389-users September 2009

389-users@lists.fedoraproject.org

33 participants
35 discussions

Migrating a Directory Server from 389-ds to FreeIPA
by Michael Kang 24 Sep '09

24 Sep '09

Dear Fedora Directory community, I'm help my PL migrating Fedora directory server(storing employees info and Linux user accounts) from 389-ds(1.1.x) to FreeIPA(1.2.2). I backed up from the command line using the *db2bak* command-line script. I got two LDIF files and two folders(userRoot and NetscapeRoot) which contains many db4 files. After reading the FreeIPA Administrator Guide, I realized there is no * db2bak* or *bak2db* commands for FreeIPA users. So I copy those LDIF files and folders to /var/lib/dirsrv/<ds instance> directly. Then I run *service dirsvr restart*, the dirsvr instance cannot start anymore. The instance names of 389-ds and FreeIPA are different. So I want to learn more about 389-ds server. I run *yum install 389-ds* in Fedora 9 i386. I got message: No package 389-ds available. My system is already updated. What's the new name of the 389-ds package? How can I finish this hard job? Have anybody ever migrated successfully? I need your help.. Best Regards, Michael -- Michael Kang（康上明学） There is a giant asleep within every man. When the giant awakens,miracles happen. Personal blog: http://ufusion.org - United Fusion

3 4

Posix attributes plugin
by Prashanth Sundaram 24 Sep '09

24 Sep '09

Thanks Rich and Everyone who helped me with this project. Thanks for being patient and answering my questions :) I have finally got my 389-ds working and meeting most of requirements, but there is this one last piece which will be great to have: posix Attributes generator/sync So I was able to sync the users from AD and all the fields are populated except the posix attributes. Is there a generator plugin, that automatically assign the next uidNumber, defaultshell, default homedir etc to new user synced? Or is there a tool/configuration to sync posix Attributes from AD? (I don¹t yet maintain the posix attributes in AD, but I if I have to then I will export it for existing users.)

2 1

User password changes
by Legatus 24 Sep '09

24 Sep '09

I am working in a fairly tight security world, and need a good solution for users to change their own password via a web interface. What are some of the solutions that you have used in your environments? -- JD Runyan Joan Crawford<http://www.brainyquote.com/quotes/authors/j/joan_crawford.html> - "I, Joan Crawford, I believe in the dollar. Everything I earn, I spend."

2 1

389 upgrade
by Juan Asensio Sánchez 23 Sep '09

23 Sep '09

Hi I am trying to upgrade some of our FDS servers. The test versions we are using for upgrade are (the same that the production servers): [root@fdsold ~]# rpm -qa | grep -i fedora fedora-ds-dsgw-1.1.1-1.fc6 fedora-ds-1.1.2-1.fc6 fedora-ds-admin-1.1.2-2.fc6 fedora-ds-console-1.1.2-1.fc6 fedora-idm-console-1.1.0-5.fc6 fedora-ds-base-1.1.3-2.fc6 fedora-ds-admin-console-1.1.2-1.fc6 We have two test servers, with replication agreements between them, and SSL configured for directory and console; 389 port is disabled. Then we upgrade FDS/389 with this command (we do not want to upgrade the full server): yum upgrade 389-admin 389-admin-console 389-console 389-ds 389-ds-base 389-ds-console 389-dsgw The upgrade is done correctly, then we run "setup-ds-admin.pl -u": [root@fdsnew ~]# setup-ds-admin.pl -u ============================================================================== The update option will allow you to re-register your servers with the configuration directory server and update the information about your servers that the console and admin server uses. You will need your configuration directory server admin ID and password to continue. Continue? [yes]: ============================================================================== Please specify the information about your configuration directory server. The following information is required: - host (fully qualified), port (non-secure or secure), suffix, protocol (ldap or ldaps) - this information should be provided in the form of an LDAP url e.g. for non-secure ldap://host.example.com:389/o=NetscapeRoot or for secure ldaps://host.example.com:636/o=NetscapeRoot - admin ID and password - admin domain - a CA certificate file may be required if you choose to use ldaps and security has not yet been configured - the file must be in PEM/ASCII format - specify the absolute path and filename Configuration directory server URL [ldaps://fdsnew.sacyl.es:636/o=NetscapeRoot]: Configuration directory server admin ID [uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot]: Configuration directory server admin password: Configuration directory server admin domain [center2.sacyl.es]: CA certificate filename: /etc/openldap/cacerts/cert-CA-cacert.pem ============================================================================== The interactive phase is complete. The script will now set up your servers. Enter No or go Back if you want to change something. Are you ready to set up your servers? [yes]: Registering the directory server instances with the configuration directory server . . . Beginning Admin Server reconfiguration . . . Registering admin server with the configuration directory server . . . Updating adm.conf with information from configuration directory server . . . Exiting . . . Log file is '/tmp/setupwDn6B0.log' And reboot... After that, when connecting with the console, we have two entries for the directory server and two for the administration server. One of each does not show the icon it should, and when I click on it, it tries to download new jars, but it can not. If I use the old item for the administration console (that shows the icon), in the encryption tab , SSL is disabled, but before the upgrade it was enabled, but if i try to access the server with the browser, i must use https (¿?). Why is SSL disabled? And if it is disabled, why must I access using https? Is there any step I haven't done? Regards and thanks in advance.

