Ubuntu Servers :: LDAP Users And Groups - Adding A User

Aug 4, 2011

I have Ubuntu 10.04.2 (Linux 2.6.32-33-server on x86_64) with OpenLDAP 2.4.21 and Webmin1.550. I converted my ldap database from another system with the older style schema (OpenLDAP 2.3.3 with slightly older Webmin version 1.480) and no longer use slapd.conf, but the newer slapd.d format.

It all works fine except for one thing. When I add a new user, it lets me type in the additional LDAP fields:

But when I click the Create button, all the fields get jumbled together in the Title/Position box with a diamond question mark delimiting the fields:

Modifying existing users (which have the Additional fields displaying correctly) also has the same result - it moves the fields all into the one Title/Position box with the diamond shapes with question marks inside between each entry. Is it a problem with my schema files? I tried reverting to the older shema files and slapd.conf and it still did the same thing on the new system. I am really at a loss.

Here is also the output of ldapsearch for that user (host and samba ids are sanitized):

Previously added users that show the fields properly have "description:" and then the field listed for each Additional LDAP field. Also shouldn't the "title" be visible in plain human readable text here? - it looks like it encrypted it somehow - similar to a password hash. The older system works fine and the fields are all readable and in their proper locations. But the new system just doesn't work right.

View 1 Replies


ADVERTISEMENT

Server :: Adding More Users In LDAP Servers And Clients?

Mar 18, 2011

I installed and configured LDAP server and client on RHEL5 successfully. Problem is that when I add more than one user on server and clients, It shows error 'invalid user'.When I run the command:-#chown -R user:users /home/user, It shows error 'invalid user'. by step for adding and modifying more users in ldap servers.

View 1 Replies View Related

Ubuntu Servers :: Export Normal Unix Users To Ldap User?

Jul 1, 2010

how to export normal unix user to ldap I've unbuntu ldap server with some local users. I want to export all my local users to ldap database as a ldap users. Or if there is any configuration so that when ever a normal user is created then automatically an ldap user with the same name as the normal user will be created

View 5 Replies View Related

Server :: Add Users To Groups With Ldap?

Jan 18, 2010

how to add users to groups with ldap? Further, could someone point me towards some good command-line management tools? Creating each dn manually is going to get old real fast...

View 14 Replies View Related

General :: How To Setup LDAP Auth Of Users / Groups On Debian 5.0?

Aug 7, 2010

I would like to ask:How do I setup LDAP auth of users/groups on Debian 5.0?Is it using LDAP Migration tools? Can be done differently? Using different tool? Some nice tootorial?Some up to date book for LDAP or I need to dig in openldap.org?I'm learning by book which is a lil bit older so Im bit confused.

View 1 Replies View Related

Server :: Apache Authentication: Allow LDAP Group OR User Named Guest But Not All LDAP Users?

May 25, 2011

I am using RackMonkey to map out my lab. Unfortunately, due to RM limitations, every user who accesses the site has write access UNLESS they are logged in as a user named "guest". I currently have Apache allowing only the users (sysadmins) in an LDAP group access to RM, but I would like to allow read-only access for other users as well.I found mod_authn_anon, but I am having trouble combining the two authentication methods. I am using Apache 2.2.18 (compiled myself) on SLES 11.1.

This is the common part:

Code:

AuthType Basic
AuthBasicProvider ldap anon
Order allow,deny
Allow from all

This part by itself works for the LDAP authentication:

Code:

AuthName "System Admins"
AuthLDAPURL "ldaps://example.com/ou=ldap,o=example.com?mail" SSL
Require ldap-group cn=SysAdmins,ou=memberlist,ou=groups,o=example.com

This part works by itself for guest access:

Code:

Anonymous guest
Anonymous_VerifyEmail Off
Anonymous_MustGiveEmail Off
Anonymous_LogEmail on
Require valid-user

But if I have both of the previous blocks enabled at once, then guest access does not work. If I throw in a "Satisfy any", then I am not prompted for a username at all. How can I allow access to this LDAP group and to a user named "guest", but not allow all valid LDAP users to log in?

View 1 Replies View Related

Fedora :: Adding The User And Groups?

