Send 389-users mailing list submissions to
389-users@xxxxxxxxxxxxxxxxxxxxxxx
To subscribe or unsubscribe via the World Wide Web, visit
https://admin.fedoraproject.org/mailman/listinfo/389-users
or, via email, send a message with subject or body 'help' to
389-users-request@xxxxxxxxxxxxxxxxxxxxxxx
You can reach the person managing the list at
389-users-owner@xxxxxxxxxxxxxxxxxxxxxxx
When replying, please edit your Subject line so it is more specific
than "Re: Contents of 389-users digest..."
Today's Topics:
1. LDAP authentication related - CANNOT change password by
running passwd on clients (albert.solaris)
2. Re: LDAP authentication related - CANNOT change password by
running passwd on clients (Dan Lavu)
3. Re: LDAP authentication related - CANNOT change password by
running passwd on clients (Grzegorz Dwornicki)
----------------------------------------------------------------------
Message: 1
Date: Thu, 01 Nov 2012 16:02:39 -0400
From: "albert.solaris" <albert.solaris@xxxxxxxxx>
To: 389 Mail list <389-users@xxxxxxxxxxxxxxxxxxxxxxx>
Subject: LDAP authentication related - CANNOT change
password by running passwd on clients
Message-ID: <5092D55F.8020001@xxxxxxxxx>
Content-Type: text/plain; charset="iso-8859-1"; Format="flowed"
I am stuck in the 389 DS implementation, hope someone could help me out.
My situation is that I am trying to establish a cute enterprise
environment with VMWorkstation and CentOS. All guest OSs are CentOS6.3
based. So far I have got DNS, DHCP, Gateway, File server worked
perfectly; However, the 389 LDAP server here, Hmm... I would say it is
partially working. And this is also where you come in.
What does it mean by 'partially working' exactly? Let me tell you.
What happened here is that I've installed and configured 389 DS without
SSL/TLS enable, migrated local users on my file server to the LDAP
already. Now, from my DHCP clients, also LDAP clients, I can retrieve
information within the LDAP server by running ldapsearch, I can even
change to regular users (i.e. user1/user2/.../user10 created on the file
server) with Autofs home directory mounted automatically. Somehow, I
cannot change password by running passwd command.
Here is what I got when changing.
[root@dhcpclient sssd]# /su - user1/
[user1@dhcpclient ~]$
[user1@dhcpclient ~]$ /passwd/
Changing password for user user1.
Current Password:
passwd: Authentication token manipulation error
[user1@dhcpclient ~]$
I am new to Linux, so have no idea about the reason behind that. Is it
a LDAP acl issue, or sssd configuration issue, or security pam issue, or
whatever else.
If you could help me out, that would be great. Please let me know if
you want any configuration files from me. I don't want to attach
everything here to scare you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/389-users/attachments/20121101/deaf8013/attachment-0001.html>
------------------------------
Message: 2
Date: Thu, 1 Nov 2012 16:19:30 -0400
From: Dan Lavu <dan@xxxxxxxx>
To: "General discussion list for the 389 Directory server project."
<389-users@xxxxxxxxxxxxxxxxxxxxxxx>
Subject: Re: LDAP authentication related - CANNOT change
password by running passwd on clients
Message-ID: <ecc11d69cbd3ae780f9063778decdcc4@xxxxxxxxxxxxxx>
Content-Type: text/plain; charset="windows-1252"
First I would check the ACI (Access Control Instruction), you will see in
IDM, which level in the Tree (ACI), right click, and goto ACI (You can view
all the inherited instructions) and make sure the users who login have the
permission to selfwrite.
The next part, by default this works, but I believe it depends on which
encryption and mapping you’re using for your password hash, so you have to
goto into the 389 config, check the hashing algorithm and check your
ldap.conf (or are you using sssd?) and make sure the password mapping
attribute is correct.
Hope this helps.
Dan
*From:* 389-users-bounces@xxxxxxxxxxxxxxxxxxxxxxx [mailto:
389-users-bounces@xxxxxxxxxxxxxxxxxxxxxxx] *On Behalf Of *albert.solaris
*Sent:* Thursday, November 01, 2012 4:03 PM
*To:* 389 Mail list
*Subject:* LDAP authentication related - CANNOT change password
by running passwd on clients
I am stuck in the 389 DS implementation, hope someone could help me out.
