Problems with accessing console
by Gerrard Geldenhuis
Hi
I have a bit of a problem with a few 389 servers I recently build...
Firstly how I got there:
I added 4 additional servers to our infrastructure, the servers had 389 installed and configured but as a separate set of 4 servers completely stand alone. I removed everything with remove-ds-admin -f -y before I added the 4 servers to our main infrastructure.
We use a shared (multimaster netscapedb setup), setup in the following way:
Enable changelog on new server ( aka master-new)
Create netscapedb root suffix
enable master replica for netscape db
iniatiate db from another master (aka master01)
run register-ds-admin.pl on master-new
The problem is that I am not able to access the admin console.
If I run the console from master01 and try to access the admin console on master-new, it takes a very long time to load and when I then try and view anything in the configuration tab I get timeouts. I can open the directory server for master-new remotely so that seems to be working fine.
My questions:
It seems remove-ds-admin.pl does not cleanly remove any previously set admin settings for the admin server, would you agree or is it expected to not remove admin server settings.
How can I fix this, comparing /etc/dirsrv/admin-serv/local.conf to another working server brings up loads and loads of differences. My first thought is to fix this file. I compared to different working servers and they seem similar enough for me to attempt this. I am just not sure if this would have other effects not yet known. Is this a recommend course of action?
My other option is to start again, but I don't know how to delete a server cleanly from netscapedb if I use a shared MM netscapedb database. Is there a recommended way to do this?
Regards
________________________________________________________________________
In order to protect our email recipients, Betfair Group use SkyScan from
MessageLabs to scan all Incoming and Outgoing mail for viruses.
________________________________________________________________________
13 years, 6 months
automount via LDAP/NFS
by John Mancuso
I am trying to automount via LDAP/NFS following
http://directory.fedoraproject.org/wiki/Howto:Automount
I'm able to login but not automount (i've already restarted autofs and nscd).
Message is:
!1004 $ ssh 192.168.0.46
jmancuso(a)192.168.0.46's password:
Last login: Thu Nov 18 19:14:41 2010 from xxxxxx.net
Could not chdir to home directory /export/home/jmancuso: No such file
or directory
Why does it say "/export/home/jmancuso". In LDAP I specified
"/home/jmancuso"... unless it's the NFS:/export/home/jmancuso. strange
See below:
dn: ou=auto.master,dc=mycompany,dc=net
ou: auto.master
objectClass: top
objectClass: automountMap
dn: cn=/home,ou=auto.master,dc=mycompany,dc=net
objectClass: automount
cn: /home
automountInformation: ldap:ldap1.mycompany.net:ou=auto.home,dc=mycompany,dc=net
dn: ou=auto.home,dc=mycompany,dc=net
ou: auto.home
objectClass: top
objectClass: organizationalUnit
objectClass: automountmap
dn: cn=jmancuso,ou=auto.home,dc=mycompany,dc=net
cn: jmancuso
objectClass: automount
automountInformation: -fstype=nfs nfs.mycompany.net:/home/jmancuso
/etc/sysconfig/autofs:
MAP_OBJECT_CLASS="automountMap"
ENTRY_OBJECT_CLASS="automount"
MAP_ATTRIBUTE="ou"
ENTRY_ATTRIBUTE="cn"
VALUE_ATTRIBUTE="automountInformation"
/var/log/messages:
Nov 18 19:10:59 SandBox1 automount[31848]: Starting automounter
version 5.0.1-0.rc2.131.el5_4.1, master map auto.master
Nov 18 19:10:59 SandBox1 automount[31848]: using kernel protocol version 5.00
Nov 18 19:10:59 SandBox1 automount[31848]: lookup_nss_read_master:
reading master files auto.master
Nov 18 19:10:59 SandBox1 automount[31848]: parse_init: parse(sun):
init gathered global options: (null)
Nov 18 19:10:59 SandBox1 automount[31848]: lookup_read_master:
lookup(file): read entry /misc
Nov 18 19:10:59 SandBox1 automount[31848]: lookup_read_master:
lookup(file): read entry /net
Nov 18 19:10:59 SandBox1 automount[31848]: lookup_read_master:
lookup(file): read entry +auto.master
Nov 18 19:10:59 SandBox1 automount[31848]: lookup_nss_read_master:
reading master files auto.master
Nov 18 19:10:59 SandBox1 automount[31848]: parse_init: parse(sun):
init gathered global options: (null)
Nov 18 19:10:59 SandBox1 automount[31848]: lookup_nss_read_master:
reading master ldap auto.master
Nov 18 19:10:59 SandBox1 automount[31848]: parse_server_string:
lookup(ldap): Attempting to parse LDAP information from string
"auto.master".
