Fedora DS Client on HP-UX?????

[Ajeet S Raina]

I have Fedora Directory Server Configured on RHEL machine and am in verse to confgure Client on HP-Ux B.11.11 system.I am able to retrieve all users data from the directory through ldapsearch but am not getting the output from id and nsquery command.

Pls Help

[Ivan Ferreira · Accepted solution]

What is your configuration in the nsswitch.conf file? It seems that you don't have configured to search for information in ldap or you don't have the library.

Can you point to the documentation you used?

[Ajeet S Raina]

Thanks for the reply.Let me tell you complete process I followed.

1. I dint find doc related to Fedora DS Client configuration on HP-UX.I was following the doc http://docs.hp.com/en/J4269-90018/ch01s03.html (I forgot the new link)
2. Somehow I found that these patches are missing from my machine. So i installed them fro my HP B.11.11 system.
1. PHCO_30913 2.PHCO_31923 3.PHCO_34214 4.PHCO_33205 5.PHCO_34275 6. PHNE_34938 7.PHKL_30398 8.PHKL_34926 are those few.

Next,I was not finding the /opt/ldapux directory but anyhow I got /opt/iexpress directory where I can /bin and thereafter ldap.conf.default file.I pointed the entry as follows:
----------------------------
# pwd
/opt/iexpress/openldap64/etc/openldap
# ls
DB_CONFIG.example ldap.conf ldap.default.bak slapd.conf
lapd.conf ldap.conf.default lapd.conf.default
----------------------------------------
Now I made the following entry into ldap.conf file :
-------------------------------
#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

BASE dc=im,dc=logica,dc=com
URI ldap://10.14.236.169 ldap://pe.im.logica.com:389

#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
-------------------------------------
The entry is correct becoz' the following command gave me the following output when I ran :
------------------------------------------
# pwd
/opt/iexpress/openldap64/bin
# cd bin
# ./ldapsearch -x -h 10.14.236.169 -b "dc=im,dc=logica,dc=com" "(objectclass=*)

Few Excerpt of Output

----------------------------------

givenName: ritesh
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: posixAccount
objectClass: shadowAccount
sn: shah
cn: ritesh shah
uidNumber: 533
gidNumber: 533
homeDirectory: /ahome/rshah
loginShell: /bin/bash
gecos: ritesh shah
shadowLastChange: 13880

# manjeet, People, im.logica.com
dn: uid=manjeet,ou=People, dc=im,dc=logica,dc=com
uid: manjeet
givenName: manjeet
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: posixAccount
objectClass: shadowAccount
sn: singh
cn: manjeet singh
uidNumber: 543
gidNumber: 543
homeDirectory: /home/manjeet
loginShell: /bin/bash
gecos: manjeet singh
shadowLastChange: 13882

# nsPwPolicyContainer, People, im.logica.com
dn: cn=nsPwPolicyContainer,ou=People,dc=im,dc=logica,dc=com
objectClass: nsContainer
objectClass: top
cn: nsPwPolicyContainer

# tkumar, People, im.logica.com
dn: uid=tkumar,ou=People, dc=im,dc=logica,dc=com
uid: tkumar
givenName: tarun
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: posixAccount
objectClass: shadowAccount
sn: kumar
cn: tarun kumar
uidNumber: 549
gidNumber: 549
homeDirectory: /xhome/tkumar
loginShell: /bin/bash
gecos: tarun kumar
shadowLastChange: 13902
userPassword:: e2NyeXB0fVpadWNFbE0yYXFGdnc=

------------------------------------------

Now,it means the Client is correctly configured..Right???
Now I run :
#nsquery passwd tkumar ldap

-----------------------------

My nsswitch.conf is :
----------------------------------
#
# /etc/nsswitch.hp_defaults:
#
# @(#)B.11.11_LR
#
# An example file that could be copied over to /etc/nsswitch.conf; it
# uses NIS (YP) in conjunction with files.
#

passwd: files ldap
group: files ldap
hosts: dns
networks: files
protocols: nis [NOTFOUND=return] files
rpc: nis [NOTFOUND=return] files
publickey: nis [NOTFOUND=return] files
netgroup: nis [NOTFOUND=return] files
automount: files nis
aliases: files nis
services: nis [NOTFOUND=return] files
----------------------------------------

When I run #nsswitch.conf then:
------------------------------------
# nsquery passwd tkumar

Using "files ldap " for the passwd policy.

Searching /etc/passwd for tkumar
tkumar was NOTFOUND

Switch configuration: Allows fallback

Searching ldap for tkumar
This Name Service is currently unavailable

Switch configuration: Allows fallback

All name services have been searched
---------------------------------------

# # whereis id
id: /usr/bin/id /usr/share/man/man1.Z/id.1
# /usr/bin/id tkumar
Can't find user tkumar
--------------------------------------

Pls help me !!! I am totally stucked..
Waitign for your Response !!!

[Ajeet S Raina]

I saw this link : http://docs.hp.com/en/J4269-90083/ch02.html now and I think a lot of changes need to be made.Is it?????Pls do help me to provide step-by step configuration changes,if you can.

