dc=rice,dc=edu" -b "ou=People,dc=rice,dc=edu"
'(uid=pengle)'
Have I done something obviously wrong? If anyone has gotten this to work
and can give me some pointers, I'd be very grateful. As far as I know, our
kerberos repository doesn't do password aging, so I don't understand the
error.
Thanks for your time,
-paul
- --
Paul D. Engle | Rice University
Sr. Systems Administrator | Information Technology - MS119
(713) 348-4702 | P.O. Box 1892
pengle(a)rice.edu | Houston, TX 77251-1892
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
iD8DBQFEaOQkCpkISWtyHNsRAuW0AKC43a0i+Uo9+Cz30wMRLVWPPXCgJQCg6iZo
a8KZSegBSrE4vajTSp10UO4=
=efIA
-----END PGP SIGNATURE-----
18 years, 1 month
[Fedora-directory-users] account lockout and proxy DN Solaris
by Jo De Troy
Hello all,
apparently when I enable the account lockout feature of password policy in
FedoraDS the proxyagent gets locked out.
When I disable the account lockout feature everything works fine (ldaplist
keeps working fine).
Is this a bug in FedoraDS or is it one in the native LDAP client of
Solaris9?
When account lockouts are enabled after I while the proxy DN entry is
updated by cn=servers,cn=plugins,cn=config
and the accountunlocktime, passwordretrycount and retrycountresetime are
added. Once passwordretrycount gets to the valued specified in the config
iop the passwordpolicy the ldaplist command fails to connect.
Best Regards,
Jo
18 years, 1 month
[Fedora-directory-users] SASL Mappings
by Rob See
Hi,
I'm working on getting SASL up and running with FDS 1.0.2 and have
run into some problems. It seems that the SASL Mappings are being
completely ignored.
Here is my setup:
Kerberos domain of SUB.BLAH.EDU
Ldap entry for uid=rob,ou=People,dc=sub,dc=blah,dc=edu
This is the map entry (the only map entry that I have):
# map1, mapping, sasl, config
dn: cn=map1,cn=mapping,cn=sasl,cn=config
objectClass: top
objectClass: nsSaslMapping
cn: map1
nsSaslMapRegexString: (.*)/admin@.*
nsSaslMapBaseDNTemplate: uid=\1,ou=People,dc=sub,dc=blah,dc=edu
nsSaslMapFilterTemplate: (objectclass=*)
I've restarted the service which doesn't seem to fix it.
When I kinit with rob/admin, running ldapsearch -Y GSSAPI gets the
following error:
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Invalid credentials (49)
additional info: SASL(-14): authorization failure:
when I kinit with rob, it works without a problem
Does anyone have any suggestions, or have I run into a bug of some sort ?
Also is there any way to turn up the log level to get more info ?
Thanks,
-Rob
18 years, 1 month
Re: [Fedora-directory-users] migration linux users, groups, hosts to fedora directory
by Mike Jackson
> good suggestions, but i'm still having trouble:
>
> the logs reported errors adding users because of "no such object"
>
> so, i removed fedora directory and re-installed it, ran the setup script
> and then tried using LdapImport.pl to migrate the users. All of the
> users, including all of their information was added (linux uid, gid and
> md5 hashed password, etc.), but they are in the UserPreferences ou in
> NetscapeRoot
The netscapeRoot database is for server internal data, not for end-user data. You want to have all end-user data in the userRoot database.
--
mike
18 years, 1 month
[Fedora-directory-users] migration linux users, groups, hosts to fedora directory
by Steve Strong
I'm having trouble migrating users to fedora directory.
I've used LdapImport and the users don't show up in the directory.
I've tried the migration scripts for RedHat directory 7.1 and they about
with a file not found error
I've tried adding a user to the directory from the console and entering
their home directory, UID and GID and they can't authenticate from a client.
Is there a clear description of how to do this somewhere?
steve
--
Steve Strong
Math and Computer Science
Washington High School
2205 Forest Dr. SE
Cedar Rapids, IA 52403
http://crwash.org
mailto:strong.s@crwash.org
18 years, 1 month
Re: [Fedora-directory-users] Solaris9 client problems / questions
by Jo De Troy
Hello all,
I disabled the account lockout mechanism on a global level (basedn level)
and not I don't seem get the
ldaplist: Object not found (Session error no available conn.)
after a while.
Is this a bug in the password policy implementation or is this a problem of
the native Solaris client?
I didn't even try have the Solaris client use an SSL profile yet. I didn't
even try to modify pam.conf yet.
Best Regards,
Jo
18 years, 1 month
