389-users September 2010

389-users@lists.fedoraproject.org

37 participants
52 discussions

Syntax error with DNA plugin in 1.2.6
by Mark Plaksin 17 Sep '10

17 Sep '10

We have the DNA plugin working fine in 1.2.5. In 1.2.6 we get a syntax error when we try to create users with uidNumber set to 'magic'. We configure and use the DNA plugin as described here: http://www.redhat.com/docs/manuals/dir-server/8.1/admin/dna.html If I turn on all the debugging it ends up complaining that uidNumber has a syntax error. As if DNA failed to replace 'magic' with a number. We've reproduced this by installing both 1.2.5 and 1.2.6 from scratch and configuring DNA using the same LDIF. 1.2.5 works, 1.2.6 gives the syntax error. Do we need to do something extra in 1.2.6? Thanks!

3 2

Syntax validation rejecting DirectoryStrings
by Edward Z. Yang 17 Sep '10

17 Sep '10

Hello all, We are having some difficulties with the new syntax validation built in to LDAP. Consider the following schema (formatted for readability): dn: cn=schema attributeTypes: ( 1.2.840.113554.4.2.1.1 NAME 'scriptsVhostName' DESC 'Canonical server name' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'scripts.mit.edu' ) attributeTypes: ( 1.2.840.113554.4.2.1.2 NAME 'scriptsVhostAlias' DESC 'Other server names' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'scripts.mit.edu' ) attributeTypes: ( 1.2.840.113554.4.2.1.3 NAME 'scriptsVhostDirectory' DESC 'Directory under $HOME/Scripts/$service for the root of this service' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'scripts.mit.edu' ) attributeTypes: ( 1.2.840.113554.4.2.1.4 NAME 'scriptsVhostAccount' DESC 'User account for finding home direcory and suexec uid/gid' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN 'scripts.mit.edu' ) objectClasses: ( 1.2.840.113554.4.2.2.1 NAME 'scriptsVhost' DESC 'Configuration for a scripts virtual host' SUP top AUXILIARY MUST ( scriptsVhostName $ scriptsVhostDirectory $ scriptsVhostAccount ) MAY ( scriptsVhostAlias ) X-ORIGIN 'scripts.mit.edu' ) The syntax validation then rejects a directory entry of the following form. 0 scriptsVhostName=ezyang.scripts.mit.edu,ou=VirtualHosts,dc=scripts,dc=mit,dc=edu objectClass: scriptsVhost objectClass: top scriptsVhostName: ezyang.scripts.mit.edu scriptsVhostAlias: ezyang.scripts scriptsVhostAccount: uid=ezyang,ou=People,dc=scripts,dc=mit,dc=edu scriptsVhostDirectory: With the following error: [16/Sep/2010:14:19:39 -0400] syntax-plugin - Syntax validate task starting (base: "scriptsVhostName=ezyang.scripts.mit.edu,ou=VirtualHosts,dc=scripts,dc=mit,dc=edu", filter: "(objectclass=*)") ... [16/Sep/2010:14:19:40 -0400] syntax-plugin - Entry "scriptsVhostName=ezyang.scripts.mit.edu,ou=VirtualHosts,dc=scripts,dc=mit,dc=edu" violates syntax. scriptsVhostDirectory: value #0 invalid per syntax [16/Sep/2010:14:19:41 -0400] syntax-plugin - Syntax validate task complete. Found 1 invalid entries. It is difficult for me to tell what value #0 is referring to, but if it is scriptsVhostName, as far as I can tell it is a perfectly fine DirectoryString. Is our schema wrong or is there a bug in the syntax validation? Cheers, Edward