My situation is that I am trying to establish a cute enterprise environment
with VMWorkstation and CentOS. All guest OSs are CentOS6.3 based. So far
I have got DNS, DHCP, Gateway, File server worked perfectly; However, the
389 LDAP server here, Hmm... I would say it is partially working. And this
is also where you come in.
What does it mean by 'partially working' exactly? Let me tell you.
What happened here is that I've installed and configured 389 DS without
SSL/TLS enable, migrated local users on my file server to the LDAP
already. Now, from my DHCP clients, also LDAP clients, I can retrieve
information within the LDAP server by running ldapsearch, I can even change
to regular users (i.e. user1/user2/.../user10 created on the file server)
with Autofs home directory mounted automatically. Somehow, I cannot change
password by running passwd command.
Here is what I got when changing.
[root@dhcpclient sssd]# *su - user1*
[user1@dhcpclient ~]$
[user1@dhcpclient ~]$ *passwd*
Changing password for user user1.
Current Password:
passwd: Authentication token manipulation error
[user1@dhcpclient ~]$
I am new to Linux, so have no idea about the reason behind that. Is it a
LDAP acl issue, or sssd configuration issue, or security pam issue, or
whatever else.
If you could help me out, that would be great. Please let me know if you
want any configuration files from me. I don't want to attach everything
here to scare you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/389-users/attachments/20121101/3d5f6b86/attachment-0001.html>
------------------------------
Message: 3
Date: Thu, 1 Nov 2012 22:08:06 +0100
From: Grzegorz Dwornicki <gd1100@xxxxxxxxx>
To: "General discussion list for the 389 Directory server project."
<389-users@xxxxxxxxxxxxxxxxxxxxxxx>
Subject: Re: LDAP authentication related - CANNOT change
password by running passwd on clients
Message-ID:
<CAOP-CUcRNz=9T5DcZjgFv7tyqsAVUp=YxANU7G+4s0NVxpuvNw@xxxxxxxxxxxxxx>
Content-Type: text/plain; charset="iso-8859-2"
Could you also provide us with error logs from ldap? Do this just after
passwd faild. This will tell us more about errors on ldap side (like the
possible ACI problems).
Passwd hash algorithm for pam_ldap you can configure in /etc/nss_ldap.conf.
Search for 'password crypt' and uncomment it. You must make other password
lines commented to be sure this works.
1 lis 2012 21:03, "albert.solaris" <albert.solaris@xxxxxxxxx> napisał(a):
I am stuck in the 389 DS implementation, hope someone could help me out.
My situation is that I am trying to establish a cute enterprise
environment with VMWorkstation and CentOS. All guest OSs are CentOS6.3
based. So far I have got DNS, DHCP, Gateway, File server worked
perfectly; However, the 389 LDAP server here, Hmm... I would say it is
partially working. And this is also where you come in.
What does it mean by 'partially working' exactly? Let me tell you.
What happened here is that I've installed and configured 389 DS without
SSL/TLS enable, migrated local users on my file server to the LDAP
already. Now, from my DHCP clients, also LDAP clients, I can retrieve
information within the LDAP server by running ldapsearch, I can even change
to regular users (i.e. user1/user2/.../user10 created on the file server)
with Autofs home directory mounted automatically. Somehow, I cannot change
password by running passwd command.
Here is what I got when changing.
[root@dhcpclient sssd]# *su - user1*
[user1@dhcpclient ~]$
[user1@dhcpclient ~]$ *passwd*
Changing password for user user1.
Current Password:
passwd: Authentication token manipulation error
[user1@dhcpclient ~]$
I am new to Linux, so have no idea about the reason behind that. Is it a
LDAP acl issue, or sssd configuration issue, or security pam issue, or
whatever else.
If you could help me out, that would be great. Please let me know if you
want any configuration files from me. I don't want to attach everything
here to scare you.
--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/389-users/attachments/20121101/0393a779/attachment-0001.html>
------------------------------
--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users
End of 389-users Digest, Vol 90, Issue 2
****************************************
