389-users October 2011

389-users@lists.fedoraproject.org

28 participants
25 discussions

SSL Question
by Cawley, Chris 19 Oct '11

19 Oct '11

Hello - We are in the process of setting up SSL on 389 ds; however, it appears that the CA cert db is empty. The builtin tokens are not even loaded. Any ideas why? - Thanks Chris Cawley System Administrator Washington Research Library Consortium 301-390-2049 cawley(a)wrlc.org

4 13

Replication issue
by Reinhard Nappert 18 Oct '11

18 Oct '11

Hi, I encountered the following logs in the errors: [06/Oct/2011:10:11:57 +0000] NSMMReplicationPlugin - changelog program - agmt="cn=srvAtosrvB" (srvB:389): CSN 4e8d804a0000000c0000 not found, we aren't as up to date, or we purged [06/Oct/2011:10:11:57 +0000] NSMMReplicationPlugin - agmt="cn=srvAtosrvB" (srvB:389): Data required to update replica has been purged. The replica must be reinitialized. [06/Oct/2011:10:11:57 +0000] NSMMReplicationPlugin - agmt="cn=srvAtosrvB" (srvB:389): Incremental update failed and requires administrator action Does anyone have an idea, what could have caused this and more importantly, how to fix this? Thanks -Reinhard

3 11

GUI console fails to show up after upgrade
by harry.devine＠faa.gov 14 Oct '11

14 Oct '11

We are running a 64-bit CentOS that used to be on 5.4, but a few days ago we put patches on it which brought it up to 5.7. It also updated our 389-ds to the following versions: rpm -qa 389* 389-dsgw-1.1.7-2.el5 389-ds-base-1.2.9.9-1.el5 389-ds-console-1.2.6-1.el5 389-admin-console-1.1.8-1.el5 389-admin-1.1.23-1.el5 389-ds-console-doc-1.2.6-1.el5 389-ds-base-libs-1.2.9.9-1.el5 389-console-1.1.7-3.el5 389-admin-console-doc-1.1.8-1.el5 389-adminutil-1.1.14-1.el5 389-ds-1.2.1-1.el5 When I try to run the 389-console application now (a user needs his password reset), I get the following errors: 389-console Exception in thread "main" java.lang.ClassFormatError: com.netscape.management.client.console.Console (unrecognized class file version) at java.lang.VMClassLoader.defineClass(libgcj.so.7rh) at java.lang.ClassLoader.defineClass(libgcj.so.7rh) at java.security.SecureClassLoader.defineClass(libgcj.so.7rh) at java.net.URLClassLoader.findClass(libgcj.so.7rh) at java.lang.ClassLoader.loadClass(libgcj.so.7rh) at java.lang.ClassLoader.loadClass(libgcj.so.7rh) at gnu.java.lang.MainThread.run(libgcj.so.7rh) Any ideas on how to fix this? Harry Devine Common ARTS Software Development AJT-144 (609)485-4218 Harry.Devine(a)faa.gov

2 18

Configure access log
by Moisés Barba Pérez 14 Oct '11

14 Oct '11

*HI, I'm doing a backup for mi access logs in several ldap servers and I have found that some of this logs have been deleted because of rotation info. The thing is, I want to save all the access log generated in a day in files of 100MB. I have searched the way to do it and now I have to set the maximum size of the combined archived logs to -1, but I don't know if I can set -1 to the **maximum number of logs for the directory to keep. Is this possible? Regards, Moses *

2 1

389 pauses every 5 minutes under load
by Justin Gronfur 13 Oct '11

13 Oct '11

Hello all, I need your expertise... please help me! (Disclaimer: I am a relative newcomer to 389ds) I'm running a Java application that keeps user authentication, permissions, and preferences in ldap. And I'm currently load testing this application (using Jmeter, 15 concurrent threads, no think time) and I'm getting really good performance most of the time. However every 5 minutes (from the time I started ldap), 389's CPU usage will spike to 375% (400% = all 4 processors at 100%, 389 normally sits around 15-20%). These pauses last for between 20 - 30 seconds (proportionate to the load I'm throwing at it) during which our application will just sit. Since I'm just running the same set of requests at it constantly, there isn't anything different in terms of our application during those times, which points to 389 as the culprit (or possibly some glassfish ldap pool problem). Some info: Glassfish 3.1 final on Java 1.6.0_26 (64 bit server VM) 389-Directory/1.2.9.10 B2011.250.1455 Fedora 15 64-bit (also observed on Centos 5.4 64-bit) Have any of you run into this problem? Do you have any possible config changes I could try? Any possible leads at all? Thanks, Justin