Hoping for your reply soon,

Thanks in advance

[Ivan Ferreira]

I have a test HP-UX system and FDS configured. Let me try to configure the LDAP client and I will post the results.

[Ajeet S Raina]

Great !!! I will be waiting for your reply.Let me tell you what configuration My fedora DS Server Holds before I leave the desk.
--------------------------------------
STEPS FOLLOWED FOR FEDORA DS INSTALLATION ON RHEL
--------------------------------------
[root@pe /]# rpm -ivh fedora-ds-1.0.4.RHEL.i386.opt.rpm

Preparing... ########################################### [100%]

1:fedora-ds ########################################### [100%]
root@pe / ]# /opt/fedora-ds/setup/setup

INFO Begin Setup . .
For My installations its as follows

Hostname to use (default: pe.im.logica.com) (Press enter for default)
Server user ID to use (default: nobody) (Press enter for default)

Server group ID to use (default: nobody) (Press enter for default)
Do you want to register this software with an existing with an existing
Fedora configuration directory server? [No] (Press enter for default -> No)

Do you want to use another directory to store your data? [No] (Press enter for default -> No)

Directory server network port [389]: (Press enter for default)
Directory server identifier [pe]: (Press enter for default)

Fedora configuration directory server administrator ID [admin] (Press enter for default)
Password: <>
The suffix is the root of your directory tree. You may have more than one suffix.
Suffix [dc=im, dc-logica, dc=com]: (Press enter for default)
Directory Manager DN [cn=Directory Manager]: (Press enter for default)
Password: <>

Administration Domain [pe.im.logica.com]: (Press enter for default)
Do you want to install the sample entries? [No]: (Press enter for default)
Type the full path and filename, the word suggest, or the word none
[suggest]: (Press enter for default)

Do you want to disable schema checking? [No]: (Press enter for default)

Administration port [58509]: (Press enter for default)
IP address [ ]: (Press enter for default)
Run Administration Server as [root]: (Press enter for default)
Apache Directory [/usr/sbin/]: (Press enter for default)

Hostname to use (default: pe.im.logica.com)

Server user ID to use (default: nobody)

Server group ID to use (default: nobody)

____________________________________________It got installed without any issue.

Now I got setting up SSL through script ./setupssl from the link:http://www.directory.fedora.redhat.com/wiki/Howto:SSL. there you will get setupssh script and it went on configuring the SSL configuration.If yu face any problem running the script,do let me know.Now my system is SSL enabled.

Now I started setting up Solaris Client from :http://web.singnet.com.sg/~garyttt/Configuring%20Solaris%20Native%20LDAP%20Client%20for%20Fedora%20Directory%20Server.htm or you can try this too:https://www.redhat.com/archives/fedora-directory-users/2006-April/msg00105.html. I followed this doc and ran rebuild.sh so as to make Fedora DS Server compatible to work to the format of Solaris..and All i was happy enough to configure that.

Now Came HP-UNIX and you know There is no doc I am finding for that.

May this help you to find the issue and fix therein.
In case you need any other information,do let me know.

Thanks

[Ivan Ferreira]

This is what I have done, in this configuration, SSL/TLS is not used:


Login as root
Install LDAP-UX client
# swinstall -s /usr/applications/J4269AA_B.04.15.01_HP-UX_B.11.23_IA_PA.depot J4269AA
# cd /opt/ldapux/config
# ./setup
Would you like to continue with the setup? [Yes]:
Directory Server: [1]:
Directory server host [hpux.sis.personal.net.py = ]: infra1.sis.personal.net.py
Directory Server port number [389]:
Would you like to extend the schema in this directory server? [Yes]:
The LDAP printer schema does not exist in the directory.
Note: The LDAP printer schema is based on IETF RFC 3712.
Would you like to extend the printer schema in this directory server? [Yes]:no
PublicKey schema does not exist in the directory server.
Would you like to install PublicKey schema in this directory server? [Yes]:no
Would you like to install the new automount schema ? [Yes]:no
Profile Entry DN: []: cn=ldapuxprofile,ou=ldapuxprofile,dc=sis,dc=personal,dc=net,dc=py
User DN [cn=Directory Manager]:
Password:
Authentication method: [1]:
Would you like to start/restart the LDAP-UX daemon (y/n) ? [y]:
LDAP-UX Client Services setup complete.

Edit /etc/nsswitch.conf
passwd: compat ldap
group: compat ldap


./ldapsearch -h infra1.sis.personal.net.py -b "dc=sis,dc=personal,dc=net,dc=py" uid=ferreiri

[works]

hpux # nsquery passwd ferreiri ldap

[did not work]

Then I verified the profile and I could identify that the base search was wrong for most information. What I did was to change the profile, for example I changed:

servicesearchdescriptor: passwd:ou=ldapuxprofile,dc=sis,dc=personal,dc=net,dc=py?sub?(objectclass=posixaccount)

to

servicesearchdescriptor: passwd:ou=people,dc=sis,dc=personal,dc=net,dc=py?sub?(objectclass=posixaccount)

Same for group information.

