389-users August 2011

389-users@lists.fedoraproject.org

34 participants
27 discussions

AUTO: Out Of The Office (returning Tue 09/06/2011)
by Herbert S McWhorter 26 Aug '11

26 Aug '11

I am out of the office from Fri 08/26/2011 until Tue 09/06/2011. In the event that you need to contact me, please call or text 303.895.9937. Thank you, Herb McWhorter Note: This is an automated response to your message "[389-users] too many fds open" sent on 8/26/11 1:11:49. This is the only notification you will receive while this person is away.

1 0

Microsoft Windows Password Sync?
by Craig T 26 Aug '11

26 Aug '11

Hi, Setup: Fedora 15 x64 * 389-admin-1.1.16-1.fc15.x86_64 * 389-admin-console-1.1.7-2.fc15.noarch * 389-admin-console-doc-1.1.7-2.fc15.noarch * 389-adminutil-1.1.13-2.fc15.x86_64 * 389-console-1.1.4-2.fc15.noarch * 389-ds-base-1.2.8.3-1.fc15.x86_64 * 389-ds-base-libs-1.2.8.3-1.fc15.x86_64 * 389-ds-console-1.2.5-1.fc15.noarch * 389-ds-console-doc-1.2.5-1.fc15.noarch Windows 2008 R2 x64 * Microsoft Active Directory * Windows Password Sync v1.1.4 x64 I'm just attempting to setup 389 Directory Server password sync to Microsoft Active Directory. I have managed to get successfull user account (ldap info) sync without passwords, it's just the .msi password sync program that I'm having issues with. Error from passsync.log: 08/25/11 14:46:43: PassSync service initialized 08/25/11 14:46:43: PassSync service running 08/25/11 14:46:44: Error initializing SSL: err=-8174 08/25/11 14:46:44: Ensure that your SSL is setup correctly 08/25/11 14:46:58: PassSync service stopped Anyone know how I can add debugging to the windows app? or ideas on what a -8174 error means? I thought SSL was setup correctly on the directory server (it certainly responds to a telnet <port 636>, again debugging on the windows side would be ideal. cya Craig

2 2

fedora-idm-console is not working after ssl enabled
by s.varadha rajan 24 Aug '11

24 Aug '11

Hi, I have configured ssl settings as per the redhat official doc( http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html/Adminis… ). There is no issues with Directory server.after enabling ssl settings in the Admin server and after restarted the admin server, i tried to login with https://localhost:9830.it's not at all logging and in the Terminal throws the below error. Exception in thread "main" java.lang.UnsatisfiedLinkError: no jss4 in java.library.path at java.lang.ClassLoader.loadLibrary(ClassLoader.java:1681) at java.lang.Runtime.loadLibrary0(Runtime.java:840) at java.lang.System.loadLibrary(System.java:1047) at org.mozilla.jss.CryptoManager.loadNativeLibraries(CryptoManager.java:1339) at org.mozilla.jss.CryptoManager.initialize(CryptoManager.java:827) at org.mozilla.jss.CryptoManager.initialize(CryptoManager.java:800) at com.netscape.management.client.util.UtilConsoleGlobals.initJSS(Unknown Source) at com.netscape.management.client.comm.HttpsChannel.<clinit>(Unknown Source) at com.netscape.management.client.comm.HttpManager.createChannel(Unknown Source) at com.netscape.management.client.comm.CommManager.send(Unknown Source) at com.netscape.management.client.comm.CommManager.send(Unknown Source) at com.netscape.management.client.comm.HttpManager.get(Unknown Source) at com.netscape.management.client.console.Console.invoke_task(Unknown Source) at com.netscape.management.client.console.Console.authenticate_user(Unknown Source) at com.netscape.management.client.console.Console.<init>(Unknown Source) at com.netscape.management.client.console.Console.main(Unknown Source) Please let me know the solution for this issue ? Regards, Varad