3 6

template scripts
by lejeczek 23 Sep '09

23 Sep '09

dear all quickie, is it possible to manually(not gui) make use of templates files from script-templates, like: db2bak, db2ldif, and perl scripts, basically what I'm trying to do is to take backup and gui console is broken, no tasks have been ever set. cheers Pawel

2 1

jar jar jar.. 386-console
by lejeczek 23 Sep '09

23 Sep '09

jar :) dear all, I've always had problems with missing messy jars, particularly after upgrades. does anybody know why, when I fire up 386-console clean, and want to connect to dir or admin server, console complains about being not able to find fedora-ds, fedora-admin respectively. there are no such files on the server, it all 389*jar now, right? which one is it to say what jar should be used, console or admin server? where to go to fix it? it's always felt to me like this part fedora-ds was wobbly. cheers Pawel

2 2

Re: [389-users] PAM PTA partially working
by Prashanth Sundaram 23 Sep '09

23 Sep '09

Andrey, Thanks for the info. It worked for me. :) Just another question, I want to secure the communication with AD secure. I read that AD is not SSL compatible and supports startTLS. What security mechanism have you used in your systems with AD? http://www.directory.fedora.redhat.com/wiki?title=Server_To_Server_Conn&redi rect=no Hi, You should not verify the users locally (there is a "no_user_check" to add). The authoritative source of validation should be AD/Kerberos. Here is the config that works for us : auth sufficient /lib/security/pam_krb5.so no_user_check account required /lib/security/pam_krb5.so no_user_check

2 1

Re: [389-users] PAM PTA partially working
by Prashanth Sundaram 22 Sep '09

22 Sep '09

Rich, Andrey¹s suggestion worked. Yes, I have enabled SSL in the Admin server and Directory Server. But it still would fall back on 389-ds password, when ³pamsecure=TRUE¹. If I set pamsecure=FALSE, the authentication passed through to the AD as intended. How do I secure the communication between 389-ds and LDAP server? I used wireshark to capture packets, and it¹s all clear. > > To revisit, here's the observation: pamsecure when set to TRUE authenticates > users only to the password in 389-ds, but when set to FALSE will > authenticate to the AD password only if the uid exists in /etc/passwd. > That's really bizarre - the only place where pamSecure is used is here: if (cfg->pamptconfig_secure) { /* is a secure connection required? */ int is_ssl = 0; slapi_pblock_get(pb, SLAPI_CONN_IS_SSL_SESSION, &is_ssl); if (!is_ssl) { slapi_log_error( SLAPI_LOG_PLUGIN, PAM_PASSTHRU_PLUGIN_SUBSYSTEM, "<= connection not secure (secure connection required; check config)"); return retcode; } } That is, if pamSecure is true, requests will be rejected unless using TLS/SSL. Do you have your directory server configured to use TLS/SSL when using pamSecure: TRUE?

