LDAP + Virtualmin/Webmin/Usermin Authentication

<div class='quote'>1. MySQL auto create dB for LDAP users.

I don't understand. Are you talking about Virtualmin virtual server users? You can already do so for new virtual servers--just enable MySQL databases. Or are you talking about Mail and FTP users? Those don't usually get databases...though it's possible, it's definitely not common. It makes me think maybe you're trying to push Virtualmin into a direction that doesn't really fit. But again, I don't really know what you're trying to accomplish.</div>

Sorry for the confusion. The Virtualmin virutal server user does have a dB auto create when the virtual server is created. I am talking about the Mail/FTP users. Those users are also stored in LDAP. But in our situation, we have several different virtual servers, each managed by different departments and each of those virtual servers have users that need dB's and web spaces. Usermin is being used for each user so they can change passwords, use the MySQL module, see disk quatas etc. Just no mail accounts on this particular server. So basically each Mail/FTP user needs a dB created when the user is created in LDAP from Webmin. Then the User can setup there individual blog, etc.

<div class='quote'>2. Why File Manager gives a Java trust error for LDAP/system users except for root. Is it possible to run usermin without https?

No idea. What's the exact error?</div>

I am on a different computer right now and I am not getting the error. I believe it was something along the lines of &quot;Java cannot get the proper language files. something,something, Java trust error.&quot; On this computer (both computers are Mac OS X 10.5.4) is that Java had a pop up asking if I trust the File Manager application. I think it has to do with a Java security setting. I will look into that.

<div class='quote'>3. Why postfix keeps starting when I have configured Sendmail (forward to a smtp gateway) to start instead.

I guess you still have it configured to start on boot, and possibly configured as the default MTA in alternatives.

Run the following:

chkconfig --level 345 postfix off

alternatives --config mta

And set the mta to sendmail.</div>

Actually, I did turn off Postfix and turn on Sendmail through both the Webmin &quot;Bootup Module&quot; and through chkconfig. Also, set Sendmail to be the MTA for virtual servers in Virtualmin. I totally forgot the alternatives command! I am sure that is it. I will give it a try.

Also, I noticed MySQL fails on boot but after the system boots it does start. Should MySQL be set to start in init/chkconfig or does Virtualmin start it independently.

Thanks!

alternatives fixed the MTA issue. Thanks!

Here is a screenshot of the JAVA error that happens on some Mac OS X computers. I have not figured out a work around yet.

Sorry, here's the image:

[img size=529]http://www.virtualmin.com/components/com_fireboard/uploaded/images/JAVA_...

<div class='quote'>Hmmm...interesting question and direction. So you're giving all users a website, but you don't want them to have their own domain (joe.department.example.com, for example)--presumably you'll use an Apache mod_userdir for http://example.com/~user style websites? So these aren't users that should have their own domain, but you do want them to be able to build sites?</div>

As of right now each user can't have there own separate sub-domain. This is a possibility in the future but for now I am stuck using mod_userdir. Each of the users are required to have a development area on the server, web space and one of several approved blogging environments.

<div class='quote'>But, this doesn't necessarily solve the problems of allowing scripts. I'm not sure if userdir can be configured with SuExec, so security might be an issue in a shared system like this. OK, good, it can:

http://httpd.apache.org/docs/2.0/suexec.html#usage

Ah, but it requires a compile time option (--with-suexec-userdir=DIR) that no standard packages include! Argh. Problematic.

Hmm, we'll need to think on this one a bit. We made need to get a custom Apache build for this to work securely.</div>

I was wondering about that. When I have setup previous systems for user environments, I did use the --with-suexec-userdir=DIR flag with the default being public_html for custom Apache installs. Is it possible to get the src and rpm spec file to build this?

<div class='quote'>The MySQL problem is reasonably easy to solve...just make a simple script that creates databases and call it when modifying a user. In the Users and Groups module (Webmin:System:Users and Groups, click Module Config), select the &quot;Before and After Commands&quot; section, and fill in a script in the &quot;Command to run after making changes&quot; field. Something like &quot;/usr/local/bin/makedatabase.sh&quot; or something.

And, in /usr/local/bin/makedatabase.sh:

#!/bin/sh

[ &acirc;

<div class='quote'>Hmmm...interesting question and direction. So you're giving all users a website, but you don't want them to have their own domain (joe.department.example.com, for example)--presumably you'll use an Apache mod_userdir for http://example.com/~user style websites? So these aren't users that should have their own domain, but you do want them to be able to build sites?</div>

As of right now each user can't have there own separate sub-domain. This is a possibility in the future but for now I am stuck using mod_userdir. Each of the users are required to have a development area on the server, web space and one of several approved blogging environments.

<div class='quote'>But, this doesn't necessarily solve the problems of allowing scripts. I'm not sure if userdir can be configured with SuExec, so security might be an issue in a shared system like this. OK, good, it can:

http://httpd.apache.org/docs/2.0/suexec.html#usage

Ah, but it requires a compile time option (--with-suexec-userdir=DIR) that no standard packages include! Argh. Problematic.

Hmm, we'll need to think on this one a bit. We made need to get a custom Apache build for this to work securely.</div>

I was wondering about that. When I have setup previous systems for user environments, I did use the --with-suexec-userdir=DIR flag with the default being public_html for custom Apache installs. Is it possible to get the src and rpm spec file to build this?

<div class='quote'>The MySQL problem is reasonably easy to solve...just make a simple script that creates databases and call it when modifying a user. In the Users and Groups module (Webmin:System:Users and Groups, click Module Config), select the &quot;Before and After Commands&quot; section, and fill in a script in the &quot;Command to run after making changes&quot; field. Something like &quot;/usr/local/bin/makedatabase.sh&quot; or something.

And, in /usr/local/bin/makedatabase.sh:

#!/bin/sh

[ &acirc;

<div class='quote'>For CentOS 5 (the GPL and Professional repos are identical, when it comes to everything except Virtualmin). I'm building an httpd package update for CentOS 5 at this very moment, though...I'll do a little research and see if this option will cause anyone any trouble, and if not, I'll roll it out for everyone.</div>

Good to know that info for the future. I will wait to see if you roll out a httpd update before I compile one.

Thanks!

<div class='quote'>#!/bin/sh

[ &acirc;

<div class='quote'>#!/bin/sh

[ &acirc;

<div class='quote'>OK, I've updated the Users and Groups module documentation to include all of the bits that were missing, including all of the available variables.

http://doxfer.com/Webmin/UsersAndGroups

The LDAP module is also documented at Doxfer, but just refers to Users and Groups for most of the details</div>.

Awesome, that helps a ton! I actually ended up finding this on the web too. I ordered the book also, just waiting for it to be delivered...

For reference here is the script I ended up adding to the LDAP Users and Groups -&gt; Module Config -&gt; Before/After Commands:

[code:1][ &acirc;

<div class='quote'>OK, I've updated the Users and Groups module documentation to include all of the bits that were missing, including all of the available variables.

http://doxfer.com/Webmin/UsersAndGroups

The LDAP module is also documented at Doxfer, but just refers to Users and Groups for most of the details</div>.

Awesome, that helps a ton! I actually ended up finding this on the web too. I ordered the book also, just waiting for it to be delivered...

For reference here is the script I ended up adding to the LDAP Users and Groups -&gt; Module Config -&gt; Before/After Commands:

[code:1][ &acirc;

<div class='quote'>When you disable a feature in a domain, it will remove the apache directives from the appropriate section of httpd.conf, just as it adds them when the feature is enabled.</div>

Ok. This works for some features but when I removed SVN and DAV access, I had to manually remove the directives from httpd.conf. It may have been caused by disabling both at the same time?

I have a new problem. This one is very urgent. I need to batch create about 100 users tonight and one of the variables that work fine when manually adding a LDAP user is not working when batching.

The script below sends a e-mail when the LDAP user is created. But when I batch add the user the $USERADMIN_PASS does not show up in the e-mail. All the rest of the variables work fine. The strange thing is there is also the makedatabase.sh script being run (earlier in this thread) that still works great. $USERADMIN_PASS sets the MySQL dB in that script just fine with the batch. The password is NOT being encrypted in the batch file. Any ideas?

Batch file format is:

create:username:password::gid:realname:path:shell::::::givenName=name:sn=lname:mail=e-mail:telephoneNumber=number

###############BEGIN SCRIPT###############
#!/bin/sh

[ &acirc;

I have a new problem. This one is very urgent. I need to batch create about 100 users tonight and one of the variables that work fine when manually adding a LDAP user is not working when batching.

The script below sends a e-mail when the LDAP user is created. But when I batch add the user the $USERADMIN_PASS does not show up in the e-mail. All the rest of the variables work fine. The strange thing is there is also the makedatabase.sh script being run (earlier in this thread) that still works great. $USERADMIN_PASS sets the MySQL dB in that script just fine with the batch. The password is NOT being encrypted in the batch file. Any ideas?

Batch file format is:

create:username:password::gid:realname:path:shell::::::givenName=name:sn=lname:mail=e-mail:telephoneNumber=number

###############BEGIN SCRIPT###############
#!/bin/sh

[ &acirc;

<div class='quote'>Have you tried $USERADMIN_PLAINPASS ? That should contact the un-encrypted password ..</div>

Hmm.. I didn't see that variable in the list. I will give that a try.

What did solve the problem, though it takes a manual change, is to change the scripts to run before the LDAP batch add. When the scripts run before it will fail to add a user if the user is added manually. So just change the scripts to run after for manual adds.

I will give the $USERADMIN_PLAINPASS a try.

Thanks!!