August 2011 - 389-users - Fedora mailing-lists

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

Re: [389-users] Replication trouble when promoting dedicated Consumer to Multiple master [SOLVED]
by Roland Schwingel 19 Dec '11

19 Dec '11

Hi..... Finally I got it I don't know whether I did it the fully correct way, but it works now. I found that this mysterious replica id 3 was stored in dse.ldif of my server-b: To recap my scenario: server A < ----- server B <-----> server C -----> server D (dedicated Consumer) (multiple Master replica ID:1) (multiple Master replica ID:2) (Dedicated Consumer) I wanted to promote my server D to become a multiple master - but it did not work. What did I do to get it going: 1. Removed all replication agreements to/from server D. 2. Stopped all LDAP services on all servers (I was a little desperate) 3. Found replica id 3 in dse.ldif of server B(?) - nowhere else (why B and not C?) 4. Removed these bogus entries. 5. Restarted all LDAP services on all machines. 6. ldapsearch on server C still revealed the bogus replica id 3 (Where the heck is that cached?). 7. Reinitialized consumer server C from server B and restarted ldap on server C. 8. ldapsearch was clean by then. 9. removed my suffix on server D and removed changelog. 10. recreated suffix on server D and made server D a dedicated consumer 11. on server C created replication agreement to server D 12. initialized server D from server C. 13, Enabled changelog on server D 14. Changed server D to be Multiple Master with replica id 3 15, Created replication aggreement to server C from server D. 16. Worked. Restarted LDAP on server D and C. 17. Still works and replicates to all other machines along the path. 18. I need vacation.... Holy Moly! Roland __________________ Hi Reinhard, Thanks for your reply!! 389-users-bounces(a)lists.fedoraproject.org wrote on 14.07.2011 16:25:10: > From: Reinhard Nappert <rnappert(a)juniper.net> > To: "General discussion list for the 389 Directory server project." > <389-users(a)lists.fedoraproject.org> > Date: 14.07.2011 16:28 > Subject: Re: [389-users] Replication trouble when promoting > dedicated Consumer to Multiple master > Sent by: 389-users-bounces(a)lists.fedoraproject.org > > Do a ldapsearch -b 'nsuniqueid=ffffffff-ffffffff-ffffffff- > ffffffff,dc=mydomain,dc=com' -D <directory manager> -w <password> -s > base objectclass=nstombstone > > This gives you all the configured (history) of replication ids. The > following is the output in my setup. > > dn: nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,o=base > objectClass: top > objectClass: nsTombstone > objectClass: extensibleobject > nsds50ruv: {replicageneration} 4df7a107000000010000 > nsds50ruv: {replica 1 ldap://yale:389} 4df7a396000000010000 4e19ad950000000100 > 00 > nsds50ruv: {replica 3 ldap://norquay:389} 4df7a39d000000030000 4e1605650000000 > 30000 > nsds50ruv: {replica 4 ldap://mustrum:389} 4df7a3a0000000040000 4dfb93650000000 > 40000 > nsds50ruv: {replica 2 ldap://louise:389} 4df7a39a000000020000 4e171a0700000002 > 0000 > o: base > nsruvReplicaLastModified: {replica 1 ldap://yale:389} 00000000 > nsruvReplicaLastModified: {replica 3 ldap://norquay:389} 00000000 > nsruvReplicaLastModified: {replica 4 ldap://mustrum:389} 00000000 > nsruvReplicaLastModified: {replica 2 ldap://louise:389} 00000000 > /\ > | > replication-id > I issued that command on my server Server C. I get the following results: # extended LDIF # # LDAPv3 # base <nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,dc=mydomain,dc=com> with scope baseObject # filter: objectclass=nstombstone # requesting: ALL # # ffffffff-ffffffff-ffffffff-ffffffff, mydomain.com dn: nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff, dc=mydomain,dc=com objectClass: top objectClass: nsTombstone objectClass: extensibleobject nsds50ruv: {replicageneration} 4bf162c6000000010000 nsds50ruv: {replica 2 ldap://server-c.mydomain.com:389} 4cd3fa1e00000002 0000 4e1ef45b000000020000 nsds50ruv: {replica 3 ldap://server-d.mydomain.de:389} nsds50ruv: {replica 1 ldap://server-b.mydomain.de:389} 4bf16732000000010 000 4e1ffa3e000000010000 dc: mydomain nsruvReplicaLastModified: {replica 2 ldap://server-c.mydomain.com:389} 4 e1ef445 nsruvReplicaLastModified: {replica 3 ldap://server-d.mydomain.de:389} 00000000 nsruvReplicaLastModified: {replica 1 ldap://server-b.mydomain.de:389} 4e 1ffa26 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 When I look at it I see that replica id 3 is assigned to my server-d (which should get that replica id). I started over deleted my server-d assigned it replica id 4 but nothing changes. I also cannot get rid of the informations for server-d in that nsuniqueid how can I do that? Thanks, Roland

2 1

Views, Filtered roles and CoS
by Colin Panisset 06 Oct '11

06 Oct '11

I have a pretty flat DIT, with all users currently under ou=people,dc=example,dc=com; these user objects also have posixAccount attributes, of which loginShell is one. What I'm trying to achieve is to be able to set a "default" loginShell to be a restricted shell (/bin/rbash) for developers, but allow that to be a non-restricted shell on systems which are development hosts. As an example, on a production host I'd like: $ ldapsearch -x "(uid=devuser)" uid loginshell to return: dn: cn=Dev User,ou=People,dc=example,dc=com loginShell: /bin/rbash uid: devuser while on a development host, I'd like the same search to return dn: cn=Dev User,ou=People,dc=example,dc=com loginShell: /bin/bash uid: devuser I thought I might be able to achieve this by creating a view called ou=Developers,dc=example,dc=com and using that as a base DN on the development boxes, then applying a CoS within the view to override the loginShell attribute, but then the CoS ends up being applied to the original entry too. Is there any way that I could: - have a CoS apply based on client system attributes, like IP address/hostname? - have a CoS which applies to a view that *doesn't* affect the original object? - perhaps make use of cosPriority through two different views, so as to have ou=Development,... and ou=Production,... (but that would be answered by the previous option anyway)? Is there some other clever way to achieve what I'd like? I'd really like to avoid maintaining 2 separate DITs for the same set of users. -- C.

