Updated the FAQ

git-svn-id: https://oss.gonicus.de/repositories/gosa/trunk@20485 594d385d-05f5-0310-b6e9-bd551577e9d8

diff --git a/gosa-core/FAQ b/gosa-core/FAQ
index 9673f88f1d44909f19ccab5ed5060cdb317e6010..3132b095d0164a14dbc5d3f2186a6a441a1146b0 100644 (file)
--- a/gosa-core/FAQ
+++ b/gosa-core/FAQ
@@ -1,343 +1,382 @@
 This is the textual form of the GOsa FAQ. Online information with
 comments is set up at Wiki: https://oss.gonicus.de/labs/gosa/wiki/documentation
 
-Q: When creating many users for one department, I need to fill some
-   fields again and again. Is there a shortcut for that?
 
-A: Just create a user template and pre-fill all values you need. You
-   can use dynamic content, too: uid, sn and givenName will be replaced.
-   i.E. an entry '/home/%uid' in homeDirectory will be replaced by the
-   real uid of the user you're creating, %sn.%givenName@yourdomain.com
-   creates proper email addresses, etc. Templates include group membership.
+Q:  When creating many users for one department, I need to fill 
+    somefields again and again. Is there a shortcut for that?
 
+A:  Just create a user template and pre-fill all values you need. You
+    can use dynamic content, too: uid, sn and givenName will be replaced.
+    i.E. an entry '/home/{%uid}' in homeDirectory will be replaced by the
+    real uid of the user you're creating, {%sn[0-4]}.{%givenName}@yourdomain.com
+    creates proper email addresses, etc. Templates include group membership.
 
-Q: Can GOsa execute commands after creating/editing/removing users,
-   departments, etc.
+    For more details visit:
+    https://oss.gonicus.de/labs/gosa/wiki/PluginInstallationUserTemplates
 
-A: Yes. Edit /etc/gosa/gosa.conf's menu section. Each plugin may has
-   an entry "postremove", "postmodify" and "postcreate".  You can use
-   ldap attributes as command line options.
-   i.E. postcreate="/usr/bin/sudo /usr/local/sbin/ftp.setperms %uid '%givenName'"
 
 
-Q: I'd like to  modify the look of GOsa to fit our CI. How can I create an
-   own theme?
+Q:  I can see passwords in my logs and in my process list while executing 
+    commands, such as postcreate/passwordHook/aso.
 
-A: Themes are splitted into two parts. ihtml/ contains templates which
-   generate the ui, html/ contains all parts that must be readable from
-   clients. GOsa first looks for predefined files in the directory indirectly
-   defined via the "theme" parameter in /etc/gosa/gosa.conf. If it can't
-   find them here, it'll use the default one.
+A:  The best way to execute scripts with sensitive data is to use envrionmental 
+    variables in your scripts, like shown here:
 
-   So start over by copying html/themes/default to html/themes/yourtheme
-   and ihtml/themes/default to ihtml/themes/yourtheme. Change gosa.conf to
-   contain theme="yourtheme" in section main. Here are some files to edit:
+    An example snippet from the gosa.conf
+    
+    ---
+    <plugin name='User password' class='password'
+        postmodify="NEWPASSWORD=%new_password /usr/bin/sudo /scripts/myScript.sh"
+    ---
+    
+    Another example for the password check hook (The passwordHook is deprecated in GOsa 2.7):
+    ---
+    <location
+        passwordHook="CURRENTPWD=%current_password NEWPWD=%new_password /usr/bin/sudo /scripts/myScript.sh"
+    ---
+
+    You can then use the variables like this:
+    ---
+    #!/bin/sh
+    echo $CURRENTPWD
+    echo $NEWPWD
+    ---
+
+
+
+Q:  Can GOsa execute commands 'BEFORE' creating/editing/removing users,departments, etc. 
+
+A:  Yes. Edit /etc/gosa/gosa.conf's menu section. 
+    Each plugin may has an entry "preremove", "premodify" and "precreate".  
+    You can use ldap attributes as command line options.
+
+    i.E. 
+    ---
+    precreate="/usr/bin/sudo /usr/local/sbin/ftp.setperms %uid %givenName"
+    ---
+
+
+
+Q:  Can GOsa execute commands 'AFTER' creating/editing/removing users,departments, etc. 
+
+A:  Yes. Edit /etc/gosa/gosa.conf's menu section. 
+    Each plugin may has an entry "postremove", "postmodify" and "postcreate".  
+    You can use ldap attributes as command line options.
+
+    i.E. 
+    ---
+    postcreate="/usr/bin/sudo /usr/local/sbin/ftp.setperms %uid %givenName"
+    ---
+
+
+
+Q:  I'd like to  modify the look of GOsa to fit our CI. How can I create anown theme? 
+
+A:  Themes are splitted into two parts. ihtml/ contains templates which
+    generate the ui, html/ contains all parts that must be readable from
+    clients. GOsa first looks for predefined files in the directory indirectly
+    defined via the "theme" parameter in /etc/gosa/gosa.conf. If it can't
+    find them here, it'll use the default one.
+
+    So start over by copying html/themes/default to html/themes/yourtheme
+    and ihtml/themes/default to ihtml/themes/yourtheme. Change gosa.conf to
+    contain theme="yourtheme" in section main. Here are some files to edit:
 
