Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - ippillihplm

Pages: [1] 2
1
Installation and Upgrades / Users/Groups Not Syncing (Zentyal 4.0.5)
« on: February 20, 2015, 05:16:28 pm »
I have 2 Zentyal 4.0.5 servers installed and are joined together.  They are supposed to be syncing over a Zentyal2Zentyal VPN connection.  I do see that the VPN tunnel is established and if I look at the cli with ifconfig, I can see the VPN IP as well as communicate over that VPN.

I did originally have all my users configured on one of the servers and joined the second server in and did see a successful join and users and groups from the original server did transfer over.

The issue now is that any new users that are added or changes to groups are not synced over to the opposite server.  It does not matter which server that I make the alteration, it does not sync.  I do not see any errors in the /var/log/zentyal/zentyal.log.  Are there any other logs which I should look at to give me any ideas what is going on here?

The only difference between the software installed is going to be that I enabled OpenChange and Jabber on the second server.

Can anyone advise why there is no sync between the systems beyond the initial sync?  Do the modules installed have to be exactly the same for the sync to occur correctly?

Any assistance would be greatly appreciated!

-Michael

2
Hello All:

I am having an issue with getting a new Zentyal install to join an existing Zentyal DC. Both of the installs are running v4.0.5.  When monitoring the logs, I see this:

Code: [Select]
2014/12/19 11:19:34 INFO> Provision.pm:824 EBox::Samba::Provision::checkAddress - Resolving poseidon.xxx to an IP address
2014/12/19 11:19:34 INFO> Provision.pm:844 EBox::Samba::Provision::checkAddress - The DC poseidon.xxx has been resolved to xxx.xxx.xxx.xxx
2014/12/19 11:19:34 INFO> Provision.pm:847 EBox::Samba::Provision::checkAddress - Checking reverse DNS resolution of 'xxx.xxx.xxx.xxx'...
2014/12/19 11:19:35 INFO> Provision.pm:868 EBox::Samba::Provision::checkAddress - The IP address xxx.xxx.xxx.xxx has been resolved to poseidon.xxx
2014/12/19 11:19:35 INFO> Provision.pm:770 EBox::Samba::Provision::checkServerReachable - Checking if AD server 'xxx.xxx.xxx.xxx' is online...
2014/12/19 11:19:35 INFO> Provision.pm:880 EBox::Samba::Provision::checkFunctionalLevels - Checking forest and domain functional levels...
2014/12/19 11:19:35 INFO> Provision.pm:908 EBox::Samba::Provision::checkRfc2307 - Checking RFC2307 compliant schema...
2014/12/19 11:19:35 INFO> Provision.pm:789 EBox::Samba::Provision::checkLocalRealmAndDomain - Checking local domain and realm...
2014/12/19 11:19:36 INFO> Provision.pm:982 EBox::Samba::Provision::checkClockSkew - Checking clock skew with AD server...
2014/12/19 11:19:36 INFO> Provision.pm:1003 EBox::Samba::Provision::checkClockSkew - Clock skew below two minutes, should be enough.
2014/12/19 11:19:36 INFO> Provision.pm:689 EBox::Samba::Provision::checkDnsZonesInMainPartition - Checking for old DNS zones stored in main domain partit
ion...
2014/12/19 11:19:36 INFO> Provision.pm:736 EBox::Samba::Provision::checkForestDomains - Checking number of domains inside forest...
2014/12/19 11:19:36 INFO> Provision.pm:942 EBox::Samba::Provision::checkTrustDomainObjects - Checking for domain trust relationships...
2014/12/19 11:19:37 INFO> Provision.pm:1044 EBox::Samba::Provision::checkADServerSite - Checking the site where the specified server is located
2014/12/19 11:19:37 INFO> Provision.pm:1052 EBox::Samba::Provision::checkADServerSite - The specified server has been located at site named Default-First
-Site-Name
2014/12/19 11:19:37 INFO> Provision.pm:1069 EBox::Samba::Provision::checkADNebiosName - Checking domain netbios name...
2014/12/19 11:19:37 INFO> Provision.pm:1292 EBox::Samba::Provision::provisionADC - Joining to domain 'xxx' as DC
2014/12/19 11:19:39 INFO> Provision.pm:1305 EBox::Samba::Provision::provisionADC - Trying to get a kerberos ticket for principal 'xxx@xxx'
2014/12/19 11:19:40 INFO> Provision.pm:1314 EBox::Samba::Provision::provisionADC - Executing domain join
2014/12/19 11:19:41 ERROR> Sudo.pm:240 EBox::Sudo::_rootError - root command samba-tool domain join xxx DC  --username='xxx'  --workgroup=
'corp'  --password=`cat /var/lib/zentyal/tmp/yUVjmS`  --server='xxx.xxx.xxx.xxx'  --dns-backend=BIND9_DLZ  --realm='xxx'  --site='Default-First
-Site-Name'  failed.
Error output:
Command output: Usage: samba-tool domain join <dnsdomain> [DC|RODC|MEMBER|SUBDOMAIN] [options]
 