3 6

Announcing 389 Directory Server version 1.2.9.6 Testing
by Rich Megginson 04 Sep '11

04 Sep '11

The 389 Project team is pleased to announce the release of 389-ds-base-1.2.9.6. This release has fixes for bugs found in 1.2.9 testing and bugs from earlier releases. NEW: EL6 support Beginning with RHEL 6.1, the 389-ds-base package is included in the base OS. It is the same as the upstream, except that it has no replication nor windows sync functionality. That has been split off into a new channel - Enterprise Identity Replication - and a new package - ds-replication. Therefore, the 389-ds-base package can no longer be provided via EPEL, due to RHEL/EPEL packaging restrictions. However, the 389 Project will still make the full 389-ds-base package, including replication/winsync, available via http://repos.fedorapeople.org/repos/rmeggins/389-ds-base. See http://directory.fedoraproject.org/wiki/Download for more information. Installation yum install --enablerepo=updates-testing 389-ds # or for EPEL yum install --enablerepo=epel-testing [--enablerepo=epel-testing-389-ds-base] 389-ds setup-ds-admin.pl Upgrade yum upgrade --enablerepo=updates-testing 389-ds-base idm-console-framework 389-admin 389-ds-console 389-admin-console # or for EPEL yum upgrade --enablerepo=epel-testing [--enablerepo=epel-testing-389-ds-base] 389-ds-base idm-console-framework 389-admin 389-ds-console 389-admin-console setup-ds-admin.pl -u How to Give Feedback The best way to provide feedback is via the Fedora Update system. * Go to https://admin.fedoraproject.org/updates * In the Search box in the upper right hand corner, type in the name of the package * In the list, find the version and release you are using (if you're not sure, use rpm -qi <package name> on your system) and click on the release * On the page for the update, scroll down to "Add a comment" and provide your input Or just send us an email to 389-users(a)lists.fedoraproject.org Reporting Bugs If you find a bug, or would like to see a new feature, you can enter it here - https://bugzilla.redhat.com/enter_bug.cgi?product=389 More Information * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download

2 15

Re: [389-users] Setting up multi master replication error 81
by David Hoskinson 01 Sep '11

01 Sep '11

I was able to run this command on both machines with similar results. From server A I pointed the script at server A fqdn and server b fqdn and returned results. I then did the same thing on server b with both fqdn. It seems to me from what I am seeing is that the protocols are supported and correct and there is a possible "trust" issue going on here? [root@xxx ~]# /usr/lib64/mozldap/ldapsearch -h xxx.stag.cle.us -ZZZ -P /etc/dirsrv/slapd-xxx/cert8.db -s base -b "" "objectclass=*" version: 1 dn: objectClass: top namingContexts: dc=stag,dc=cle,dc=us supportedExtension: 2.16.840.1.113730.3.5.7 supportedExtension: 2.16.840.1.113730.3.5.8 supportedExtension: 2.16.840.1.113730.3.5.10 supportedExtension: 2.16.840.1.113730.3.5.3 supportedExtension: 2.16.840.1.113730.3.5.12 supportedExtension: 2.16.840.1.113730.3.5.5 supportedExtension: 2.16.840.1.113730.3.5.6 supportedExtension: 2.16.840.1.113730.3.5.9 supportedExtension: 2.16.840.1.113730.3.5.4 supportedExtension: 1.3.6.1.4.1.1466.20037 supportedExtension: 1.3.6.1.4.1.4203.1.11.1 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 2.16.840.1.113730.3.4.3 supportedControl: 2.16.840.1.113730.3.4.4 supportedControl: 2.16.840.1.113730.3.4.5 supportedControl: 1.2.840.113556.1.4.473 supportedControl: 2.16.840.1.113730.3.4.9 supportedControl: 2.16.840.1.113730.3.4.16 supportedControl: 2.16.840.1.113730.3.4.15 supportedControl: 2.16.840.1.113730.3.4.17 supportedControl: 2.16.840.1.113730.3.4.19 supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1 supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2 supportedControl: 1.2.840.113556.1.4.319 supportedControl: 1.3.6.1.4.1.4203.666.5.16 supportedControl: 2.16.840.1.113730.3.4.14 supportedControl: 2.16.840.1.113730.3.4.20 supportedControl: 1.3.6.1.4.1.1466.29539.12 supportedControl: 2.16.840.1.113730.3.4.12 supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.13 supportedSASLMechanisms: EXTERNAL supportedSASLMechanisms: PLAIN supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: LOGIN supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: ANONYMOUS supportedSASLMechanisms: DIGEST-MD5 supportedLDAPVersion: 2 supportedLDAPVersion: 3 vendorName: 389 Project vendorVersion: 389-Directory/1.2.8.3 B2011.122.1636 dataversion: 020110831163410 netscapemdsuffix: cn=ldap://dc=xxx,dc=stag,dc=cle,dc=us:389 David Hoskinson | DATATRAK International Systems Engineer Mayfield Heights, Ohio, USA +1.440.443.0082 x 124 (p) | +1.216.280.5457 (m) david.hoskinson(a)datatrak.net<mailto:david.hoskinson@datatrak.net> | www.datatrak.net<http://www.datatrak.net/>

2 9

Re: [389-users] Setting up multi master replication error 81
by David Hoskinson 31 Aug '11

