1 This is the textual form of the GOsa FAQ. Online information with
2 comments is set up at Wiki: https://oss.gonicus.de/labs/gosa/wiki/documentation
4 Q: When creating many users for one department, I need to fill some
5 fields again and again. Is there a shortcut for that?
7 A: Just create a user template and pre-fill all values you need. You
8 can use dynamic content, too: uid, sn and givenName will be replaced.
9 i.E. an entry '/home/%uid' in homeDirectory will be replaced by the
10 real uid of the user you're creating, %sn.%givenName@yourdomain.com
11 creates proper email addresses, etc. Templates include group membership.
14 Q: Can GOsa execute commands after creating/editing/removing users,
15 departments, etc.
17 A: Yes. Edit /etc/gosa/gosa.conf's menu section. Each plugin may has
18 an entry "postremove", "postmodify" and "postcreate". You can use
19 ldap attributes as command line options.
20 i.E. postcreate="/usr/bin/sudo /usr/local/sbin/ftp.setperms %uid '%givenName'"
23 Q: I'd like to modify the look of GOsa to fit our CI. How can I create an
24 own theme?
26 A: Themes are splitted into two parts. ihtml/ contains templates which
27 generate the ui, html/ contains all parts that must be readable from
28 clients. GOsa first looks for predefined files in the directory indirectly
29 defined via the "theme" parameter in /etc/gosa/gosa.conf. If it can't
30 find them here, it'll use the default one.
32 So start over by copying html/themes/default to html/themes/yourtheme
33 and ihtml/themes/default to ihtml/themes/yourtheme. Change gosa.conf to
34 contain theme="yourtheme" in section main. Here are some files to edit:
36 * login.tpl -> login screen
37 * framework.tpl -> page contents
38 * style.css -> stylesheets used by GOsa
41 Q: How can I let a person do administrative tasks under a specific department?
43 A: Gosa 2.5.x
44 * Create a group inside this department.
45 * Put all administrative people inside
46 * go to the "ACL" tab and check all fields these users should be able to adminstrate.
48 GOsa 2.6 implements a more flexible but complex ACL management, please have a look at
49 the following wiki page: https://oss.gonicus.de/labs/gosa/wiki/DocumentationWritingACLs2.6
50 If you have still questions, please use the mailing list or the forum.
53 Q: How can I permit users to change some of their own attributes?
55 A: Same like described above, but additionally you have to check the option
56 'Apply this acl only for users own entries'.
57 (For versions 2.6.x, see the wiki pages)
60 Q: What about applications?
62 A: GOsa can manage desktop applications in ldap. Create a group and put all users
63 in there, which have common desktop settings. Go to the "Application" tab and
64 add all applications common to this group. Applications can be created from the
65 application plugin.
66 The idea behind this feature is a script running on the terminal-servers/
67 workstation which check for applications on login (or on a regular basis using
68 timestamps). This one will create the corresponding icons on your KDE or GNOME
69 desktop.
72 Q: What's this terminal stuff?
74 A: GOto is - similar to LTSP - a ldap based diskless client system. It is available
75 from our projects page.
78 Q: I can't select any mailservers. What's wrong?
80 A: It seems that a mail server is missing in your configuration.
81 Create a new server, go to the services tab and add the imap service.
82 For more details, please have a look at the FAQ and wiki pages.
83 (This may differ in older GOsa versions)
86 Q: GOsa is not in my native language, can I translate it to my language?
88 A: Yes. Just go to the locale directory and copy the messages.po file somewhere
89 else. Edit the copy and put your translations into the msgstr lines. To be
90 included in next GOsa releases, you may want to send it to the GOsa maintainer.
91 Finally you need to create a directory with your language code. (i.e. de for
92 german) containing the LC_MESSAGES directory. Move your messages.po file there
93 and run 'msgfmt messages.po' in that directory. That's it.
95 You may need to restart apache, depending on your setup. On Debian, be sure
96 to have your locale generated (dpkg-reconfigure locales) before.
99 Q: The online help doesn't exist in my language, can i translate it to my language?
101 A: Yes. Just go to the doc/guide/user/en directory and copy the lyx-source directory
102 to a new directory in doc/guide/user/<your language>. You have to use the lyx
103 program create the online help in your language. When you have finish just run
104 ./gen_online_help from the gosa root directory to generate the online docs.
107 Q: Can I specify some kind of password policies?
109 A: You can place the keywords "passwordMinLength" and "passwordMinDiffer" in the main
110 section of your gosa.conf. "passwordMinLength" specifies how many characters a
111 password must have to be accepted. "passwordMinDiffer" contains the number of
112 characters that must be different from the previous password.