4 5

Failure while Copy a subtree (deleteOldRdn: 0)
by Roberto Polli 23 Aug '11

23 Aug '11

Hi all, I'm playing with the changeType: modrdn command, and I got the following issue. 1- I want to copy a subtree in another location: source: ou=People,dc=top dest: ou=PeopleBak,dc=top 2- I can move it with changeType: modrdn newrdn: ou=PeopleBak deleteoldrdn: 0 3- I would expect that "deleteOldRdn:0" would leave the old "ou=People" at its place. While "deleteOldRdn: 1" should remove it. Do you have any hint? Peace, R. -- Roberto Polli Project Manager Babel S.r.l. - http://www.babel.it T: +39.06.9826.9651 M: +39.340.6522736 F: +39.06.9826.9680 P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma) CONFIDENZIALE: Questo messaggio ed i suoi allegati sono di carattere confidenziale per i destinatari in indirizzo. E' vietato l'inoltro non autorizzato a destinatari diversi da quelli indicati nel messaggio originale. Se ricevuto per errore, l'uso del contenuto e' proibito; si prega di comunicarlo al mittente e cancellarlo immediatamente.

2 1

Recover Management Console Password
by Brant Hohnstein 22 Aug '11

22 Aug '11

Is there a procedure (however cumbersome) to reset the Management Console (admin) password if the password is not currently known? I changed the admin password in the Console GUI (domainName/ldapservername/ServerGroup/Administration Server/Configure Admin Server/Access(tab). I must have typed the password wrong twice because it accepted it. Now I can't seem to type the password "wrong" in the same way to get into the Management Console. I have tried shutting down the Admin Server and copying in a /etc/dirsrv/admin-serv/admpw file from a different 389 server where I do know the password. After restarting and typing in the known password, I get an error about not being able to contact the directory server. I have also searched for a password recovery procedure without success. Any helpful suggestions would be appreciated. Brant Hohnstein System Administrator Return Path, Inc. 8001 Arista Place, Suite 300 Broomfield, CO 80021 brant.hohnstein(a)returnpath.net +1 303-999-3233

4 4

Is 1.2.9.5 stable?
by Diego Woitasen 16 Aug '11

16 Aug '11

Hi, I saw that there is a 1.2.9.5 version in the source repository. Is this version stable? Because it hasn't been announced. Regards, Diego -- Diego Woitasen

2 3

Re: [389-users] duplicate replica id detected - can I remove replicas?
by Rich Megginson 12 Aug '11