31 Aug '11

I hope I have replied correctly this time. Yes I created the certs on both machines using this link: http://xilab.net/blog/389-directory-server-ssl walking through each step one at a time. As you see I created a Server-Cert and the serial number 1000,1001,1002 for both servers. I can understand if I should have put 1000,1001,1002 for 1 machine and 1100,1101,1102 for other machine. I followed the instructions on the link you sent me to delete existing cert and replace with my new one for server b which was exported from server a. This time I did not receive error messages when importing, however I still get the message 81 can't contact ldap server. Hope this information helps helps me understand how this works better as this is the last step. On 08/31/2011 09:12 AM, David Hoskinson wrote: This seems to be getting me somewhere.... Thanks for the quick response .... I have run the following commands on the master $ certutil -S -n "consumer-Cert" -s "cn=xxx.stag.cle.us" -c "CA certificate" -t "u,u,u" -m 999 -v 120 -d . -k rsa Do you have another cert (server cert or ca cert) with the same -m value? The value given to the -m argument must be unique for every cert. $ pk12util -d . -o consumer-cert.p12 -n Server-Cert And then copied consumer.p12 and cacert.asc to /tmp on server B When I tried to import the replication consumer cert into other 389 DS I receive the following error [root@xxx302 slapd-adm302]# pk12util -d . -i /tmp/consumer-cert.p12 Enter Password or Pin for "NSS Certificate DB": Enter Password or Pin for "NSS Certificate DB": Enter password for PKCS12 file: pk12util: using nickname: xxx.stag.cle.us pk12util: PKCS12 decode import bags failed: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert. From: Rich Megginson [mailto:rmeggins@redhat.com] Sent: Wednesday, August 31, 2011 10:51 AM To: General discussion list for the 389 Directory server project. Cc: David Hoskinson Subject: Re: [389-users] Setting up multi master replication error 81 On 08/31/2011 08:45 AM, David Hoskinson wrote: I have setup 2 servers running the following versions of 389 Directory server 389-adminutil-1.1.13-1.el5 389-admin-1.1.16-1.el5 389-dsgw-1.1.6-1.el5 389-ds-1.2.1-1.el5 389-ds-base-1.2.8.3-1.el5 389-admin-console-1.1.7-1.el5 389-console-1.1.4-1.el5 389-admin-console-doc-1.1.7-1.el5 389-ds-base-libs-1.2.8.3-1.el5 389-ds-console-1.2.5-1.el5 389-ds-console-doc-1.2.5-1.el5 I have also enabled ssl and created the appropriate certs for each machine. I am able to set each machine as a client so I can test that from server A, I can login to server A while being authenticated by server B and vice versa. The last problem that I seem to be having is setting up replication. I have enabled the changelog, created a replication account, and enabled replica. When I create my replication agreement on the userRoot, the supplier shows as server A port 389 and the consumer shows as server B 636. I am using Use TLS with ldaps, and simple bind with my replication account and password. I next leave enable fractional replication unchecked, always keep directories in sync and initialize consumer... this is on server A and done. I get the following error message. Consumer initialization has unsuccessfully completed. The error received by the replica is '81 - LDAP error: Can't contact LDAP server' I believe I am reading that in some manner the cacert.asc from server A has to be on server B and the cacert B has to be on server A Correct. http://directory.fedoraproject.org/wiki/Howto:SSL#Exporting_the_certs_for_u… but am not sure and having problems with this. Any help with this would be appreciated and can provide additional information if needed... David Hoskinson | DATATRAK International Systems Engineer Mayfield Heights, Ohio, USA +1.440.443.0082 x 124 (p) | +1.319.471.3689 (m) david.hoskinson(a)datatrak.net<mailto:david.hoskinson@datatrak.net> | www.datatrak.net<http://www.datatrak.net/> -- 389 users mailing list 389-users(a)lists.fedoraproject.org<mailto:389-users@lists.fedoraproject.org> https://admin.fedoraproject.org/mailman/listinfo/389-users David Hoskinson | DATATRAK International Systems Engineer Mayfield Heights, Ohio, USA +1.440.443.0082 x 124 (p) | +1.319.471.3689 (m) david.hoskinson(a)datatrak.net<mailto:david.hoskinson@datatrak.net> | www.datatrak.net<http://www.datatrak.net/>

2 1

Setting up multi master replication error 81
by David Hoskinson 31 Aug '11

31 Aug '11

I have setup 2 servers running the following versions of 389 Directory server 389-adminutil-1.1.13-1.el5 389-admin-1.1.16-1.el5 389-dsgw-1.1.6-1.el5 389-ds-1.2.1-1.el5 389-ds-base-1.2.8.3-1.el5 389-admin-console-1.1.7-1.el5 389-console-1.1.4-1.el5 389-admin-console-doc-1.1.7-1.el5 389-ds-base-libs-1.2.8.3-1.el5 389-ds-console-1.2.5-1.el5 389-ds-console-doc-1.2.5-1.el5 I have also enabled ssl and created the appropriate certs for each machine. I am able to set each machine as a client so I can test that from server A, I can login to server A while being authenticated by server B and vice versa. The last problem that I seem to be having is setting up replication. I have enabled the changelog, created a replication account, and enabled replica. When I create my replication agreement on the userRoot, the supplier shows as server A port 389 and the consumer shows as server B 636. I am using Use TLS with ldaps, and simple bind with my replication account and password. I next leave enable fractional replication unchecked, always keep directories in sync and initialize consumer... this is on server A and done. I get the following error message. Consumer initialization has unsuccessfully completed. The error received by the replica is '81 - LDAP error: Can't contact LDAP server' I believe I am reading that in some manner the cacert.asc from server A has to be on server B and the cacert B has to be on server A but am not sure and having problems with this. Any help with this would be appreciated and can provide additional information if needed... David Hoskinson | DATATRAK International Systems Engineer Mayfield Heights, Ohio, USA +1.440.443.0082 x 124 (p) | +1.319.471.3689 (m) david.hoskinson(a)datatrak.net<mailto:david.hoskinson@datatrak.net> | www.datatrak.net<http://www.datatrak.net/>

2 1

PAM Pass Through- PAM succeeds but 389 fails?
by Sam Harmon 30 Aug '11

30 Aug '11

Hello, I'm trying to configure a 389 instance to pass authentication to our Kerberos server using the PAM Pass Through plugin. As far as I can tell, the authentication is happening correctly in PAM, but it's getting refused by the 389 server. I've included the relevant configurations and some log file snippets of an example authentication. Has anyone seen a problem like this before? Do I have a problem in my configuration? Thanks, Sam My pass through auth config from dse.ldif: dn: cn=PAM Pass Through Auth,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject objectClass: pamConfig cn: PAM Pass Through Auth nsslapd-pluginPath: libpam-passthru-plugin nsslapd-pluginInitfunc: pam_passthruauth_init nsslapd-pluginType: preoperation nsslapd-pluginEnabled: on nsslapd-pluginloadglobal: true nsslapd-plugin-depends-on-type: database pamMissingSuffix: ALLOW pamIncludeSuffix: o=isp pamExcludeSuffix: cn=config pamIDMapMethod: RDN pamIDAttr: notUsedWithRDNMethod pamFallback: TRUE pamSecure: FALSE pamService: ldapserver nsslapd-pluginId: pam_passthruauth nsslapd-pluginVersion: 1.2.2 nsslapd-pluginVendor: 389 Project nsslapd-pluginDescription: PAM pass through authentication plugin Here is the PAM configuration file I'm using (/etc/pam.d/ldapserver): auth sufficient /lib64/security/pam_krb5.so force_first_pass forwardable debug no_user_check ignore_k5login no_initial_prompt password sufficient /lib64/security/pam_krb5.so use_authtok session optional /lib64/security/pam_krb5.so Here's the PAM log from an attempted authentication: Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: configured realm 'INS.CWRU.EDU' Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: flags: forwardable Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: flag: no ignore_afs Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: flag: no krb4_convert Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: flag: krb4_convert_524 Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: flag: krb4_use_as_req Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: will try previously set password first Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: will let libkrb5 ask questions Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: flag: no use_shmem Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: flag: no external Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: flag: no multiple_ccaches Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: flag: validate Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: flag: warn Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: ticket lifetime: 0 Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: renewable lifetime: 0 Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: banner: Kerberos 5 Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: ccache dir: /tmp Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: keytab: FILE:/etc/krb5.keytab Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: called to authenticate 'sdh7', realm 'INS.CWRU.EDU' Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: authenticating 'sdh7(a)INS.CWRU.EDU' Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: not using an entered password for 'sdh7', allowing libkrb5 to prompt for more Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: authenticating 'sdh7(a)INS.CWRU.EDU' to 'krbtgt/INS.CWRU.EDU(a)INS.CWRU.EDU' Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: libkrb5 asked for long-term password, replacing prompt text with generic prompt Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: krb5_get_init_creds_password(krbtgt/INS.CWRU.EDU(a)INS.CWRU.EDU) returned 0 (Success) Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: validating credentials Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: error reading keytab 'FILE:/etc/krb5.keytab' Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: TGT verified Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: got result 0 (Success) Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: authentication succeeds for 'sdh7' (sdh7(a)INS.CWRU.EDU) Aug 30 12:55:44 its-srv-ksl-1 ns-slapd: pam_krb5[23742]: pam_authenticate returning 0 (Success) And here is the 389 error log from the same auth: [30/Aug/2011:12:55:44 -0400] pam_passthru-plugin - => pam_passthru_bindpreop [30/Aug/2011:12:55:44 -0400] pam_passthru-plugin - pam msg [0] = 1 Password: [30/Aug/2011:12:55:44 -0400] pam_passthru-plugin - Error from PAM during pam_acct_mgmt (7: Authentication failure) [30/Aug/2011:12:55:44 -0400] pam_passthru-plugin - Invalid PAM password for user id [sdh7], bind DN [uid=sdh7,ou=pe ople,o=cwru.edu,o=isp][30/Aug/2011:12:55:44 -0400] pam_passthru-plugin - <= handled (error 49 - Invalid credentials) [30/Aug/2011:12:55:44 -0400] passthru-plugin - => passthru_bindpreop[30/Aug/2011:12:55:44 -0400] passthru-plugin - <= not handled (not one of our suffixes)