-   * login.tpl          -> login screen
-   * framework.tpl     -> page contents
-   * style.css          -> stylesheets used by GOsa
- 
+    * login.tpl          -> login screen
+    * framework.tpl    -> page contents
+    * style.css          -> stylesheets used by GOsa
 
-Q: How can I let a person do administrative tasks under a specific department?
 
-A: Gosa 2.5.x
-   * Create a group inside this department. 
-   * Put all administrative people inside
-   * go to the "ACL" tab and check all fields these users should be able to adminstrate.
-   
-   GOsa 2.6 implements a more flexible but complex ACL management, please have a look at 
-   the following wiki page: https://oss.gonicus.de/labs/gosa/wiki/DocumentationWritingACLs2.6
-   If you have still questions, please use the mailing list or the forum.
-   
 
-Q: How can I permit users to change some of their own attributes?
+Q:  How can I let a person do administrative tasks under a specific department? 
 
-A: Same like described above, but additionally you have to check the option 
-   'Apply this acl only for users own entries'.
-   (For versions 2.6.x, see the wiki pages)
+A:  GOsa 2.6 implements a flexible but complex ACL management, please have a look at 
+    the following wiki page: https://oss.gonicus.de/labs/gosa/wiki/DocumentationWritingACLs2.6
+    If you have still questions, please use the mailing list or the forum.
 
 
-Q: What about applications?
 
-A: GOsa can manage desktop applications in ldap. Create a group and put all users
-   in there, which have common desktop settings. Go to the "Application" tab and
-   add all applications common to this group. Applications can be created from the
-   application plugin.
-   The idea behind this feature is a script running on the terminal-servers/
-   workstation which check for applications on login (or on a regular basis using
-   timestamps). This one will create the corresponding icons on your KDE or GNOME
-   desktop.
+Q:  What about applications? 
 
+A:  GOsa can manage desktop applications in ldap. Create a group and put all users
+    in there, which have common desktop settings. Go to the "Application" tab and
+    add all applications common to this group. Applications can be created from the
+    application plugin.
+    The idea behind this feature is a script running on the terminal-servers/
+    workstation which check for applications on login (or on a regular basis using
+    timestamps). This one will create the corresponding icons on your KDE or GNOME
+    desktop.
 
-Q: What's this terminal stuff?
 
-A: GOto is - similar to LTSP - a ldap based diskless client system. It is available
-   from our projects page.
 
+Q:  What's this terminal stuff? 
 
-Q: I can't select any mailservers. What's wrong?
+A:  GOto is - similar to LTSP - a ldap based diskless client system. It is available
+    from our projects page.
 
-A: It seems that a mail server is missing in your configuration.
-   Create a new server, go to the services tab and add the imap service.
-   For more details, please have a look at the FAQ and wiki pages. 
-   (This may differ in older GOsa versions)
 
 
-Q: GOsa is not in my native language, can I translate it to my language?
+Q:  I can't select any mailservers. What's wrong? 
 
-A: Yes. Just go to the locale directory and copy the messages.po file somewhere
-   else. Edit the copy and put your translations into the msgstr lines. To be
-   included in next GOsa releases, you may want to send it to the GOsa maintainer.
-   Finally you need to create a directory with your language code. (i.e. de for
-   german) containing the LC_MESSAGES directory. Move your messages.po file there
-   and run 'msgfmt messages.po' in that directory. That's it.
+A:  It seems that a mail server is missing in your configuration.
+    Create a new server, go to the services tab and add a mailserver 
+    service and/or the imap service.
+    For more details, please have a look at the FAQ and 
+    https://oss.gonicus.de/labs/gosa/wiki/PluginInstallationMailMethods. 
 
-   You may need to restart apache, depending on your setup. On Debian, be sure
-   to have your locale generated (dpkg-reconfigure locales) before.
 
 
-Q: The online help doesn't exist in my language, can i translate it to my language?
+Q:  Can I specify some kind of password policies? 
 
-A: Yes. Just go to the doc/guide/user/en directory and copy the lyx-source directory
-   to a new directory in doc/guide/user/<your language>. You have to use the lyx
-   program create the online help in your language. When you have finish just run
-   ./gen_online_help from the gosa root directory to generate the online docs.
+A:  You can place the keywords "passwordMinLength" and "passwordMinDiffer" in the main
+    section of your gosa.conf. "passwordMinLength" specifies how many characters a
+    password must have to be accepted. "passwordMinDiffer" contains the number of
+    characters that must be different from the previous password.
 
