Study Notes

Novell Directory Services (NDS) debuted in 1994, and was derived from the Xerox X.500 database scheme. Although NDS was, and still is, primarily, the facility that allowed you to create users and groups on the Netware network. Novell eDirectory has the ability to exist on many platforms, other than Netware, including Windows NT/2000, Linux and Solaris.

gettext must be installed. gettext is, according to its website, “a set of tools that provides a framework to help other GNU packages produce multi-lingual messages”.

1. Pre-Install
Before beginning the installation, you will need to check certain parameters in your Linux server/workstation :
Enable Multicasting. You will need to check your routing table for an existing specific multicasting entry. Login as root and execute the following command,

#/bin/netstat -rn

Existing routes will be printed to screen. Look for the following entry

224.0.0.00.0.0.0

If you do not see this, then you will need to add the necessary entry. Again, as root user, execute the following command, (this assumes that you have just one network card and it is recognized by your system as eth0.

#route add -net 224.0.0.0 netmask 240.0.0.0 dev eth0

If you have more than one eDirectory server on the same network. You will need to use NTP to synchronize the time on your systems. You probably should have an NTP server configured on your network, if your company is fairly large. I have encountered problems starting my eDirectory server if the NTP connection is lost or unavailable. An indication that this may be the problem is when the NDS daemon fails to start at boot time.

2. Install nds8.8
Register novell user and download nds8.8 iso for Linux.
[root@localhost /]# mount -o loop edir_88_linux.iso /mnt
[root@localhost /]# cd /mnt/setup
[root@localhost setup]# ./nds-install
%%% Welcome to the installation of Novell eDirectory.
%%% The Novell eDirectory 8.8 for Linux End User License Agreement will now be displayed.
%%% Please read the agreement carefully before accepting the terms.
%%% Press ENTER to continue.

Novell(r) eDirectory(r) 8.8
Novell Software License Agreement
PLEASE READ THIS AGREEMENT CAREFULLY, BY INSTALLING OR OTHERWISE USING THE SOFTWARE, YOU AGREE TO THE TERMS OF THIS AGREEMENT. IF YOU DO NOT AGREE WITH THESE TERMS, DO NOT DOWNLOAD, INSTALL OR USE THE SOFTWARE. THE SOFTWARE MAY NOT BE SOLD, TRANSFERRED, OR FURTHER DISTRIBUTED EXCEPT AS AUTHORIZED BY Novell.
This Novell Software License Agreement (“Agreement”) is a legal agreement between You (an entity or a person) and Novell, Inc. (“Novell”). The software product identified in the title of this Agreement, media (if any) and accompanying documentation (collectively the “Software”) is protected by the copyright laws and treaties of the United States (“U.S.”) and other countries and is subject to the terms of this Agreement. If You do not agree with the terms of this Agreement, do not download, install or otherwise use the Software and, if applicable, return the entire unused package to the reseller with Your receipt for a refund. The Software is licensed to You, not sold.
The Software may include or be bundled with other software programs licensed under different terms and/or licensed by a licensor other than Novell. Use of any software programs accompanied by a separate license agreement is governed by that separate license agreement. Any third party software that may be provided wit

%%% Do you accept the terms of Novell eDirectory 8.8 license agreement ‘[y/n/q] ? y

%%% List of Novell eDirectory 8.8 components available to install

%%% 1 Novell eDirectory Server
%%% 2 Novell eDirectory Administration Utilities

%%% Select the components you wish to install [?, q] : 1,2

%%% Installing NICI-2.7.0…

%%% Adding packages…

%%% Installing novell-NDSmasv… done
%%% Installing novell-NDSbase… done
%%% Installing novell-NLDAPsdk… done
%%% Installing novell-NLDAPbase… done
%%% Installing novell-NDScommon… done
%%% Installing novell-pkiserver… done
%%% Installing novell-npkiapi… done
%%% Installing novell-npkit… done
%%% Installing novell-NOVLsas… done
%%% Installing novell-ntls… done
%%% Installing novell-ncpenc… done
%%% Installing novell-NDSserv… done
%%% Installing novell-NDSrepair… done
%%% Installing novell-NOVLstlog… done
%%% Installing novell-NOVLsubag… done
%%% Installing novell-nmas… done
%%% Installing novell-NOVLxis… done
%%% Installing novell-NOVLlmgnt… done
%%% Installing novell-NOVLembox… done
%%% Installing novell-NOVLsnmp… done
%%% Installing novell-NDSimon… done
%%% Installing novell-NOVLice… done

%%% Use “ndsconfig” or “ndsmanage” to configure Novell eDirectory Server.