3 3

force MAC LDAP client to comply Linux LDAP server's password policy
by Shouben Zhou 29 Aug '11

29 Aug '11

Does anybody how to configure MAC OS LDAP client to comply the password policy (expiration time) against Linux LDAP server? -- -- Shouben Zhou Science Systems and Applications Inc.(SSAI) 1 Enterprise Pkwy, Hampton, VA 23666 Tel: (757)951-1905 Fax: (757)951-1900 Email: Shouben.Zhou(a)nasa.gov

1 0

too many fds open
by Martin Stiborský 26 Aug '11

26 Aug '11

Hello, I'd like to ask you here for help with problem with 389 Fedora LDAP. Our LDAP fail every day, because of "too many fds open" problem, as is logged in log file… I've found many posts about it on internet (this is one seems to be useful http://www.linuxquestions.org/questions/linux-enterprise-47/fedora-director…) but still the problem is there even after raise of few limits. When the ldap failed, I checked number of created "fd" by dirsrv process with ls -l /proc/$DIRSRV_PID/fd | wc -l and it was about ~1000 files, so probably some limit in system is still in use (fds per process or user??). Please, could you give me a hint? Thanks a lot! -- S pozdravem Martin Stiborský Jabber: stibi(a)njs.netlab.cz

4 4

AUTO: Out Of The Office (returning Tue 09/06/2011)
by Herbert S McWhorter 26 Aug '11

26 Aug '11

I am out of the office from Fri 08/26/2011 until Tue 09/06/2011. In the event that you need to contact me, please call or text 303.895.9937. Thank you, Herb McWhorter Note: This is an automated response to your message "[389-users] too many fds open" sent on 8/26/11 1:11:49. This is the only notification you will receive while this person is away.

1 0

Microsoft Windows Password Sync?
by Craig T 25 Aug '11

25 Aug '11

Hi, Setup: Fedora 15 x64 * 389-admin-1.1.16-1.fc15.x86_64 * 389-admin-console-1.1.7-2.fc15.noarch * 389-admin-console-doc-1.1.7-2.fc15.noarch * 389-adminutil-1.1.13-2.fc15.x86_64 * 389-console-1.1.4-2.fc15.noarch * 389-ds-base-1.2.8.3-1.fc15.x86_64 * 389-ds-base-libs-1.2.8.3-1.fc15.x86_64 * 389-ds-console-1.2.5-1.fc15.noarch * 389-ds-console-doc-1.2.5-1.fc15.noarch Windows 2008 R2 x64 * Microsoft Active Directory * Windows Password Sync v1.1.4 x64 I'm just attempting to setup 389 Directory Server password sync to Microsoft Active Directory. I have managed to get successfull user account (ldap info) sync without passwords, it's just the .msi password sync program that I'm having issues with. Error from passsync.log: 08/25/11 14:46:43: PassSync service initialized 08/25/11 14:46:43: PassSync service running 08/25/11 14:46:44: Error initializing SSL: err=-8174 08/25/11 14:46:44: Ensure that your SSL is setup correctly 08/25/11 14:46:58: PassSync service stopped Anyone know how I can add debugging to the windows app? or ideas on what a -8174 error means? I thought SSL was setup correctly on the directory server (it certainly responds to a telnet <port 636>, again debugging on the windows side would be ideal. cya Craig

2 2

fedora-idm-console is not working after ssl enabled
by s.varadha rajan 24 Aug '11

24 Aug '11

Hi, I have configured ssl settings as per the redhat official doc( http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html/Adminis… ). There is no issues with Directory server.after enabling ssl settings in the Admin server and after restarted the admin server, i tried to login with https://localhost:9830.it's not at all logging and in the Terminal throws the below error. Exception in thread "main" java.lang.UnsatisfiedLinkError: no jss4 in java.library.path at java.lang.ClassLoader.loadLibrary(ClassLoader.java:1681) at java.lang.Runtime.loadLibrary0(Runtime.java:840) at java.lang.System.loadLibrary(System.java:1047) at org.mozilla.jss.CryptoManager.loadNativeLibraries(CryptoManager.java:1339) at org.mozilla.jss.CryptoManager.initialize(CryptoManager.java:827) at org.mozilla.jss.CryptoManager.initialize(CryptoManager.java:800) at com.netscape.management.client.util.UtilConsoleGlobals.initJSS(Unknown Source) at com.netscape.management.client.comm.HttpsChannel.<clinit>(Unknown Source) at com.netscape.management.client.comm.HttpManager.createChannel(Unknown Source) at com.netscape.management.client.comm.CommManager.send(Unknown Source) at com.netscape.management.client.comm.CommManager.send(Unknown Source) at com.netscape.management.client.comm.HttpManager.get(Unknown Source) at com.netscape.management.client.console.Console.invoke_task(Unknown Source) at com.netscape.management.client.console.Console.authenticate_user(Unknown Source) at com.netscape.management.client.console.Console.<init>(Unknown Source) at com.netscape.management.client.console.Console.main(Unknown Source) Please let me know the solution for this issue ? Regards, Varad

4 5

Failure while Copy a subtree (deleteOldRdn: 0)
by Roberto Polli 23 Aug '11

23 Aug '11

Hi all, I'm playing with the changeType: modrdn command, and I got the following issue. 1- I want to copy a subtree in another location: source: ou=People,dc=top dest: ou=PeopleBak,dc=top 2- I can move it with changeType: modrdn newrdn: ou=PeopleBak deleteoldrdn: 0 3- I would expect that "deleteOldRdn:0" would leave the old "ou=People" at its place. While "deleteOldRdn: 1" should remove it. Do you have any hint? Peace, R. -- Roberto Polli Project Manager Babel S.r.l. - http://www.babel.it T: +39.06.9826.9651 M: +39.340.6522736 F: +39.06.9826.9680 P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma) CONFIDENZIALE: Questo messaggio ed i suoi allegati sono di carattere confidenziale per i destinatari in indirizzo. E' vietato l'inoltro non autorizzato a destinatari diversi da quelli indicati nel messaggio originale. Se ricevuto per errore, l'uso del contenuto e' proibito; si prega di comunicarlo al mittente e cancellarlo immediatamente.

