Ppolicy does not seem to work

2011-02-14 Thread Jan Kohnert
Hi there, I'm new to this list, so first of all welcome to everyone. I have a problem with ppolicy and got stuck finding a solution. I configured slapd using the information from [1] trying to be able to lock users. But anyway, the lock seems to be ignored: As soon as one tries to log in, the

Re: Ppolicy does not seem to work

2011-02-14 Thread Clément OUDOT
2011/2/13 Jan Kohnert nospam001-li...@jankoh.dyndns.org: Hi there, I'm new to this list, so first of all welcome to everyone. I have a problem with ppolicy and got stuck finding a solution. I configured slapd using the information from [1] trying to be able to lock users. But anyway, the

RE: Ldap with GroupOfUniqueNames + PosixGroups

2011-02-14 Thread Alejandro Gándara Álvarez
Hi list, We use ldap for applications such as : Samba, Apache, Bugzilla, Openfire, Asterisk and more services. Our groups have as Estructural objectcalss posixgroups. Now we want to integrate ldap with Nuxeo. This mean we want to use Groups with groupOfUniquesNames as objectclass. So I have a

Re: Slapd Security based on port

2011-02-14 Thread Aaron Richton
Stopping users that are unauthenticated makes no sense; everything's unauthenticated at time=0. You might as well stop slapd if you want a 100% inability to serve data. You can deny anonymous users that aren't plaintext, including any ldaps:/// connections, with something like: access to *

Local root browsing for translucent proxy

2011-02-14 Thread Hugo Monteiro
Hello, I have set a translucent proxy and things have been working rather well. I've been able to add/delete and modify local attributes authenticating with the local rootdn. All this has been done using openldap's command line tools. I now have the need to use a web based interface and so i

Re: Ldap with GroupOfUniqueNames + PosixGroups

2011-02-14 Thread Christ Schlacta
On 2/14/2011 04:22, Alejandro Gándara Álvarez wrote: Hi list, We use ldap for applications such as : Samba, Apache, Bugzilla, Openfire, Asterisk and more services. Our groups have as Estructural objectcalss posixgroups. Now we want to integrate ldap with Nuxeo. This mean we want to use

ldap auth does not works after openldap upgrade

2011-02-14 Thread Leonardo Carneiro
Hello everyone, I upgraded my debian machine from lenny to squeeze (the new stable) that comes with samba 3.5.6 and openldap 2.4.23. this machines works primarily as a PDC. i have 3 services authenticating on ldap: samba, apache and redmine. samba is acting very weird, but it's kinda working,

[Q] Does anybody succeed to setup SASL(digest-md5) authentication with mysql database and latest openldap-server??

2011-02-14 Thread Hiroyuki Sato
Dear members. Does anybody succeed to setup SASL(digest-md5) authentication with mysql database and latest openldap-server?? I'm not sure, why this configuration does not work correctly. and It seems that LDAP server compare dn and input password in ldap authentication. (see log below) Thank

Re: ldap auth does not works after openldap upgrade

2011-02-14 Thread Leonardo Carneiro
On Mon, Feb 14, 2011 at 12:37 PM, Leonardo Carneiro chesterma...@gmail.com wrote: Hello everyone, I upgraded my debian machine from lenny to squeeze (the new stable) that comes with samba 3.5.6 and openldap 2.4.23. this machines works primarily as a PDC. i have 3 services authenticating on

Re: ldap auth does not works after openldap upgrade

2011-02-14 Thread Dan White
On 14/02/11 12:37 -0200, Leonardo Carneiro wrote: Hello everyone, I upgraded my debian machine from lenny to squeeze (the new stable) that comes with samba 3.5.6 and openldap 2.4.23. this machines works primarily as a PDC. i have 3 services authenticating on ldap: samba, apache and redmine.

Re: Does anybody succeed to setup SASL(digest-md5) authentication with mysql database and latest openldap-server??

2011-02-14 Thread Dan White
On 14/02/11 23:47 +0900, Hiroyuki Sato wrote: Does anybody succeed to setup SASL(digest-md5) authentication with mysql database and latest openldap-server?? I'm not sure, why this configuration does not work correctly. and It seems that LDAP server compare dn and input password in ldap

Re: Slapd Security based on port

2011-02-14 Thread Chris Jackson
On Feb 11, 2011, at 09:50 AM, Chris Jackson wrote: Is it possible to prevent anonymous and unauthenticated binds to ldaps:// 636 but allow them on ldap:// 389? I want to allow staff to query my ldaps:// outside of my network while requiring them to login to do so but allow anyone to bind

Re: Ppolicy does not seem to work

2011-02-14 Thread Jan Kohnert
Hello, Clément OUDOT schrieb: 2011/2/13 Jan Kohnert nospam001-li...@yyy.zzz.org: I have a problem with ppolicy and got stuck finding a solution. I configured slapd using the information from [1] trying to be able to lock users. But anyway, the lock seems to be ignored: As soon as one

RE: How to use LDAP_OPT_CONNECT_ASYNC?

2011-02-14 Thread Ian Puleston
-Original Message- From: Howard Chu [mailto:h...@symas.com] Ian Puleston wrote: If this all works I'll put in a bug report with a patch. Sounds to me like you should just file the bug report first. The patch can come later. I need to get this fixed in the port I am using so

Re: Ppolicy does not seem to work

2011-02-14 Thread Jan Kohnert
Jan Kohnert schrieb: I have a problem with ppolicy and got stuck finding a solution. I configured slapd using the information from [1] trying to be able to lock users. But anyway, the lock seems to be ignored: As soon as one tries to log in, the pwdLockedTime agument es removed from the entry

Re: Ppolicy does not seem to work

2011-02-14 Thread Howard Chu
Jan Kohnert wrote: So there comes the next question: Is there a way to lock out specific users permanently (other than creating a cronjob setting the lockout time new after 900s) or do I need to set pwdLockoutDuration to inf and so are forced to manually reset users whose accounts were tried to