Jan 15, 2009

just getting startedin linux <fedora9> and haveseveral questions. first what bookwould be best to start the learning process? have looked at fedora 9 and enterprise and the newest fedora 10 with enterprise and these seem to be aimed at networking setups which I do not have.also in adding users and groups which I have done I think successfully however when I use the newgrp command and try to access a file I have saved under a group with two members the file does not show in the ls command.

users are jevans in group programmers cevans in group programmers in creating the file I didthe newgrp programmers command and created the filein the cevans spotand changed to jevans and negrp programmers and the filedoes not show.so what do I do here, or is my understaning of this incorrect?

View 14 Replies View Related

Server :: Adding LDAP People Entries That Are Not Users

Jan 22, 2010

I currently have an LDAP database on my Suse 10.2 server for managing authentication and controlling emails for my Cyrus email server. I use this setup to provide email functionality to my web and email hosting clients, as well as DNS functionality, and it uses the default LDAP database that was setup when OpenLDAP was initially configured. Email support is working wonderfully, I might add. I also tested and verified the use of an email lookup directory in two different email clients (Outlook and Evolution) so that I can tell one of my clients how to lookup the email address of users who are setup in the LDAP server, and it works beautifully.

However, I'd also like to be able to allow my clients to build a shared contact database that can also be used in their email clients so that they can share them among all of their users. Ideally, I would need to be able to allow each client to have their own database of shared contacts, and I assume this would be done by creating a new LDAP database for each client company (i.e. group of users) that can contain the list of shared contacts for any of that client's users. When they configure their email client directory settings, they would enter the base path to their database in order to retrieve their shared contact database entries.

In my web searches, I've found plenty of CRM solutions on the web that claim to provide this type of functionality, but I believe that OpenLDAP contains everything I need to make this work without adding another layer of software to the server solution. (I subscribe to the "Keep it Simple, Stupid!" approach whenever possible.) Essentially, I need to have People entries in a client's LDAP database that are NOT email users on the system. The fields in the standard people schema are all the fields they would need - as long as I can figure out how best to add these non-user entries in the LDAP database. Are there any potential difficulties in creating additional LDAP databases expressly for this purpose?

Are there any tricks to adding contact entries into a client's LDAP database without them also being current email users on the server, so that those entries can be retrieved through an Email Client directory lookup? I will also want to provide an easy method for my client users to add new entries to their LDAP contact database, most likely through a web interface for them that could then issue LDAP commands on the server based on the input fields for the new contact. (I don't believe this is possible from within the email client itself.) Is there any reason this could not be done with the proper configuration? What should I be aware of as I setup this contact management web interface? Is there a better way for non-technical client users to manage this list of shared contacts?

View 3 Replies View Related

General :: Set Default User Groups For New Users?

Dec 7, 2010

I am building a livecd, the live user created at boot time is a member of the audio group set in /etc/group. This way works for the livecd but when installed a user must manually add himself to the audio group. How can I set new users to automatically become a member of the audio group? In /etc/default/useradd I can set only one group.

View 4 Replies View Related

Server :: Adding New User In LDAP Client

May 2, 2010

I am facing problem in adding new users in ldap server and client for a long time. I configure ldap server and client successfully and I can login the client machine by a user. User is created on server during configuring the server but after same time when I create a new user on server and create a home dir for the same user on client machine and assign 700 permission on home dir of same user and copy the /etc/skel/.* /home/user-dir and when run the command "#chown -R user:users /home/user" it shows invalid user error.

View 1 Replies View Related

Ubuntu Servers :: Using Groups To Lock Users Away From Filesystem?

Mar 31, 2010

I'm currently running a small server using 9.10 and I wondered if using groups was a possible route in order to keep users away from the bulk of the file system and keep them in locked their home directories.

What I planned to do is use a group named 'allowsystemfiles' to be added to admin accounts, then to set parts of the file system to that group, along with the permissions 0760 to keep non-admin users out.

Is is a good idea or will this hose my system?

View 7 Replies View Related

Ubuntu Servers :: IPsec - Limit Users Or Groups

Jun 22, 2011

I successfully configured a VPN using IPSec(Openswan) and xl2ptd. While roughly following this guide (among countless others): [URL]

The VPN-Connection works fine, connecting to it is also a swirl, I can reach all that I want in the network, and also the gateway to the Internet works - everything being routed through that VPN.