2 1

Recover Management Console Password
by Brant Hohnstein 22 Aug '11

22 Aug '11

Is there a procedure (however cumbersome) to reset the Management Console (admin) password if the password is not currently known? I changed the admin password in the Console GUI (domainName/ldapservername/ServerGroup/Administration Server/Configure Admin Server/Access(tab). I must have typed the password wrong twice because it accepted it. Now I can't seem to type the password "wrong" in the same way to get into the Management Console. I have tried shutting down the Admin Server and copying in a /etc/dirsrv/admin-serv/admpw file from a different 389 server where I do know the password. After restarting and typing in the known password, I get an error about not being able to contact the directory server. I have also searched for a password recovery procedure without success. Any helpful suggestions would be appreciated. Brant Hohnstein System Administrator Return Path, Inc. 8001 Arista Place, Suite 300 Broomfield, CO 80021 brant.hohnstein(a)returnpath.net +1 303-999-3233

4 4

Is 1.2.9.5 stable?
by Diego Woitasen 16 Aug '11

16 Aug '11

Hi, I saw that there is a 1.2.9.5 version in the source repository. Is this version stable? Because it hasn't been announced. Regards, Diego -- Diego Woitasen

2 3

Re: [389-users] duplicate replica id detected - can I remove replicas?
by Rich Megginson 12 Aug '11

12 Aug '11

On 08/10/2011 11:00 PM, Amos Shapira wrote: > Some more research after I sent my question (narrower search terms) > found the following bug and fix: > > https://bugzilla.redhat.com/show_bug.cgi?id=624442 > > The package I use is centos-ds-base-8.1.0-0.14.el5.centos.2 > > Does this mean that this is a bug in the package I have and I should > just use different replication id's? > Or can I still somehow clear the tombstones? You might be able to use db2ldif -r to dump the database along with the replication meta data, then edit the LDIF file to remove the bogus data, then ldif2db to reload your database from the LDIF file. > > Thanks, > > --Amos > > On 11 August 2011 14:55, <389-users-owner(a)lists.fedoraproject.org > <mailto:389-users-owner@lists.fedoraproject.org>> wrote: > > You are not allowed to post to this mailing list, and your message has > been automatically rejected. If you think that your messages are > being rejected in error, contact the mailing list owner at > 389-users-owner(a)lists.fedoraproject.org > <mailto:389-users-owner@lists.fedoraproject.org>. > > > > ---------- Forwarded message ---------- > From: Amos Shapira <amos.shapira(a)gmail.com > <mailto:amos.shapira@gmail.com>> > To: "General discussion list for the 389 Directory server > project." <389-users(a)lists.fedoraproject.org > <mailto:389-users@lists.fedoraproject.org>> > Date: Thu, 11 Aug 2011 14:55:08 +1000 > Subject: duplicate replica id detected - can I remove replicas? > Hello, > > I've deleted old replication agreements and setup new ones as part > of server reshuffling (previous consumers turned into multi-masters). > > I'm following the instructions in > http://directory.fedoraproject.org/wiki/Howto:WalkthroughMultimasterSSL > which look like a shorter summary of the official documentation. > > When I finally click on the "Inisitalize consumer" I get a pop-up > about duplicate replicas existing. > > The replica numbers on the servers are "4" (on the supplier I > intend to initialise from) and "3" (on the intended consumer). > > I followed instructions given in this forum earlier to list > replicas on both servers and these are the results: > > # ./ldapsearch -x -b > 'nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,dc=company' -D > 'cn=Directory Manager' -w ******* -h cunsumers-ip-addr -s base > objectclass=nstombstone > version: 1 > dn: nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,dc=company > objectClass: top > objectClass: nsTombstone > objectClass: extensibleobject > nsds50ruv: {replicageneration} 4a679e1c000000010000 > nsds50ruv: {replica 3 ldap://directory2:389 > } > nsds50ruv: {replica 1 ldap://directory5:389} 4a679ebf000000010000 > 4e30ce4e000200010000 > nsds50ruv: {replica 65535 ldap://directory2:389} > 4e323b300000ffff0000 4e4026ef0000ffff0000 > dc: company > nsruvReplicaLastModified: {replica 3 ldap://directory2:389} 00000000 > nsruvReplicaLastModified: {replica 1 ldap://directory5:389} 000000 > 00 > nsruvReplicaLastModified: {replica 65535 ldap://directory2:389} > 4e4026d9 > > # ./ldapsearch -x -b > 'nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,dc=company' -D > 'cn=Directory Manager' -w ******** -s base objectclass=nstombstone > version: 1 > dn: nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,dc=company > objectClass: top > objectClass: nsTombstone > objectClass: extensibleobject > nsds50ruv: {replicageneration} 4a679e1c000000010000 > nsds50ruv: {replica 3 ldap://directory2:389} > nsds50ruv: {replica 1 ldap://directory5:389} 4a679ebf000000010000 > 4e30ce4e000200010000 > nsds50ruv: {replica 65535 ldap://directory2:389} 4e4026ef0000ffff0000 > dc: company > nsruvReplicaLastModified: {replica 3 ldap://directory2:389} 00000000 > nsruvReplicaLastModified: {replica 1 ldap://directory5:389} 4e30ce > 27 > nsruvReplicaLastModified: {replica 65535 ldap://directory2:389} > 4e4026da > > directory1 is the server I'm running the query on and is the > intended initialising supplier. > directory2 is the server I'm trying to initialize. > directory1 and directory2 are the servers I intend to be the new > multi-masters. I configured them to use LDAPS on port 636 with > certificates. > directory5 is one of the two older multi-masters (the old > multi-masters haven't been configured corretly, I guess that's why > we don't see a second replica from the old multi-master pair). > > Is there a way for me to remove the old replicas or must I just > pick new replica numbers for the new multi-masters? > > In case this matters - I'm configuring things through a > centos-idm-console which I copied to my Ubuntu desktop in another > location and accessing the DC over VPN. I have direct access from > my desktop to ports 636 and 389 on both servers. When I setup the > replication agreement the console complains that it can't validate > the connection but I suspect this is related to it not having > access to the cert8.db file > (https://bugzilla.redhat.com/show_bug.cgi?id=200989) > > Thanks, > > --Amos > >