2 3

Announcing 389 Directory Server 1.2.6
by Rich Megginson 16 Sep '10

16 Sep '10

The 389 team is pleased to announce the availability of version 1.2.6. This release is essentially the same as 1.2.6 RC7. * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download === New features === * Upgrade_to_New_DN_Format http://directory.fedoraproject.org/wiki/Upgrade_to_New_DN_Format ** in order to make sure DN valued attributes can be searched correctly, an upgrade will automatically fix these values in the database * Replication_Session_Hooks http://directory.fedoraproject.org/wiki/Replication_Session_Hooks ** API for plugins to intercept replication session at various points * Managed Entries - http://directory.fedoraproject.org/wiki/Managed_Entry_Design ** Used, for example, to automatically create the user's group entry when adding a user entry * Subtree Rename and Entry Move (modifyDN with newSuperior) ** https://bugzilla.redhat.com/show_bug.cgi?id=429005 ** ability to rename a node that has children ** ability to move a node, with or without children, to another parent node * Security Enhancements ** SELinux Policy http://directory.fedoraproject.org/wiki/SELinux_Policy *** https://bugzilla.redhat.com/show_bug.cgi?id=442228 * Matching rules ** support for all RFC 4517 matching rules (except the FirstComponent ones) === Bugs Fixed === This release contains many, many bug fixes. The complete list of bugs fixed is found at the link below. Note that bugs marked as MODIFIED have been fixed but are still in testing. * Tracking bug for 1.2.6 release - https://bugzilla.redhat.com/showdependencytree.cgi?id=543590&hide_resolved=0

2 9

Problems upgrading to 1.2.6
by Edward Z. Yang 16 Sep '10

16 Sep '10

Hello all, I can verify that the upgrade from 389-ds-base-1.2.6-0.1.a1.fc13.x86_64 to 1.2.6-1.fc13.x86_64 requires performing the instructions described at [1] (in our case, LDAP authentication stopped working shortly after the upgrade.) Is there any particular reason this isn't built into the process by default? Cheers, Edward [1] http://directory.fedoraproject.org/wiki/Subtree_Rename#warning:_upgrade_fro…

3 4

Using ldclt
by Gerrard Geldenhuis 15 Sep '10

15 Sep '10

Hi I have not been able to get ldclt working. I suspect I am not using it correctly and would appreciate anyone just giving my options a sanity check. Running the following: ldclt -h testserver.example.com -p 389 -e bindeach,bindonly -Z /etc/dirsrv/slapd-testserver -e cltcertname=certname,keydbfile=key3.db,keydbpin=password -V Running that give me an error: ldclt version 4.23 /usr/bin/ldclt: line 47: 2352 Segmentation fault ${dir}/${COMMAND} "$@" I have tried both the server and the CA cert names as options n the cltcertname. Some of the CA certs have spaces in so I enclose it in single quotes which then still gives me an segmentation fault Best Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 1

Re: [389-users] Restoring a completely broken machine that is using a shared netscapedb
by Prashanth Sundaram 15 Sep '10

15 Sep '10

Gerrad, Here is some documentation on Disaster recovery. http://www.redhat.com/docs/manuals/dir-server/8.2/admin/html/disaster-recov… Basically the steps are correct, but when I was in that situation I pointed the ldap to our then stand-by server. The reason was, I could not completely recover from the backup as I had replication setup for admin-server(netscaperoot) and when I tried to restore I got weird messages. This was just my experience, but I am sure the recovery must be simple. Few things I find hard in the backup and recovery is SSL certs, Replication and the order in which you should recover, automated backups and indexing and backup do not go well together when running at same time. >Hi >I was wandering if anyone can share some tips on how to restore a >machine that is using a shared/replicated netscapedb. > >If I loose the server and need to rebuild the hardware how would I >"plug" the server back in? > >The steps as I think they should be done without having tested it yet >is: >Install 389 dir server rpms ( same version as other servers ) >Make backup of netscapedb on any other server. >Restore it on the server >Copy backed-up dse.ldif >Re-initialize userdb > >I am still reading about all the backup commands so the above is >conceptually what I believe needs doing. > >Any comments would be appreciated. > >Best Regards

