RE: POODLE SSLv3 downgrade attack

2014-10-19 Thread Joe Friedeggs
Pardon my ignorance on the subject, but I need to understand this: You've probably all heard about this new attack several times by now. Just to confirm what's already been stated - this attack only affects HTTP browsers that deliberately break the TLS handshake protocol to allow using

RE: ACL syntax with wildcards

2012-03-27 Thread Joe Friedeggs
On 26/2/2012 1:22 μμ, Nick Milas wrote: It seems to me that it would require to use regex *in a filter* and then group.expand based on the results. But is this possible? Any alternatives? Hmm, no one? Let me re-phrase: Can we express the following three statements using ONE

RE: ACL syntax with wildcards

2012-03-27 Thread Joe Friedeggs
On 26/2/2012 1:22 μμ, Nick Milas wrote: It seems to me that it would require to use regex *in a filter* and then group.expand based on the results. But is this possible? Any alternatives? Hmm, no one? Let me re-phrase: Can we express the following three statements using ONE

RE: ACL syntax with wildcards

2012-03-27 Thread Joe Friedeggs
On 26/2/2012 1:22 μμ, Nick Milas wrote: It seems to me that it would require to use regex *in a filter* and then group.expand based on the results. But is this possible? Any alternatives? Hmm, no one? Let me re-phrase: Can we express the following three statements using ONE

RE: ACL syntax with wildcards

2012-03-27 Thread Joe Friedeggs
On 26/2/2012 1:22 μμ, Nick Milas wrote: It seems to me that it would require to use regex *in a filter* and then group.expand based on the results. But is this possible? Any alternatives? Hmm, no one? Let me re-phrase: Can we express the following three statements using ONE

RE: ACL syntax with wildcards

2012-03-27 Thread Joe Friedeggs
On 26/2/2012 1:22 μμ, Nick Milas wrote: It seems to me that it would require to use regex *in a filter* and then group.expand based on the results. But is this possible? Any alternatives? Hmm, no one? Let me re-phrase: Can we express the following three statements using

RE: Implementing password policy

2012-01-08 Thread Joe Friedeggs
On 06/01/2012 21:29, Chris Jacobs wrote: Your example shows only 2 pwdFailureTime entries and your policy indicates pwdMaxFailure: 3. Hi Chris, No matter how many failed attempts I make, it never appears as locked: I now have: pwdFailureTime: 20120106193928Z pwdFailureTime:

input error=-2

2010-06-04 Thread Joe Friedeggs
I just recently noticed 'input error=-2' when running in debug mode, and in my logs (loglevel sync shell stats ber conns).  It seems to occur (always) when the connection it closed.  Anyone know what might cause this?  Is it anything I should be concerned with?  I am not sure when this

RE: RPM spec file

2010-04-21 Thread Joe Friedeggs
On Thursday, 15 April 2010 15:38:05 Joe Friedeggs wrote: I need to build a Red Hat rpm for the latest OpenLDAP release. I am looking for spec file, howto page, or anything else that might speed up this project. Any advice/suggestions would be greatly appreciated. There is also: http

RE: RPM spec file

2010-04-21 Thread Joe Friedeggs
On Thursday, 15 April 2010 15:38:05 Joe Friedeggs wrote: I need to build a Red Hat rpm for the latest OpenLDAP release. I am looking for spec file, howto page, or anything else that might speed up this project. Any advice/suggestions would be greatly appreciated. There is also: http

RE: Partial replication

2010-04-06 Thread Joe Friedeggs
The e-mail thread seems to have wandered a bit, hoping I am replying to the correct one. I've tested both methods, ACL vs 'syncrepl search filter', both seem to work well for me.  I agree with Andrew's point that controlling this via the ACLs on the provider is more secure (in my case).

Partial replication

2010-03-30 Thread Joe Friedeggs
Is it possible to replicate, on a slave, two branches of the DIT (only)?  I have several instances of LDAP running on servers throughout the world.  Connection to some of these from our support location is not dependable.  I want to do something similar to this: Main LDAP (here, master):

RE: Partial replication

2010-03-30 Thread Joe Friedeggs
On 03/30/10 18:36, Joe Friedeggs wrote: Is it possible to replicate, on a slave, two branches of the DIT (only)? I have several instances of LDAP running on servers throughout the world. Connection to some of these from our support location is not dependable. I want to do something

MD5 password hash with ppolicy

2009-12-22 Thread Joe Friedeggs
I am working (with RH via Dell support) to solve an issue (that I believe to be a pam_ldap issue).  The problem is that the password policy control messaging does not occur when I set 'pam_password md5', thus the Linux client never knows that the password expires. They have informed me that

PAM EXOP causes chain bind password to change

2009-12-02 Thread Joe Friedeggs
I am having an issue with my 'chain' bind password getting changed instead of the user's password. In a Red Hat Linux environment, running OpenLDAP 2.3.43(-3.el5 RPM from RH), I am using a master-slave setup, with chaining (as opposed to referral) as a method to allow users to change