2 2

Existing certificate error
by s.varadha rajan 09 Aug '11

09 Aug '11

Hi, We are planning to configure ssl enabled Fedora directory server.we have a proper signed certificate.while importing, it is asking "Enter the password to access the Token" ? like that. even though we have given the exact password, while creating the certificate but it is not working. I referred wiki fedora doc also but getting this error. How to use existing certificate and enable secure ldap server. I have already posted the same question but nobody is reply Regards, Varad

4 7

Centos 6?
by Brett Dikeman 09 Aug '11

09 Aug '11

Greetings, I'm trying to install 389 on Centos 6, following this: http://directory.fedoraproject.org/wiki/Install_Guide#New_Install The guide makes it out to be as simple as "configure EPEL, then execute yum install 389-ds". Instead, the install dies with yum not able to find a dozen or two dependencies, all of them perl, it looks like: -perl(Setup) -perl (Mozilla::LDAP::Utils) -perl(Resource) ...and so on (Dialog, DSMigration, Migration, DSUpdate etc.) I've tried both EPEL release, and EPEL testing. I can't seem to find anyone else complaining about these issues, so I'm guessing I'm missing something. Any suggestions? Thanks! Brett

11 29

Re: [389-users] Crashing
by Wendt, Trevor 08 Aug '11

08 Aug '11

*resending with message truncated, hit message size max* Hello Rich, Still fails when run from within the server directory: ====================================================================== [root@ server]# pwd /opt/fedora-ds/bin/slapd/server [root@ server]# gdb ./ns-slapd ../../../slapd/logs/core.5916 Reading symbols from /opt/fedora-ds/bin/slapd/server/ns-slapd...(no debugging symbols found)...done. [New Thread 5972] ...additional threads... warning: .dynamic section for "/usr/lib/libstdc++.so.6" is not at the expected address warning: difference appears to be caused by prelink, adjusting expectations warning: .dynamic section for "/lib/libm.so.6" is not at the expected address warning: difference appears to be caused by prelink, adjusting expectations warning: .dynamic section for "/lib/libresolv.so.2" is not at the expected address warning: difference appears to be caused by prelink, adjusting expectations Reading symbols from ./libslapd.so...(no debugging symbols found)...done. Loaded symbols for ./libslapd.so Reading symbols from ../lib/libssl3.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libssl3.so Reading symbols from ../lib/libnss3.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libnss3.so Reading symbols from ../lib/libsoftokn3.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libsoftokn3.so Reading symbols from ../lib/libssldap60.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libssldap60.so Reading symbols from ../lib/libldap60.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libldap60.so Reading symbols from ../lib/libprldap60.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libprldap60.so Reading symbols from ../lib/libplc4.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libplc4.so Reading symbols from ../lib/libplds4.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libplds4.so Reading symbols from ../lib/libnspr4.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libnspr4.so Reading symbols from /lib/libdl.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libdl.so.2 Reading symbols from /usr/lib/libsasl2.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libsasl2.so.2 Reading symbols from /lib/libcrypt.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libcrypt.so.1 Reading symbols from /lib/libpthread.so.0...(no debugging symbols found)...done. [Thread debugging using libthread_db enabled] Loaded symbols for /lib/libpthread.so.0 Reading symbols from ./libdb-4.2.so...(no debugging symbols found)...done. Loaded symbols for ./libdb-4.2.so Reading symbols from /usr/lib/libstdc++.so.6...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libstdc++.so.6 Reading symbols from /lib/libm.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libm.so.6 Reading symbols from /lib/libgcc_s.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libgcc_s.so.1 Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libresolv.so.2 Reading symbols from /lib/libnss_files.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libnss_files.so.2 Reading symbols from /usr/lib/sasl2/liblogin.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/sasl2/liblogin.so.2 Reading symbols from /usr/lib/sasl2/libsasldb.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/sasl2/libsasldb.so.2 Reading symbols from /usr/lib/sasl2/libplain.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/sasl2/libplain.so.2 Reading symbols from /usr/lib/sasl2/libanonymous.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/sasl2/libanonymous.so.2 Reading symbols from /opt/fedora-ds/lib/syntax-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/syntax-plugin.so Reading symbols from /opt/fedora-ds/lib/liblcoll.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/liblcoll.so Reading symbols from ../lib/libicui18n.so.34...(no debugging symbols found)...done. Loaded symbols for ../lib/libicui18n.so.34 Reading symbols from ../lib/libicuuc.so.34...(no debugging symbols found)...done. Loaded symbols for ../lib/libicuuc.so.34 Reading symbols from ../lib/libicudata.so.34...(no debugging symbols found)...done. Loaded symbols for ../lib/libicudata.so.34 Reading symbols from /opt/fedora-ds/lib/pwdstorage-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/pwdstorage-plugin.so Reading symbols from /opt/fedora-ds/lib/des-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/des-plugin.so Reading symbols from /opt/fedora-ds/lib/attr-unique-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/attr-unique-plugin.so Reading symbols from /opt/fedora-ds/lib/acl-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/acl-plugin.so Reading symbols from ../lib/libns-dshttpd10.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libns-dshttpd10.so Reading symbols from /opt/fedora-ds/lib/chainingdb-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/chainingdb-plugin.so Reading symbols from /opt/fedora-ds/lib/cos-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/cos-plugin.so Reading symbols from /opt/fedora-ds/lib/http-client-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/http-client-plugin.so Reading symbols from /opt/fedora-ds/lib/libback-ldbm.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/libback-ldbm.so Reading symbols from /opt/fedora-ds/lib/replication-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/replication-plugin.so Reading symbols from /opt/fedora-ds/lib/passthru-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/passthru-plugin.so Reading symbols from /opt/fedora-ds/lib/referint-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/referint-plugin.so Reading symbols from /opt/fedora-ds/lib/retrocl-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/retrocl-plugin.so Reading symbols from /opt/fedora-ds/lib/roles-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/roles-plugin.so Reading symbols from /opt/fedora-ds/lib/statechange-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/statechange-plugin.so Reading symbols from /opt/fedora-ds/lib/views-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/views-plugin.so Reading symbols from ../lib/libfreebl3.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libfreebl3.so Reading symbols from /opt/fedora-ds/alias/libnssckbi.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/alias/libnssckbi.so Core was generated by `./ns-slapd -D /opt/fedora-ds/slapd -i /opt/fedora-ds/slapd/logs/pid -w'. Program terminated with signal 11, Segmentation fault. #0 0x00f3b80c in slapi_sdn_get_ndn () from ./libslapd.so (gdb) ====================================================================== Access log snippet: ====================================================================== [08/Aug/2011:13:39:59 -0500] conn=4244 fd=68 slot=68 connection from 10.1.20.15 to 10.1.25.67 [08/Aug/2011:13:39:59 -0500] conn=4153 op=14 EXT oid="2.16.840.1.113730.3.5.3" name="Netscape Replication Start Session" [08/Aug/2011:13:39:59 -0500] conn=4153 op=14 RESULT err=0 tag=120 nentries=0 etime=0 [08/Aug/2011:13:39:59 -0500] conn=4244 op=0 BIND dn="uid=Manager,dc=our_dc,dc=com" method=128 version=3 [08/Aug/2011:13:39:59 -0500] conn=4244 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=manager,dc=our_dc,dc=com" [08/Aug/2011:13:39:59 -0500] conn=4153 op=15 ADD dn="uid=user1,ou=users,ou=external,dc=our_dc,dc=com" [08/Aug/2011:13:39:59 -0500] conn=4245 fd=70 slot=70 connection from 10.1.20.15 to 10.1.25.67 [08/Aug/2011:13:39:59 -0500] conn=4245 op=0 BIND dn="uid=user1,ou=users,ou=external,dc=our_dc,dc=com" method=128 version=3 **** CRASH **** [08/Aug/2011:13:40:48 -0500] conn=0 fd=64 slot=64 connection from 10.1.25.1 to 10.1.25.67 [08/Aug/2011:13:40:49 -0500] conn=0 op=0 BIND dn="" method=128 version=2 [08/Aug/2011:13:40:49 -0500] conn=0 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [08/Aug/2011:13:40:49 -0500] conn=0 op=1 UNBIND [08/Aug/2011:13:40:49 -0500] conn=0 op=1 fd=64 closed - U1 [08/Aug/2011:13:40:50 -0500] conn=1 fd=64 slot=64 connection from 10.1.20.15 to 10.1.25.67 [08/Aug/2011:13:40:50 -0500] conn=1 op=0 BIND dn="uid=Manager,dc=our_dc,dc=com" method=128 version=3 [08/Aug/2011:13:40:50 -0500] conn=1 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=manager,dc=our_dc,dc=com" [08/Aug/2011:13:40:50 -0500] conn=1 op=1 SRCH base="uid=user2,ou=users,ou=external,dc=our_dc,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL [08/Aug/2011:13:40:50 -0500] conn=1 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [08/Aug/2011:13:40:50 -0500] conn=1 op=2 UNBIND ====================================================================== Logging is set as "nslapd-errorlog-level" is set to "8200" - not sure where I found that number at, the wiki shows 8192. What should I be using or just capture everything? Thanks! ________________________________ This electronic message transmission contains information from Black Hills Corporation, its affiliate or subsidiary, which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, be aware the disclosure, copying, distribution or use of the contents of this information is prohibited. If you received this electronic transmission in error, please reply to sender immediately; then delete this message without copying it or further reading.