%%% To use eMBox you need JRE version 1.4 or above. If your default version doesn’t work then update the PATH variable as follows to use jre version 1.4
PATH=$PATH:/opt/novell/eDirectory/lib/nds-modules/embox/jre/bin

%%% WARNING: The user should install openslp or NDSslp(version-8.8) package for using SLP services.

%%% Please update the following environment variables and export them or run /opt/novell/eDirectory/bin/ndspath to set the environment for Novell eDirectory 8.8
PATH=/opt/novell/eDirectory/bin:/opt/novell/eDirectory/sbin:$PATH
LD_LIBRARY_PATH=/opt/novell/eDirectory/lib:/opt/novell/eDirectory/lib/nds-modules:/opt/novell/lib:$LD_LIBRARY_PATH
MANPATH=/opt/novell/man:/opt/novell/eDirectory/man:$MANPATH

%%% Please go through /c/setup/../readme.txt carefully before using the product.
%%% Novell eDirectory Server packages successfully installed.

%%% Novell eDirectory Administration Utilities packages successfully installed.

Then vi /root/.bash_profile, and the following items and log again.

export SHLIB_PATH=/opt/novell/eDirectory/lib:/opt/novell/eDirectory/lib/nds-modules:/opt/novell/lib:$SHLIB_PATH
export PATH=/opt/novell/eDirectory/bin:/opt/novell/eDirectory/sbin:$PATH
export MANPATH=/opt/novell/man:/opt/novell/eDirectory/man:$MANPATH
export TEXTDOMAINDIR=/opt/novell/eDirectory/share/locale:$TEXTDOMAINDIR

2. Install ConsoleOne 1.3.6f
Download ConsoleOne 1.3.6f tarball from novell site, then compress to “Linux” directory.
[root@localhost root]# tar zxvf c1_136f-linux.tar.gz
[root@localhost root]# cd Linux
[root@localhost Linux]# ./c1-install
Welcome to the installation of ConsoleOne 1.3.6f

The following is a list of languages that are available to install.
1 English
2 Chinese
3 Chinese Traditional
4 French
5 German
6 Italian
7 Japanese
8 Portuguese
9 Russian
10 Spanish
11 All
Select the languages you wish to install [?,q]: 1

The following are all the available snapins you can choose to install
0 NONE
1 ICE Snapin
2 Index Manager Snapin
3 LDAP Snapin
4 SLP Snapin
5 WAN Manager Snapin
6 PKI Snapin
7 Filtered Replica Snapin
8 All
Select the snapin(s) you wish to install [?,q]: 8

———————————————-
Linux Kernel Version installed in this system:
2.4.21-32.EL
———————————————-

