CentOS 5.6 DC with LDAP Backend - Cant populate LDAP
Linux - ServerThis forum is for the discussion of Linux Software used in a server related context.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
CentOS 5.6 DC with LDAP Backend - Cant populate LDAP
Greetings!
First i'm from Germany, so please excuse if my posts are not grammatically correct everytime
Im pretty new with Linux Server tasks but know the basics and tried to get a first impression with the following tutorial building a Domaincontroler with LDAP Backend to join some Win7 machines to this domain: http://www.howtoforge.com/centos-5.x...h-ldap-backend
Unfortunately i tried to get my server running now for four times without success, im failing everytime with populating my LDAP Server, but first my testdomain configuration:
entry dc=homedom,dc=de already exist.
adding new entry: ou=People,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 3.
adding new entry: ou=Group,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 4.
adding new entry: ou=Computers,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 5.
adding new entry: ou=Idmap,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 6.
adding new entry: uid=root,ou=People,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 7.
adding new entry: uid=nobody,ou=People,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 8.
adding new entry: cn=Domain Admins,ou=Group,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 9.
adding new entry: cn=Domain Users,ou=Group,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 10.
adding new entry: cn=Domain Guests,ou=Group,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 11.
adding new entry: cn=Domain Computers,ou=Group,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 12.
adding new entry: cn=Administrators,ou=Group,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 16.
adding new entry: cn=Account Operators,ou=Group,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 18.
adding new entry: cn=Print Operators,ou=Group,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 19.
adding new entry: cn=Backup Operators,ou=Group,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 20.
adding new entry: cn=Replicators,ou=Group,dc=homedom,dc=de
failed to add entry: modifications require authentication at /usr/sbin/smbldap-populate line 500, <GEN1> line 21.
entry sambaDomainName=HOMEDOM,dc=homedom,dc=de already exist. Updating it...
failed to modify entry: modifications require authentication at /usr/sbin/smbldap-populate line 493, <GEN1> line 21.
Please provide a password for the domain root:
/usr/sbin/smbldap-passwd: user root doesn't exist
BUT if i look into my LDAP i can login via PHPLDAPADMIN and i can see my root object.
And at last my configs:
/etc/openldap/slapd.conf
Quote:
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/samba.schema
index cn,sn,uid,displayName pres,sub,eq
index uidNumber,gidNumber eq
index sambaSID eq
index sambaPrimaryGroupSID eq
index sambaDomainName eq
index objectClass pres,eq
index default sub
domain logons = Yes
domain master = Yes
os level = 65
preferred master = Yes
wins support = yes
# passdb backend = ldapsam:"ldap://ldap1.company.com ldap://ldap2.company.com"
passdb backend = ldapsam:ldap://127.0.0.1/
ldap admin dn = cn=root,dc=homedom,dc=de
ldap ssl = off
#ldap admin dn = cn=samba,ou=DSA,dc=company,dc=com
ldap suffix = dc=homedom,dc=de
ldap group suffix = ou=Groups
ldap user suffix = ou=Users
ldap machine suffix = ou=Computers
#ldap idmap suffix = ou=Idmap
add user script = /usr/sbin/smbldap-useradd -m "%u"
#ldap delete dn = Yes
delete user script = /usr/sbin/smbldap-userdel "%u"
add machine script = /usr/sbin/smbldap-useradd -t 0 -w "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
#delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
# printers configuration
#printer admin = @"Print Operators"
load printers = Yes
create mask = 0640
directory mask = 0750
#force create mode = 0640
#force directory mode = 0750
nt acl support = Yes
printing = cups
printcap name = cups
deadtime = 10
guest account = nobody
map to guest = Bad User
dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd
show add printer wizard = yes
; to maintain capital letters in shortcuts in any of the profile folders:
preserve case = yes
short preserve case = yes
case sensitive = no
[netlogon]
path = /home/netlogon/
browseable = No
read only = yes
[profiles]
path = /home/profiles
read only = no
create mask = 0600
directory mask = 0700
browseable = No
guest ok = Yes
profile acls = yes
csc policy = disable
# next line is a great way to secure the profiles
#force user = %U
# next line allows administrator to access all profiles
#valid users = %U "Domain Admins"