-   
-Q: Can I specify some kind of password policies?
+    Note that these only affect passwords that are set by the user, not by the admins.
 
-A: You can place the keywords "passwordMinLength" and "passwordMinDiffer" in the main
-   section of your gosa.conf. "passwordMinLength" specifies how many characters a
-   password must have to be accepted. "passwordMinDiffer" contains the number of
-   characters that must be different from the previous password.
 
-   Note that these only affect passwords that are set by the user, not by the admins.
 
+Q:  I've to update passwords on external windows PDCs. Can I 
+    add a command to letsynchronize these for me? 
 
-Q: I've to update passwords on external windows PDCs. Can I add a command to let
-   synchronize these for me?
+A:  There's the possibility to add a hooks in gosa.conf's plugin tags 
+    using the "premodify/postmodify" keywords. The specified command 
+    will be executed with these additional parameters: 
+    * current_password 
+    * new_password 
+    * userPassword
 
-A: There's the possibility to add a hooks in gosa.conf's plugin tags using
-   the "premodify/postmodify" keywords. The specified command will be executed with 
-   these additional parameters: %current_password %new_password %userPassword 
+    ---
+    <plugin acl="users/password:self" class="password"
+     premodify="/scripts/prepareForPasswordChange %current_password %new_password %uid"
+     check="/scripts/checkPasswordHash %userPassword %dn"
+     postmodify="/scripts/changePassword %dn %uid %userPassword %current_password %new_password %userPassword"
+    >
+    ---
 
-   For further information about pre- and post hooks search for the premodify 
-   and postmodify statements.
+    For further information about pre- and post hooks search for the premodify and postmodify statements.
 
-   So you can call i.e. smbpasswd to handle your password change on the PDC.
+    So you can call i.e. smbpasswd to handle your password change on the PDC.
 
 
-Q: What about templates for vacation messages?
 
-A: Create a directory to keep a set of vacation messages which are readable by the
-   user that runs your apache. In this example I'll use /etc/gosa/vacation for that.
+Q:  What about templates for vacation messages? 
 
-   Put your vacation files in there containing a "DESC:some descriptive text" as the
-   first line followed by the normal vacation text. You can use all attributes from
-   the generic tab. I.e.:
+A:  Create a directory to keep a set of vacation messages which are readable by the
+    user that runs your apache. In this example I'll use /etc/gosa/vacation for that.
+
+    Put your vacation files in there containing a "DESC:some descriptive text" as the
+    first line followed by the normal vacation text. You can use all attributes from
+    the generic tab. I.e.:
 
     /etc/gosa/vacation/business.txt 
+    --- 
+     DESC:Away from desk
+     Hi, I'm currently away from my desk. You can contact me on
+     my cell phone via %mobile.
 
-   |--> 
-    DESC:Away from desk
-    Hi, I'm currently away from my desk. You can contact me on
-    my cell phone via %mobile.
-    
-    Greetings,
-    %givenName %sn
-   |<--
- 
-   Place the config option vacationTemplateDirectory="/etc/gosa/vacation" in the location found in
-   gosa.conf and a template box is show in the vacation mail tab.
+     
+     Greetings,
+     %givenName %sn
+    ---
+     
+    Place the config option vacationTemplateDirectory="/etc/gosa/vacation" in the location found in
+    gosa.conf and a template box is show in the vacation mail tab.
+
+
+
+Q:  How can I generate automatic ID's for user templates? 
+
+A:  Add an entry describing your id policy in gosa.conf, location section:
+
+
+    1) Using attributes
+    You can specify LDAP attributes (currently only sn and givenName) in braces {}
+    and add a percent sign befor it. Optionally you can strip it down to a number
+    of characters, specified in []. I.e.
+
+    --- 
+    idGenerator="{%sn}-{%givenName[2-4]}"
+    ---
 
+    will generate an ID using the full surename, adding a dash, and adding at least
+    the first two characters of givenName. If this ID is used, it'll use up to four
+    characters. If no automatic generation is possible, a input box is shown.
 
-Q: How can I generate automatic ID's for user templates?
+    2) using automatic id's
+    I.e. specifying
 
-A: Add an entry describing your id policy in gosa.conf, location section:
+    --- 
+    idGenerator="acct{id:3}"
+    ---
 
-   a) using attributes
-      You can specify LDAP attributes (currently only sn and givenName) in braces {}
-      and add a percent sign befor it. Optionally you can strip it down to a number
-      of characters, specified in []. I.e.
+    will generate a three digits id with the next free entry appended to "acct".
 