2 11

Certificate based authentication
by Gerhardus Geldenhuis 13 Oct '11

13 Oct '11

Hi I am looking at doing certifcate based authentication using 389. The company where I am working currently issues a certificate for every new starter and these certs are well managed with regards to sensible expiry dates etc. This cert is your key to the whole environment and a lot of the applications like jira/confluence authenticate you based on your certificate. I have read through the documentation: http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html/Adminis… and it seems to suggest that it is nessesary to convert the user certificate and upload it into 389 db. This seems a bit of a duplication. Is there anyway to "talk" to the certificate provider to ascertain the validity or not of a certificate and obtain any other required information, rather than having a copy of the certificate in the database. The documentation also does not say whether this is the public or private part of the certificate that needs to be uploaded. I am assuming it is the public part. The second part of the question is how would this work with regards to ssh authentication. Somehow via pam and ssh the certificate must be passed on to 389 when the authentication happens. I am not sure this is currently possible with pam but would be interested in any suggestions to achieve something like this. Regards -- Gerhardus Geldenhuis

3 5

sendmail LDAP routing
by Orion Poplawski 12 Oct '11

12 Oct '11

Looks like 389 doesn't by default have the LDAP Schema for Intranet Mail Routing schema defined which uses objectClass inetLocalMailRecipient. Any particular reason for this? Is there a more useful schema? -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA/CoRA Division FAX: 303-415-9702 3380 Mitchell Lane orion(a)cora.nwra.com Boulder, CO 80301 http://www.cora.nwra.com

2 2

389 Console & setup SSL with MMR
by Pieter Baele 12 Oct '11

12 Oct '11

Hi, I used 389 Directory Server in the past.... but it has been a long time... Problem 1: --------------- When I start 389-console on top of an ssh session with X, I can't use the input boxes... (solved by a local installation of 389-ds but...) Problem 2: --------------- I see for an easy setup of multimaster replication with SSL, I can still use setupssl2.sh and mmr.pl scripts :-) But what's the right order? After setup-ds-admin.pl I first ran setupssl2.sh and then I tried to setup mmr. I've this fault when I choose --with-ssl.... (replication without ssl works) [11/Oct/2011:13:15:51 +0200] slapi_ldap_bind - Error: could not send bind request for id [cn=repman,cn=config] mech [SIMPLE]: error -1 (Can't contact LDAP server) -8054 (You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.) 107 (Transport endpoint is not connected) (with the normal replication I also see netscapeRoot, not userRoot) Sincerely, PieterB

2 1

setting up ACLs
by Karoly Czovek 10 Oct '11

10 Oct '11

Hi there, i ran into a problem with the ACLs. I set up an account, what needed to acquire only certain attributes, i set the following ACL: (targetattr = "uid || mail || mailHost || accountType || accountStatus || mailAlternateAddress || mailForwardingAddress || mailUserPassword") (target = "ldap:///dc=moveone,dc=info") (targetfilter = ou=People) (version 3.0; acl "Email server can lookup some data"; allow (read,compare,search) (userdn = "ldap:///cn=emailServerLookup,ou=People,dc=moveone,dc=info") ;) but the search is gives back all the attributes, not only the allowed ones. What i am miss? the lookup: ldapsearch -x -LLL -h ds -b ou=People,dc=moveone,dc=info -D "cn=emailServerLookup,ou=People,dc=moveone,dc=info" -w TheSecretPassword uid=karoly.czovek dn: uid=karoly.czovek,ou=People,dc=moveone,dc=info -- Karoly CZOVEK Global Systems Administrator MoveOne IT Department Eastern Europe - Balkans - CIS& Central Asia - Middle East& Africa - Asia Pacific phone: +36 1 266 0181 - ext.6710 mobile: +36 70 708 9953 skype: mo_karoly.czovek email: karoly.czovek(a)moveoneinc.com web: http://www.moveoneinc.com

2 1

Best way to sync ldap and samba passwords
by David Hoskinson 07 Oct '11

07 Oct '11

I am trying to find out the best way to change my password using ldappaswd... and have it also update my samba passwd. From what I am understanding the ldap sync option in samba will do that, but we don't use samba as a domain controller, only as a file server. We change our passwords from command line in linux. Everything I am reading seems to point the opposite direction of what we want to do. Thanks. David Hoskinson | DATATRAK International Systems Engineer Mayfield Heights, Ohio, USA +1.440.443.0082 x 124 (p) | +1.216.280.5457 (m) david.hoskinson(a)datatrak.net<mailto:david.hoskinson@datatrak.net> | www.datatrak.net<http://www.datatrak.net/>

5 10

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users October 2011