Nov 18 19:10:59 SandBox1 automount[31848]: parse_server_string:
lookup(ldap): mapname auto.master
Nov 18 19:10:59 SandBox1 automount[31848]: parse_ldap_config:
lookup(ldap): ldap authentication configured with the following
options:
Nov 18 19:10:59 SandBox1 automount[31848]: parse_ldap_config:
lookup(ldap): use_tls: 0, tls_required: 0, auth_required: 1,
sasl_mech: (null)
Nov 18 19:10:59 SandBox1 automount[31848]: parse_ldap_config:
lookup(ldap): user: (null), secret: unspecified, client principal:
(null) credential cache: (null)
Nov 18 19:10:59 SandBox1 automount[31848]: do_bind: lookup(ldap):
auth_required: 1, sasl_mech (null)
Nov 18 19:11:00 SandBox1 automount[31848]: do_bind: lookup(ldap): ldap
anonymous bind returned 0
Nov 18 19:11:00 SandBox1 automount[31848]: get_query_dn: lookup(ldap):
found query dn ou=auto.master,dc=mycompany,dc=net
Nov 18 19:11:00 SandBox1 automount[31848]: parse_init: parse(sun):
init gathered global options: (null)
Nov 18 19:11:00 SandBox1 automount[31848]: do_bind: lookup(ldap):
auth_required: 1, sasl_mech (null)
Nov 18 19:11:00 SandBox1 automount[31848]: do_bind: lookup(ldap): ldap
anonymous bind returned 0
Nov 18 19:11:00 SandBox1 automount[31848]: lookup_read_master:
lookup(ldap): searching for "(objectclass=automount)" under
"ou=auto.master,dc=mycompany,dc=net"
Nov 18 19:11:00 SandBox1 automount[31848]: lookup_read_master:
lookup(ldap): examining entries
Nov 18 19:11:00 SandBox1 automount[31848]: master_do_mount: mounting /misc
Nov 18 19:11:00 SandBox1 automount[31848]: automount_path_to_fifo:
fifo name /var/run/autofs.fifo-misc
Nov 18 19:11:00 SandBox1 automount[31848]: lookup_nss_read_map:
reading map file /etc/auto.misc
Nov 18 19:11:00 SandBox1 automount[31848]: parse_init: parse(sun):
init gathered global options: (null)
Nov 18 19:11:00 SandBox1 automount[31848]: mounted indirect on /misc
with timeout 300, freq 75 seconds
Nov 18 19:11:00 SandBox1 automount[31848]: st_ready: st_ready(): state
= 0 path /misc
Nov 18 19:11:00 SandBox1 automount[31848]: master_do_mount: mounting /net
Nov 18 19:11:00 SandBox1 automount[31848]: automount_path_to_fifo:
fifo name /var/run/autofs.fifo-net
Nov 18 19:11:00 SandBox1 automount[31848]: lookup_nss_read_map:
reading map hosts (null)
Nov 18 19:11:00 SandBox1 automount[31848]: parse_init: parse(sun):
init gathered global options: (null)
Nov 18 19:11:00 SandBox1 automount[31848]: mounted indirect on /net
with timeout 300, freq 75 seconds
Nov 18 19:11:00 SandBox1 automount[31848]: st_ready: st_ready(): state
= 0 path /net
Nov 18 19:11:00 SandBox1 automount[31848]: master_do_mount: mounting /home
Nov 18 19:11:00 SandBox1 automount[31848]: automount_path_to_fifo:
fifo name /var/run/autofs.fifo-home
Nov 18 19:11:00 SandBox1 automount[31848]: lookup_nss_read_map:
reading map ldap
ldap:ldap1.mycompany.net:ou=auto.home,dc=mycompany,dc=net
Nov 18 19:11:00 SandBox1 automount[31848]: parse_server_string:
lookup(ldap): Attempting to parse LDAP information from string
"ldap:ldap1.mycompany.net:ou=auto.home,dc=mycompany,dc=net".
