Linux Mail Server Setup and Howto Guide

Hi,

I'm trying to install two servers (389 and AD directory) for now, I've a question.

Can you explain me this error lines into my PassSync.log :

06/02/10 11:33:18: Ldap bind error in Connect
    32: No such object
06/02/10 11:33:18: Can not connect to ldap server in SyncPasswords

My PassSync configuration :

Host Name : fedora389.synchro389.lan  (my fqdn 389 server)

Port Number : 636

User Name : uid=SMaster,cn=config (user is created in my 389 server)

Password : SMaster password

Cert Token : (empty because I don't know the password that the "setupssl2.sh" script take)

Search Base : (empty too)

I hope my english is not so bad (french guy)

Thanks in advance for helping me.

Mura.

Yep there is a pwdfile:

b48dacd668f40405e652b4b2281e9a1102dd62b7

Should I put this in the cert token input. ?

Post edited 1:11 pm – June 4, 2010 by Murasakiiru

Well I did as you said. Now for testing I run this command in my 389 server :

/usr/lib/mozldap/ldapsearch -Z -P /etc/dirsrv/slapd-fedora389/cert8.db -h AD_server_IP -p 636 -D "cn=administrateur,cn=users,dc=synchro389,dc=lan" -w password -s base -b "cn=users,dc=synchro389,dc=lan" "objectclass=*"

Supposing the syntax is correct, it returns me this :

ldap_simple_bind: Can't contact LDAP server

        SSL error -8179 (Peer's Certificate issuer is not recognized.)

I also captured frames with Wireshark and a TLS frame says that :

Alert (Level: Fatal, Description: Unknown CA)

Hope I give you pertinent informations and thanks for the help

For my project, I need to do the synchronization in the two ways. So if a password is changed in the 389DS, no software need to be added and if a password is changed to AD we need PassSync ? Is that right ?

Maybe I should restart to the beginning. Could you links me to your how-to the steps to do :

Enabling SSL (389 and AD server)

Create the synchronization

Tests

I've read all your how-to for 389/AD but I don't really know which way to go.

Thanks

Hi,

Sorry for my absence last week (I was in my training week)

So this week I try to follow your how-to. I did some synchronizations without problems.

I create a certificate with my AD server (in windows 2008) so I follow approximately the method for enable ssl on AD, export the certificate and this.

And now I've got this error message when I click the "Done" button in the summary page of my Windows Sync Agreement :

LDAP server is unwilling to perform

SSL frames captured with wireshark.

Mura.

The SSL test command doesn't work. It returns :

ldap_simple_bind: Can't contact LDAP server
        SSL error -8179 (Peer's Certificate issuer is not recognized.)

After testing, it seems I just need to uncheck/check the "enable replica" button to work again my synchronization without SSL.

I just find how to resolve my "Unknwon CA" issue. I think I didn't know very well how the certificates works. And it was difficult to auto-sign it.

The RedHat Documentation is very interesting link to the part that help me to resolv my problem.

And I used TinyCA to sign my certificates.