-   |--> 
-      idGenerator="{%sn}-{%givenName[2-4]}"
-   |<--
+    --- 
+    idGenerator="ext{id#3}"
+    ---
 
-      will generate an ID using the full surname, adding a dash, and adding at least
-      the first two characters of givenName. If this ID is used, it'll use up to four
-      characters. If no automatic generation is possible, a input box is shown.
+    will generate a three digits random number appended to "ext".
 
-   b) using automatic id's
-      I.e. specifying
 
-   |--> 
-      idGenerator="acct{id:3}"
-   |<--
 
-      will generate a three digits id with the next free entry appended to "acct".
 
-   |--> 
-      idGenerator="ext{id#3}"
-   |<--
+Q:  I'm migrating from the current LDAP, now GOsa does not allow uid's 
+    and groupwith upper/lower case and spaces. What can I do? 
 
-      will generate a three digits random number appended to "ext".
+A:  Include the strictNamingRules="no" keyword in your gosa.conf's location section.
+    
+    WARNING: using strictNamingRules="no" will cause problems with cyrus/postfix!!
 
 
-Q: I'm migrating from the current LDAP, now GOsa does not allow uid's and group
-   with upper/lower case and spaces. What can I do?
 
-A: Include the strictNamingRules="no" keyword in your gosa.conf's location section.
-   WARNING: using strictNamingRules="no" will cause problems with cyrus/postfix!!
+Q:  I'd like to place my users under ou=staff, not under ou=people. Can I changethis? 
 
+    Yes. You can change the people and group locations by adding the following
+    statements to your location sections:
 
-Q: I'd like to place my users under ou=staff, not under ou=people. Can I change
-   this?
+    --- 
+    userRDN="ou=staff"
+    groupRDN="ou=crowds"
+    ---
 
-A: Yes. You can change the people and group locations by adding the following
-   statements to your location sections:
+    After logging in again, people and groups are created in the configured places.
+    As a side note, you can leave these strings blank for flat structures, too.
 
-   |--> 
-   userRDN="ou=staff"
-   groupRDN="ou=crowds"
-   |<--
 
-   After logging in again, people and groups are created in the configured places.
-   As a side note, you can leave these strings blank for flat structures, too.
 
 
-Q: I've problems with many objectClass violations/undefined attributes. Can GOsa
-   check what's missing?
+Q:  I really don't want dn's containing the CN for user accounts because I don't
+    want to support anonymous binds for uid resolution. 
+    Is it possible to have dn'scontaining the uid instead? 
 
-A: Yes. Move away your gosa.conf and go to the GOsa setup. Follow the steps till
-   you can download the config. If you get up to this point, your schema is ok...
+A:  Yes. Placing the accountPrimaryAttribute="uid" keyword in your gosa.conf's location
+    section will solve your problem.
 
 
-Q: I really don't want dn's containing the CN for user accounts because I don't
-   want to support anonymous binds for uid resolution. Is it possible to have dn's
-   containing the uid instead?
 
-A: Yes. Placing the accountPrimaryAttribute="uid" keyword in your gosa.conf's location
-   section will solve your problem.
 
+Q:  Hey, I've installed GOsa, but it claims something about "SID and / or RIDBASE
+    are missing in your configuration". What's wrong? 
 
-Q: Hey, I've installed GOsa, but it claims something about "SID and / or RIDBASE
-   are missing in your configuration". What's wrong?
+A:  You've configured GOsa to use samba3, but your LDAP has no samba domain object
+    inside. Either log into samba for the first time to let it create that object,
+    or supply the sid and ridbase for your domain in your gosa.conf's location, i.e.:
 
-A: You've configured GOsa to use samba3, but your LDAP has no samba domain object
-   inside. Either log into samba for the first time to let it create that object,
-   or supply the sid and ridbase for your domain in your gosa.conf's location, i.e.:
+    --- 
+    <location name=...>
+        ...
+        sambaRidBase="1000"
+        sambaSID="0-815-4711" \>
+    ---
 
-   |--> 
-   <location name=...>
-             ...
-             sambaRidBase="1000"
-             sambaSID="0-815-4711" \>
-   |<--
+    Remember to fill in your real domain sid which is retrievable by the command
+    "net getlocalsid".
 
-   Remember to fill in your real domain sid which is retrievable by the command
-   "net getlocalsid".
 
 
-Q: We have massive performance problems with using samba as a member server.
+Q:  We have massive performance problems with using samba as a member server. 
 
-A: This is a known issue. We're working around this by putting
+A:  This is a known issue. We're working around this by putting
 
-   |--> 
-   <location name=...>
-    ...
-    sambaIdMapping="true"
-    ... \>
-   |<--
+    --- 
+    <location name=...>
+        ...
+        sambaIdMapping="true"
+        ... \>
+    ---
 
     into the configuration. GOsa will write the additional objectClass sambaIdmapEntry
     to the group and user objects.
 
 
-Q: I get 'The value specified as GID/UID number is too small' when forcing IDs. Why?
 