Nov 18 19:11:00 SandBox1 automount[31848]: parse_server_string:
lookup(ldap): server "ldap://ldap1.mycompany.net/", base dn
"ou=auto.home,dc=mycompany,dc=net"
Nov 18 19:11:00 SandBox1 automount[31848]: parse_ldap_config:
lookup(ldap): ldap authentication configured with the following
options:
Nov 18 19:11:00 SandBox1 automount[31848]: parse_ldap_config:
lookup(ldap): use_tls: 0, tls_required: 0, auth_required: 1,
sasl_mech: (null)
Nov 18 19:11:00 SandBox1 automount[31848]: parse_ldap_config:
lookup(ldap): user: (null), secret: unspecified, client principal:
(null) credential cache: (null)
Nov 18 19:11:00 SandBox1 automount[31848]: do_bind: lookup(ldap):
auth_required: 1, sasl_mech (null)
Nov 18 19:11:00 SandBox1 automount[31848]: do_bind: lookup(ldap): ldap
anonymous bind returned 0
Nov 18 19:11:00 SandBox1 automount[31848]: get_query_dn: lookup(ldap):
found query dn ou=auto.home,dc=mycompany,dc=net
Nov 18 19:11:00 SandBox1 automount[31848]: parse_init: parse(sun):
init gathered global options: (null)
13 years, 6 months
SSH AllowGroups and LDAP authentication
by Allan Hougham
Hi,
I need help with this issue, I setting sshd_config with "AllowGroups" but I can´t authenticate with LDAP, the groups are settings up, this is my configuration:
Do you have any tutorial or guide for setting ssh authentication groups with LDAP?
This is the mistake, but the user ahougham is in "Search Group"
[root@ds03 log]# tail -f secure
Nov 6 04:09:22 ds03 sshd[7056]: debug1: kex: client->server aes256-ctr hmac-sha1 none
Nov 6 04:09:22 ds03 sshd[7056]: debug1: kex: server->client aes256-ctr hmac-sha1 none
Nov 6 04:09:22 ds03 sshd[7056]: debug1: SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received
Nov 6 04:09:22 ds03 sshd[7056]: debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
Nov 6 04:09:22 ds03 sshd[7056]: debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
Nov 6 04:09:22 ds03 sshd[7056]: debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
Nov 6 04:09:22 ds03 sshd[7056]: debug1: SSH2_MSG_NEWKEYS sent
Nov 6 04:09:22 ds03 sshd[7056]: debug1: expecting SSH2_MSG_NEWKEYS
Nov 6 04:09:22 ds03 sshd[7056]: debug1: SSH2_MSG_NEWKEYS received
Nov 6 04:09:22 ds03 sshd[7056]: debug1: KEX done
Nov 6 04:09:33 ds03 sshd[7056]: debug1: userauth-request for user ahougham service ssh-connection method none
Nov 6 04:09:33 ds03 sshd[7056]: debug1: attempt 0 failures 0
Nov 6 04:09:33 ds03 sshd[7055]: User ahougham from 10.10.38.27 not allowed because none of user's groups are listed in AllowGroups
Nov 6 04:09:33 ds03 sshd[7056]: input_userauth_request: invalid user ahougham
Nov 6 04:09:33 ds03 sshd[7055]: debug1: PAM: initializing for "ahougham"
Nov 6 04:09:33 ds03 sshd[7055]: debug1: PAM: setting PAM_RHOST to "10.10.38.27"
Nov 6 04:09:33 ds03 sshd[7055]: debug1: PAM: setting PAM_TTY to "ssh"
Nov 6 04:09:35 ds03 sshd[7056]: debug1: userauth-request for user ahougham service ssh-connection method password
Nov 6 04:09:35 ds03 sshd[7056]: debug1: attempt 1 failures 1
Nov 6 04:09:35 ds03 sshd[7055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.10.38.27 user=ahougham
Nov 6 04:09:36 ds03 sshd[7055]: debug1: PAM: password authentication failed for an illegal user: Authentication failure
Nov 6 04:09:36 ds03 sshd[7055]: Failed password for invalid user ahougham from 10.10.38.27 port 1480 ssh2
Thanks
Allan
sshd:
________________________________________________________________________---
# $OpenBSD: sshd_config,v 1.73 2005/12/06 22:38:28 reyk Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.
Port 22
#Protocol 2,1
Protocol 2
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 768
# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO
LogLevel DEBUG
# Authentication:
#LoginGraceTime 2m
LoginGraceTime 1m
#PermitRootLogin yes
PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
MaxAuthTries 6
AllowGroups root ref
AllowGroups Bids ref
AllowGroups Search ref
AllowGroups Question ref
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
PermitEmptyPasswords no
PasswordAuthentication yes
# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication mechanism.
# Depending on your PAM configuration, this may bypass the setting of
# PasswordAuthentication, PermitEmptyPasswords, and
# "PermitRootLogin without-password". If you just want the PAM account and
# session checks to run without PAM authentication, then enable this but set
# ChallengeResponseAuthentication=no
#UsePAM no
UsePAM yes
# Accept locale-related environment variables
#AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
#AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
#AcceptEnv LC_IDENTIFICATION LC_ALL
#AllowTcpForwarding yes
AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10
#PermitTunnel no
# no default banner path
#Banner /some/path
# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server
__________________________________________________________________________
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_ldap.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_ldap.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_ldap.so
_____________________________________________________________________________
# Search timelimit
#timelimit 30
timelimit 120
# Bind/connect timelimit
#bind_timelimit 30
bind_timelimit 120
# Reconnect policy: hard (default) will retry connecting to
# the software with exponential backoff, soft will fail
# immediately.
#bind_policy hard
# Idle timelimit; client will close connections
# (nss_ldap only) if the server has not been contacted
# for the number of seconds specified below.
#idle_timelimit 3600
idle_timelimit 3600
# Filter to AND with uid=%s
#pam_filter objectclass=account
# The user ID attribute (defaults to uid)
#pam_login_attribute uid
# Search the root DSE for the password policy (works
# with Netscape Directory Server)
#pam_lookup_policy yes
# Check the 'host' attribute for access control
# Default is no; if set to yes, and user has no
# value for the host attribute, and pam_ldap is
# configured for account management (authorization)
# then the user will not be allowed to login.
#pam_check_host_attr yes
# Check the 'authorizedService' attribute for access
# control
# Default is no; if set to yes, and the user has no
# value for the authorizedService attribute, and
# pam_ldap is configured for account management
# (authorization) then the user will not be allowed
# to login.
#pam_check_service_attr yes
# Group to enforce membership of
#pam_groupdn cn=PAM,ou=Groups,dc=example,dc=com
# Group member attribute
#pam_member_attribute uniquemember
# Specify a minium or maximum UID number allowed
#pam_min_uid 0
#pam_max_uid 0
# Template login attribute, default template user
# (can be overriden by value of former attribute
# in user's entry)
#pam_login_attribute userPrincipalName
#pam_template_login_attribute uid
#pam_template_login nobody
# HEADS UP: the pam_crypt, pam_nds_passwd,
# and pam_ad_passwd options are no
# longer supported.
#
# Do not hash the password at all; presume
# the directory server will do it, if
# necessary. This is the default.
#pam_password clear
# Hash password locally; required for University of
# Michigan LDAP server, and works with Netscape
# Directory Server if you're using the UNIX-Crypt
# hash mechanism and not using the NT Synchronization
# service.
#pam_password crypt
# Remove old password first, then update in
# cleartext. Necessary for use with Novell
# Directory Services (NDS)
#pam_password clear_remove_old
#pam_password nds
# RACF is an alias for the above. For use with
# IBM RACF
#pam_password racf
# Update Active Directory password, by
# creating Unicode password and updating
# unicodePwd attribute.
#pam_password ad
# Use the OpenLDAP password change
# extended operation to update the password.
#pam_password exop
# Redirect users to a URL or somesuch on password
# changes.
#pam_password_prohibit_message Please visit http://internal to change your password.