2 1

Problems starting dirsrv-admin
by Juan Asensio Sánchez 22 Sep '09

22 Sep '09

Hi For some time i am having troubles starting dirsrv-admin. It worked fine, but now it doesn't start. When I run /etc/init.d/dirsrv-admin start, the process hangs, and after 10 minutes, i get this error: [root@XXXXXX ~]# /etc/init.d/dirsrv-admin start Starting dirsrv-admin: *** Error: dirsrv-admin failed to start [FALLÓ] If i run this command manually, using strace for debug, the last lines before a segmentation fault are these (full output attached): [root@XXXXXX ~]# strace /usr/sbin/httpd.worker -k start -f /etc/dirsrv/admin-serv/httpd.conf -e debug -X [...] open("/etc/hosts", O_RDONLY) = 6 fcntl64(6, F_GETFD) = 0 fcntl64(6, F_SETFD, FD_CLOEXEC) = 0 fstat64(6, {st_mode=S_IFREG|0644, st_size=505, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f99000 read(6, "# Do not remove the following li"..., 4096) = 505 read(6, "", 4096) = 0 close(6) = 0 munmap(0xb7f99000, 4096) = 0 open("/etc/hosts", O_RDONLY) = 6 fcntl64(6, F_GETFD) = 0 fcntl64(6, F_SETFD, FD_CLOEXEC) = 0 fstat64(6, {st_mode=S_IFREG|0644, st_size=505, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f99000 read(6, "# Do not remove the following li"..., 4096) = 505 close(6) = 0 munmap(0xb7f99000, 4096) = 0 socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 6 fcntl64(6, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0 connect(6, {sa_family=AF_INET, sin_port=htons(636), sin_addr=inet_addr("XX.XX.XX.XX")}, 16) = -1 EINPROGRESS (Operation now in progress) poll([{fd=6, events=POLLPRI|POLLOUT}], 1, 5000) = 1 ([{fd=6, revents=POLLOUT}]) getsockopt(6, SOL_SOCKET, SO_ERROR, [0], [4]) = 0 getpeername(6, {sa_family=AF_INET, sin_port=htons(636), sin_addr=inet_addr("XX.XX.XX.XX")}, [16]) = 0 time(NULL) = 1253515556 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ XX.XX.XX.XX is the IP address of the server. [root@XXXXXX ~]# rpm -qa | grep fedora fedora-ds-admin-1.1.1-1.fc6 fedora-ds-1.1.0-3.fc6 fedora-ds-base-1.1.0-3.fc6 fedora-admin-console-1.1.0-4.fc6 fedora-idm-console-1.1.0-5.fc6 fedora-ds-console-1.1.0-5.fc6 [root@XXXXXX ~]# uname -a Linux XXXXXXXXXXXXXXXXXXX 2.6.18-128.1.10.el5.centos.plusPAE #1 SMP Mon May 11 07:51:33 EDT 2009 i686 i686 i386 GNU/Linux Any idea why is happening this? The LDAP server itself is working fine. Regards.

2 6

Re: [389-users] Configuring Multimaster Replication
by Morris, Patrick 22 Sep '09

22 Sep '09

On Mon, 21 Sep 2009, Allan Gaston Hougham wrote: > Hi, > > I trying to create a Multimaster Replication (two master only, active-active) > and I tryed with this solution but this issue is not working > > http://directory.fedoraproject.org/wiki/Howto:MultiMasterReplication > > Is posible to have two masters servers? any have this implementation in production? A couple things: 1. When starting a new thread, don't reply to someone else's message and change the subject. Those of use with threaded mail readers probably won't see it, since your message will be included in a thread on a totally different subject. 2. Yes, multi-master replication works. Give us some details about what's not working for you and what's in your logs and someone can probably help you out.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users September 2009