-A: This is an additional security feature, so that no one can fall back to uid 0. The
-   default minimum ID is 100. You can set it to every value you like by specifying
+Q:  I get 'The value specified as GID/UID number is too small' when forcing IDs. Why? 
+
+A:  This is an additional security feature, so that no one can fall back to uid 0. The
+    default minimum ID is 100. You can set it to every value you like by specifying
+
+    --- 
+    <location name=...>
+        ...
+        minId="40"
+        ... \>
+    ---
 
-   |--> 
-   <location name=...>
-    ...
-    minId="40"
-    ... \>
-   |<--
+    in your configuration. In this example 40 will be the smallest ID you can enter.
 
-   in your configuration. In this example 40 will be the smallest ID you can enter.
 
 
-Q: Aahhrg. I've updated to a new version and my gosa.conf seems to be broken.
+Q:  Aahhrg. I've updated to a new version and my gosa.conf seems to be broken. 
 
-A: Some parameters may have changed. Please move your gosa.conf away and re-run the setup.
+A:  Some parameters may have changed. Please move your gosa.conf away and re-run the setup.
 
 
-Q: I've saved my windows workstations in other locations like GOsa is doing it
-   for decades. Is there a way to change this?
 
-A: Yes. Use the winstation parameter in your location section: 
 
-   |--> 
-   <location name=...>
-   ...
-   sambaMachineAccountRDN="ou=machineaccounts"
-   ... \>
-   |<--
+Q:  I've saved my windows workstations in other locations like GOsa is doing it
+    for decades. Is there a way to change this? 
 
+A:  Yes. Use the sambaMachineAccountRDN parameter in your location section: 
 
-Q: GOsa doesn't seem to follow my referrals. What can I do?
+    --- 
+    <location name=...>
+        ...
+        sambaMachineAccountRDN="ou=machineaccounts"
+        ... \>
+    ---
 
-A: Place the option 'ldapFollowReferrals = "true"' inside your locations definition
-   and you should be fine.
 
 
-Q: I'd like to have TLS based LDAP connections from within GOsa. Is this possible?
+Q:  I'd like to have TLS based LDAP connections from within GOsa. Is this possible? 
 
-A: Yes, add
+A:  Yes, add
 
-   |--> 
-   <location ...>
-   ...
-         ldapTLS="true"
-   ... \>
-   |<--
+    --- 
+    <location ...>
+        ...
+              ldapTLS="true"
+        ... \>
+    ---
 
-   to the location section of GOsa. This switch affects LDAP connections for a single location only.
+    to the location section of GOsa. This switch affects LDAP connections for a single location only.
 
 
-Q: Cyrus folder get created in the style user.username. I prefer the unix hirachy
-   style user/username. Is it possible to change this?
 
-A: Yes, add
+Q:  Cyrus folder get created in the style user.username. I prefer the unix 
+    hirachystyle user/username. Is it possible to change this? 
 
-   |--> 
-   <location
-       ...
-    cyrusUseSlashes="true"
-   |<--
+A:  Yes, add
 
-   to the location or main section of GOsa and the folders are created in unix style.
 
+    --- 
+    <location
+        cyrusUseSlashes="true"
+    ---
+
+    to the location or main section of GOsa and the folders are created in unix style.
 
-Q: I've a cyrus installation with customized user and folder prefixes. 
-   How can I tell GOsa to use the prefixes I prefer?
 
-A: Simply set the following attributes in the location tag of your gosa.conf:  
 
-   |--> 
-   <location 
-       ...
-    mailUserCreation="myprefix/%mail%"
-    mailFolderCreation="myfolder\\.%cn%@%domain%"
-   |<--
+Q:  I've a cyrus installation with customized user and folder prefixes. 
+    How can I tell GOsa to use the prefixes I prefer? 
 
-   The dot in the above example is escaped to prevent it from replacing with '/' if 
+A:  Simply set the following attributes in the location tag of your gosa.conf:  
+
+    --- 
+    <location 
+        mailUserCreation="myprefix/%mail%"
+        mailFolderCreation="myfolder\\.%cn%@%domain%"
+    ---
+
+
+    The dot in the above example is escaped to prevent it from replacing with '/' if 
     cyrusUseSlashes is set to true.
 
-   You can use the following replacements:
-   |--> 
+
+    You can use the following replacements:
+    --- 
     %cn%       - The groups cn.
     %uid%      - The users uid.
     %prefix%   - The default prefix used by the mailmethod.
@@ -345,235 +384,285 @@ A: Simply set the following attributes in the location tag of your gosa.conf:
     %domain%   - The domain part of the given mail address. (user@domain.com = domain.com)
     %mailpart% - The user part of the mail address. (user@domain.com = user)
     %mail%     - The complete mail address. 
-   |<--
+    ---
 
 
-Q: I want to use cyrus for multiple mail domains, but GOsa uses the 'uid' attribute for account namens, how do I change this to 'mail'?
 
