[389-users] Issues with Password Policy when password is about to expire (e.g date reached passwordExpirationTime attribute value)

2015-02-02 Thread Predrag Zecevic [Unix Systems Administrator]
Hi all, we are faced with strange issue (started in last 4-5months; tried to fix it ourselves - didn't worked): our password policy require password change every 90 days... As soon as it reaches period (passwordExpirationTime) no one can log-in until DM changes password (and thus resets passwo

Re: [389-users] Importing database to new server

2014-03-12 Thread Predrag Zecevic [Unix Systems Administrator]
Hi, I cannot recall why, but I use pair of (export) db2ldif.pl and (import) ldif2db.pl tools, and that works fine (also importing JUST userRoot file). Actually, we do cloning (for testing purposes) of our production LDAP with those tools... Also, I am not using GUI tools (389-console ?), but

Re: [389-users] Importing database to new server

2014-03-11 Thread Predrag Zecevic [Unix Systems Administrator]
Hi, how did you make backup (export) of LDAP data? Regards. On 03/11/14 04:55 PM, Elizabeth Jones wrote: I'm having some problems trying to import an existing database into a new server. I know I was able to do this in the past, but since I'm an idiot I did not take notes on what I did and now

Re: [389-users] help with cert expired

2014-03-11 Thread Predrag Zecevic [Unix Systems Administrator]
Hi, I have done this (do not take it as good example - best would be IF you can test it somehow... in any case, do full backup of /etc/dirsrv/${INSTANCE} directory once your LDAP server is down, so at least you can revert changes). Use this at your own risk (unless someone confirms procedure

Re: [389-users] The admin server: failed to get a socket for 0.0.0.0

2014-01-16 Thread Predrag Zecevic [Unix Systems Administrator]
Hi, check if you have another process listening on that port. Regards. On 01/16/14 09:54 AM, Jan Tomasek wrote: On 01/15/2014 08:39 PM, Jonathan Vaughn wrote: Ah, I should have been more clear - I was asking if it was, because sometimes that sort of error can be caused be SELinux blocking the

Re: [389-users] "Re:Binding Directory Manager as default Bind when using SSL/TLS certificate (please help)"

2013-12-30 Thread Predrag Zecevic [Unix Systems Administrator]
Hi, ldapsearch looks at /etc/openldap/ldap.conf ... Maybe you have something weird there? Regards. On 12/30/13 04:16 PM, fosiul alam wrote: Hi Thanks for reply. Anonymous bind looks on to me from dse.ldif nsslapd-allow-anonymous-access: on Bellow is the result : I get result with this :

Re: [389-users] Binding Directory Manager as default Bind when using SSL/TLS certificate (please help)

2013-12-30 Thread Predrag Zecevic [Unix Systems Administrator]
Hi, to me it looks like anonymous bind is not allowed. Can you verify? Regards. On 12/30/13 03:07 PM, fosiul alam wrote: Hi All, I refer to my this question https://lists.fedoraproject.org/pipermail/389-users/2013-December/016572.html I have setup fedora 389 Directory server to use SSL/TLS

Re: [389-users] Unable to open 389 Console after running setupssl2.sh

2013-12-24 Thread Predrag Zecevic [Unix Systems Administrator]
Hi, maybe you have started (only) secure ldap port (TCP 636) **before** your console was configured to use it? Can you verify (look into logs, /var/log/dirsrv/slapd-NAME/access and /var/log/dirsrv/admin-serv/{error,access}) that you ldap server is using both unsecure and secure connection?

Re: [389-users] Password Failure Lockout doesn't seem to work

2013-11-26 Thread Predrag Zecevic [Unix Systems Administrator]
Hi, do you have anonymous bind enabled? Maybe this is why it is working? Just guess. Regards. On 11/26/13 14:13, JLPicard wrote: Yes, I can, after 8 consecutive failed authentications, the account can still successfully query the DS with the correct password. % ldapsearch -x -ZZ -LLL -h "my-

Re: [389-users] Problem with permissions in RHEL6

2013-09-16 Thread Predrag Zecevic [Unix Systems Administrator]
Hi, LDAP server should not be running as nobody... Which user account you have used on OLD system and which one on NEW? Can you paste output from: ps -ef | grep dirsrv form both boxes here? Regards. P.S. Usually, there is ldap:ldap username:groupname reserved for this use. On 09/16/13 04:49 P

Re: [389-users] How to get password expire time for user

2013-03-06 Thread Predrag Zecevic [Unix Systems Administrator]
Hi, if you have enabled password policy and set entries using /usr/lib/dirsrv/${SLAPD}/ns-newpwpolicy.pl utility (those all goes to sub-entry), then you can list it: ldapsearch -D "Directory Manager" -W -b "cn=nsPwPolicyContainer,People,dc=DOMAIN,dc=com" "(&(objectclass=ldapsubentry)(cn=$User))"

Re: [389-users] Backing up our 389-DS

2012-12-13 Thread Predrag Zecevic [Unix Systems Administrator]
Hi, we are using export/import (LDIF data)... Here shell snippet (PADL=instance_name - we are exporting both NetscapeRoot and rootUser space -> LDAP conf itself and our DATA set). ---8<--- # Get host architecture [[ $(uname -m) = "x86_64" ]] && ARCH=64 # Define path to the Export utility EXPUTI