.

I have tried the command line itself that is presented.  When I run it the cmdline, it joins just fine and joins the domain as expected.  So I cannot seem to figure out why the GUI doesn't seem to join.  I have tried running the join with a VPN tunnel as these are in 2 physically different locations and they seem to have the same issue except with the proper internal IP addresses.

Any ideas what else I can try here?  Any other logs I can look into beyond the /var/log/zentyal/zentyal.log?

-Michael

3
Installation and Upgrades / Re: 3.5: User Password Change [SOLVED]
« on: September 02, 2014, 07:36:06 am »
Yep,

I later encountered this issue.  The problem being, the user www-data, which is what the cgi/perl script is running as, is trying to access the smb.conf and openchange.conf files in the /etc/samba/ directory.  There is no secure way, at least that I have found, to run the perl script so that it can access those conf files.  Additionally, if you change the permissions on the files so that it the user can access them, it is temporary at best.  I have ended up running a crontab job that allows the user to access the files with the following commands in crontab:

Code: [Select]
0 * * * * setfacl -m "u:www-data:rx" /etc/samba/openchange.conf
0 * * * * setfacl -m "u:www-data:rx" /etc/samba/smb.conf

What this does is on the hour to set the ACLs for the user of www-data to allow it to access the necessary files.  this has worked for me thus far, but no guarantees here.

-Michael

4
Installation and Upgrades / (3.5) Jabber Shared Roster
« on: August 14, 2014, 08:46:59 am »
Hello,

I am having issues with Shared Rosters not showing up for my Jabber server.  When I look into the /var/log/ejabber/ejabberd.log I find this coming up:
Code: [Select]
=ERROR REPORT==== 2014-08-14 02:33:17 ===
E(<0.351.0>:eldap_utils:166) : failed to parse LDAP filter:
** Filter: []
** Reason: {error,["syntax error before: ",[]]}

Looking at the basic /etc/ejabberd/ejabberd.cfg the shared roster config looks to be as follows:
Code: [Select]
  {mod_shared_roster_ldap, [
    {ldap_filter, ""},
    {ldap_rfilter, "(objectClass=group)"},
    {ldap_gfilter, "(&(objectClass=group)(cn=%g))"},
    {ldap_ufilter, "(&(jabberUid=%u)(objectClass=userJabberAccount))"},
    {ldap_groupattr, "cn"},
    {ldap_groupdesc, "description"},
    {ldap_memberattr, "member"},
    {ldap_memberattr_format, "jabberUid=%u,DC=otmns,DC=net"},
    {ldap_useruid, "jabberUid"},
    {ldap_userdesc, "cn"}
  ]},

the /usr/share/zentyal/stubs/jabber/ejabberd.cfg.mas show the roster config at:
Code: [Select]
% if ($sharedroster) {
  {mod_shared_roster_ldap, [
    {ldap_filter, ""},
    {ldap_rfilter, "(objectClass=group)"},
    {ldap_gfilter, "(&(objectClass=group)(cn=%g))"},
    {ldap_ufilter, "(&(jabberUid=%u)(objectClass=userJabberAccount))"},
    {ldap_groupattr, "cn"},
    {ldap_groupdesc, "description"},
    {ldap_memberattr, "member"},
    {ldap_memberattr_format, "jabberUid=%u,<% $usersDn %>"},
    {ldap_useruid, "jabberUid"},
    {ldap_userdesc, "cn"}
  ]},
% }

And of course the Roster is enabled in the Jabber settings...

