Re: SYNC without password ...

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Vipul Ramani wrote:
> i think we are head to solutions ...
>
> do i need to re-install certificate in passync again ??? after we 
> install new CSR with FQDN ... ???
No, at least, not yet.  The ldapsearch output below looks correct.  In 
your sync agreement, did you use labdc01.tf-lab.test2.com or just 
labdc01?  You have to use the FQDN.

Is /etc/dirsrv/slapd-linux2/slapd-linux2cert8.db a symlink to 
/etc/dirsrv/slapd-linux2/cert8.db?  What is the relationship between 
slapd-linux2cert8.db and cert8.db?
>
>
> root at linux2 slapd-linux2]# /usr/lib/mozldap/ldapsearch -v  -h 
> labdc01.tf-lab.test2.com <http://labdc01.tf-lab.test2.com>   -p 636 -Z 
> -P /etc/dirsrv/slapd-linux2/slapd-linux2cert8.db  -3 -s base -b "" 
> "objectclass=*"
> ldapsearch: started Mon Oct 20 06:18:20 2008
>
> ldap_init( labdc01.tf-lab.test2.com <http://labdc01.tf-lab.test2.com>, 
> 636 )
> ldaptool_getcertpath -- /etc/dirsrv/slapd-linux2/slapd-linux2cert8.db
> ldaptool_getkeypath -- /etc/dirsrv/slapd-linux2/slapd-linux2cert8.db
> ldaptool_getmodpath -- (null)
> ldaptool_getdonglefilename -- (null)
> filter pattern: objectclass=*
> returning: ALL
> filter is: (objectclass=*)
> version: 1
> dn:
> currentTime: 20081020202134.0Z
> subschemaSubentry: 
> CN=Aggregate,CN=Schema,CN=Configuration,DC=tf-lab,DC=tribal
>  fusion,DC=com
> dsServiceName: CN=NTDS 
> Settings,CN=LABDC01,CN=Servers,CN=Default-First-Site-Na
>  me,CN=Sites,CN=Configuration,DC=tf-lab,DC=test2,DC=com
> namingContexts: DC=tf-lab,DC=test2,DC=com
> namingContexts: CN=Configuration,DC=tf-lab,DC=test2,DC=com
> namingContexts: CN=Schema,CN=Configuration,DC=tf-lab,DC=test2,DC=com
> namingContexts: DC=DomainDnsZones,DC=tf-lab,DC=test2,DC=com
> namingContexts: DC=ForestDnsZones,DC=tf-lab,DC=test2,DC=com
> defaultNamingContext: DC=tf-lab,DC=test2,DC=com
> schemaNamingContext: CN=Schema,CN=Configuration,DC=tf-lab,DC=test2,DC=c
>  om
> configurationNamingContext: CN=Configuration,DC=tf-lab,DC=test2,DC=com
> rootDomainNamingContext: DC=tf-lab,DC=test2,DC=com
> supportedControl: 1.2.840.113556.1.4.319
> supportedControl: 1.2.840.113556.1.4.801
> supportedControl: 1.2.840.113556.1.4.473
> supportedControl: 1.2.840.113556.1.4.528
> supportedControl: 1.2.840.113556.1.4.417
> supportedControl: 1.2.840.113556.1.4.619
> supportedControl: 1.2.840.113556.1.4.841
> supportedControl: 1.2.840.113556.1.4.529
> supportedControl: 1.2.840.113556.1.4.805
> supportedControl: 1.2.840.113556.1.4.521
> supportedControl: 1.2.840.113556.1.4.1948
> supportedLDAPVersion: 3
> supportedLDAPVersion: 2
> supportedLDAPPolicies: MaxPoolThreads
> supportedLDAPPolicies: MaxDatagramRecv
> supportedLDAPPolicies: MaxReceiveBuffer
> supportedLDAPPolicies: InitRecvTimeout
> supportedLDAPPolicies: MaxConnections
> supportedLDAPPolicies: MaxConnIdleTime
> supportedLDAPPolicies: MaxPageSize
> supportedLDAPPolicies: MaxQueryDuration
> supportedLDAPPolicies: MaxTempTableSize
> supportedLDAPPolicies: MaxResultSetSize
> supportedLDAPPolicies: MaxNotificationPerConn
> supportedLDAPPolicies: MaxValRange
> highestCommittedUSN: 90680
> supportedSASLMechanisms: GSSAPI
> supportedSASLMechanisms: GSS-SPNEGO
> supportedSASLMechanisms: EXTERNAL
> supportedSASLMechanisms: DIGEST-MD5
> dnsHostName: labdc01.tf-lab.test2.com <http://labdc01.tf-lab.test2.com>
> ldapServiceName: tf-lab.test2.com:labdc01$@TF-LAB.TEST2.COM 
> <http://TF-LAB.TEST2.COM>
> serverName: 
> CN=LABDC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=tf-lab,DC=test2,DC=com
> supportedCapabilities: 1.2.840.113556.1.4.800
> supportedCapabilities: 1.2.840.113556.1.4.1670
> supportedCapabilities: 1.2.840.113556.1.4.1791
> isSynchronized: TRUE
> isGlobalCatalogReady: TRUE
> domainFunctionality: 0
> forestFunctionality: 0
> domainControllerFunctionality: 2
>
>
> root at linux2 slapd-linux2]# grep err /var/log/dirsrv/slapd-linux2/errors
> [root at linux2 slapd-linux2]#
>
>
>
>
>
>
>
> On Mon, Oct 20, 2008 at 12:07 PM, Vipul Ramani <vipulramani at gmail.com 