114 Note that these only affect passwords that are set by the user, not by the admins.
117 Q: I've to update passwords on external windows PDCs. Can I add a command to let
118 synchronize these for me?
120 A: There's the possibility to add a hooks in gosa.conf's plugin tags using
121 the "premodify/postmodify" keywords. The specified command will be executed with
122 these additional parameters: %current_password %new_password %userPassword
124 For further information about pre- and post hooks search for the premodify
125 and postmodify statements.
127 So you can call i.e. smbpasswd to handle your password change on the PDC.
130 Q: What about templates for vacation messages?
132 A: Create a directory to keep a set of vacation messages which are readable by the
133 user that runs your apache. In this example I'll use /etc/gosa/vacation for that.
135 Put your vacation files in there containing a "DESC:some descriptive text" as the
136 first line followed by the normal vacation text. You can use all attributes from
137 the generic tab. I.e.:
139 /etc/gosa/vacation/business.txt
141 |-->
142 DESC:Away from desk
143 Hi, I'm currently away from my desk. You can contact me on
144 my cell phone via %mobile.
146 Greetings,
147 %givenName %sn
148 |<--
150 Place the config option vacationTemplateDirectory="/etc/gosa/vacation" in the location found in
151 gosa.conf and a template box is show in the vacation mail tab.
154 Q: How can I generate automatic ID's for user templates?
156 A: Add an entry describing your id policy in gosa.conf, location section:
158 a) using attributes
159 You can specify LDAP attributes (currently only sn and givenName) in braces {}
160 and add a percent sign befor it. Optionally you can strip it down to a number
161 of characters, specified in []. I.e.
163 |-->
164 idGenerator="{%sn}-{%givenName[2-4]}"
165 |<--
167 will generate an ID using the full surename, adding a dash, and adding at least
168 the first two characters of givenName. If this ID is used, it'll use up to four
169 characters. If no automatic generation is possible, a input box is shown.
171 b) using automatic id's
172 I.e. specifying
174 |-->
175 idGenerator="acct{id:3}"
176 |<--
178 will generate a three digits id with the next free entry appended to "acct".
180 |-->
181 idGenerator="ext{id#3}"
182 |<--
184 will generate a three digits random number appended to "ext".
187 Q: I'm migrating from the current LDAP, now GOsa does not allow uid's and group
188 with upper/lower case and spaces. What can I do?
190 A: Include the strictNamingRules="no" keyword in your gosa.conf's location section.
191 WARNING: using strictNamingRules="no" will cause problems with cyrus/postfix!!
194 Q: I'd like to place my users under ou=staff, not under ou=people. Can I change
195 this?
197 A: Yes. You can change the people and group locations by adding the following
198 statements to your location sections:
200 |-->
201 userRDN="ou=staff"
202 groupRDN="ou=crowds"
203 |<--
205 After logging in again, people and groups are created in the configured places.
206 As a side note, you can leave these strings blank for flat structures, too.
209 Q: I've problems with many objectClass violations/undefined attributes. Can GOsa
210 check what's missing?
212 A: Yes. Move away your gosa.conf and go to the GOsa setup. Follow the steps till
213 you can download the config. If you get up to this point, your schema is ok...
216 Q: I really don't want dn's containing the CN for user accounts because I don't
217 want to support anonymous binds for uid resolution. Is it possible to have dn's
218 containing the uid instead?
220 A: Yes. Placing the accountPrimaryAttribute="uid" keyword in your gosa.conf's location
221 section will solve your problem.
224 Q: Hey, I've installed GOsa, but it claims something about "SID and / or RIDBASE
225 are missing in your configuration". What's wrong?
227 A: You've configured GOsa to use samba3, but your LDAP has no samba domain object
228 inside. Either log into samba for the first time to let it create that object,
229 or supply the sid and ridbase for your domain in your gosa.conf's location, i.e.:
231 |-->
232 <location name=...>
233 ...
234 sambaRidBase="1000"
235 sambaSID="0-815-4711" \>
236 |<--
238 Remember to fill in your real domain sid which is retrievable by the command
239 "net getlocalsid".
242 Q: We have massive performance problems with using samba as a member server.
244 A: This is a known issue. We're working around this by putting
246 |-->
247 <location name=...>
248 ...
249 sambaIdMapping="true"
250 ... \>
251 |<--
253 into the configuration. GOsa will write the additional objectClass sambaIdmapEntry
254 to the group and user objects.
257 Q: I get 'The value specified as GID/UID number is too small' when forcing IDs. Why?
259 A: This is an additional security feature, so that no one can fall back to uid 0. The
260 default minimum ID is 100. You can set it to every value you like by specifying
262 |-->
263 <location name=...>
264 ...
265 minId="40"
266 ... \>
267 |<--
269 in your configuration. In this example 40 will be the smallest ID you can enter.
272 Q: Aahhrg. I've updated to a new version and my gosa.conf seems to be broken.
274 A: Some parameters may have changed. Please move your gosa.conf away and re-run the setup.
277 Q: I've saved my windows workstations in other locations like GOsa is doing it
278 for decades. Is there a way to change this?
280 A: Yes. Use the winstation parameter in your location section:
282 |-->
283 <location name=...>
284 ...
285 sambaMachineAccountRDN="ou=machineaccounts"
286 ... \>
287 |<--
290 Q: GOsa doesn't seem to follow my referrals. What can I do?
292 A: Place the option 'ldapFollowReferrals = "true"' inside your locations definition
293 and you should be fine.
296 Q: I'd like to have TLS based LDAP connections from within GOsa. Is this possible?
298 A: Yes, add
300 |-->
301 <location ...>
302 ...
303 ldapTLS="true"
304 ... \>
305 |<--
307 to the location section of GOsa. This switch affects LDAP connections for a single location only.
310 Q: Cyrus folder get created in the style user.username. I prefer the unix hirachy
311 style user/username. Is it possible to change this?
313 A: Yes, add
315 |-->
316 <location
317 ...
318 cyrusUseSlashes="true"
319 |<--
321 to the location or main section of GOsa and the folders are created in unix style.
324 Q: I've a cyrus installation with customized user and folder prefixes.
325 How can I tell GOsa to use the prefixes I prefer?
327 A: Simply set the following attributes in the location tag of your gosa.conf:
329 |-->
330 <location
331 ...
332 mailUserCreation="myprefix/%mail%"
333 mailFolderCreation="myfolder\\.%cn%@%domain%"
334 |<--
336 The dot in the above example is escaped to prevent it from replacing with '/' if
337 cyrusUseSlashes is set to true.
339 You can use the following replacements:
340 |-->
341 %cn% - The groups cn.
342 %uid% - The users uid.
343 %prefix% - The default prefix used by the mailmethod.
344 %uattrib% - The configured mailAttribute="" (gosa.conf).
345 %domain% - The domain part of the given mail address. (user@domain.com = domain.com)
346 %mailpart% - The user part of the mail address. (user@domain.com = user)
347 %mail% - The complete mail address.
348 |<--
351 Q: I want to use cyrus for multiple mail domains, but GOsa uses the 'uid' attribute for account namens, how do I change this to 'mail'?
353 A: Just add/modify the following line to/in your gosa.conf:
355 |-->
356 <location
357 ...
358 mailAttribute="mail"
359 |<--
362 Q: I'd like to do special checks for several plugin parameters. How can I modify
363 GOsa to take care of these checks?
365 A: No need to modify anything. Just add a hook the the plugin you'd like to
366 check:
368 |-->
369 check="/your/command/binary"
370 |<--
372 This binary will get an ldif to STDIN for analysis and may write an error message
373 to STDOUT. Note, that the supplied ldif may NOT be the original target ldif due
374 to technical reasons.
377 Q: Is there a way to use ACL independet filtering when using administrative units?
379 A: Yes. Set "honourUnitTags" to "true" in your gosa.conf's location section.
382 Q: How can i active the account expiration code for the gosa interface?
384 A: Yes. Just set "handleExpiredAccounts" to "true" in your gosa.conf's main section.
387 Q: What is the correct connection string for a Kolab server in GOsa?
389 A: Try {localhost:143/novalidate-cert}.
392 Q: Sieve is not working from GOsa - there are authentication problems
393 with this service, IMAP/POP is working. What's wrong?
395 A: Verify that the paramater sasl_auto_transition: no is not
396 present in your imap.conf
399 Q: I have a SIEVE problem - "Can't log into SIEVE server. Server says //. -
401 A: Probably something is wrong with the authentification which is used by timesieved.
402 - Check if you can login with "sieveshell" on this host.
403 - Also check "telnet localhost 2000" - Is there any output about "Plain Login"?
405 Please verify the ldap imap attributes, like goImapSieveServer and goImapSievePort.
406 These value can be modified using the server->services tab in GOsa 2.6 and in
407 GOsa 2.5 you can find these options under server->databases.
409 Here is an older, but maybe helpful solution for Cyrus-Imapd 2.1.5 on SuSE 9.0:
410 - Install the "cyrus-sasl-plain" rpm from the distro-cd (This packet contains "sasl2/libplain" library).
411 - Modify your /etc/imap.conf:
413 |-->
414 sasl_pwcheck_method: saslauthd
415 sasl_mech_list: plain login
416 |<--
418 - Modify your /etc/sysconfig/saslauthd:
420 |-->
421 SASLAUTHD_AUTHMECH=pam
422 |<--
425 Q: Slapd does not start with kolab2.schema included. It claims that the
426 definition of calFBURL is missing. What can I do?
428 A: For Kolab to work correctly you have to include the rfc2739.schema
429 in your slapd.conf. Insert it before the kolab2.schema
432 Q: New implementations of OpenLDAP seem to require {sasl} instead of {kerberos}
433 in password hashes. GOsa writes the wrong string. What can I do?
435 A: You can set "useSaslForKerberos" to "true" in your gosa.conf's main section.
438 Q: Is there a way to add the personalTitle attribute the the users dn?
440 A: Just add this line into the location section of your gosa.conf.
442 |-->
443 <location
444 ...
445 personalTitleInDN="true"
446 |<--
449 Q: I'd like to assign different uid bases for certain user/group objects.
450 How can this be achieved?
452 A: Use the 'baseIdHook' in your gosa.conf's location section to specify a script
453 which handles the ID generation externaly. It get's called with the "dn"
454 and the attribute to be ID'd. It should return an integer value.
457 Q: I'd like to use rfc2307bis compliant groups. Is this possible?
459 A: Yes - place the rfc2307bis="true" inside of the location section of
460 your gosa.conf. Remember, that you can't create empty groups in this mode.
463 Q: Can GOsa show some vendor information for given MAC addresses?
465 A: Yes. Download http://standards.ieee.org/regauth/oui/oui.txt and place
466 it in /etc/gosa/oui.txt.
469 Q: GOsa sessions expire too quick. Is there a way to change this?
471 A: Yes. Set "sessionLifetime" to the number of seconds of inactivity. 7200
472 (60x60x2) would be for two hours. Place this option inside the main
473 section of your gosa.conf.
476 Q: Is there a way to let users change passwords without logging into GOsa?
478 A: Yes. Browse to "password.php". You can preset a couple of things i.e.:
480 |-->
481 http://your.admin.server/password.php?uid=cajus&method=md5&directory=GONICUS+GmbH
482 |<--
485 Q: GOsa only shows 300 entries at a time. Is this normal?
487 A: There's a default sizelimit. You can set the "ldapSizelimit" option in your
488 gosa.conf's location section to a higher value to get rid of it.
491 Q: I have problems with my ldap server when I open groups with
492 a huge amount of members, what can I do?
494 A: You can set a nesting limit which ensures that the user names will not be
495 resolved if the amount of members reaches this limit.
497 |-->
498 <location
499 ...
500 ldapFilterNestingLimit="100"
501 |<--
504 Q: I want to disable the "Is the configuration file up to date?" check when logging in.
505 How can I disable this check?
507 A: Just set the configVersion attribute to an empty value:
509 |-->
510 <conf configVersion="" >
511 |<--
514 Q: I've shredded my access control and am not able to do anything from now on. Is there
515 a way to override the ACL?
517 A: Yes. Insert the following statement in the location section of your gosa.conf:
519 |-->
520 ignoreAcl="your user's dn"
521 |<--
524 Q: I can't logon as Administration, what is wrong?
526 A: It looks like you are missing an administrativ account.
527 In newer versions of GOsa you can simply re-run the setup and create
528 an admin account on the migration page.
530 Additionally you can set ignoreACL in GOsa 2.6, just search the FAQ.
533 Q: The Unix's user's shell list is empty (unconfigured)
535 A: Just copy or link your /etc/shell in /etc/gosa.
538 Q: After upgrading GOsa, the setup.php doesn't work or looks broken.
540 A: You should delete all files in /var/spool/gosa
542 |-->
543 # cd /var/spool/gosa
544 # rm -rf *
545 |<--
548 Q: After installing GOsa using an existing LDAP tree, my user accounts are not listed.
550 A: You need to add the following objectClasses to your accounts:
552 |-->
553 objectClass: person
554 objectClass: organizationalPerson
555 |<--
557 The setup will automatically migrate those accounts, see migration step in GOsa setup!
560 Q: Is it possible to login with the users mail address too?
562 A: Yes, just add the following line to your gosa.conf:
564 |-->
565 <location
566 ...
567 loginAttribute="mail"
568 |<--
570 or for both, uid and mail:
572 |-->
573 <location
574 ...
575 loginAttribute="uid,mail"
576 |<--