When configuring Apache, some configuration options can be safely applied via a reload. Others require a full restart of the Apache process.

I have been unable to figure out which are which while reading the Apache docs. Nor have I found anything when searching the web.

So, which directives can be updated via a reload?

Which directives can only be updated via a restart?

See the directive quick reference for a list of all the directives.

Thanks for your help!

Edit: https://httpd.apache.org/docs/2.4/stopping.html doesn't list a reload. And I saw that the httpd.service file on CentOS 7 uses -k graceful for the reload command. Does that mean that a 'reload' on any OS is actually a graceful restart? Which would mean I could rely on a 'reload' to apply all my configuration changes safely.

What I want

For various reasons, I'd like to see the following authentication procedure work:

• go to moodle.blah.bla
• Apache asks for your login information via mod_auth_cas
• Once authenticated, Apache sends you to moodle.blah.bla/login/index.php?authCAS=CAS
• Moodle then sends you to your CAS server which is already authenticated
• CAS sends you back to moodle as an authenticated user.

What I have

Currently I have confirmed that mod_auth_cas does authenticate my user. I also have successfully authenticated Moodle using their CAS plugin.

The problem

Where I am stuck is putting the two things together.

First, once mod_auth_cas authenticates you, I'm not sure how to send the user on to the correct Moodle url.

Second, when I manually browse to the Moodle CAS auth link, it ends up sending me into a redirect loop.

Firefox has detected that the server is redirecting the request for this address in a way that will never complete.

And Chromium:

ERR_TOO_MANY_REDIRECTS

My thoughts on the problem

For the first issue, I would think that I'd want to redirect only when a specific header is set. Except that I think the header would stick around until the end of the session, thus triggering a redirect for every single page...

For the second issue, is the ticket from mod_auth_cas getting invalidated and thus apache is trying to send me back to the cas server? Even though we just came from there... Which would be a redirect loop.

Any other suggestions on how to get his working?

Server config and specs

My server is running:

• Ubuntu 14.04
• Apache 2.4
• http://packages.ubuntu.com/trusty/libapache2-mod-auth-cas
• Moodle 2.8+

In my vhost:

CASValidateServer Off
CASLoginURL https://casserver/cas/login
CASValidateURL https://casserver/cas/serviceValidate
<LocationMatch "/.*">
AuthType CAS
require valid-user
</LocationMatch>

Moodle is configured to use CAS 2.0.

The CAS server is running 4.x.

I have data extract that gets updated by another server. I want to run a script whenever that file is updated.

My incron task looks similar to:

/path/to/file IN_MODIFY php -f /path/to/script.php -- -arg val -arg val

This task does not run when the file is overwritten. The timestamp on the file changes. The data in the file changes, but the incron task does not run.

This is on a Ubuntu 12.04 server.

The file is overwritten when the remote server sftp/scp's a new version over the top of it.

When I tried the IN_CLOSE mask and edited the file manually, it spawned hundreds of tasks.

Using IN_ATTRIB spawns the task multiple times when I edit the file manually.

IN_CLOSE_WRITE does not work at all when the file is overwritten by the upload.

So, what am I missing? All I want is for the task to run one time when the file is modified by the upload....

I've followed this http://sealedabstract.com/code/nsa-proof-your-e-mail-in-2-hours/ tutorial, adjusted to allow for vimbadmin3 users, to set up my mail server. Most of my adjustments come from https://github.com/opensolutions/ViMbAdmin/wiki/Mail-System-Install-on-Ubuntu

The first tutorial uses the dovecot sieve (I think) plugin to route things through dspam. sieve aparently needs a .dovecot.sieve file in the users maildir.

How can I make sure that file is created when dovecot initiates new user maildirs?

Is there a way to create the file in one location, and tell dovecot/sieve to use it on all email accounts?

The file needs to contain:

require ["regex", "fileinto", "imap4flags"];
# Catch mail tagged as Spam, except Spam retrained and delivered to the mailbox
if allof (header :regex "X-DSPAM-Result" "^(Spam|Virus|Bl[ao]cklisted)$",
      not header :contains "X-DSPAM-Reclassified" "Innocent") {
  # Mark as read
  setflag "\\Seen";
  # Move into the Junk folder
  fileinto "Spam";
  # Stop processing here
  stop;
}

I'm running Ubuntu 14.04, using dovecot and postfix. I'm creating users in vimbadmin3, so their directory is not created until their first email is received.