-A: Just add/modify the following line to/in your gosa.conf:
+Q:  I want to use cyrus for multiple mail domains, but GOsa uses the 'uid' attribute 
+    for account namens, how do I change this to 'mail'? 
 
-   |--> 
-   <location 
-    ...
-    mailAttribute="mail"
-   |<--
+A:  Just add/modify the following line to/in your gosa.conf:
 
+    --- 
+    <location 
+        ...
+        mailAttribute="mail"
+    ---
 
-Q: I'd like to do special checks for several plugin parameters. How can I modify
-   GOsa to take care of these checks?
 
-A: No need to modify anything. Just add a hook the the plugin you'd like to
-   check:
 
-   |--> 
+Q:  I'd like to do special checks for several plugin parameters. How can I modify
+    GOsa to take care of these checks? 
+
+A:  No need to modify anything. Just add a hook the the plugin you'd like to
+    check:
+
+    --- 
     check="/your/command/binary"
-   |<--
+    ---
+
+    This binary will get an ldif to STDIN for analysis and may write an error message
+    to STDOUT. Note, that the supplied ldif may NOT be the original target ldif due
+    to technical reasons.
+
+
 
-   This binary will get an ldif to STDIN for analysis and may write an error message
-   to STDOUT. Note, that the supplied ldif may NOT be the original target ldif due
-   to technical reasons.
+Q:  Is there a way to use ACL independet filtering when using administrative units? 
 
+A:  Yes. Set "honourUnitTags" to "true" in your gosa.conf's location section.
 
-Q: Is there a way to use ACL independet filtering when using administrative units?
 
-A: Yes. Set "honourUnitTags" to "true" in your gosa.conf's location section.
 
+Q:  How can i active the account expiration code for the gosa interface? 
 
-Q: How can i active the account expiration code for the gosa interface?
+A:  Yes. Just set "handleExpiredAccounts" to "true" in your gosa.conf's main section.
 
-A: Yes. Just set "handleExpiredAccounts" to "true" in your gosa.conf's main section.
 
 
-Q: What is the correct connection string for a Kolab server in GOsa?
+Q:  What is the correct connection string for a Kolab server in GOsa? 
 
-A: Try {localhost:143/novalidate-cert}.
+A:  Try {localhost:143/novalidate-cert}.
 
 
-Q: Sieve is not working from GOsa - there are authentication problems
-   with this service, IMAP/POP is working. What's wrong?
 
-A: Verify that the paramater sasl_auto_transition: no is not
-   present in your imap.conf
+Q:  Sieve is not working from GOsa - there are authentication problems
+    with this service, IMAP/POP is working. What's wrong? 
 
+A:  Verify that the paramater sasl_auto_transition: no is not present in your imap.conf
 
-Q: I have a SIEVE problem - "Can't log into SIEVE server. Server  says //. -
 
-A: Probably something is wrong with the authentification which is used by timesieved.
-   - Check if you can login with "sieveshell" on this host.
-   - Also check "telnet localhost 2000" - Is there any output about "Plain Login"?
 
-   Please verify the ldap imap attributes, like goImapSieveServer and goImapSievePort. 
-   These value can be modified using the server->services tab in GOsa 2.6 and in
-    GOsa 2.5 you can find these options under server->databases.
+Q:  I have a SIEVE problem - "Can't log into SIEVE server. Server  says //. - 
 
-   Here is an older, but maybe helpful solution for Cyrus-Imapd 2.1.5 on SuSE 9.0:
-   - Install the "cyrus-sasl-plain" rpm from the distro-cd (This packet contains "sasl2/libplain" library).
-   - Modify your /etc/imap.conf:
+A:  Probably something is wrong with the authentification which is used by timesieved.
+    * Check if you can login with "sieveshell" on this host.
+    * Also check "telnet localhost 2000" - Is there any output about "Plain Login"?
 
-   |--> 
+    Please verify the ldap imap attributes, like goImapSieveServer and goImapSievePort. 
+    These value can be modified using the server->services tab in GOsa 2.6.
+
+    Here is an older, but maybe helpful solution for Cyrus-Imapd 2.1.5 on SuSE 9.0:
+    * Install the "cyrus-sasl-plain" rpm from the distro-cd (This packet contains "sasl2/libplain" library).
+    * Modify your /etc/imap.conf:
+
+    --- 
     sasl_pwcheck_method: saslauthd
     sasl_mech_list: plain login
-   |<--
+    ---
+
+    * Modify your /etc/sysconfig/saslauthd:
+
+    --- 
+     SASLAUTHD_AUTHMECH=pam
+    ---
+
 
-   - Modify your /etc/sysconfig/saslauthd:
+Q:  Slapd does not start after adding or changing schema files to the slapd config. What can I do? 
 
