1 This is the textual form of the GOsa FAQ. Online information with
2 comments is set up at Wiki: http://wiki.subnet.at/gosa/, thanks to
3 Markus Amersdorfer.
5 Q: When creating many users for one department, I need to fill some
6 fields again and again. Is there a shortcut for that?
8 A: Just create a user template and pre-fill all values you need. You
9 can use dynamic content, too: uid, sn and givenName will be replaced.
10 i.E. an entry '/home/%uid' in homeDirectory will be replaced by the
11 real uid of the user you're creating, %sn.%givenName@yourdomain.com
12 creates proper email addresses, etc. Templates include group membership.
15 Q: Can GOsa execute commands after creating/editing/removing users,
16 departments, etc.
18 A: Yes. Edit /etc/gosa/gosa.conf's menu section. Each plugin may have
19 an entry "postremove", "postmodify" and "postcreate". You can use
20 ldap attributes as command line options.
21 i.E. postcreate="/usr/bin/sudo /usr/local/sbin/ftp.setperms %uid '%givenName'"
24 Q: I'd like to modify the look of GOsa to fit our CI. How can I create an
25 own theme?
27 A: Themes are splitted into two parts. ihtml/ contains templates which
28 generate the ui, html/ contains all parts that must be readable from
29 clients. GOsa first looks for predefined files in the directory indirectly
30 defined via the "theme" parameter in /etc/gosa/gosa.conf. If it can't
31 find them here, it'll use the default one.
33 So start over by copying html/themes/default to html/themes/yourtheme
34 and ihtml/themes/default to ihtml/themes/yourtheme. Change gosa.conf to
35 contain theme="yourtheme" in section main. Here are some files to edit:
37 * login.tpl -> login screen
38 * framework.tpl -> page contents
39 * style.css -> stylesheets used by GOsa
41 In fact, the rest of the UI is not converted to smarty, yet. Please be
42 patient.
45 Q: How can I let a person do administrative tasks under a specific department?
47 A: Create a group inside this department. Put all administrative people inside,
48 go to the "ACL" tab and check all fields these users should be able to adminstrate.
51 Q: How can I permit users to change some of their own attributes?
53 A: Same like the point above, but this rule only works for users own attributes
54 by checking the box on the acl page.
57 Q: What about applications?
59 A: GOsa can manage desktop applications in ldap. Create a group and put all users
60 in there, which have common desktop settings. Go to the "Application" tab and
61 add all applications common to this group. Applications can be created from the
62 application plugin.
63 The idea behind this feature is a script running on the terminal-servers/
64 workstation which check for applications on login (or on a regular basis using
65 timestamps). This one will create the corresponding icons on your KDE or GNOME
66 desktop.
69 Q: What's this terminal stuff?
71 A: GOto is - similar to LTSP - a ldap based diskless client system. It is available
72 from our projects page.
75 Q: I can't select any mailservers. What's wrong?
77 A: LDAP stores information about all your servers. The server plugin is not ready
78 yet, so you've to adjust/add these entries using your favorite ldap tool.
81 Q: GOsa is not in my native language, can I translate it to my language?
83 A: Yes. Just go to the locale directory and copy the messages.po file somewhere
84 else. Edit the copy and put your translations into the msgstr lines. To be
85 included in next GOsa releases, you may want to send it to the GOsa maintainer.
86 Finally you need to create a directory with your language code. (i.e. de for
87 german) containing the LC_MESSAGES directory. Move your messages.po file there
88 and run 'msgfmt messages.po' in that directory. That's it.
90 You may need to restart apache, depending on your setup. On Debian, be sure
91 to have your locale generated (dpkg-reconfigure locales) before.
94 Q: Can I specify some kind of password policies?
96 A: You can place the keywords "pwminlen" and "pwdiffer" in the main section of your
97 gosa.conf. "pwminlen" specifies how many characters a password must have to be
98 accepted. "pwdiffer" contains the number of characters that must be different
99 from the previous password.
101 Note that these only affect passwords that are set by the user, not by the admins.
104 Q: I've to update passwords on external windows PDCs. Can I add a command to let
105 synchronize these for me?
107 A: There's the possibility to add a password hook in gosa.conf's main section using
108 the keyword "externalpwdhook". The specified command will be executed with
109 three parameters: /path/to/your/script username oldpassword newpassword
111 So you can call i.e. smbpasswd to handle your password change on the PDC.
114 Q: What about templates for vacation messages?
116 A: Create a directory to keep a set of vacation messages which are readable by the
117 user that runs your apache. In this example I'll use /etc/gosa/vacation for that.
119 Put your vacation files in there containing a "DESC:some descriptive text" as the
120 first line followed by the normal vacation text. You can use all attributes from
121 the generic tab. I.e.:
123 /etc/gosa/vacation/business.txt ------------------------------------------------->8
124 DESC:Away from desk
125 Hi, I'm currently away from my desk. You can contact me on
126 my cell phone via %mobile.
128 Greetings,
129 %givenName %sn
130 -----------------------------------------------------------------------------------
132 Place the config option vacationdir="/etc/gosa/vacation" in the location found in
133 gosa.conf and a template box is show in the vacation mail tab.
136 Q: How can I generate automatic ID's for user templates?
138 A: Add an entry describing your id policy in gosa.conf, location section:
140 a) using attributes
141 You can specify LDAP attributes (currently only sn and givenName) in braces {}
142 and add a percent sign befor it. Optionally you can strip it down to a number
143 of characters, specified in []. I.e.
145 idgen="{%sn}-{%givenName[2-4]}"
147 will generate an ID using the full surename, adding a dash, and adding at least
148 the first two characters of givenName. If this ID is used, it'll use up to four
149 characters. If no automatic generation is possible, a input box is shown.
151 b) using automatic id's
152 I.e. specifying
154 idgen="acct{id:3}"
156 will generate a three digits id with the next free entry appended to "acct".
158 idgen="ext{id#3}"
160 will generate a three digits random number appended to "ext".
163 Q: I'm migrating from the current LDAP, now GOsa does not allow uid's and group
164 with upper/lower case and spaces. What can I do?
166 A: Include the strict="no" keyword in your gosa.conf's location section.
167 WARNING: using strict="no" will cause problems with cyrus/postfix!!
170 Q: I'd like to place my users under ou=staff, not under ou=people. Can I change
171 this?
173 A: Yes. You can change the people and group locations by adding the following
174 statements to your location sections:
176 people="ou=staff"
177 groups="ou=crowds"
179 After logging in again, people and groups are created in the configured places.
180 As a side note, you can leave these strings blank for flat structures, too.
183 Q: I've problems with many objectClass violations/undefined attributes. Can GOsa
184 check what's missing?
186 A: Yes. Move away your gosa.conf and go to the GOsa setup. Follow the steps till
187 you can download the config. If you get up to this point, your schema is ok...
190 Q: I really don't want dn's containing the CN for user accounts because I don't
191 want to support anonymous binds for uid resolution. Is it possible to have dn's
192 containing the uid instead?
194 A: Yes. Placing the dnmode="uid" keyword in your gosa.conf's location section will
195 solve your problem.
198 Q: Hey, I've installed GOsa, but it claims something about "SID and / or RIDBASE
199 are missing in your configuration". What's wrong?
201 A: You've configured GOsa to use samba3, but your LDAP has no samba domain object
202 inside. Either log into samba for the first time to let it create that object,
203 or supply the sid and ridbase for your domain in your gosa.conf's location, i.e.:
205 <location name=...>
206 ...
207 ridbase="1000"
208 sid="0-815-4711" \>
210 Remember to fill in your real domain sid which is retrievable by the command
211 "net getlocalsid".
214 Q: We have massive performance problems with using samba as a member server.
216 A: This is a known issue. We're working around this by putting
218 <location name=...>
219 ...
220 sambaidmapping="true"
221 ... \>
223 into the configuration. GOsa will write the additional objectClass sambaIdmapEntry
224 to the group and user objects.
227 Q: I get 'The value specified as GID/UID number is too small' when forcing IDs. Why?
229 A: This is an additional security feature, so that no one can fall back to uid 0. The
230 default minimum ID is 100. You can set it to every value you like by specifying
232 <location name=...>
233 ...
234 minid="40"
235 ... \>
237 in your configuration. In this example 40 will be the smallest ID you can enter.
240 Q: Aahhrg. I've updated to a new version and my gosa.conf seems to be broken.
242 A: Some parameters have changed. Please call the fix_config.sh script which is in
243 the contrib directory.
246 Q: I've saved my windows workstations in other locations like GOsa is doing it
247 for decades. Is there a way to change this?
249 A: Yes. Use the winstation parameter in your location section:
251 <location name=...>
252 ...
253 winstations="ou=machineaccounts"
254 ... \>
257 Q: GOsa doesn't seem to follow my referrals. What can I do?
259 A: Place the option 'recursive = "true"' inside your locations definition
260 and you should be fine.
263 Q: I'd like to have TLS based LDAP connections from within GOsa. Is this possible?
265 A: Yes, add
267 <main ...>
268 ...
269 tls="true"
270 ... \>
272 to the main section of GOsa. This switch affects all LDAP connections.
275 Q: Cyrus folder get created in the style user.username. I prefer the unix hirachy
276 style user/username. Is it possible to change this?
278 A: Yes, add
280 <main ...>
281 ...
282 cyrusunixstyle="true"
283 ... \>
285 to the main section of GOsa and the folders are created in unix style.