# RFC2307bis naming contexts
# Syntax:
# nss_base_XXX base?scope?filter
# where scope is {base,one,sub}
# and filter is a filter to be &'d with the
# default filter.
# You can omit the suffix eg:
# nss_base_passwd ou=People,
# to append the default base DN but this
# may incur a small performance impact.
#nss_base_passwd ou=People,dc=example,dc=com?one
#nss_base_shadow ou=People,dc=example,dc=com?one
#nss_base_group ou=Group,dc=example,dc=com?one
#nss_base_hosts ou=Hosts,dc=example,dc=com?one
#nss_base_services ou=Services,dc=example,dc=com?one
#nss_base_networks ou=Networks,dc=example,dc=com?one
#nss_base_protocols ou=Protocols,dc=example,dc=com?one
#nss_base_rpc ou=Rpc,dc=example,dc=com?one
#nss_base_ethers ou=Ethers,dc=example,dc=com?one
#nss_base_netmasks ou=Networks,dc=example,dc=com?ne
#nss_base_bootparams ou=Ethers,dc=example,dc=com?one
#nss_base_aliases ou=Aliases,dc=example,dc=com?one
#nss_base_netgroup ou=Netgroup,dc=example,dc=com?one
# Just assume that there are no supplemental groups for these named users
nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon
# attribute/objectclass mapping
# Syntax:
#nss_map_attribute rfc2307attribute mapped_attribute
#nss_map_objectclass rfc2307objectclass mapped_objectclass
# configure --enable-nds is no longer supported.
# NDS mappings
#nss_map_attribute uniqueMember member
# Services for UNIX 3.5 mappings
#nss_map_objectclass posixAccount User
#nss_map_objectclass shadowAccount User
#nss_map_attribute uid msSFU30Name
#nss_map_attribute uniqueMember msSFU30PosixMember
#nss_map_attribute userPassword msSFU30Password
#nss_map_attribute homeDirectory msSFU30HomeDirectory
#nss_map_attribute homeDirectory msSFUHomeDirectory
#nss_map_objectclass posixGroup Group
#pam_login_attribute msSFU30Name
#pam_filter objectclass=User
#pam_password ad
# configure --enable-mssfu-schema is no longer supported.
# Services for UNIX 2.0 mappings
#nss_map_objectclass posixAccount User
#nss_map_objectclass shadowAccount user
#nss_map_attribute uid msSFUName
#nss_map_attribute uniqueMember posixMember
#nss_map_attribute userPassword msSFUPassword
#nss_map_attribute homeDirectory msSFUHomeDirectory
#nss_map_attribute shadowLastChange pwdLastSet
#nss_map_objectclass posixGroup Group
#nss_map_attribute cn msSFUName
#pam_login_attribute msSFUName
#pam_filter objectclass=User
#pam_password ad
# RFC 2307 (AD) mappings
#nss_map_objectclass posixAccount user
#nss_map_objectclass shadowAccount user
#nss_map_attribute uid sAMAccountName
#nss_map_attribute homeDirectory unixHomeDirectory
#nss_map_attribute shadowLastChange pwdLastSet
#nss_map_objectclass posixGroup group
#nss_map_attribute uniqueMember member
#pam_login_attribute sAMAccountName
#pam_filter objectclass=User
#pam_password ad
# configure --enable-authpassword is no longer supported
# AuthPassword mappings
#nss_map_attribute userPassword authPassword
# AIX SecureWay mappings
#nss_map_objectclass posixAccount aixAccount
#nss_base_passwd ou=aixaccount,?one
#nss_map_attribute uid userName
#nss_map_attribute gidNumber gid
#nss_map_attribute uidNumber uid