12 Aug '11

On 08/10/2011 11:00 PM, Amos Shapira wrote: > Some more research after I sent my question (narrower search terms) > found the following bug and fix: > > https://bugzilla.redhat.com/show_bug.cgi?id=624442 > > The package I use is centos-ds-base-8.1.0-0.14.el5.centos.2 > > Does this mean that this is a bug in the package I have and I should > just use different replication id's? > Or can I still somehow clear the tombstones? You might be able to use db2ldif -r to dump the database along with the replication meta data, then edit the LDIF file to remove the bogus data, then ldif2db to reload your database from the LDIF file. > > Thanks, > > --Amos > > On 11 August 2011 14:55, <389-users-owner(a)lists.fedoraproject.org > <mailto:389-users-owner@lists.fedoraproject.org>> wrote: > > You are not allowed to post to this mailing list, and your message has > been automatically rejected. If you think that your messages are > being rejected in error, contact the mailing list owner at > 389-users-owner(a)lists.fedoraproject.org > <mailto:389-users-owner@lists.fedoraproject.org>. > > > > ---------- Forwarded message ---------- > From: Amos Shapira <amos.shapira(a)gmail.com > <mailto:amos.shapira@gmail.com>> > To: "General discussion list for the 389 Directory server > project." <389-users(a)lists.fedoraproject.org > <mailto:389-users@lists.fedoraproject.org>> > Date: Thu, 11 Aug 2011 14:55:08 +1000 > Subject: duplicate replica id detected - can I remove replicas? > Hello, > > I've deleted old replication agreements and setup new ones as part > of server reshuffling (previous consumers turned into multi-masters). > > I'm following the instructions in > http://directory.fedoraproject.org/wiki/Howto:WalkthroughMultimasterSSL > which look like a shorter summary of the official documentation. > > When I finally click on the "Inisitalize consumer" I get a pop-up > about duplicate replicas existing. > > The replica numbers on the servers are "4" (on the supplier I > intend to initialise from) and "3" (on the intended consumer). > > I followed instructions given in this forum earlier to list > replicas on both servers and these are the results: > > # ./ldapsearch -x -b > 'nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,dc=company' -D > 'cn=Directory Manager' -w ******* -h cunsumers-ip-addr -s base > objectclass=nstombstone > version: 1 > dn: nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,dc=company > objectClass: top > objectClass: nsTombstone > objectClass: extensibleobject > nsds50ruv: {replicageneration} 4a679e1c000000010000 > nsds50ruv: {replica 3 ldap://directory2:389 > } > nsds50ruv: {replica 1 ldap://directory5:389} 4a679ebf000000010000 > 4e30ce4e000200010000 > nsds50ruv: {replica 65535 ldap://directory2:389} > 4e323b300000ffff0000 4e4026ef0000ffff0000 > dc: company > nsruvReplicaLastModified: {replica 3 ldap://directory2:389} 00000000 > nsruvReplicaLastModified: {replica 1 ldap://directory5:389} 000000 > 00 > nsruvReplicaLastModified: {replica 65535 ldap://directory2:389} > 4e4026d9 > > # ./ldapsearch -x -b > 'nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,dc=company' -D > 'cn=Directory Manager' -w ******** -s base objectclass=nstombstone > version: 1 > dn: nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,dc=company > objectClass: top > objectClass: nsTombstone > objectClass: extensibleobject > nsds50ruv: {replicageneration} 4a679e1c000000010000 > nsds50ruv: {replica 3 ldap://directory2:389} > nsds50ruv: {replica 1 ldap://directory5:389} 4a679ebf000000010000 > 4e30ce4e000200010000 > nsds50ruv: {replica 65535 ldap://directory2:389} 4e4026ef0000ffff0000 > dc: company > nsruvReplicaLastModified: {replica 3 ldap://directory2:389} 00000000 > nsruvReplicaLastModified: {replica 1 ldap://directory5:389} 4e30ce > 27 > nsruvReplicaLastModified: {replica 65535 ldap://directory2:389} > 4e4026da > > directory1 is the server I'm running the query on and is the > intended initialising supplier. > directory2 is the server I'm trying to initialize. > directory1 and directory2 are the servers I intend to be the new > multi-masters. I configured them to use LDAPS on port 636 with > certificates. > directory5 is one of the two older multi-masters (the old > multi-masters haven't been configured corretly, I guess that's why > we don't see a second replica from the old multi-master pair). > > Is there a way for me to remove the old replicas or must I just > pick new replica numbers for the new multi-masters? > > In case this matters - I'm configuring things through a > centos-idm-console which I copied to my Ubuntu desktop in another > location and accessing the DC over VPN. I have direct access from > my desktop to ports 636 and 389 on both servers. When I setup the > replication agreement the console complains that it can't validate > the connection but I suspect this is related to it not having > access to the cert8.db file > (https://bugzilla.redhat.com/show_bug.cgi?id=200989) > > Thanks, > > --Amos > >

2 2

Existing certificate error
by s.varadha rajan 10 Aug '11

10 Aug '11

Hi, We are planning to configure ssl enabled Fedora directory server.we have a proper signed certificate.while importing, it is asking "Enter the password to access the Token" ? like that. even though we have given the exact password, while creating the certificate but it is not working. I referred wiki fedora doc also but getting this error. How to use existing certificate and enable secure ldap server. I have already posted the same question but nobody is reply Regards, Varad

4 7

Centos 6?
by Brett Dikeman 09 Aug '11

09 Aug '11

Greetings, I'm trying to install 389 on Centos 6, following this: http://directory.fedoraproject.org/wiki/Install_Guide#New_Install The guide makes it out to be as simple as "configure EPEL, then execute yum install 389-ds". Instead, the install dies with yum not able to find a dozen or two dependencies, all of them perl, it looks like: -perl(Setup) -perl (Mozilla::LDAP::Utils) -perl(Resource) ...and so on (Dialog, DSMigration, Migration, DSUpdate etc.) I've tried both EPEL release, and EPEL testing. I can't seem to find anyone else complaining about these issues, so I'm guessing I'm missing something. Any suggestions? Thanks! Brett