Now my problem is actually the next steps, and I didn't succeed finding the right result on any possible search:

a) I want to limit, that the VPN-Connection is only used for distinct connections to hosts, that aren't in a "company subnet", but the IP's are publicly available. (Example: The Target-IP 8.8.8.8 allows per iptables, that only my VPN-Host 1.2.3.4 accesses it via SSH, and thus I only can access that Target-IP via SSH when I'm on the VPN). When actually browsing to the ubuntu-website, I want, that NOT the VPN-Connection is used but rather my normal connection (as a reference: i'm on a Windows-Client - not my choice, btw.)

b) I want to have several such "limitations" grouped, and give users 'access-rights' to certain hosts (Examples: Admin gets access to all on all ports Testers get access to some machines on distinct ports CEO gets access only to the mailserver via POP3 or IMAP

View 1 Replies View Related

Ubuntu Servers :: Apache 2.2 Users And Groups In Virtual Hosts?

Mar 3, 2011

I have Apache up and running and have a few virtual sites enabled. All these sites belong to the same user and group and the directory root for each site is in /home/{same-user}/www/{site-name}/htdocs/

I use Samba to connect from Windows to these directories and by default, files and directories are saved as the {same-user} and {same-group}. My question is, would it cause a problem if I changed the user and group in the virtual server directives in /etc/apache2/sites-available/site.conf files, giving apache permission to write to these files and directories. In the past I have changed the user and group to www-data (the default) but this seems inefficient an cumbersome compared to what I intend to do.

I use the server mostly for development, although at times I have a small site or two available to the public. Before I do this I want to be sure I'm not leaving a gaping security hole by changing these things. If this is all wrong, what is the standard way of running virtual hosts from apache and what is the standard document root for virtual sites?

View 4 Replies View Related

Ubuntu Servers :: Prompt Root Password When Attempt To Manage Users And Groups Through The GUI

Mar 20, 2010

So i have a fresh install of the server edition of Karmic, i'm running the Xfce desktop. When I attempt to manage users and groups through the GUI, I am prompted for what I think is the root password, the reason I say this is because the account I am currently logged in has sudo privileges and it does not accept that password at all, but I read that by default the root account is 'locked,' (to be honest it was so long ago since I last installed Ubuntu I completely forgot if it is or isn't, my current desktop installation has su access) is it asking for the root password? why doesn't my current user account password work if the root account is 'locked'? I can perform all other administrative tasks with sudo no problem.

the funny thing is, I have the exact same setup in a virtual machine, the same problem happens, except for some strange reason after changing the password on the only account (besides root), the password required to administer users and groups stayed the same after the change. (at the time of installation I just put both the user and root password the same and now that it is setup), i'm now ready to change the passwords. except now I read that the root account is locked by default, but this strange problem occurs.

View 2 Replies View Related

Fedora Servers :: Add Newly Created Users To Supplementary Groups Automatically?

Jul 30, 2010

The question is, as far as I know Ubuntu distro adds a user created with useradd to supplementary groups automatically. For instance, I want to enable sudo for all newly created users on my LiveCD and want them to be added to the group 'wheel' on creation. I'm sure it is possible to do it in Fedora, but how?

View 10 Replies View Related

Ubuntu Servers :: Setting Up An LDAP / Windows Users Be Able To Log In To Their Machines Using Domain Controller?

Oct 18, 2010

Im an IT manager for a small company with a small ammount of users. We already use linux for our data server and I would like to implement a domain controller. All of our user machines are WIndows XP pro.

Ive been reading up on using OpenLDAP as an alternative to active directory.

What I want is just a simple active directory like server, with a GUI if possible.

What do I need to look at and how would I go about setting this up? Im fairly proficient with Ubuntu already, I just need to be pointed in the right direction.

Is it even possible to have my windows users be able to log in to their machines using an ubuntu domain controller?

View 1 Replies View Related

Ubuntu Servers :: Adding AD Domain Users Group?

May 4, 2010

I have server 9.04 and joined thru winbind to Windows Domain and subversion installed.Windows AD users can use their own credentials to join and everything is working fine.However the group svn which is used to access the repos in /etc/groups has some users.However I would like to add the domain users group to the svn group but the domain users contains Space. And /etc/groups does not happend to read the space any ideas on how to add "domain users" to the svn group in /etc/groups

View 1 Replies View Related

Ubuntu Servers :: Get A List Of Both The Local Groups And The Groups In The Active Directory?