#nss_map_attribute userPassword passwordChar
#nss_map_objectclass posixGroup aixAccessGroup
#nss_base_group ou=aixgroup,?one
#nss_map_attribute cn groupName
#nss_map_attribute uniqueMember member
#pam_login_attribute userName
#pam_filter objectclass=aixAccount
#pam_password clear
# Netscape SDK LDAPS
#ssl on
# Netscape SDK SSL options
#sslpath /etc/ssl/certs
# OpenLDAP SSL mechanism
# start_tls mechanism uses the normal LDAP port, LDAPS typically 636
#ssl start_tls
#ssl on
# OpenLDAP SSL options
# Require and verify server certificate (yes/no)
# Default is to use libldap's default behavior, which can be configured in
# /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for
# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
#tls_checkpeer yes
# CA certificates for server certificate verification
# At least one of these are required if tls_checkpeer is "yes"
#tls_cacertfile /etc/ssl/ca.cert
#tls_cacertdir /etc/ssl/certs
# Seed the PRNG if /dev/urandom is not provided
#tls_randfile /var/run/egd-pool
# SSL cipher suite
# See man ciphers for syntax
#tls_ciphers TLSv1
# Client certificate and key
# Use these, if your server requires client authentication.
#tls_cert
#tls_key
# Disable SASL security layers. This is needed for AD.
#sasl_secprops maxssf=0
# Override the default Kerberos ticket cache location.
#krb5_ccname FILE:/etc/.ldapcache
# SASL mechanism for PAM authentication - use is experimental
# at present and does not support password policy control
#pam_sasl_mech DIGEST-MD5
uri ldap://ds02.ml.com/
ssl no
tls_cacertdir /etc/openldap/cacerts
pam_password md5
13 years, 6 months
dsml packages
by Angel Bosch Mora
hi,
i can't find last dsml packages anywhere.
must i compile from sources?
i use epel repos.
regards,
abosch
13 years, 7 months
Decrypting SSL for 389-ds
by Gerrard Geldenhuis
Hi
I am trying to decrypt SSL traffic capture with tcpdump in wireshark. A quick google turned up a page that said the NSS utils does not allow you to expose your private key. Is there different way or howto that anyone can share to help decrypt SSL encrypted traffic for 389?
Regards
________________________________________________________________________
In order to protect our email recipients, Betfair Group use SkyScan from
MessageLabs to scan all Incoming and Outgoing mail for viruses.
________________________________________________________________________
13 years, 7 months
upgrading packages
by Angel Bosch Mora
hi,
i've some questions about upgrading:
- must i run 'setup-ds-admin.pl -u' everytime there's a new package in the repos?
- doesn't packaging take care of that?
- does it matter how many instances are configured?
i've been having some strange problems in my (mixed) environment and i just want to clarify some things.
abosch
13 years, 7 months
Re: [389-users] Multi Master Replication
by Billy O'Connell
Gerrard,
Thanks for the response. I have set it up manually in another
environment, and it works just fine. At this point it would have
been quicker to do so, but I am hard headed and would like to figure
out why this is not working as I was hoping.