11 29

Re: [389-users] Crashing
by Wendt, Trevor 08 Aug '11

08 Aug '11

*resending with message truncated, hit message size max* Hello Rich, Still fails when run from within the server directory: ====================================================================== [root@ server]# pwd /opt/fedora-ds/bin/slapd/server [root@ server]# gdb ./ns-slapd ../../../slapd/logs/core.5916 Reading symbols from /opt/fedora-ds/bin/slapd/server/ns-slapd...(no debugging symbols found)...done. [New Thread 5972] ...additional threads... warning: .dynamic section for "/usr/lib/libstdc++.so.6" is not at the expected address warning: difference appears to be caused by prelink, adjusting expectations warning: .dynamic section for "/lib/libm.so.6" is not at the expected address warning: difference appears to be caused by prelink, adjusting expectations warning: .dynamic section for "/lib/libresolv.so.2" is not at the expected address warning: difference appears to be caused by prelink, adjusting expectations Reading symbols from ./libslapd.so...(no debugging symbols found)...done. Loaded symbols for ./libslapd.so Reading symbols from ../lib/libssl3.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libssl3.so Reading symbols from ../lib/libnss3.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libnss3.so Reading symbols from ../lib/libsoftokn3.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libsoftokn3.so Reading symbols from ../lib/libssldap60.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libssldap60.so Reading symbols from ../lib/libldap60.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libldap60.so Reading symbols from ../lib/libprldap60.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libprldap60.so Reading symbols from ../lib/libplc4.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libplc4.so Reading symbols from ../lib/libplds4.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libplds4.so Reading symbols from ../lib/libnspr4.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libnspr4.so Reading symbols from /lib/libdl.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libdl.so.2 Reading symbols from /usr/lib/libsasl2.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libsasl2.so.2 Reading symbols from /lib/libcrypt.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libcrypt.so.1 Reading symbols from /lib/libpthread.so.0...(no debugging symbols found)...done. [Thread debugging using libthread_db enabled] Loaded symbols for /lib/libpthread.so.0 Reading symbols from ./libdb-4.2.so...(no debugging symbols found)...done. Loaded symbols for ./libdb-4.2.so Reading symbols from /usr/lib/libstdc++.so.6...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libstdc++.so.6 Reading symbols from /lib/libm.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libm.so.6 Reading symbols from /lib/libgcc_s.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libgcc_s.so.1 Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libresolv.so.2 Reading symbols from /lib/libnss_files.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libnss_files.so.2 Reading symbols from /usr/lib/sasl2/liblogin.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/sasl2/liblogin.so.2 Reading symbols from /usr/lib/sasl2/libsasldb.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/sasl2/libsasldb.so.2 Reading symbols from /usr/lib/sasl2/libplain.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/sasl2/libplain.so.2 Reading symbols from /usr/lib/sasl2/libanonymous.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/sasl2/libanonymous.so.2 Reading symbols from /opt/fedora-ds/lib/syntax-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/syntax-plugin.so Reading symbols from /opt/fedora-ds/lib/liblcoll.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/liblcoll.so Reading symbols from ../lib/libicui18n.so.34...(no debugging symbols found)...done. Loaded symbols for ../lib/libicui18n.so.34 Reading symbols from ../lib/libicuuc.so.34...(no debugging symbols found)...done. Loaded symbols for ../lib/libicuuc.so.34 Reading symbols from ../lib/libicudata.so.34...(no debugging symbols found)...done. Loaded symbols for ../lib/libicudata.so.34 Reading symbols from /opt/fedora-ds/lib/pwdstorage-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/pwdstorage-plugin.so Reading symbols from /opt/fedora-ds/lib/des-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/des-plugin.so Reading symbols from /opt/fedora-ds/lib/attr-unique-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/attr-unique-plugin.so Reading symbols from /opt/fedora-ds/lib/acl-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/acl-plugin.so Reading symbols from ../lib/libns-dshttpd10.