Feb 4, 2011

I already know of a work around to fix this problem, but I guess my question is why is this not working as expected? I am using a Windows Server 2008 R2 Active Directory for authentication.

I have run auth-client-config for the ldap profile and pam-auth-update. When running getent passwd, I get a list of both the local users and the users in the active directory (with populated information in the Unix schema extension). When running getent group I get a list of both the local groups and the groups in the active directory (with populated information in the Unix schema extension).

Interestingly enough, though, when I run su DOMAINUSER, after the prompt for the password I get an authentication error. In /var/log/auth.log I can see an entry with pam_ldap: missing "host" in file "/etc/ldap.conf". The SRV records in the DNS servers resolve correctly. I've checked this with nslookup and I have seen the records within my zone file. Obviously if the ldap.conf file is working with getent and the ldap server is resolving from the SRV records, it is working fine.

The interesting part is that the Windows Server 2008 R2 AD machine shows in the event viewer that there was a successful authentication, yet the Ubuntu box says no. When I add the host within the ldap.conf file, everything works...getent and the actual authentication, either initial login or su.

[Code]...

View 1 Replies View Related

Ubuntu Servers :: Mapping UNIX Groups To Windows Groups?

Oct 12, 2010

I am currently trying to set up a Samba domain server. In the Samba-HOWTO-Collection I found an
example file.(Point 3.3.3.1) In the explanations of the example below, the author says I need to map UNIX Groups to NT Groups. He writes a shell-script of how one could do it, but when I copy it and then execute it, I get the error:

Bad option: rid=512
Bad option: rid=513
Bad option: rid=514

The other groups do get mapped, just the Domain Admins, Domain Users and Domain Guests dont. This is the shell from the HOWTO:

#!/bin/bash
#### Shell-Skript f ̈r sp ̈tere Verwendung aufbewahren
net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmins rid=512
net groupmap modify ntgroup="Domain Users" unixgroup=users rid=513
net groupmap modify ntgroup="Domain Guests" unixgroup=nobody rid=514

[Code]...

View 2 Replies View Related

General :: Openssh + PAM + LDAP Fails Only With LDAP Users?

Mar 31, 2010

I've compiled openssh-5.4p1 on RHEL 4.8 with Openssl 0.9.8m + pam It works perfect without pam (pam-0.77-66), both with password and public key auth. Whith pam enabled and LDAP (openldap-2.4.21, from scratch) something strange happens: system users: I can do ssh with both password and public key LDAP users: public key works for remote users, still I cannot do ssh with just password. I'm trying a custom PAM configuration, because the default one (even with authconfig + LDAP ) blocks ssh even with system users.

My pam SSHD configuration is:

#%PAM-1.0
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth sufficient pam_ldap.so use_first_pass

[code]....

My LDAP users are ok: i can do "su - " remote LDAP (so that nss_ldap is OK), also getent passwd and getent group is ok.

View 2 Replies View Related

Fedora Servers :: LDAP Authentication Of Unregistered User At Client Side?

Sep 2, 2011

I have a openldap server running on one machine (fedora10) and pam_ldap.so and nss_ldap.so running on the other machine.

I have added a new user to the LDAP server database, this user is not created on client machine.

1. Can i login to the client machine using this new user?

2. Now if i try logging with this new user I am getting error messages, the error messages are as follows at client side

Sep 2 10:34:36 localhost sshd[8484]: Invalid user kim from 10.254.194.148
Sep 2 10:34:36 localhost sshd[8485]: input_userauth_request: invalid user kim
Sep 2 10:35:16 localhost sshd[8484]: pam_ldap: error trying to bind as user "cn=min soo,ou=people,dc=samsung,dc=com" (Invalid credentials)

[Code]....

View 4 Replies View Related

Ubuntu Servers :: Propagate Ldap Password Change To Samba And Unix User Account?

Apr 21, 2010

I setup openldap and samba on 9.10. The ubuntu desktop client gets authenticated successfully with the server. But when I do a passwd on the client, only the ldap passwd is getting changed but not in the samba and the unix user account.