Do you wish to install Java Runtime Environment [y,n,q] ? y

%% A later version of NICI (2.7.0) is already present on this system.
%% The version of NICI available with this distribution (2.6.4) was not installed.
%% Adding package NOVLc1Linuxjre …
Preparing… ########################################### [100%]
1:NOVLc1Linuxjre ########################################### [100%]
%% Adding package NDSslp …
Preparing… ########################################### [100%]
1:NDSslp ########################################### [100%]
%% Adding package NDSbase …
Preparing… ########################################### [100%]
1:NDSbase ########################################### [100%]
%% Adding package NDScommon …
Preparing… ########################################### [100%]
1:NDScommon ########################################### [100%]
%% Adding package NLDAPsdk …
Preparing… ########################################### [100%]
1:NLDAPsdk ########################################### [100%]
%% Adding package NLDAPbase …
Preparing… ########################################### [100%]
1:NLDAPbase ########################################### [100%]
%% Adding package NOVLxis …
Preparing… ########################################### [100%]
1:NOVLxis ########################################### [100%]
%% Adding package NOVLlmgnt …
Preparing… ########################################### [100%]
1:NOVLlmgnt ########################################### [100%]
%% Adding package NOVLice …
Preparing… ########################################### [100%]
1:NOVLice ########################################### [100%]
%% Adding package NOVLsas …
Preparing… ########################################### [100%]
1:NOVLsas ########################################### [100%]
%% Adding package NOVLpkia …
Preparing… ########################################### [100%]
1:NOVLpkia ########################################### [100%]
%% Adding package NOVLpkis …
Preparing… ########################################### [100%]
1:NOVLpkis ########################################### [100%]
%% Adding package NOVLc1 …
Preparing… ########################################### [100%]
1:NOVLc1 ########################################### [100%]
%% Adding package NDSsice …
Preparing… ########################################### [100%]
1:NDSsice ########################################### [100%]
%% Adding package NDSsimgr …
Preparing… ########################################### [100%]
1:NDSsimgr ########################################### [100%]
%% Adding package NDSsldap …
Preparing… ########################################### [100%]
1:NDSsldap ########################################### [100%]
%% Adding package NDSsslp …
Preparing… ########################################### [100%]
1:NDSsslp ########################################### [100%]
%% Adding package NDSswan …
Preparing… ########################################### [100%]
1:NDSswan ########################################### [100%]
%% Adding package NDSspki …
Preparing… ########################################### [100%]
1:NDSspki ########################################### [100%]
%% Adding package NDSsfrep …
Preparing… ########################################### [100%]
1:NDSsfrep ########################################### [100%]
%% Java Runtime Environment Successfully Installed.
%% ConsoleOne Successfully Installed.
%% Execute /usr/ConsoleOne/bin/ConsoleOne to run ConsoleOne
%% Snapins Successfully Installed.
NDSslp-8.7.3-13
Starting NDS SLP services…
Done

4. Set up the tree
[root@localhost root]# ndsconfig new -t Plasmon -n o=Plasmon -a cn=PlasmonAdmin.o=Plasmon
Enter the password for cn=PlasmonAdmin.o=Plasmon:
Re-enter the password for cn=PlasmonAdmin.o=Plasmon:
Please enter the absolute path for the instance [ /var/opt/novell/eDirectory ]:
Please enter absolute path of the database directory [ /var/opt/novell/eDirectory/data/dib ]:
Configuring the NDAP interfaces… Done
Configuring the LDAP interfaces… Done
Configuring the HTTP interfaces… Done
Starting the service ‘ndsd’… Done.
Configuring Novell eDirectory server with following parameters
Admin name = cn=PlasmonAdmin.o=Plasmon
Tree name = Plasmon
Server Context = o=Plasmon
DIB location = /var/opt/novell/eDirectory/data/dib
Searching for Duplicate Tree Name in the network. Please wait…
Basic configuration is successful. Proceeding with additional configuration…
Extending schema… Done
For more details view schema extension logfile: /var/opt/novell/eDirectory/log/schema.log
Configuring HTTP service… Done
Configuring LDAP service… Done
Configuring SNMP service… Done
Configuring SAS service… Done
Associating certificate with the NCP server object… Done
Configuring NMAS service… Done
Configuring SecretStore… Done
Configuring LDAP Server with default SSL CertificateDNS certificate… Done
The instance at /etc/opt/novell/eDirectory/conf/nds.conf is successfully configured.

Check the service stauts:
[root@localhost root]# ndsstat
[1] Instance at /etc/opt/novell/eDirectory/conf/nds.conf: localhost.o=Plasmon.PLASMON
Tree Name: PLASMON
Server Name: .CN=localhost.O=Plasmon.T=PLASMON.
Binary Version: 20112.91
Root Most Entry Depth: 0
Product Version: eDirectory for Linux v8.8 [DS]
5. Setting Up hosts.nds
If you are installing eDirectory on a pristine Red Hat system, you may have default firewall rules that block the Service Location Protocol (SLP). SLP functions like the “Network Neighbourhood” of Microsoft Windows, in that it broadcasts available services on the network, and enable applications like ConsoleOne to “know” what services are available. If SLP is blocked, you will not be able to “browse” for the eDirectory server.

In any case, one way to do away with SLP, or, if you don’t like to wait for ConsoleOne to browse for the eDirectory server, is to create a file hosts.nds inside /etc directory. This file is very similar to the hosts file that network engineers are so familiar with. The contents of our hosts.nds file are shown below:
# hosts.nds file for Virago
# Tree name Internet Address
Plasmon. 192.168.123.33

Note the trailing period “.” after the Tree name. This is not a typo — you need to specify it as a fully qualified tree name. If your server has a static IP address, you can specify it under “Internet Address”.
6.Configuring for LDAP With ConsoleOne
run ConsoleOne:

# cd /usr/ConsoleOne/bin
# ./ConsoleOne
ConsoleOne was not found in ./../jre/jre/bin/java

Later, I modified the /usr/ConsoleOne/bin/ConsoleOne script, add chmod line:
…
prog=”${jre}/bin/java”
chmod 777 “$prog” # grant privilege

# Run.
if [ -x “$prog” ]
then
$prog -noverify -Dapplication.home=”${APPHOME}” -classpath “$classpath” com.novell.application.console.shell.Console “$@”
else
echo >&2 “$progname was not found in ${prog}”
exit 1
fi
…

Then, run Console successfully.

7. Test LDAP server

After authenticating successfully, expand all the objects in the left pane and take a look around. Click on the oganization object in the left pane and you should see all the objects that are created for it in the right pane.

Locate the LDAP Server object and the LDAP Group object. You are going to make some changes to the properties of these objects. Right-click the LDAP Server object and select “Properties”. You will see the General Settings of your LDAP server.

Click on the SSL/TLS Configuration tab. Ensure that the checkbox for “Require TLS for All Operations” is cleared. Click Apply then Close.

Next, locate the LDAP Group object. Right click it and select “Properties”. You will see the LDAP Group General Settings. Ensure that the checkbox for “Require TLS for simple binds with password” is cleared. Click Apply then Close.

Now begin testing several LDAP operations against eDirectory.Using eDirectory’s text commands, which are very similar to those of OpenLDAP, and we will look at debugging information from DSTRACE, a very useful troubleshooting tool for eDirectory.

First, login as root, because cannot execute ndstrace as a normal user. Open a terminal window and execute the following command :
# ndstrace

The terminal window will look something like the picture above. Note the NDSTrace: prompt at the bottom of the window. Your commands will appear there. Type “set dstrace=nodebug” (without the quotes), this will clear the DSTRACE settings. Then type “set dstrace=+ldap”. This will turn on LDAP debugging. When you run any LDAP commands against this eDirectory server, informational and error messages will be displayed in this DSTRACE window. For production deployments, you will want to turn off LDAP debugging because it takes up CPU cycles.

At this point, issue the following command:
# ldapsearch -x -h localhost -b “” -s one objectclass=*
First time, I forgot to type “-x”, error displays: ldap_sasl_interactive_bind_s: Unknown authentication method”.
Add “-x”, all the entries are able to be returned.

Since 192.168.123.33 is the nds server IP address, I run the following commands on 192.168.123.33:
# ldapsearch -x -b “o=Plasmon” -H ldap://192.168.123.33
# ldapsearch -x -b “o=Plasmon” -H ldaps://192.168.123.33:636
# ldapsearch -x -b “o=Plasmon” -H ldap://127.0.0.1
# ldapsearch -x -b “o=Plasmon” -H ldaps://127.0.0.1:636
The above four run OK. But, when I log on other Linux(192.168.123.68), and try:
# ldapsearch -x -b “o=Plasmon” -H ldap://192.168.123.33
It always said cannot find LDAP server. Why? I check the ConsoleOne LDAP setting, its network configuration contains “ldap://127.0.0.1:389 ldaps://127.0.0.1:636”, and I could not modify this field. Is the disable connection caused by this setting? I scan all the open ports in 192.168.123.33, all LDAP ports display. Then run nmap in 192.168.123.68, Ah, it takes a long time to scan, but return no result. Yes, I see, The reason must be the firewall enabled in 192.168.123.33 server. Just shutdown the firewall in 192.168.123.33, and run ldapsearch again, Yeah!