Thanks!

When trying to make ldaps connections to my Novel eDirectory 8.8 server, sometimes I have to put TLS_REQCERT never in the client servers ldap.conf file. Obviously, this is a bad idea.

The command I run is something like this with credentials that actually work...

ldapsearch -x -H ldaps://ldapserver -b 'ou=active,ou=people,dc=example,dc=org' -D 'cn=admin,dc=example,dc=org' -W "cn=username"

On Ubuntu 13.10, it works fine.

On SLES it works fine.

On CentOS 6.5 it returns:

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

Now, the cert I've imported is a wildcard cert purchased from DigiCert. My coworker found some reports indicating that some systems have issues with wildcards.

So, is the wildcard cert to blame? If so, how do I fix it?

If it is not the wildcard cert, then what is it?

Following Andrew Schulman's suggestion, I added -d1 to my ldapsearch command. Here is what I ended up with:

ldap_url_parse_ext(ldaps://ldap.example.org)
ldap_create
ldap_url_parse_ext(ldaps://ldap.example.org:636/??base)
Enter LDAP Password: 
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP ldap.example.org:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 10.225.0.24:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
TLS: certdb config: configDir='/etc/openldap' tokenDescription='ldap(0)' certPrefix='cacerts' keyPrefix='cacerts' flags=readOnly
TLS: cannot open certdb '/etc/openldap', error -8018:Unknown PKCS #11 error.
TLS: could not get info about the CA certificate directory /etc/openldap/cacerts - error -5950:File not found.
TLS: certificate [CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user..
TLS: error: connect - force handshake failure: errno 2 - moznss error -8172
TLS: can't connect: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user..
ldap_err2string
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

From what that says, CentOS doesn't trust DigiCert? Or CentOS doesn't have a list of trusted issuers?

For a variety of reasons, I've become the defacto LDAP admin at my workplace. I've been learning it on the job for about a year now. So, as I describe things, feel free to suggest better ways of doing things.

I have a Novell eDirectory that I'm storing employee information in. It's main use is to authenticate various web services like Moodle or Drupal. But I'm also using it as a backend for a new Employee Directory. I didn't see any point in duplicating the data anymore than it was already being duplicated. Plus, an employee directory sounds like exactly the kind of thing LDAP was made for.

I created entries for each office, then set up an attribute on each user that references the dn of the office entry for their office. The problem I have now is that each office likely has it's own phone number. Thus, employees who have more than one office (if they work at more than one campus, for example) have more than one phone number. Since phone numbers follow the employee, I can't just assign the number to the office entry. So, I need some way to say, "this phone number is for this office."

If this was a MySQL database, I'd just create a table that maps things however I want.

Is there a similar structure I could use in LDAP? Or method that's equivalent?

To give a detailed example of what I'm talking about here's a pseudo ldif of an employee entry:

dn: cn=user,ou=staff,dc=college,dc=edu
officedn: cn=DC107,ou=locations,dc=college,dc=edu
officedn: cn=MAIN222,ou=locations,dc=college,dc=edu
phone: 555-555-5555
phone: 111-111-1111
departmentdn: cn=it,ou=departments,ou=groups,dc=college,dc=edu
departmentdn: cn=math,ou=departments,ou=groups,dc=college,dc=edu
title: web systems admin
title: professor of discrete math

So, how would I relate: officedn: cn=DC107,ou=locations,dc=college,dc=edu to phone: 555-555-5555?

Or officedn: cn=MAIN222,ou=locations,dc=college,dc=edu to phone: 111-111-1111?

Or departmentdn: cn=math,ou=departments,ou=groups,dc=college,dc=edu to title: professor of discrete math?

And so on...

Some notes, just in case they are relevant:

I created custom attributes for the office and department dn's using the DN syntax 1.3.6.1.4.1.1466.115.121.1.12.

Department entries have the objectClasses groupOfNames, nestedGroupAux, and Top.

Offices have the objectClasses: A custom objectClass containing the custom dn reference to their parent campus entry, ndsLoginProperties, organizationalPerson, Person, and Top.

User entries are the same as offices, plus posixAccount.

Is there any other information I should provide?