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libns-dshttpd10.so Reading symbols from /opt/fedora-ds/lib/chainingdb-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/chainingdb-plugin.so Reading symbols from /opt/fedora-ds/lib/cos-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/cos-plugin.so Reading symbols from /opt/fedora-ds/lib/http-client-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/http-client-plugin.so Reading symbols from /opt/fedora-ds/lib/libback-ldbm.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/libback-ldbm.so Reading symbols from /opt/fedora-ds/lib/replication-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/replication-plugin.so Reading symbols from /opt/fedora-ds/lib/passthru-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/passthru-plugin.so Reading symbols from /opt/fedora-ds/lib/referint-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/referint-plugin.so Reading symbols from /opt/fedora-ds/lib/retrocl-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/retrocl-plugin.so Reading symbols from /opt/fedora-ds/lib/roles-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/roles-plugin.so Reading symbols from /opt/fedora-ds/lib/statechange-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/statechange-plugin.so Reading symbols from /opt/fedora-ds/lib/views-plugin.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/lib/views-plugin.so Reading symbols from ../lib/libfreebl3.so...(no debugging symbols found)...done. Loaded symbols for ../lib/libfreebl3.so Reading symbols from /opt/fedora-ds/alias/libnssckbi.so...(no debugging symbols found)...done. Loaded symbols for /opt/fedora-ds/alias/libnssckbi.so Core was generated by `./ns-slapd -D /opt/fedora-ds/slapd -i /opt/fedora-ds/slapd/logs/pid -w'. Program terminated with signal 11, Segmentation fault. #0 0x00f3b80c in slapi_sdn_get_ndn () from ./libslapd.so (gdb) ====================================================================== Access log snippet: ====================================================================== [08/Aug/2011:13:39:59 -0500] conn=4244 fd=68 slot=68 connection from 10.1.20.15 to 10.1.25.67 [08/Aug/2011:13:39:59 -0500] conn=4153 op=14 EXT oid="2.16.840.1.113730.3.5.3" name="Netscape Replication Start Session" [08/Aug/2011:13:39:59 -0500] conn=4153 op=14 RESULT err=0 tag=120 nentries=0 etime=0 [08/Aug/2011:13:39:59 -0500] conn=4244 op=0 BIND dn="uid=Manager,dc=our_dc,dc=com" method=128 version=3 [08/Aug/2011:13:39:59 -0500] conn=4244 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=manager,dc=our_dc,dc=com" [08/Aug/2011:13:39:59 -0500] conn=4153 op=15 ADD dn="uid=user1,ou=users,ou=external,dc=our_dc,dc=com" [08/Aug/2011:13:39:59 -0500] conn=4245 fd=70 slot=70 connection from 10.1.20.15 to 10.1.25.67 [08/Aug/2011:13:39:59 -0500] conn=4245 op=0 BIND dn="uid=user1,ou=users,ou=external,dc=our_dc,dc=com" method=128 version=3 **** CRASH **** [08/Aug/2011:13:40:48 -0500] conn=0 fd=64 slot=64 connection from 10.1.25.1 to 10.1.25.67 [08/Aug/2011:13:40:49 -0500] conn=0 op=0 BIND dn="" method=128 version=2 [08/Aug/2011:13:40:49 -0500] conn=0 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [08/Aug/2011:13:40:49 -0500] conn=0 op=1 UNBIND [08/Aug/2011:13:40:49 -0500] conn=0 op=1 fd=64 closed - U1 [08/Aug/2011:13:40:50 -0500] conn=1 fd=64 slot=64 connection from 10.1.20.15 to 10.1.25.67 [08/Aug/2011:13:40:50 -0500] conn=1 op=0 BIND dn="uid=Manager,dc=our_dc,dc=com" method=128 version=3 [08/Aug/2011:13:40:50 -0500] conn=1 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=manager,dc=our_dc,dc=com" [08/Aug/2011:13:40:50 -0500] conn=1 op=1 SRCH base="uid=user2,ou=users,ou=external,dc=our_dc,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL [08/Aug/2011:13:40:50 -0500] conn=1 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [08/Aug/2011:13:40:50 -0500] conn=1 op=2 UNBIND ====================================================================== Logging is set as "nslapd-errorlog-level" is set to "8200" - not sure where I found that number at, the wiki shows 8192. What should I be using or just capture everything? Thanks! ________________________________ This electronic message transmission contains information from Black Hills Corporation, its affiliate or subsidiary, which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, be aware the disclosure, copying, distribution or use of the contents of this information is prohibited. If you received this electronic transmission in error, please reply to sender immediately; then delete this message without copying it or further reading.

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users August 2011