> <mailto:vipulramani at gmail.com>> wrote:
>
>
>
>     CA is self-signed generated certificate . by Linux2 it self.
>
>
>     [root at linux2 ~]# certutil -L -d /etc/dirsrv/slapd-linux2 -n "CA"
>
>
>     Certificate Nickname                                         Trust
>     Attributes
>                                                                 
>     SSL,S/MIME,JAR/XPI
>
>     Certificate:
>         Data:
>             Version: 3 (0x2)
>             Serial Number: 1000 (0x3e8)
>             Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
>             Issuer: "CN=CAcert"
>             Validity:
>                 Not Before: Fri Oct 17 15:11:18 2008
>                 Not After : Wed Oct 17 15:11:18 2018
>             Subject: "CN=CAcert"
>             Subject Public Key Info:
>                 Public Key Algorithm: PKCS #1 RSA Encryption
>                 RSA Public Key:
>                     Modulus:
>                         c8:40:4b:86:0b:70:3d:5d:6a:f6:f4:a5:86:e9:1c:98:
>                         d0:dd:19:31:e3:b8:18:3b:0a:c8:9f:83:33:98:cd:98:
>                         54:83:9d:73:97:69:04:26:b8:75:4a:95:7e:ed:92:62:
>                         51:2c:70:8a:a6:f2:a6:8b:b5:c6:53:d3:f8:cc:01:c9:
>                         e8:78:55:1f:69:e3:c4:5c:5e:e8:a6:bf:dc:53:ac:a6:
>                         ce:75:14:98:2f:a7:c0:da:ae:be:5d:91:e6:f2:96:84:
>                         02:a0:ec:df:e4:de:91:25:2d:65:d8:bd:79:3d:07:ea:
>                         8c:9f:9e:5b:ee:04:a3:18:2e:98:c6:ab:15:a1:d5:d9
>                     Exponent: 65537 (0x10001)
>         Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
>         Signature:
>             55:bd:f2:f7:37:e5:60:e0:87:20:a7:d7:69:b2:eb:79:
>             e6:98:7e:72:f1:b1:dc:11:08:94:fd:c3:56:a8:14:37:
>             2b:1b:cd:bc:05:3d:54:45:73:7f:b2:dc:f8:f1:f4:44:
>             61:25:54:c6:e2:c2:68:1f:d7:cc:d3:37:16:37:98:b8:
>             37:c3:7e:49:48:12:58:17:26:fe:87:bc:d4:ef:ee:6b:
>             5d:35:1f:1f:72:a5:5e:6b:b7:94:e6:c3:63:7c:2a:24:
>             4c:43:39:cd:74:7b:56:08:15:f9:85:3f:ed:c9:ba:01:
>             88:d0:90:84:1d:e6:0e:84:7f:83:8e:bf:9e:9a:b2:a3
>         Fingerprint (MD5):
>             2C:77:B6:61:BA:3D:F0:E2:8E:EB:BA:4D:74:A4:E4:0C
>         Fingerprint (SHA1):
>             06:FE:B9:62:26:E7:56:1E:2B:84:C0:5E:AC:DC:F7:1A:AE:A8:58:0E
>
>         Certificate Trust Flags:
>             SSL Flags:
>                 Valid CA
>                 Trusted CA
>                 User
>                 Trusted Client CA
>             Email Flags:
>                 User
>             Object Signing Flags:
>                 User
>
>     [root at linux2 ~]# certutil -L -d /etc/dirsrv/slapd-linux2 -n "linux2"
>
>
>     Certificate Nickname                                         Trust
>     Attributes
>                                                                 
>     SSL,S/MIME,JAR/XPI
>
>     Certificate:
>         Data:
>             Version: 3 (0x2)
>             Serial Number:
>                 14:fc:4e:02:00:00:00:00:00:16
>             Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
>             Issuer: "CN=labdc01,DC=tf-lab,DC=test2,DC=com"
>             Validity:
>                 Not Before: Fri Oct 17 23:35:13 2008
>                 Not After : Sun Oct 17 23:35:13 2010
>             Subject:
>     "CN=linux2,OU=Ops,O=Exponential,L=Emeryville,ST=California,C
>                 =US"
>             Subject Public Key Info:
>                 Public Key Algorithm: PKCS #1 RSA Encryption
>                 RSA Public Key:
>                     Modulus:
>                         da:db:9b:d8:c2:aa:42:4e:85:69:b2:0a:19:46:87:2d:
>                         67:e6:4b:9b:4d:97:96:6a:e3:bf:90:c2:ab:a7:0d:17:
>                         --removed-some-part---
>                         24:72:dc:18:5c:7e:1a:16:b3:bd:38:1b:0a:0f:a6:48:
>                         ae:4e:ef:5a:eb:cd:12:6f:5e:16:8f:6c:ce:ff:fa:71
>                     Exponent: 65537 (0x10001)
