This is the textual form of the GOsa FAQ. Online information with comments is set up at Wiki: https://oss.gonicus.de/labs/gosa/wiki/documentation Q: When creating many users for one department, I need to fill somefields again and again. Is there a shortcut for that? A: Just create a user template and pre-fill all values you need. You can use dynamic content, too: uid, sn and givenName will be replaced. i.E. an entry '/home/{%uid}' in homeDirectory will be replaced by the real uid of the user you're creating, {%sn[0-4]}.{%givenName}@yourdomain.com creates proper email addresses, etc. Templates include group membership. For more details visit: https://oss.gonicus.de/labs/gosa/wiki/PluginInstallationUserTemplates Q: I can see passwords in my logs and in my process list while executing commands, such as postcreate/passwordHook/aso. A: The best way to execute scripts with sensitive data is to use envrionmental variables in your scripts, like shown here: An example snippet from the gosa.conf --- login screen * framework.tpl -> page contents * style.css -> stylesheets used by GOsa Q: How can I let a person do administrative tasks under a specific department? A: GOsa 2.6 implements a flexible but complex ACL management, please have a look at the following wiki page: https://oss.gonicus.de/labs/gosa/wiki/DocumentationWritingACLs2.6 If you have still questions, please use the mailing list or the forum. Q: What about applications? A: GOsa can manage desktop applications in ldap. Create a group and put all users in there, which have common desktop settings. Go to the "Application" tab and add all applications common to this group. Applications can be created from the application plugin. The idea behind this feature is a script running on the terminal-servers/ workstation which check for applications on login (or on a regular basis using timestamps). This one will create the corresponding icons on your KDE or GNOME desktop. Q: What's this terminal stuff? A: GOto is - similar to LTSP - a ldap based diskless client system. It is available from our projects page. Q: I can't select any mailservers. What's wrong? A: It seems that a mail server is missing in your configuration. Create a new server, go to the services tab and add a mailserver service and/or the imap service. For more details, please have a look at the FAQ and https://oss.gonicus.de/labs/gosa/wiki/PluginInstallationMailMethods. Q: Can I specify some kind of password policies? A: You can place the keywords "passwordMinLength" and "passwordMinDiffer" in the main section of your gosa.conf. "passwordMinLength" specifies how many characters a password must have to be accepted. "passwordMinDiffer" contains the number of characters that must be different from the previous password. Note that these only affect passwords that are set by the user, not by the admins. Q: I've to update passwords on external windows PDCs. Can I add a command to letsynchronize these for me? A: There's the possibility to add a hooks in gosa.conf's plugin tags using the "premodify/postmodify" keywords. The specified command will be executed with these additional parameters: * current_password * new_password * userPassword --- --- For further information about pre- and post hooks search for the premodify and postmodify statements. So you can call i.e. smbpasswd to handle your password change on the PDC. Q: What about templates for vacation messages? A: Create a directory to keep a set of vacation messages which are readable by the user that runs your apache. In this example I'll use /etc/gosa/vacation for that. Put your vacation files in there containing a "DESC:some descriptive text" as the first line followed by the normal vacation text. You can use all attributes from the generic tab. I.e.: /etc/gosa/vacation/business.txt --- DESC:Away from desk Hi, I'm currently away from my desk. You can contact me on my cell phone via %mobile. Greetings, %givenName %sn --- Place the config option vacationTemplateDirectory="/etc/gosa/vacation" in the location found in gosa.conf and a template box is show in the vacation mail tab. Q: How can I generate automatic ID's for user templates? A: Add an entry describing your id policy in gosa.conf, location section: 1) Using attributes You can specify LDAP attributes (currently only sn and givenName) in braces {} and add a percent sign befor it. Optionally you can strip it down to a number of characters, specified in []. I.e. --- idGenerator="{%sn}-{%givenName[2-4]}" --- will generate an ID using the full surename, adding a dash, and adding at least the first two characters of givenName. If this ID is used, it'll use up to four characters. If no automatic generation is possible, a input box is shown. 