My smb.conf

Code:

passdb backend = ldapsam:ldap://192.168.3.100
ldap suffix = dc=example,dc=local
ldap user suffix = ou=People
ldap group suffix = ou=Groups

[code].....

But only the ldap password is getting changed and not in the samba and unix user account.

I tried

unix password sync = yes

but same result.

View 1 Replies View Related

Ubuntu Installation :: Cannot ID LDAP User On LDAP Client

Dec 2, 2010

I've setup an Ubuntu 10.10 LDAP Client to authenticate off my LDAP server. I've install the following: sudo apt-get install libpam-ldap libnss-ldap nss-updatedb libnss-db nscd ldap-utils pam_ccreds Here's my /etc/nsswitch.conf: passwd: files ldap [NOTFOUND=return] db group: files ldap [NOTFOUND=return] db

[Code]...

View 9 Replies View Related

CentOS 5 Networking :: LDAP User Can't Login Remotely By SSH On LDAP/Samba PDC?

Sep 8, 2009

I installed CentOS 5.2 and then run yum update. I configured this server as LDAP/Samba primary domain controller. LDAP seems to be OK and for testing I am able to create users with:smbldap-tools useradd -am usernameI can ssh into the server as root and also as a Linux user which was locally created in the server. But ssh into the server as LDAP user fails (from a Fedora 11 machine) with "Permission denied, please try again", prompting again for password.Some data:

# rpm -qa | grep ldap
python-ldap-2.2.0-2.1
php-ldap-5.1.6-23.2.el5_3

[code]....

View 1 Replies View Related

Server :: Define A Global Group Made Up Of Other Groups In LDAP?

Apr 13, 2011

I'm trying to create a group called Domain Users, that will include several other groups that are populated with users inside of the LDAP database. In the LDAPdatabase, for a group entry, there are memberUid entries that can be filled. When I try to use another "Group" name, it just lists that name and not the people in that group. So if group "A" has Jim, John, Sue, and I include group "A" in the memberUid of the Domain Users group, I want that to reference the people in that group, not the group name. Testing access right, having the group name listed in "Domain Users" group, does not grant user access under the group rights on a directory. Should be simple, but I don't know the syntax to use for this reference.

View 2 Replies View Related

Ubuntu :: 11.4 Users And Groups GUI?

Dec 20, 2010

I am logged in with the account i created with ubuntu back in 10.4 but i cant do anything with the users and groups management tool any idea's what might be wrong? It also doesnt ask to escalate provilages when i run it which i suspect is part of the issue.

View 2 Replies View Related

General :: Command For Adding Groups To A File?

May 15, 2010

What is the best command for adding groups to a file?

View 2 Replies View Related

Ubuntu :: Root Can't Run Users And Groups

Dec 30, 2010

I'm running 10.10 64-bit and have configured it for root graphical login for administration of the system. When I log in as root, I can run all menu items in System -> Administration with the exception of Users and Groups. When I try running this, the application starts, but I only get an animated spinning disk that doesn't stop, can't modify the users properties and I can't close the application unless I go to System -> Administration -> System Monitor -> Processes tab , highlight users-admin and click End Process.

View 6 Replies View Related

General :: Difference Between Regular User And System User (and Groups)

Sep 28, 2010

What is the difference between creating a "regular" user and creating a "system" user on Linux?

For example:

Code:

adduser john

Code:

adduser --system john

Similarly it seems there are normal groups and system groups. Doing an internet search and reading man pages does not give much information on the whole concept of system and regular user/group.

View 1 Replies View Related

Ubuntu Servers :: Samba Share Using Domain User/group In Valid Users?

May 20, 2010

I have Ubuntu server 10.04 joined to a domain using Likewise Open. I can login using my domain credentials and have added my domain account to the sudoers file. Now that I've got it joined to the domain I want to add some samba shares and have domain members use their accounts to access them. However, no matter what combination of my domain name and the domain user or group I use in the valid users field it won't let me in. What's the proper way of inputting a domain user or group in the valid user field?

This is the entry I'm using for the share:

Code:
[testshare]
path = /srv/testshare
valid users = @"Domain Name+Domain Group" (Have tried many things here)
public = no
writable = yes
printable = no
create mask = 0765

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved