389-users March 2013

389-users@lists.fedoraproject.org

33 participants
43 discussions

Hiring for project
by Mike 15 Mar '13

15 Mar '13

Hello, I'd like to hire someone to remotely setup and configure 389 directory server running in vm's in my xen environment. I'm looking for a HA configuration involving multimaster replication to serve in an ISP environment, and secondly I am also wanting to import an existing ldap with it's schema and data. I personally prefer debian but am willing to go with whatever you are most comfortable with in order that the final result meets my expectations for correctness and stability. I expect to pay for quality work, and that someone with prior experience here likely could get this done in a very reasonable amount of time. Interested persons please send me a proposal including a brief description of your experience as relates to this sort of work as well as a quote for the work. I'd prefer a flat rate but everything is negotiable. Job will likely be filled quickly so please respond soon. Thank you. Mike-

1 0

Announcing 389 Directory Server Gateway version 1.1.10
by Mark Reynolds 13 Mar '13

13 Mar '13

The 389 Directory Server team is proud to announce 389-dsgw version 1.1.10. Fedora packages are available from the Fedora 18 Testing repositories. It will move to the Fedora 18 Stable repositories once it has received enough karma in Bodhi. We encourage you to test and provide feedback here in order to speed up the push to the Stable repositories. The new packages and versions are: 389-dsgw-1.1.10-1 A source tarball is available for download at http://port389.org/sources/389-dsgw-1.1.10.tar.bz2 Highlights in 1.1.10 Fixed format string errors that allowed for buffer overflows. Installation and Upgrade See Download for information about setting up your yum repositories. To install, use yum install 389-dsgw yum install 389-dsgw To upgrade, use yum upgrade yum upgrade See Source for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://admin.fedoraproject.org/mailman/listinfo/389-users If you find a bug, or would like to see a new feature, file it in our Trac instance: https://fedorahosted.org/389 Detailed Changelog since 1.1.9 Mark Reynolds (2): bump version to 1.1.10 https://fedorahosted.org/389/ticket/606 Ticket 606 - Format string errors -- Mark Reynolds Red Hat, Inc mreynolds(a)redhat.com

1 0

Announcing 389 Directory Server version 1.3.0.4
by Mark Reynolds 13 Mar '13

13 Mar '13

The 389 Directory Server team is proud to announce 389-ds-base version 1.3.0.4. The new packages and versions are: 389-ds-base-1.3.0.4-1 A source tarball is available for download at http://port389.org/sources/389-ds-base-1.3.0.4.tar.bz2 Highlights in 1.3.0.4 Fix crash caused by a invalid control Fix crash when attempting to delete a tombstone. Fix issue with replication interfering with certain modify operations. Improved role performance. Installation and Upgrade See Download for information about setting up your yum repositories. To install, use yum install 389-ds yum install 389-ds After install completes, run setup-ds-admin.pl to set up your directory server. setup-ds-admin.pl To upgrade, use yum upgrade yum upgrade After upgrade completes, run setup-ds-admin.pl -u to update your directory server/admin server/console information. setup-ds-admin.pl -u Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://admin.fedoraproject.org/mailman/listinfo/389-users If you find a bug, or would like to see a new feature, file it in our Trac instance: https://fedorahosted.org/389 Detailed Changelog since 1.3.0.3 Mark Reynolds (3): bump version to 1.3.0.4 Ticket 570 - DS returns error 20 when replacing values of a multi-valued attribute (only when replication is enabled) Ticket 590 - ns-slapd segfaults while trying to delete a tombstone entry Noriko Hosoi (2): Ticket #490 - Slow role performance Bug 912964 - CVE-2013-0312 389-ds: unauthenticated denial of service vulnerability in handling of LDAPv3 control data -- Mark Reynolds Red Hat, Inc mreynolds(a)redhat.com

1 0

Announcing 389 Directory Server version 1.2.11.19
by Mark Reynolds 13 Mar '13

13 Mar '13

The 389 Directory Server team is proud to announce 389-ds-base version 1.2.11.19. Fedora packages are available from the Fedora 18 Testing repositories. It will move to the Fedora 18 Stable repositories once it has received enough karma in Bodhi. We encourage you to test and provide feedback here in order to speed up the push to the Stable repositories. The new packages and versions are: 389-ds-base-1.2.11.19-1 A source tarball is available for download at http://port389.org/sources/389-ds-base-1.2.11.19.tar.bz2 Highlights in 1.2.11.19 Fixed security issue with invalid controls. Fixed crash casued by trying to delete a tombstone entry. Fixed issue where the dse.ldif can get corrupted. Fixed erroneous error message from WinSync. Improved DNA plugin startup process. Fixed issue where an invalid chaining plugin configuration would accidentally casue the server to shutdown. Fixed issue with replication interfering with certain modify operations. Fixed some ememory leaks. Fixed issue with the PAM plugin schema not being upgraded correctly. Installation and Upgrade See Download for information about setting up your yum repositories. To install, use yum install 389-ds yum install 389-ds After install completes, run setup-ds-admin.pl to set up your directory server. setup-ds-admin.pl To upgrade, use yum upgrade yum upgrade After upgrade completes, run setup-ds-admin.pl -u to update your directory server/admin server/console information. setup-ds-admin.pl -u Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://admin.fedoraproject.org/mailman/listinfo/389-users If you find a bug, or would like to see a new feature, file it in our Trac instance: https://fedorahosted.org/389 Detailed Changelog since 1.2.11.18 Noriko Hosoi (5): Bug 912964 - CVE-2013-0312 389-ds: unauthenticated denial of service vulnerability in handling of LDAPv3 control data Ticket 579 - Error messages encountered when using POSIX winsync Ticket 576 - DNA: use event queue for config update only at the start up Ticket 572 - PamConfig schema not updated during upgrade Bug 906005 - Valgrind reports memleak in modify_update_last_modified_attr Mark Reynolds (4): bump version to 1.2.11.19 Ticket 570 - DS returns error 20 when replacing values of a multi-valued attribute (only when replication is enabled) Ticket 590 - ns-slapd segfaults while trying to delete a tombstone entry Ticket 367 - Invalid chaining config triggers a disk full error and shutdown Ludwig Krispenz (1): Ticket #518 - dse.ldif is 0 length after server kill or machine kill -- Mark Reynolds Red Hat, Inc mreynolds(a)redhat.com

1 0

Forwarding client requests to AD
by David Barr 13 Mar '13

13 Mar '13

Good Morning, I'm afraid my Google-fu is failing me, this morning. Synchronizing 389-ds with Active Directory is well understood.[1] However, for various non-technical reasons, I won't be able to do that for this environment. What I need 389-ds to do is receive an ID/Auth requests from an LDAP client, forward that request into the AD environment, and then pass the response back to the end client. I suppose I would be tasking 389-ds to act as an AD proxy server, without doing full synchronization. For bonus points, I will be loading sudoers information[2] into 389-ds and using it for *nix privilege authorization. So, "ou=SUDOers,dc=example,dc=com" would be locally served, while "ou=People,dc=example,dc=com" and "ou=Groups,dc=example,dc=com" would be forwarded. (My SudoUser attributes will use user and group names returned from AD.) Is using 389-ds as a AD proxy documented somewhere? Am I just not finding it? Thanks! David [1] - http://directory.fedoraproject.org/wiki/Howto:WindowsSync [2] - http://www.sudo.ws/sudoers.ldap.man.html -- David - Offbeat http://dafydd.livejournal.com dafydd - Online http://pgp.mit.edu/ Battalion 4 - Black Rock City Emergency Services Department Integrity*Commitment*Communication*Support ----5----1----5----2----5----3----5----4----5----5----5----6----5----7-- Werner Heisenberg is driving down the autobahn. A police officer pulls him over. The officer says, "Excuse me, sir, do you know how fast you were going?" "No," replies Dr. Heisenberg, "but I know where I am."

1 1

almost off-topic: when is it advisable to get a 3rd party signed (vs. a self-signed) cert to use with 389-ds?
by Jon Detert 13 Mar '13

13 Mar '13

I managed to get 389-ds working with encryption. Whew. The project should really update http://directory.fedoraproject.org/wiki/Howto:SSL to make it simpler to figure out. I'm willing to, but the wiki says "We are not ready to accept contributions at this time." Anyway, I'm wondering what advantage(s) I'd have in using a 3rd-part signed cert instead of a self-signed one? I admit - this question stems from my ignorance of how clients certify servers. I think I understand that when you use a self-signed cert, that you typically have to 'inform' a client about that cert, telling the client that it is trusted. How would it be different if I used a 3rd-party (like GeoTrust) signed cert? Do clients typically know about common CA's? Do they typically rely on the o.s. to define/supply the list of known CAs? Here are some of the clients I need to talk ldaps to my ldap servers: Zimbra Liferay Apache openldap ldapsearch Home-grown java code Actuate Thanks, -- Jon Detert Sr. Systems Administrator Infinity Healthcare Milwaukee, Wisconsin 414-290-6759