-   |--> 
-    SASLAUTHD_AUTHMECH=pam
-   |<--
+A:  Check the order of how slapd loads the schema files. 
+    Order of schema loading matters, because some schemas depend on other
+    schemas being already loaded. For a working order of the schema files 
+    look here: https://oss.gonicus.de/labs/gosa/wiki/InstallingLdap
 
 
-Q: Slapd does not start with kolab2.schema included. It claims that the
-   definition of calFBURL is missing. What can I do?
 
-A: For Kolab to work correctly you have to include the rfc2739.schema
-   in your slapd.conf. Insert it before the kolab2.schema
+Q:  Slapd does not start with kolab2.schema included. It claims that thedefinition of 
+    calFBURL is missing. What can I do? 
 
+A:  For Kolab to work correctly you have to include the rfc2739.schema
+    in your slapd.conf. Insert it before the kolab2.schema
 
-Q: New implementations of OpenLDAP seem to require {sasl} instead of {kerberos}
-   in password hashes. GOsa writes the wrong string. What can I do?
 
-A: You can set "useSaslForKerberos" to "true" in your gosa.conf's main section.
 
+Q:  New implementations of OpenLDAP seem to require {sasl} instead of {kerberos}
+    in password hashes. GOsa writes the wrong string. What can I do? 
 
-Q: Is there a way to add the personalTitle attribute the the users dn?
+A:  You can set "useSaslForKerberos" to "true" in your gosa.conf's main section.
 
-A: Just add this line into the location section of your gosa.conf.
 
-   |--> 
-   <location
+
+Q:  Is there a way to add the personalTitle attribute the the users dn? 
+
+A:  Just add this line into the location section of your gosa.conf.
+
+
+    --- 
+    <location
     ... 
     personalTitleInDN="true"
-   |<--
+    ---
 
 
-Q: I'd like to assign different uid bases for certain user/group objects.
-   How can this be achieved?
 
-A: Use the 'baseIdHook' in your gosa.conf's location section to specify a script
-   which handles the ID generation externaly. It get's called with the "dn"
-   and the attribute to be ID'd. It should return an integer value.
+Q:  I'd like to assign different uid bases for certain user/group objects.How can this be achieved? 
 
+A:  Use the 'baseIdHook' in your gosa.conf's location section to specify a script
+    which handles the ID generation externaly. It get's called with the "dn"
+    and the attribute to be ID'd. It should return an integer value.
 
-Q: I'd like to use rfc2307bis compliant groups. Is this possible?
 
-A: Yes - place the rfc2307bis="true" inside of the location section of
-   your gosa.conf. Remember, that you can't create empty groups in this mode.
 
+Q:  I'd like to use rfc2307bis compliant groups. Is this possible? 
 
-Q: Can GOsa show some vendor information for given MAC addresses?
+A:  Yes - place the rfc2307bis="true" inside of the location section of
+    your gosa.conf. Remember, that you can't create empty groups in this mode.
 
-A: Yes. Download http://standards.ieee.org/regauth/oui/oui.txt and place
-   it in /etc/gosa/oui.txt.
 
 
-Q: GOsa sessions expire too quick. Is there a way to change this?
+Q:  GOsa sessions expire too quick. Is there a way to change this? 
 
-A: Yes. Set "sessionLifetime" to the number of seconds of inactivity. 7200
-   (60x60x2) would be for two hours. Place this option inside the main
-   section of your gosa.conf.
+A:  Yes. Set "sessionLifetime" to the number of seconds of inactivity. 7200
+    (60x60x2) would be for two hours. Place this option inside the main
+    section of your gosa.conf.
 
 
-Q: Is there a way to let users change passwords without logging into GOsa?
 
-A: Yes. Browse to "password.php". You can preset a couple of things i.e.:
+Q:  Is there a way to let users change passwords without logging into GOsa? 
 
-   |--> 
+A:  Yes. Browse to "password.php". You can preset a couple of things i.e.:
+
+    --- 
     http://your.admin.server/password.php?uid=cajus&method=md5&directory=GONICUS+GmbH
-   |<--
+    ---
+
 
 
-Q: GOsa only shows 300 entries at a time. Is this normal?
+Q:  GOsa only shows 300 entries at a time. Is this normal? 
 
-A: There's a default sizelimit. You can set the "ldapSizelimit" option in your
-   gosa.conf's  location section to a higher value to get rid of it.
+A:  There's a default sizelimit. You can set the "ldapSizelimit" option in your
+    gosa.conf's  location section to a higher value to get rid of it.
 
 
-Q: I have problems with my ldap server when I open groups with 
-   a huge amount of members, what can I do?
 
-A: You can set a nesting limit which ensures that the user names will not be 
-   resolved if the amount of members reaches this limit.
+Q:  I have problems with my ldap server when I open groups with a 
+    huge amount of members, what can I do? 
 