# $Id: smbldap.conf 35 2011-02-23 09:07:36Z fumiyas $
#
# smbldap-tools.conf : Q & D configuration file for smbldap-tools
# This code was developped by IDEALX (http://IDEALX.org/) and
# contributors (their names can be found in the CONTRIBUTORS file).
#
# Copyright (C) 2001-2002 IDEALX
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
# USA.
# Purpose :
# . be the configuration file for all smbldap-tools scripts
##############################################################################
#
# General Configuration
#
##############################################################################
# Put your own SID. To obtain this number do: "net getlocalsid".
# If not defined, parameter is taking from "net getlocalsid" return
SID="S-1-5-21-3443067517-799580430-224139724"
# Domain name the Samba server is in charged.
# If not defined, parameter is taking from smb.conf configuration file
# Ex: sambaDomain="IDEALX-NT"
sambaDomain="HOMEDOM"
# Notes: to use to dual ldap servers backend for Samba, you must patch
# Samba with the dual-head patch from IDEALX. If not using this patch
# just use the same server for slaveLDAP and masterLDAP.
# Those two servers declarations can also be used when you have
# . one master LDAP server where all writing operations must be done
# . one slave LDAP server where all reading operations must be done
# (typically a replication directory)
# Slave LDAP server
# Ex: slaveLDAP=127.0.0.1
# If not defined, parameter is set to "127.0.0.1"
slaveLDAP="127.0.0.1"
# Slave LDAP port
# If not defined, parameter is set to "389"
slavePort="389"
# Master LDAP server: needed for write operations
# Ex: masterLDAP=127.0.0.1
# If not defined, parameter is set to "127.0.0.1"
masterLDAP="127.0.0.1"
# Master LDAP port
# If not defined, parameter is set to "389"
masterPort="389"
# Use TLS for LDAP
# If set to 1, this option will use start_tls for connection
# (you should also used the port 389)
# If not defined, parameter is set to "0"
ldapTLS="0"
# Use SSL for LDAP
# If set to 1, this option will use SSL for connection
# (standard port for ldaps is 636)
# If not defined, parameter is set to "0"
ldapSSL="0"
# How to verify the server's certificate (none, optional or require)
# see "man Net::LDAP" in start_tls section for more details
verify="require"
# CA certificate
# see "man Net::LDAP" in start_tls section for more details
cafile="/etc/pki/tls/certs/ldapserverca.pem"
# certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientcert="/etc/pki/tls/certs/ldapclient.pem"
# key certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientkey="/etc/pki/tls/certs/ldapclientkey.pem"
# Where are stored Users
# Ex: usersdn="ou=Users,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for usersdn
usersdn="ou=People,${suffix}"
# Where are stored Computers
# Ex: computersdn="ou=Computers,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for computersdn
computersdn="ou=Computers,${suffix}"
# Where are stored Groups
# Ex: groupsdn="ou=Groups,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for groupsdn
groupsdn="ou=Group,${suffix}"
# Where are stored Idmap entries (used if samba is a domain member server)
# Ex: idmapdn="ou=Idmap,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for idmapdn
idmapdn="ou=Idmap,${suffix}"
# Where to store next uidNumber and gidNumber available for new users and groups
# If not defined, entries are stored in sambaDomainName object.
# Ex: sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"
# Ex: sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}"
sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"