2) using automatic id's I.e. specifying --- idGenerator="acct{id:3}" --- will generate a three digits id with the next free entry appended to "acct". --- idGenerator="ext{id#3}" --- will generate a three digits random number appended to "ext". Q: I'm migrating from the current LDAP, now GOsa does not allow uid's and groupwith upper/lower case and spaces. What can I do? A: Include the strictNamingRules="no" keyword in your gosa.conf's location section. WARNING: using strictNamingRules="no" will cause problems with cyrus/postfix!! Q: I'd like to place my users under ou=staff, not under ou=people. Can I changethis? Yes. You can change the people and group locations by adding the following statements to your location sections: --- userRDN="ou=staff" groupRDN="ou=crowds" --- After logging in again, people and groups are created in the configured places. As a side note, you can leave these strings blank for flat structures, too. Q: I really don't want dn's containing the CN for user accounts because I don't want to support anonymous binds for uid resolution. Is it possible to have dn'scontaining the uid instead? A: Yes. Placing the accountPrimaryAttribute="uid" keyword in your gosa.conf's location section will solve your problem. Q: Hey, I've installed GOsa, but it claims something about "SID and / or RIDBASE are missing in your configuration". What's wrong? A: You've configured GOsa to use samba3, but your LDAP has no samba domain object inside. Either log into samba for the first time to let it create that object, or supply the sid and ridbase for your domain in your gosa.conf's location, i.e.: --- ... sambaRidBase="1000" sambaSID="0-815-4711" \> --- Remember to fill in your real domain sid which is retrievable by the command "net getlocalsid". Q: We have massive performance problems with using samba as a member server. A: This is a known issue. We're working around this by putting --- ... sambaIdMapping="true" ... \> --- into the configuration. GOsa will write the additional objectClass sambaIdmapEntry to the group and user objects. Q: I get 'The value specified as GID/UID number is too small' when forcing IDs. Why? A: This is an additional security feature, so that no one can fall back to uid 0. The default minimum ID is 100. You can set it to every value you like by specifying --- ... minId="40" ... \> --- in your configuration. In this example 40 will be the smallest ID you can enter. Q: Aahhrg. I've updated to a new version and my gosa.conf seems to be broken. A: Some parameters may have changed. Please move your gosa.conf away and re-run the setup. Q: I've saved my windows workstations in other locations like GOsa is doing it for decades. Is there a way to change this? A: Yes. Use the sambaMachineAccountRDN parameter in your location section: --- ... sambaMachineAccountRDN="ou=machineaccounts" ... \> --- Q: I'd like to have TLS based LDAP connections from within GOsa. Is this possible? A: Yes, add --- ... ldapTLS="true" ... \> --- to the location section of GOsa. This switch affects LDAP connections for a single location only. Q: Cyrus folder get created in the style user.username. I prefer the unix hirachystyle user/username. Is it possible to change this? A: Yes, add --- services tab in GOsa 2.6. Here is an older, but maybe helpful solution for Cyrus-Imapd 2.1.5 on SuSE 9.0: * Install the "cyrus-sasl-plain" rpm from the distro-cd (This packet contains "sasl2/libplain" library). * Modify your /etc/imap.conf: --- sasl_pwcheck_method: saslauthd sasl_mech_list: plain login --- * Modify your /etc/sysconfig/saslauthd: --- SASLAUTHD_AUTHMECH=pam --- Q: Slapd does not start after adding or changing schema files to the slapd config. What can I do? A: Check the order of how slapd loads the schema files. Order of schema loading matters, because some schemas depend on other schemas being already loaded. For a working order of the schema files look here: https://oss.gonicus.de/labs/gosa/wiki/InstallingLdap Q: Slapd does not start with kolab2.schema included. It claims that thedefinition of calFBURL is missing. What can I do? A: For Kolab to work correctly you have to include the rfc2739.schema in your slapd.conf. Insert it before the kolab2.schema Q: New implementations of OpenLDAP seem to require {sasl} instead of {kerberos} in password hashes. GOsa writes the wrong string. What can I do? A: You can set "useSaslForKerberos" to "true" in your gosa.conf's main section. Q: Is there a way to add the personalTitle attribute the the users dn? A: Just add this line into the location section of your gosa.conf. --- --- Q: I've shredded my access control and am not able to do anything from now on. Is there a way to override the ACL? A: Yes. Insert the following statement in the location section of your gosa.conf: --- ignoreAcl="your user's dn" --- Q: I can't logon as Administration, what is wrong? A: It looks like you are missing an administrativ account. In newer versions of GOsa you can simply re-run the setup and create an admin account on the migration page. Additionally you can set ignoreACL in GOsa 2.6, just search the FAQ. Q: The Unix's user's shell list is empty (unconfigured) A: Just copy or link your /etc/shell in /etc/gosa. Q: After upgrading GOsa, the setup.php doesn't work or looks broken. A: You should delete all files in /var/spool/gosa --- # cd /var/spool/gosa # rm -rf * --- Q: After installing GOsa using an existing LDAP tree, my user accounts are not listed. A: You need to add the following objectClasses to your accounts: --- objectClass: person objectClass: organizationalPerson --- The setup will automatically migrate those accounts, see migration step in GOsa setup! Q: Is it possible to login with the users mail address too? A: Yes, just add the following line to your gosa.conf: ---