1 0

Debug PTA and PAM-PTA stack for ldap timeout
by Prashanth Sundaram 15 Sep '10

15 Sep '10

Hello, We are having some ldap timeout issues in out MMR-SLAVE ldap setup. A user is unable to ssh to random hosts at random times. Terminal Error: Permission denied (publickey,gssapi-with-mic,password) secure logs: pam_ldap: ldap_result Timed out Failed password for psundaram from 10.1.0.120 port 22039 ssh2 Sifting thru logs tell the user's password was successfully authenticated upstream by looking at dirsrv access log with err=0. The clients connecting to slave incur regular timeouts and the login fails but it is not case with clients connecting to Master directly. Setup: Two Masters with MMR, Two Slaves with MMR. The authentication for clients connecting to the slave ldap server goes to the master via PTA plugin and then from Master it goes to Windows AD via PAM-PTA. Client----->Slave--(PTA)-->Master--(PAM-PTA)-->AD(This is where all passwords are) I understand we have might have a long traversal for the authentication, but we have set considerably high timeout limits. /etc/ldap.conf timelimit 120 bind_timelimit 5 bind_policy hard idle_timelimit 3600 slave ldap server nsslapd-idletimeout: 86400 nsbindtimeout: 15 nsslapd-timelimit: 3600 Master ldap server nsslapd-idletimeout: 7200 nsbindtimeout: 15 nsslapd-timelimit: 3600 Anybody had similar issue or can share some debugging tips? -Prashanth

2 1

Restoring a completely broken machine that is using a shared netscapedb
by Gerrard Geldenhuis 15 Sep '10

15 Sep '10

Hi I was wandering if anyone can share some tips on how to restore a machine that is using a shared/replicated netscapedb. If I loose the server and need to rebuild the hardware how would I "plug" the server back in? The steps as I think they should be done without having tested it yet is: Install 389 dir server rpms ( same version as other servers ) Make backup of netscapedb on any other server. Restore it on the server Copy backed-up dse.ldif Re-initialize userdb I am still reading about all the backup commands so the above is conceptually what I believe needs doing. Any comments would be appreciated. Best Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

1 0

GOSA as a frontend for the 389 Directory Server?
by Stefan-Michael Guenther 14 Sep '10

14 Sep '10

Hello, one of our clients wants to use GOSA (https://oss.gonicus.de/labs/gosa/) as a frontend for the 389 DS. I found a number of postings that configuring GOSA to work with the 398 DS isn't easy. Therefore my question is whether anyone has a working combination and might publish a howto on it? Otherwise I would have to find my way through it and write the docu on it. Thanks for any hints & suggestions, Stefan

5 8

389 as authentication server on Fedora 13 #389 #ldap @Skolan
by Lars Gunther 14 Sep '10

14 Sep '10

Hi all I am new to this list and need help setting up an authentication server for an all Linux network. I previously used OpenLDAP, but think it is very complicated to set up and use, so I am giving 389 a try. However, things are not going great... I am running a network where users should have access both through SSH to the servrer and be able to log in on a local machine to a roaming profile. /home is shared via NFS. Both the server and all clients are running Fedora 13. 389 is installed and running. I can query the server and using the admin tools I was able to import an old account saved as LDIF. However, the following does not work: 1. The user I imported can not authenticate. I think that I need to set up 389 to use encryption with ldaps (Fedora 13 does not allow unencrypted passwords, which I used earlier since this net was experimental, isolated and contains no sensitive information). 2. I can not import old posixGroups, nor can I create new ones. Trying to import using LDIF, I get errors. Trying to create manually, I do not see the option appear in the admin tool. I wish there was a guide that did provide exactly the steps I need to set up my server and network. The manual is good, but frankly I do not understand it well enough and lots of information is redundant to my needs. When I've gotten this to work, I intend to write such a guide! But perhaps someone on this list could point me in the right direction...) BTW, please CC my Evernote account when you reply to this thread. -- Lars Gunther http://keryx.se/ http://twitter.com/itpastorn/ http://itpastorn.blogspot.com/

3 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users September 2010