I have tried replacing the ldap_filter line with after perusing ejabberd docs, but this failed as well:
Code: [Select]
    {ldap_filter, "(sAMAccountName=*)"},
Any other ideas?

Thanks!
Michael

5
Hello All:

It looks as though this bug is fixed, however there are other issues with the acceptance of the message.  New bug created, but this one is done.

6
Installation and Upgrades / Re: Zentyal 3.5 User Backup
« on: August 14, 2014, 08:37:04 am »
Hello,

Thanks for the info.  Ended up re-deploying entirely...

7
Installation and Upgrades / Zentyal 3.5 User Backup [SOLVED]
« on: July 21, 2014, 04:14:28 am »
Hello All,

Is there a way to rescue just the users/passwords from an Zentyal 3.5 install?  That is all that I really want.  I know with older Zentyal installs I could pull an LDIF file from OpenLDAP, but since that doesn't exist anymore...

Thanks!
Michael

9
i did double check to ensure that there were members in the group as well as each member in the group having an email address as well. However the error still comes up.

10
Installation and Upgrades / Re: 3.5: User Password Change
« on: July 15, 2014, 11:20:55 am »
I think I was able to find a way to accomplish this via a CGI script.  If anyone is interested, here is the CGI file that I used that I did a lot of searching for...

############################################################################
# Simple CGI script that uses smbpasswd to allow a user to change their
# password on a Windows domain controller.
#
# Written 2013-03-02 by Lester Hightower
############################################################################

use strict;
use CGI qw(:standard);
use IPC::Open3;
use Symbol 'gensym';

my $DOM_CONTROLLER = '127.0.0.1';
my $EXE_SMBPASSWD = '/usr/bin/smbpasswd';

my $q = CGI->new;
if (uc($q->request_method()) eq 'POST') {
  try_change_passwd($q);
} else {
  send_change_form($q);
}

exit;

############################################################################
############################################################################
############################################################################

sub send_change_form($) {
  my $q=shift @_;
  print $q->header('text/html');
  my @form_elements = (
        { 'name' => 'Username', 'html' =>
    textfield(-name=>'username', -value=>'',-size=>20,-maxlength=>80)
        },
        { 'name' => 'Current Password', 'html' =>
    password_field(-name=>'old_passwd', -value=>'',-size=>20,-maxlength=>80),
        },
        { 'name' => 'New Password', 'html' =>
    password_field(-name=>'new_passwd', -value=>'',-size=>20,-maxlength=>80),
        },
        { 'name' => 'Retype new password', 'html' =>
    password_field(-name=>'new_passwd2', -value=>'',-size=>20,-maxlength=>80),
        },
        );
  print
    "<html>\n" .
    "<head><title>Change Password</title></head>\n" .
    "<body>\n" .
    start_form(-method=>'POST') .
    "<table>\n" .
    make_form_table_fields($q, \@form_elements) .
    "<tr><td colspan=2 align=right>" .
        submit(-name=>'btn_chpasswd', -value=>'Change Password') .
        "</td></tr>\n" .
    "</table>\n" .
    end_form .
    "</body>\n" .
    "</html>\n";

  return;
}
sub make_form_table_fields($$) {
  my $q=shift @_;
  my $form_elements=shift @_;

  my $t='';
  foreach my $fe (@{$form_elements}) {
    my $name=$fe->{name};
    my $html=$fe->{html};
    $t.="<tr><td align=right>$name</td><td>$html</td></tr>\n";
  }
  return $t;
}


