<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";
color:black;}
span.EmailStyle24
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Ok so to stop updates just don’t let the clients through the firewall. To allow updates I’d investigate the ChainOnUpdate method. Thanks Rich <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> Rich Megginson [mailto:rmeggins@redhat.com] <br><b>Sent:</b> Thursday, February 09, 2012 11:38 AM<br><b>To:</b> Groten, Ryan<br><b>Cc:</b> General discussion list for the 389 Directory server project.<br><b>Subject:</b> Re: [389-users] How do read-only consumers work?<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>On 02/09/2012 11:37 AM, Groten, Ryan wrote: <o:p></o:p></p><p class=MsoNormal><span style='color:#1F497D'>What if the clients are external (along with the consumer) and can’t follow the referral? Ideally the read-only replica is put in place outside a firewall, then it is allowed to talk directly to the master (clients are not allowed). This would prevent having to allow X number of clients to connect directly to a master directory server. </span><o:p></o:p></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>If they can't follow the referral, they will get an error.<br><br><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal><span style='color:#1F497D'>If it’s not possible to control which updates are allowed and which aren’t, is there a way to disable updates (from the read-only to the master) entirely?</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>There are no updates from the read-only to the master. There are only updates from clients.<br><br><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>This wouldn’t be ideal because it complicates the environment for users (ie: don’t change your password in external facing zones because it won’t be reflected internally), but prevents an external intrusion from affecting internal.</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>See also <a href="http://directory.fedoraproject.org/wiki/Howto:ChainOnUpdate">http://directory.fedoraproject.org/wiki/Howto:ChainOnUpdate</a><br><br><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal><span style='color:#1F497D'> </span><o:p></o:p></p><div><div style='border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0in 0in 0in;border-color:-moz-use-text-color -moz-use-text-color'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> Rich Megginson [<a href="mailto:rmeggins@redhat.com">mailto:rmeggins@redhat.com</a>] <br><b>Sent:</b> Thursday, February 09, 2012 11:27 AM<br><b>To:</b> General discussion list for the 389 Directory server project.<br><b>Cc:</b> Groten, Ryan<br><b>Subject:</b> Re: [389-users] How do read-only consumers work?</span><o:p></o:p></p></div></div><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>On 02/09/2012 11:24 AM, Groten, Ryan wrote: <o:p></o:p></p><p class=MsoNormal>Hi all,<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>I’m testing out setting up 2 read-only consumers (each matches 1 of 2 multi-masters). Seems to be working fine, but I’m just trying to wrap my head around what’s happening when changes are made:<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoListParagraph style='text-indent:-.25in'>Have 2 multi-master Directory Servers (1.2.9.9) setup and running<o:p></o:p></p><p class=MsoListParagraph style='text-indent:-.25in'>Create another DS, set Replication to “dedicated consumer”<o:p></o:p></p><p class=MsoListParagraph style='text-indent:-.25in'>Create a replication agreement from 1 of the multi-masters to this consumer<o:p></o:p></p><p class=MsoListParagraph style='text-indent:-.25in'>Modify an entry from the consumer<o:p></o:p></p><p class=MsoListParagraph style='text-indent:-.25in'>Change is made on the read-only server and on the multi-masters<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>There’s no replication agreement going FROM the consumer to the master, but I see changes on the master side anyways. Is the consumer sending a request with the change to the master, who then makes the change and replicates it back to the consumer?<o:p></o:p></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>No. The database state on the consumers are set to "referral on update". This means that when a update request is received on the consumer, it sends back to the client a referral to one of the masters. If you are using a "smart" client like the console, it will automatically follow the referral for you.<br><br><br></span><o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>If the above is true, then how would I go about doing something like this:<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>The goal I’m trying to achieve is I want to put some read-only DS in an external zone. In theory I don’t think the read-only’s should be able to modify the masters for security reasons (ie: if someone external compromises the external DS, they shouldn’t be able to delete all the entries in the internal). However, having the option to allow certain changes from the external into internal may be useful (maybe allowing password changes from the read-only to the master or something).<o:p></o:p></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>That would be tricky to implement<br><br><br></span><o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Thanks,<o:p></o:p></p><p class=MsoNormal>Ryan<o:p></o:p></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'> </span><o:p></o:p></p><div class=MsoNormal align=center style='text-align:center'><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><hr size=2 width="100%" align=center></span></div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:gray'>This communication, including any attached documentation, is intended only for the person or entity to which it is addressed, and may contain confidential, personal and/or privileged information. Any unauthorized disclosure, copying, or taking action on the contents is strictly prohibited. If you have received this message in error, please contact us immediately so we may correct our records. Please then delete or destroy the original transmission and any subsequent reply.<br><br><br></span><o:p></o:p></p><pre> <o:p></o:p></pre><pre> <o:p></o:p></pre><pre>--<o:p></o:p></pre><pre>389 users mailing list<o:p></o:p></pre><pre><a href="mailto:389-users@lists.fedoraproject.org">389-users@lists.fedoraproject.org</a><o:p></o:p></pre><pre><a href="https://admin.fedoraproject.org/mailman/listinfo/389-users">https://admin.fedoraproject.org/mailman/listinfo/389-users</a><o:p></o:p></pre><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p></div></body></html>