>             Signed Extensions:
>                 Name: Certificate Subject Key ID
>                 Data:
>                     75:e0:f9:0d:9f:77:24:61:38:87:17:87:43:ee:25:5d:
>                     c0:b2:4f:d3
>
>                 Name: Certificate Authority Key Identifier
>                 Key ID:
>                     83:c2:a6:03:eb:b2:a8:ea:40:d0:63:42:01:68:8f:a8:
>                     11:9e:ec:f9
>
>                 Name: CRL Distribution Points
>                 URI:
>     "ldap:///CN=labdc01,CN=labdc01,CN=CDP,CN=Public%20Key%20Serv
>                     ices,CN=Services,CN=Configuration,DC=tf-lab,DC=test2,D
>                    
>     C=com?certificateRevocationList?base?objectClass=cRLDistribut
>                     ionPoint"
>                 URI: "http://labdc01.tf-lab.test2.com/CertEnroll/labdc01.c
>                     rl"
>
>                 Name: Authority Information Access
>                 Method: PKIX CA issuers access method
>                 Location:
>                     URI:
>     "ldap:///CN=labdc01,CN=AIA,CN=Public%20Key%20Services,CN
>                         =Services,CN=Configuration,DC=tf-lab,DC=test2,DC=c
>                        
>     om?cACertificate?base?objectClass=certificationAuthority"
>                 Method: PKIX CA issuers access method
>                 Location:
>                     URI:
>     "*http://labdc01.tf-lab.test2.com*/CertEnroll/labdc
>                         01.tf-lab.test2.com_labdc01.crt"
>
>                 Name: Microsoft Enrollment Cert Type Extension
>                 Data: "WebServer"
>
>                 Name: Certificate Basic Constraints
>                 Critical: True
>                 Data: Is not a CA.
>
>                 Name: Certificate Key Usage
>                 Usages: Digital Signature
>                         Key Encipherment
>
>                 Name: Extended Key Usage
>                     TLS Web Server Authentication Certificate
>
>         Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
>         Signature:
>             0b:f7:2f:25:e5:99:aa:27:59:5d:76:96:5a:64:0b:a7:
>             91:7d:48:49:fd:a8:46:db:cc:39:7b:97:34:94:3c:0c:
>             7c:fe:4d:f7:99:5e:da:a6:7d:53:5c:36:ba:ed:a7:05:
>             60:04:2a:76:6e:02:75:a0:1c:59:bd:ad:82:db:fc:61:
>             --removed some--part--
>             6d:11:23:4c:77:60:18:ec:fd:47:63:72:d3:00:ee:04:
>             c2:01:3a:d8:dc:f1:4b:55:c5:7a:39:09:83:9b:09:bd:
>             65:64:4c:6f:8d:19:86:94:95:76:1b:07:08:ad:03:70
>         Fingerprint (MD5):
>             BD:3D:31:6C:27:A8:82:1A:11:81:5B:F6:56:D7:FA:E3
>         Fingerprint (SHA1):
>             89:45:EE:8E:7D:B7:01:EB:72:80:F2:86:91:B8:02:D4:60:3A:19:FA
>
>         Certificate Trust Flags:
>             SSL Flags:
>                 Valid CA
>                 Trusted CA
>                 User
>                 Trusted Client CA
>             Email Flags:
>                 User
>             Object Signing Flags:
>                 User
>
>         
>
>
>     *| /usr/lib/mozldap/ldapsearch -h windowshost -p 636 -Z -P
>     /etc/dirsrv/slapd-linux2 -3 -s base -b "" "objectclass=*" *
>
>     *When i do this i am getting cordump ...  :((  *
>         
>
>
>
>
>
> -- 
> Regards
>
> Vipul Ramani
>
> ------------------------------------------------------------------------
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>   

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3258 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20081020/70819618/attachment.bin 


[Index of Archives]     [Fedora User Discussion]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora News]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora QA]     [Fedora Triage]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Yosemite Photos]     [Linux Apps]     [Maemo Users]     [Gnome Users]     [KDE Users]     [Fedora Tools]     [Fedora Art]     [Fedora Docs]     [Maemo Users]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Fedora ARM]

  Powered by Linux