############################################################################

sub try_change_passwd($) {
  my $q=shift @_;
  print $q->header('text/html');

  my $username = $q->param('username');
  my $old_passwd = $q->param('old_passwd');
  my $new_passwd = $q->param('new_passwd');
  my $new_passwd2 = $q->param('new_passwd2');

  if ($username !~ m/^[a-z._0-9]+$/i) {
    print "Invalid username\n";
    return;
  }
  if (length($new_passwd) < 1) {
    print "New password cannot be blank.\n";
    return;
  }
  if ($new_passwd ne $new_passwd2) {
    print "Mismatch in new password verification.\n";
    return;
  }

  my($wtr, $rdr, $err);
  $err = gensym;
  my @cmd=($EXE_SMBPASSWD,'-D 0','-s','-U',$username);
  #warn "LHHD: running - " . join(" ", @cmd) . "\n";
  my $pid = open3($wtr, $rdr, $err, @cmd);
  print $wtr "$old_passwd\n$new_passwd\n$new_passwd2\n";
  waitpid( $pid, 0 );
  my $child_exit_status = $? >> 8;

  if ($child_exit_status == 0) {
    print "Password changed successfully.";
  } else {
    my $stdout=<$rdr>;
    my $stderr=<$err>;
    my $errmsg=$stdout;
    if (length($errmsg)) { $errmsg .= "\n-\n"; }
    $errmsg .= $stderr;
    print "Password change was not successful:<pre>$errmsg</pre>\n";
  }
  return;
}

11
Hello,

I have moved onto the Zentyal 3.5 and have had pretty good luck thus far.  I do have one blaring issue that I see when I try to create a distribution group.  The distro I can create just fine, but when I try to assign an email address to the group, it feeds back the error:
There are no users in the group or the users do not have a mail account, so an alias account cannot be created

I check the zentyal.log and it shows close to the same thing:
2014/07/15 05:11:21 DEBUG> CreateGroupAlias.pm:55 EBox::Mail::CGI::CreateGroupAlias::_process - There are no users in the group or the users do not have a mail account, so an alias account cannot be created at There are no users in the group or the users do not have a mail account, so an alias account cannot be created at /usr/share/perl5/EBox/Mail/CGI/CreateGroupAlias.pm line 55


So the question is...would this be considered a bug or am is there anything that I can do about this to get distro groups with an email address?

Thanks!

Michael

12
Installation and Upgrades / Re: 3.5 - Samba LDAP
« on: July 07, 2014, 02:37:53 pm »
Thanks, I appreciate the info.

I actually forgot that in that this is going to require a fully qualified user such as user@domain.com to login.  I was able to get logged in successfully.

13
Installation and Upgrades / 3.5 - Samba LDAP [SOLVED]
« on: July 07, 2014, 09:52:38 am »
Hello All...

I understand that the OpenLDAP has been dropped in order to work with Samba.  I also understand that Samba does have an LDAP server included.  How does one authenticate against it via LDAP to pull users for authentication for something like ownCloud?

Thanks!

14
Installation and Upgrades / 3.5: User Password Change [SOLVED]
« on: July 01, 2014, 09:16:31 am »
How does a user change his password under 3.5 if the User Portal is now gone?  Is this just using the smbpasswd command for now?

15
Hello All:

I have an issue where inbound email that is coming to the user@hostname.domain.com instead of user@domain.com which is the original recipient. Not all mail has this issue, but there there is definitely some missing email that has occurred.  I am not sure if this is DNS or the hostname being presented or what...

An example with some partial headers:
Received: from barracudacentral.org (unknown [64.235.144.160])
   by demeter.otmns.net (Postfix) with ESMTPS id 7C69810F6
   for <xxx@demeter.otmns.net>; Thu,  5 Jun 2014 12:18:06 -0400 (EDT)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
   by barracudacentral.org (8.13.1/8.13.1) with ESMTP id s55GI5nl021543
   for <xxx@otmns.net>; Thu, 5 Jun 2014 09:18:05 -0700
...
To: "xxx@otmns.net" <xxx@demeter.otmns.net>

In the last Received header, you can see that the message was due to goto user@domain.com, but the first shows user@host.domain.com.  I realize that this is most likely the sending server doing this, but I have no idea why it is using the hostname.  I was thinking that it might be DNS...but it all looks okay to me:

otmns.net.   3600   IN   MX   30 demeter.otmns.net.
demeter.otmns.net.   3600   IN   A   107.170.23.203

I am stumped and I could use some help on this...

As a side note...to get this work, I ended up having to add a virtual domain reflecting the host.domain.com on top of the domain.com to get it to work, but I don't think this is supposed to work like this...

Thanks in advance!

Michael

Pages: [1] 2