After that, I had to update the profile information running:

cd /opt/ldapux/config
./get_profile_entry -s nss
./display_profile_cache | more
[Check that the search base is correct]

Then:

nsquery passwd ferreiri ldap

Using "ldap" for the passwd policy.

Searching ldap for ferreiri
User name: ferreiri
User Id: 64682
Group Id: 48357
Gecos:
Home Directory: /home/ferreiri
Shell: /bin/bash

Switch configuration: Terminates Search

Welcome to the forum, please, ensure to review this link:

http://forums1.itrc.hp.com/service/forums/helptips.do?#28

For information about how to assign points to the answers you get.

Have a nice day.

[Ajeet S Raina]

Thanks a lot for the reply,I will definitely modify therein.
I am finding difficult to find this patch/package.Can you send me the link where you downloaded the same?
Also, One thing to ask you...about The modification you made ????
---------------------------------
Profile Entry DN: []: cn=ldapuxprofile,ou=ldapuxprofile,dc=sis,dc=personal,dc=net,dc=py
----------------------------------------
Is it you are mentioning on the client side for the first time?Do we need to modify the same in server too.?
I wrote about the script (one button script) fro Solaris and we needed to make some changes.Likewise,Do I need to make changes for Fedora DS too...Pls Help.
Now I am going to install the patch once you sedn me the link and will proceed as you did.
Thanks in advance

[Ajeet S Raina]

Its working now... I just downloaded the required packages and run the setup.Now the id command and nsquery seems to be working.But what i next need to do for making the user login.

The output it displays:
----------------------------------
# nsquery passwd tuser ldap

Using "ldap" for the passwd policy.

Searching ldap for tuser
User name: tuser
User Id: 9999
Group Id: 102
Gecos: Test User
Home Directory: /home/tuser
Shell: /bin/bash

Switch configuration: Terminates Search
----------------------------------------

# /usr/bin/id tuser
uid=9999(tuser) gid=102(mysql)
---------------------------------------

Whenver I am trying to login it says login incorrect.

I too created a home directory in the client side and copied /etc/skel/* (I think is it necessary? Right?) but whenever i ran:
#passwd tuser

It says "Invalid login name".

Is it something to do with PAM? I guess.

Pls Help??

[Ajeet S Raina]

Thanks for the response ..anyway..Now Its seems to work.The issue got resolved when I tried to copy /etc/pam.ldap into the /etc/pam.conf..Now everything works fine.
Well, Can I ask you for help regarding the Solaris if you have ever worked with.I know HP cant support for Solaris but if you can help me regarding the PAM File related to Solaris then I would be very thankful.
The issue is same...The id and passwd command seems to be working but I am not able to login.
My Pam.conf file for solaris is :
-----------------
#ident "@(#)pam.conf 1.28 04/04/21 SMI"
#
# Copyright 2004 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
#
# PAM configuration
#
# Unless explicitly defined, all services use the modules
# defined in the "other" section.
#
# Modules are defined with relative pathnames, i.e., they are
# relative to /usr/lib/security/$ISA. Absolute path names, as
# present in this file in previous releases are still acceptable.
#
# Authentication management
#
# login service (explicit because of pam_dial_auth)
#
login auth requisite pam_authtok_get.so.1
login auth required pam_dhkeys.so.1
login auth required pam_unix_cred.so.1
login auth required pam_unix_auth.so.1
login auth required pam_dial_auth.so.1
login auth required pam_ldap.so.1
#


auth requisite pam_authtok_get.so.1
sshd auth required pam_dhkeys.so.1
sshd auth sufficient pam_unix_auth.so.1
#sshd auth required pam_ldap.so.1 try_first_pass
sshd account required pam_unix_account.so.1


# rlogin service (explicit because of pam_rhost_auth)
#
rlogin auth sufficient pam_rhosts_auth.so.1
rlogin auth requisite pam_authtok_get.so.1
rlogin auth required pam_dhkeys.so.1
rlogin auth required pam_unix_cred.so.1
rlogin auth required pam_unix_auth.so.1
#rlogin auth required pam_ldap.so.1 try_first_pass
other auth required pam_unix_auth.so.1
#other auth required pam_ldap.so.1
#
# passwd command (explicit because of a different authentication module)
#
passwd auth required pam_passwd_auth.so.1
#passwd auth required pam_ldap.so.1
#
# cron service (explicit because of non-usage of pam_roles.so.1)
#
cron account required pam_unix_account.so.1
#
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
#
other account requisite pam_roles.so.1
other account required pam_unix_account.so.1
#other account required pam_ldap.so.1
#

# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
#
other session required pam_unix_session.so.1
#other session required pam_ldap.so.1
#
# Default definition for Password management
# Used when service name is not explicitly mentioned for password management
#
other password required pam_dhkeys.so.1
other password requisite pam_authtok_get.so.1
other password requisite pam_authtok_check.so.1
other password required pam_authtok_store.so.1
#other password required pam_ldap.so.1
#
# Support for Kerberos V5 authentication and example configurations can
# be found in the pam_krb5(5) man page under the "EXAMPLES" section.
-------------------------------


Pls Help..Coz When I commented all these hashed one the root is not able to login..

Pls Help