Re: Re: Tuning openldap, nss_ldap and pam_ldap

2011-04-05 Thread c0re
/usr/local/etc/ldap.conf timelimit 10 bind_timelimit 5 bind_policy soft 2011/4/5 Marco Pizzoli marco.pizz...@gmail.com On 5 Apr 2011 16:11, c0re nr1c...@gmail.com wrote: nss_ldap.conf: timelimit 10 bind_timelimit 5 bind_policy soft nss_connect_policy oneshot I think

Re: slow ldap authentication

2011-01-07 Thread c0re
2011/1/4 bluethundr bluethu...@gmail.com: Hi list,  It's been a few days and I just wanted to check back to see if anyone had any troubleshooting tips that might help to solve this situation that I'm dealing with as I'm still a relatively new LDAP admin. I really appreciated your advice in

Using dynlist overlay like dynlist and dyngroup (extend dyngroup schema?)

2010-12-15 Thread c0re
Hello openldap users! slapd.conf: overlay dynlist dynlist-attrset groupOfUrls labeledURI member ldif: dn: cn=testgroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: testgroup member: cn=test,ou=users,dc=domain,dc=local dn: cn=maingroup,ou=servers,dc=domain,dc=local objectclass:

Re: Want interesting restrictions to ldap auth on different servers to different users

2010-12-06 Thread c0re
2010/12/6 Dan White dwh...@olp.net: On 06/12/10 15:34 +0300, c0re wrote: 2010/12/1 Dan White dwh...@olp.net: Thanks for example! But it still requires to edit clients.conf when adding device. And not restricts by groups. That's true, unless you have some of your clients coming from behind

Re: Want interesting restrictions to ldap auth on different servers to different users

2010-12-01 Thread c0re
2010/11/29 Howard Chu h...@symas.com: c0re wrote: 2010/11/19 Phuong Marie VUONGmangocph...@gmail.com: Hello, First, im sorry about my English. I share here my experience which worked for limit acces host/group of host for user... In the configuration of ldap client /etc/ldap.conf , i

Re: Want interesting restrictions to ldap auth on different servers to different users

2010-11-29 Thread c0re
, for exe : hostname.domain or PatternofHostGroup or * Hope that can help 2010/11/19 c0re nr1c...@gmail.com can you give an example of usage pam_check_host_attr? And how can I use group of hosts and assign user to this group to permit access user to this group avoiding enumerating

Re: self signed certificate

2010-11-22 Thread c0re
2010/11/22 Márcio Luciano Donada mdon...@auroraalimentos.com.br: Em 21/11/2010 22:36, Howard Chu escreveu: No, the software will accept whatever you tell it to use, if you configure it appropriately. which is the way to own a set? What documentation should I follow? -- Márcio Luciano

Re: Want interesting restrictions to ldap auth on different servers to different users

2010-11-19 Thread c0re
to pam_ldap? 2010/11/18 Aaron Richton rich...@nbcs.rutgers.edu: On Thu, 18 Nov 2010, c0re wrote: I mean user user1 can must login only on server1,server2 and server3. And user2 can login only on server5 and server2. You could probably overload almost anything (dyngroups, OpenLDAP ACLs, search

Re: Can't get TLS working.

2010-09-16 Thread c0re
# making clientkey openssl genrsa -out client.key 2048 # making certificate request openssl req -new -key client.key -out client.csr # signing openssl x509 -req -days 1024 -CA ../ssl/rootcrt.pem -CAkey ../ssl/rootkey.pem -in client.csr -out client.crt -CAserial ../ssl/root.seq # configuring on

Re: Can't get TLS working.

2010-09-16 Thread c0re
(3,0x80133e000,4096) = 0 (0x0) close(3) = 0 (0x0) 2010/9/16 Dieter Kluenter die...@dkluenter.de: c0re nr1c...@gmail.com writes: I tryed to test with ldapsearch, but it ignores ldap.conf somehow (where CA certificate

Re: Can't get TLS working.

2010-09-15 Thread c0re
Yes, same output of debug as in my first post, nothing changed. Also I tryed to use ssl on and connect to 636 port - same debug output... 2010/9/15 Dieter Kluenter die...@dkluenter.de: c0re nr1c...@gmail.com writes: I tried to set disallow tls_authc and/or TLSVerifyClient never in slapd.conf

Can't get TLS working.

2010-09-14 Thread c0re
Hello everyone! Wrote to openldap-software, but got Technical details of permanent failure: Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the