2 3

Crashing
by Wendt, Trevor 08 Aug '11

08 Aug '11

Hello all, Need some help with tuning and crash debugging. We're running Fedora-Directory/1.0.4 B2006.312.1539. The problem is on our "Dedicated Consumer" machine running on RHEL 5. We have over ~150,000 users authenticating against our FDS systems. System resources are not a problem (~.39 load, free memory, 92k swap) For months, the system is solid without any issues then we seem to get a large spike in traffic and FDS crashes. I run Monit so the service is restarted automatically but I cannot figure out why the service keeps crashing. FDS was setup and tuned based off: http://directory.fedoraproject.org/wiki/Performance_Tuning#Linux I have reviewed http://directory.fedoraproject.org/wiki/FAQ#Debugging_Crashes as well, but some of that is over my head. I have turned buffering off and increased the logging level in the LDAP config. Here is our "monitor" script output: version: 1 dn: cn=monitor objectClass: top objectClass: extensibleObject cn: monitor version: Fedora-Directory/1.0.4 B2006.312.1539 threads: 30 currentconnections: 19 totalconnections: 11918 dtablesize: 8192 readwaiters: 0 opsinitiated: 43703 opscompleted: 43702 entriessent: 16086 bytessent: 2911011 currenttime: 20110805164243Z starttime: 20110805114053Z nbackends: 2 Here is our "Access Log Analyzer" summary for a 24 hour period: --------------------------------------------------------------- Access Log Analyzer 6.0 Filename Total Lines Lines processed --------------------------------------------------------------- /opt/fedora-ds/slapd/logs/access 298225 298231 ----------- Access Log Output ------------ Restarts: 6 Total Connections: 39720 Peak Concurrent Connections: 84 Total Operations: 95471 Total Results: 95393 Overall Performance: 99.9% Searches: 48215 Modifications: 167 Adds: 551 Deletes: 2 Mod RDNs: 0 6.x Stats Persistent Searches: 0 Internal Operations: 0 Entry Operations: 0 Extended Operations: 845 Abandoned Requests: 0 Smart Referrals Received: 0 VLV Operations: 0 VLV Unindexed Searches: 0 SORT Operations: 0 SSL Connections: 0 Entire Search Base Queries: 0 Unindexed Searches: 6 FDs Taken: 39720 FDs Returned: 39657 Highest FD Taken: 93 Broken Pipes: 0 Connections Reset By Peer: 0 Resource Unavailable: 10872 - 10872 (T1) Idle Timeout Exceeded Binds: 45691 Unbinds: 27987 LDAP v2 Binds: 15694 LDAP v3 Binds: 29997 SSL Client Binds: 0 Failed SSL Client Binds: 0 SASL Binds: 0 Directory Manager Binds: 0 Anonymous Binds: 16346 Other Binds: 29345 --------------------------------------------------------------- In FDS console: -- Configuration > Performance tab: Size Limit: 2000, Time Limit: 3600, Idle Timeout: 60, Max file descriptors: 8192. -- Configuration > Data > Database Link Settings > Connection Management: Max TCP Connections: 10, Bind timeout: 20, Max binds per connection: 20, Timeout before abandon: 10, Max LDAP Connections: 20, Max bind retries: 3, Max operations per connection: 5, connection life: 60. We have talked about moving to the latest 389 Directory packages and I have a migration process tested out so it's a matter of getting the OK and time but I doubt the upgrade will solve our crashing problem. It seems to me we are hitting some limits that just haven't been accounted for yet and that is where I need help. Any suggestions on how to proceed with stopping these crashes is welcomed! Thanks for reading. Trevor ________________________________ This electronic message transmission contains information from Black Hills Corporation, its affiliate or subsidiary, which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, be aware the disclosure, copying, distribution or use of the contents of this information is prohibited. If you received this electronic transmission in error, please reply to sender immediately; then delete this message without copying it or further reading.

