Tag Info

New answers tagged

0

I am still seeing this same behavior in OpenLDAP on Ubuntu. I have been trying to replace the SSL certificate on my OpenLDAP instance and found that the directions at the Ubuntu wiki site do not work: https://help.ubuntu.com/lts/serverguide/openldap-server.html#openldap-tls Specifically, these instructions: Create the file certinfo.ldif with the ...


0

You can use Kerberos to map AIX logins to AD names/domains. This IBM page is a good reference for the AD and server config. Then you just do: chuser auth_name=ADUSER auth_domain=example.com registry=KRB5Afiles SYSTEM=KRB5Afiles login (note this is a bit different on AIX7.1 but works well on 6.1 and 5.3.) This is how we authenticate to AD at my workplace, ...


2

I would say this depends entirely on who and what is connecting to your LDAP server. Every client that connects via LDAPS SHOULD verify that the certificate is signed by a trusted authority. Not all of them do. (This is what EEAA is referring to) A self signed certificate will not be trusted by default. So it will need to be imported into the list of ...


0

I've just stumbled on this question with a similar problem myself. I'd been trying to setup an LDAP server with selinux enabled and got a similar error. If you have selinux enabled, try it in permissive mode or disable it and try again. Not so good if you're trying for a secure system and ldap complains about selinux!


2

I believe you are taking a more complicated approach than necessary. To disable a DIT disable its corresponding database. This can be accomplished by setting olcHidden: TRUE. olcHidden: TRUE | FALSE Controls whether the database will be used to answer queries. A database that is hidden will never be selected to answer any queries, and any suffix ...


0

If a machine is configured to look to LDAP or Active Directory for user information, local user management commands such as "useradd" will pick up on the existence of any duplicate uid/uidnumber entries in the domain and refuse to create the account. It does not store all domain user information locally (though it may cache it). Duplicate entries can be ...


0

ldapmodify is lying to you about the validity of your file. If you take the LDIF file you created and run ldapmodify -v -n -f <path/to/file.ldif> The output looks like this: add olcAccess: {1}to dn.subtree="ou=Users,dc=domain,dc=lan" attrs=sambaLMPassword,sambaNTPassword by self write by dn=sambaAdmin,dc=domain,dc=lan write by anonymous auth ...


1

At a previous employer, they tried to disable changing passwords via control-alt-delete and force password changing via a web page to address this particular issue. Sadly, you'll likely have to either invest in a third party product or write something (like the web page mentioned above) in order to sync the passwords.


0

You can enable the ldap-auth-client (debian and ubuntu) to edit passwords like you would on a local machine. if you run dpkg-reconfigure ldap-auth-config and select yes for Make local root Database admin this will allow you to run passwd like you normally would. You can also do this by editing your /etc/ldap.conf file and adding: # The distinguished name ...


0

I've solved the problem, problem was a case of PEBKAC. In order to use the check_password module, you have to add the check_password.so file to the password policy itself, not to the main list of modules loaded in LDAP server startup. Here how it's done Compile the package using its Makefile Copy the file to /usr/lib/ldap Add pwdPolicyChecker objectClass ...


0

Your LDAP database has this suffix: dc=my-domain,dc=com You're trying to add an entry with dn: cn=1000,ou=sip,dc=digium,dc=internal LDAP is an hierarchical database, you must fix the DB suffix or the entry DN in order to fit your hierarchy needs. You can do it changing the entry dn with: cn=1000,ou=sip,dc=my-domain,dc=com But still the Organisation ...


0

Use CentOS OpenLDAP help page. It is very concise and no fluff. Prior to doing so - please revert all the config files to their original state. Can be confirmed via: # rpm -V openldap-server If above command shows any files modified - either remove and reinstall openldap-server or fetch files over from backup.



Top 50 recent answers are included