Thanks,
Billy
At 11:40 AM 11/10/2010, Gerrard Geldenhuis wrote:
> > -----Original Message-----
> > From: 389-users-bounces(a)lists.fedoraproject.org [mailto:389-users-
> > bounces(a)lists.fedoraproject.org] On Behalf Of Billy O'Connell
> > Sent: 10 November 2010 14:47
> > To: 389-users(a)lists.fedoraproject.org
> > Subject: [389-users] Multi Master Replication
> >
> > Hi,
> >
> > I have setup 2 x 389 directory servers. Both are Centos Linux 2.6.18-
> > 164.15.1.el5 servers. I am trying to Configure Multimaster Replication
> > between them. Following the guide at :
> > http://directory.fedoraproject.org/wiki/Howto:MultiMasterReplication
> >
> > I have grabbed the mmr.pl script, but am having issues with it. When I run
> > it, it just hangs. I do not see any output to the log files on
> my dir servers. I
> > use this from the command line:
> >
> > perl -d mmr.pl --host1 ldap1 --host2 ldap2 --host1_id 1 --host2_id
> > 2 --bindpw mypassword --repmanpw repsecret --base
> > dc=mydomain,dc=com --create --with-ssl
> >
> > I am not familiar with perl's debug, but this is what I can see.
> >
> > Enter h or `h h' for help, or `man perldebug' for more help.
> >
> > main::(mmr.pl:21): my %o;
> > DB<1> r
> >
> > And then it just hangs until I kill it.
> >
> > Any help or pointers would be extremely appreciated.
> >
> > Thanks,
> > Billy
> >
>
>Hi Billy,
>
>I have not used these perl scripts before. My suggestion would be
>to first go through the manual setup explained in the admin guide to
>get a better understanding of how everything works before you use an
>automated script that does all the grunt work. That way you will
>have a much better understanding of how everything fits together and
>be able to debug problems with multimaster much better.
>
> [Gerrard Geldenhuis]
>
>
>________________________________________________________________________
>In order to protect our email recipients, Betfair Group use SkyScan from
>MessageLabs to scan all Incoming and Outgoing mail for viruses.
>
>________________________________________________________________________
>--
>389 users mailing list
>389-users(a)lists.fedoraproject.org
>https://admin.fedoraproject.org/mailman/listinfo/389-users
>
>
>-----
>No virus found in this message.
>Checked by AVG - www.avg.com
>Version: 10.0.1153 / Virus Database: 424/3248 - Release Date: 11/10/10
13 years, 7 months
Multi Master Replication
by Billy O'Connell
Hi,
I have setup 2 x 389 directory servers. Both are Centos
Linux 2.6.18-164.15.1.el5 servers. I am trying to Configure
Multimaster Replication between them. Following the guide at :
http://directory.fedoraproject.org/wiki/Howto:MultiMasterReplication
I have grabbed the mmr.pl script, but am having issues with it. When
I run it, it just hangs. I do not see any output to the log files on
my dir servers. I use this from the command line:
perl -d mmr.pl --host1 ldap1 --host2 ldap2 --host1_id 1 --host2_id
2 --bindpw mypassword --repmanpw repsecret --base
dc=mydomain,dc=com --create --with-ssl
I am not familiar with perl's debug, but this is what I can see.
Enter h or `h h' for help, or `man perldebug' for more help.
main::(mmr.pl:21): my %o;
DB<1> r
And then it just hangs until I kill it.
Any help or pointers would be extremely appreciated.
Thanks,
Billy
13 years, 7 months
strong authentication (securid, two factor) with 389
by Roberto Polli
Hi all,
does 389 provide a strong authentication module like SecurID?
Is there a way to provide it without using clear-text password?
Peace,
R.
--
Roberto Polli
Project Manager
Babel S.r.l. - http://www.babel.it
T: +39.06.91801075 M: +39.340.6522736 F: +39.06.91612446
P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma)
CONFIDENZIALE: Questo messaggio ed i suoi allegati sono di carattere
confidenziale per i destinatari in indirizzo.
E' vietato l'inoltro non autorizzato a destinatari diversi da quelli indicati
nel messaggio originale.
Se ricevuto per errore, l'uso del contenuto e' proibito; si prega di
comunicarlo al mittente e cancellarlo immediatamente.
13 years, 7 months