2 3

LDAPCon 2011 Call for Papers
by Peter Gietz 08 Aug '11

08 Aug '11

With the usual apologies. The 3rd Edition of the International Conference on LDAP (LDAPCon 2011[1]) will be held on October, 10-11, 2011 in Heidelberg, Germany. A Call For Papers[2] has been raised and the Program Committee asks you to submit abstracts by July 8th. The International Conference on LDAP is a technical forum for IT professionals interested in LDAP and related topics like directory servers, directory management applications, directory integration, identity and access management, and meta directories. It focuses on implementation and integration of LDAP servers and LDAP-enabled client applications. The event will bring together vendors, developers, active and prospective LDAP practitioners to share their experiences about deployment strategies, service operations, interoperability, discuss LDAP usage in new projects and learn about upcoming trends and developments. The 1st LDAPCon[3] was held in September 2007 in Germany, the 2nd LDAPCon[4] was held in September 2009 in Portland, Oregon, USA (Some pictures from LDAPCon 2007 [5] and a nice summary of LDAPCon 2009 [6]) So if you're involved with LDAP in interesting projects and you want to share your experiences, please check the Call For Papers and submit a proposal. Best, Peter [1]: http://www.ldapcon.org [2]: http://www.daasi.de/ldapcon2011/index.php?site=cfp [3]: http://www.guug.de/veranstaltungen/ldapcon2007/index.html [4]: http://www.symas.com/ldapcon2009 [5]: http://www.flickr.com/photos/ludovic_p/sets/72157601937159198/detail/ [6]: http://blogs.sun.com/Ludo/entry/ldapcon_2009_summary -- _______________________________________________________________________ Peter Gietz (CEO) DAASI International GmbH phone: +49 7071 407109-0 Europaplatz 3 Fax: +49 7071 407109-9 D-72074 Tübingen mail: peter.gietz(a)daasi.de Germany Web: www.daasi.de DAASI International GmbH, Tübingen Geschäftsführer Peter Gietz, Amtsgericht Stuttgart HRB 382175 Directory Applications for Advanced Security and Information Management _______________________________________________________________________

1 2

389-DS vs windows 2008 - Replication
by Édnei 08 Aug '11

08 Aug '11

Hello Guys. My doubt is the certificates. How to create the certificates correctly ? I follow this guide: http://www.linuxmail.info/install-ssl-certificate-fds/ and this http://www.linuxmail.info/389-directory-active-directory-ssl-synch/ But i have the same error: LDAP erro 81 - Peer's Certificate issuer is not recognized I believe that i am failing to create the certificates and submit it to the 389-ds. Can anyone point me somewhere where I could find a solution ? Thanks in advance for any return, Édnei.

2 1

xinetd app LDAP errors when LDAP server is down for non-LDAP user
by James Smallacombe 05 Aug '11

05 Aug '11

We're having a pretty severe issue of a server/client app that is running out of xinetd generating nss_ldap errors when the primary LDAP server is down. The thing is, the user that this application (nagios nrpe) runs as exists in every host's /etc/passwd (and group) file and NOT in the Directory Server, just for this reason. I am wondering if this is a pam issue, but I admit I do not know to what extent that service users consult pam. Here is the error: Aug 2 12:03:18 host01 xinetd[32012]: nss_ldap: failed to bind to LDAP server ldap://ldap_1.domain/: Can't contact LDAP server Aug 2 12:03:18 host01 xinetd[32012]: nss_ldap: reconnected to LDAP server ldap://ldap_2.domain/ Aug 2 12:03:18 host01 nrpe[32012]: Error: Could not complete SSL handshake.5 Again /etc/xinetd.d/nrpe is configured to run this client as a user that exists in local auth, not LDAP. Why would it need to contact the LDAP server at all? We do not use LDAP for name resolution, that is all done in DNS and /etc/resolv.conf. We ONLY use it for user authentication. We used authconfig to set this up on the clients. I am wondering if the PAM stack in /etc/pam.d/system-auth, which gets modified by authconfig for LDAP has anything to do with it. The one thing that caught my eye was this: account required pam_unix.so broken_shadow account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so The UID of the daemon user is ABOVE 500. Would changing it to one below 500 fix the problem? Thanks in advance!

2 2

Delete object on Consumer
by Jim Tyrrell 04 Aug '11

04 Aug '11

Hi, We have a setup with multiple masters which are replicating down to 389 Directory Server consumers via 2 hubs, but have a consistency issue. It appears a few objects were deleted and re-added to the masters but the object was not deleted from the 389 consumers. We now have 1 object on the masters and 2 objects on the consumers which causes problems for the mail servers. If we delete the object from the master we are still left with one object on the slaves. The slaves currently have a few duplicate objects like this: dn: cn=mx::10, cn=somedomain.co.uk, ou=dns, o=acmesystems.com cn: mx::10 mailtransport: nexthop:[mailserver.ourdomain.com] dnspreference: 10 dnstype: MX dn: nsuniqueid=7edfa581-1dd211b2-8014f995-55bd0000+cn=mx::10,cn=somedomain.co.uk, ou=dns,o=acmesystems.com cn: mx::10 mailtransport: nexthop:[mailserver.ourdomain.com] dnspreference: 10 dnstype: MX The object showing nsuniqueid is the valid one that exists on the master. Is there a way to remove the 2nd object from the consumer without re-initialising? I have seen this before on a single consumer so we re-initialised it, but its a much bigger problem to re-initialise all of the consumers. It would be ideal if there is a way to manually delete an object direct on a consumer? Thanks. Jim.

4 14

autoenrollment proxy and dogtag 9 ? Where can I find AEP source code ?
by Alexander Jung 03 Aug '11

03 Aug '11

Hello, I try to use the autoenrollment proxy with the most recent dogtag. Unfourtunately it seems that its been a while since somebody touched that code and the aep does not support the port seperation in the more recent dogtag versions (since 1.2). I'd like to update the source, but I could not download it from the fedora-cvs server as described in http://directory.fedoraproject.org/wiki/Auto_Enroll_Build (Server not responding) Where can I download the most recent aep source code ? yours, Alexander Jung

2 3

Change name of server, admin-server no longer works
by Techie 01 Aug '11

01 Aug '11

Hello, We were required to change the hostname of our LDAP server running 389-DS. Since that time the LDAP server runs fine but the admin server does not authenticate login any longer, meaning i cannot log into the admin server. What do I need to do to fix the admin server and change all references from the old host name to the new host name. Thanks Jimmy

3 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users August 2011