-   |--> 
+A:  You can set a nesting limit which ensures that the user names will not be 
+    resolved if the amount of members reaches this limit.
+
+    --- 
     <location
-     ...
-     ldapFilterNestingLimit="100"
-   |<--
+        ...
+        ldapFilterNestingLimit="100"
+    ---
 
 
-Q: I want to disable the "Is the configuration file up to date?" check when logging in.
-   How can I disable this check?
+Q:  I want to disable the "Is the configuration file up to date?" check when logging in.
+    How can I disable this check? 
 
-A: Just set the configVersion attribute to an empty value:
+A:  Just set the configVersion attribute to an empty value:
 
-   |--> 
+    --- 
     <conf configVersion="" >
-   |<--
+    ---
+
 
 
-Q: I've shredded my access control and am not able to do anything from now on. Is there
-   a way to override the ACL?
+Q:  I've shredded my access control and am not able to do anything from now on. 
+    Is there a way to override the ACL? 
 
-A: Yes. Insert the following statement in the location section of your gosa.conf:
+A:  Yes. Insert the following statement in the location section of your gosa.conf:
 
-   |--> 
+    --- 
     ignoreAcl="your user's dn"
-   |<--
+    ---
 
 
-Q: I can't logon as Administration, what is wrong?
+Q:  I can't logon as Administration, what is wrong? 
 
-A: It looks like you are missing an administrativ account. 
-   In newer versions of GOsa you can simply re-run the setup and create 
+A:  It looks like you are missing an administrativ account. 
+    In newer versions of GOsa you can simply re-run the setup and create 
     an admin account on the migration page. 
 
-   Additionally you can set ignoreACL in GOsa 2.6, just search the FAQ.
- 
+    Additionally you can set ignoreACL in GOsa 2.6, just search the FAQ.
 
-Q: The Unix's user's shell list is empty (unconfigured)
 
-A: Just copy or link your /etc/shell in /etc/gosa.
 
+Q:  The Unix's user's shell list is empty (unconfigured) 
 
-Q: After upgrading GOsa, the setup.php doesn't work or looks broken. 
+A:  Just copy or link your /etc/shell in /etc/gosa.
 
-A: You should delete all files in /var/spool/gosa
 
-   |--> 
+
+Q:  After upgrading GOsa, the setup.php doesn't work or looks broken.  
+
+A:  You should delete all files in /var/spool/gosa
+
+    --- 
     # cd /var/spool/gosa
     # rm -rf *
-   |<--
+    ---
+
+
 
+Q:  After installing GOsa using an existing LDAP tree, my user accounts are not listed. 
 
-Q: After installing GOsa using an existing LDAP tree, my user accounts are not listed.
+A:  You need to add the following objectClasses to your accounts:
 
-A: You need to add the following objectClasses to your accounts:
-  
-   |--> 
+    --- 
     objectClass: person
     objectClass: organizationalPerson
-   |<--
+    ---
+
+    The setup will automatically migrate those accounts, see migration step in GOsa setup!
+
+
+
+Q:  Is it possible to login with the users mail address too?  
+
+A:  Yes, just add the following line to your gosa.conf:
+
+    --- 
+    <location 
+        ...
+        loginAttribute="mail"
+    ---
+
+    or for both, uid and mail:
+
+    --- 
+    <location 
+        ...
+        loginAttribute="uid,mail"
+    ---
+
+
+
+PLEASE VERIFY THOSE
+
+
 
-   The setup will automatically migrate those accounts, see migration step in GOsa setup!
+Q:  GOsa doesn't seem to follow my referrals. What can I do? 
 
+A:  Place the option 'ldapFollowReferrals = "true"' inside your locations definition
+    and you should be fine.
 
-Q: Is it possible to login with the users mail address too? 
 
-A: Yes, just add the following line to your gosa.conf:
+Q:  GOsa is not in my native language, can I translate it to my language? 
 
-   |--> 
-   <location 
-    ...
-    loginAttribute="mail"
-   |<--
+    Yes. Just go to the locale directory and copy the messages.po file somewhere
+    else. Edit the copy and put your translations into the msgstr lines. To be
+    included in next GOsa releases, you may want to send it to the GOsa maintainer.
+    Finally you need to create a directory with your language code. (i.e. de for
+    german) containing the LC_MESSAGES directory. Move your messages.po file there
+    and run 'msgfmt messages.po' in that directory. That's it.
 
-   or for both, uid and mail:
+    You may need to restart apache, depending on your setup. On Debian, be sure
+    to have your locale generated (dpkg-reconfigure locales) before.
 
-   |--> 
-   <location 
-    ...
-    loginAttribute="uid,mail"
-   |<--
 
 
+Q:  Can GOsa show some vendor information for given MAC addresses? 
 
+A:  Yes. Download http://standards.ieee.org/regauth/oui/oui.txt and place
+    it in /etc/gosa/oui.txt.