Edit to address issues the comments are too short for:

If I create another entry containing the meta information, as described in https://serverfault.com/a/500129/99647 I'd need to create a meta entry per phone number, and per job title.

dn: cn=MAIN222,cn=user,ou=staff,dc=college,dc=edu officedn: cn=MAIN222,ou=locations,dc=college,dc=edu phone: 111-111-1111 departmentdn: cn=math,ou=departments,ou=groups,dc=college,dc=edu title: professor of discrete math departmentdn: cn=it,ou=departments,ou=groups,dc=college,dc=edu title: web systems admin

Would not work because there's no way for a computer to figure out that web systems admin doesn't go with math, but does go with it.

Before I posted the question, the method I thought out was something like creating an ou for all the metadata: ou=metadata,dc=college,dc=edu Then an ou for each user: ou=userid,ou=metadata,dc=college,dc=edu Then an entry per job title and phone number that linked them to their departments and offices:

``` dn: cn=jobtitle,ou=userid,ou=metadata,dc=college,dc=edu officedn: cn=DC107,ou=locations,dc=college,dc=edu phone: 555-555-5555

dn: cn=phonenumber,ou=userid,ou=metadata,dc=college,dc=edu officedn: cn=MAIN222,ou=locations,dc=college,dc=edu phone: 111-111-1111 ```

I was hoping that there was a cleaner way than that to accomplish what I want.

I created a custom LDAP objectClass, but forgot a couple attributes before I added it to my OpenLDAP server. I followed the instructions on this Ubuntu doc page: https://help.ubuntu.com/12.04/serverguide/openldap-server.html I am running Ubuntu 12.04.

So, how do I add a new MAY attribute to an objectClass that is already applied to the server?

Specifically on OpenLDAP, but it would be good to know how for Novell eDirectory as well.

I have an Ubuntu 11.10 VM set up in VMSphere. I'm storing some data on a nfs mount. The VM has been going down frequently. I haven't been able to pin the reason why down, but I think it has to do with this error:

Jan 19 09:53:07 ws-test-moodlearchive-01 kernel: [  384.523617] nfs4_reclaim_open_state: Lock reclaim failed!

It shows up in /var/log/syslog thousands of time. Most often after cron starts running.

I originally was saving the output of one cron job to a text file stored on the NFS mount. Switching that to the local disk seems to have reduced the number of errors, but it's still showing up.

Google has been been very unhelpful, nothing I found seemed to apply. Didn't find anything even close on this site, or StackOverflow.

So, what does that error mean? And how can I keep it from occurring?

Using Apache 2.2.14 on Ubuntu 10.04, I am trying to protect a folder with LDAP authentication. Our LDAP server is running Novell eDirectory.

All our users are in subgroups of ou=Users,ou=Directory,o=IC. Like this:

• ou=Managers,ou=Users,ou=Directory,o=IC
• ou=Employees,ou=Users,ou=Directory,o=IC
• ou=Misc,ou=Users,ou=Directory,o=IC
• ou=Outsiders,ou=Users,ou=Directory,o=IC

I want all of ou=Users,ou=Directory,o=IC to be able to access my folder, except those in ou=Outsiders,ou=Users,ou=Directory,o=IC.

I can get into my folder with my LDAP log in information using the following settings, but it doesn't block users in the Outsiders group:

AuthName "Login Required: please enter your L-number and PIN"
AuthType Basic
AuthBasicProvider ldap
AuthzLDAPAuthoritative on
AuthLDAPURL ldaps://ldap.example.com/ou=Users,ou=Directory,o=IC?cn?sub?(objectclass=Person)
Require ldap-filter (|(cn=*,ou=Managers,ou=Users,ou=Directory,o=IC)(cn=*,ou=Employees,ou=Users,ou=Directory,o=IC)(cn=*,ou=Misc,ou=Users,ou=Directory,o=IC))
AuthLDAPBindDN cn=binder,ou=Admin,ou=Directory,o=IC
AuthLDAPBindPassword password

I've tried:

• Require valid-user
• Various AuthLDAPURLs
• Require ldap-group for only the groups I want.
• Other searches for the Require ldap-filter, like not having "cn=*" in it.

Everything either doesn't let me in, throws a 500 error, or lets members of ou=Outsiders,ou=Users,ou=Directory,o=IC in.

So, how do I keep members of ou=Outsiders,ou=Users,ou=Directory,o=IC out of my folder?