# if hash_encrypt is set to CRYPT, you may set a salt format.
# default is "%s", but many systems will generate MD5 hashed
# passwords if you use "$1$%.8s". This parameter is optional!
crypt_salt_format="%s"
# Default password validation time (time in days) Comment the next line if
# you don't want password to be enable for defaultMaxPasswordAge days (be
# careful to the sambaPwdMustChange attribute's value)
defaultMaxPasswordAge="45"
# The UNC path to home drives location (%U username substitution)
# Just set it to a null string if you want to use the smb.conf 'logon home'
# directive and/or disable roaming profiles
# Ex: userSmbHome="\\PDC-SMB3\%U"
userSmbHome="\\SERVER1\%U"
# The UNC path to profiles locations (%U username substitution)
# Just set it to a null string if you want to use the smb.conf 'logon path'
# directive and/or disable roaming profiles
# Ex: userProfile="\\PDC-SMB3\profiles\%U"
userProfile="\\SERVER1\profiles\%U"
# The default Home Drive Letter mapping
# (will be automatically mapped at logon time if home directory exist)
# Ex: userHomeDrive="H:"
userHomeDrive="H:"
# The default user netlogon script name (%U username substitution)
# if not used, will be automatically username.cmd
# make sure script file is edited under dos
# Ex: userScript="startup.cmd" # make sure script file is edited under dos
userScript="logon.bat"
# Domain appended to the users "mail"-attribute
# when smbldap-useradd -M is used
# Ex: mailDomain="idealx.com"
mailDomain="homedom.de"
##############################################################################
#
# SMBLDAP-TOOLS Configuration (default are ok for a RedHat)
#
##############################################################################
# Allows not to use smbpasswd (if with_smbpasswd="0" in smbldap.conf) but
# prefer Crypt::SmbHash library
with_smbpasswd="0"
smbpasswd="/usr/bin/smbpasswd"
# Allows not to use slappasswd (if with_slappasswd="0" in smbldap.conf)
# but prefer Crypt:: libraries
with_slappasswd="0"
slappasswd="/usr/sbin/slappasswd"
# comment out the following line to get rid of the default banner
# no_banner="1"
/etc/smbldap-tools/smbldap_bind.conf
Quote:
# $Id: smbldap_bind.conf 35 2011-02-23 09:07:36Z fumiyas $
#
############################
# Credential Configuration #
############################
# Notes: you can specify two differents configuration if you use a
# master ldap for writing access and a slave ldap server for reading access
# By default, we will use the same DN (so it will work for standard Samba
# release)
slaveDN="cn=root,dc=homedom,dc=de"
slavePw="{SSHA}***"
masterDN="cn=root,dc=homedom,dc=de"
masterPw="{SSHA}***"
This is more of a smb-ldap tools issue than a ldap issue.
I saw something like this once. I don't remember the details. I had to find the line in the smbldap-populate script and change something. Take a look at line 500 and see what it says.
You could also try a more recent version of the smb-ldap tools.
I'm also newbie, this has been my problem and found some answers, actually I am also working on this and I am stuck on page two of http://www.howtoforge.com/centos-5.x...dap-backend-p2 its about on smbldap_tools.pm problem, I still does'nt configure completely, anyway I hope this helps.
Base on the site it is only tested in centos 5.3 and also works in centos 5.4 ( you are using ver 5.6 )
I suggest you should try this in your configuration:
since you are still testing the configuration try this in your /etc/smbldap-tools/smbldap.conf follow this settings:
#slaveLDAP="127.0.0.1"put a comment those line and try not to use slaveldap #slavePort="389"put also a comment verify="none"
your smbldap_bind.conf
#slaveDN="cn=root,dc=homedom,dc=de"comment this line and try not to use slave ldap #slavePw="{SSHA}***" comment also this line masterDN="cn=root,dc=homedom,dc=de" masterPw="1234567"your slappasswd password
Start over
stop the ldap server:
service ldap stop
delete all datbase file
rm -f /var/lib/ldap/*
restart server
service ldap start
you can the repopulate the database smbldap-populate
Quote:
Originally Posted by Totenkopf
Greetings!
First i'm from Germany, so please excuse if my posts are not grammatically correct everytime
Im pretty new with Linux Server tasks but know the basics and tried to get a first impression with the following tutorial building a Domaincontroler with LDAP Backend to join some Win7 machines to this domain: http://www.howtoforge.com/centos-5.x...h-ldap-backend
Unfortunately i tried to get my server running now for four times without success, im failing everytime with populating my LDAP Server, but first my testdomain configuration:
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
CentOS 5.6 DC with LDAP Backend - Cant populate LDAP