2 1

documentation on creating/using roles
by Elizabeth Jones 12 Mar '13

12 Mar '13

Can anyone point me towards any documentation or examples on creating and using roles? I am hoping to set up a role for our service desk users so they can add/delete users, but I need to have them login as themselves so we can track them. I have an aci that I created that would allow them to do this but I don't want to put the aci directly on specific user accounts if i can avoid it. thanks - Elizabeth J

3 2

Single Master replication : after master o.s. + dirsrv upgrade, replication fails with nsds5replicaLastInitStatus=3
by Jon Detert 07 Mar '13

07 Mar '13

I have a single master replicating to 2 slaves. The master is Fedora Directory Server v1.0.4 The slaves are 389-DirectoryServer v1.2.10. This has been working fine. I tried to replace the single master with the same ds software as the slaves (389-DirectoryServer v1.2.10), but I could not get replication to work. I'm hoping someone can help me see what I did wrong. What I did: ----------- 1) deleted the replication agreements from the Fedora ds master. (Not sure this was necessary. Thought it might leave the slave replicas in a state that would more cleanly accept new replication agreements). 2) replaced the fedora ds master with new o.s. running 389-ds v1.2.10. Created new slapd instance, and loaded it with the same schema and data as was used in the fedora ds DIT. 3) created replication agreements (on the new master) with the 2 slaves. What I see: ----------- a) Immediately, the replication status was: "nsds5replicaLastInitStatus: 3 Replication error acquiring replica: permission denied" b) On the master, /var/log/dirsrv/slapd-madds1/errors says this: "NSMMReplicationPlugin - agmt="cn=o-ihccom-to-madds2" (madds2:389): Unable to acquire replica: permission denied. The bind dn "uid=replica-manager,cn=config" does not have permission to supply replication updates to the replica. Will retry later." c) On the slaves, /var/log/dirsrv/slapd-madds2/errors says this: "NSMMReplicationPlugin - conn=34 op=3 replica="dc=example,dc=com": Unable to acquire replica: error: permission denied" d) The following query on a slave, shows that the bind-dn used by the master is correct: ldapsearch -x -LLL -D 'cn=directory manager' -W -b cn=config -s sub objectclass=nsds5replica yields output like this: dn: cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config objectClass: top objectClass: nsds5replica objectClass: extensibleObject cn: replica nsDS5ReplicaRoot: dc=example,dc=com nsDS5ReplicaType: 2 nsDS5ReplicaBindDN: uid=replica-manager,cn=config nsDS5Flags: 0 nsDS5ReplicaId: 65535 nsState:: //8AAAAAAADDxzdRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== nsDS5ReplicaName: edb50b02-86af11e2-9dc2a557-8005a77d nsds5ReplicaChangeCount: 0 nsds5replicareapactive: 0 Thanks for any insight you offer. -- Jon Detert Sr. Systems Administrator Infinity Healthcare Milwaukee, Wisconsin 414-290-6759

1 1

nsDS5ReplicaCredentials confusion
by Jon Detert 07 Mar '13

07 Mar '13

When setting up replication, I understand that you : a) create a dn on the consumer to be used as the 'bind-dn' for the replica on the consumer; b) create a replication agreement on the supplier, in which you reference the bind dn from a). I have a couple questions about this: 1) How do you generate the hash used in the nsDS5ReplicaCredentials attribute of the supplier's replication agreement? I understand that the 389-ds-console will generate it for you, but I don't want to use the console. 2) Why is the hash recorded in the nsDS5ReplicaCredentials attribute of the supplier's replication agreement {DES} differently than the hash recorded in the person objectClass {SSHA} on the consumer for the dn? 3) How does the supplier authenticate to the consumer when replicating? Does it pass the binddn credentials? If so, in what format? How are they validated? Thanks, Jon

2 2

How can I grant read access to the attributes of a nsDS5ReplicationAgreement object?
by Jon Detert 07 Mar '13

07 Mar '13

I want to check the status of replication agreements, but I don't want to use the directory manager's credentials to do so. I want to use bind credentials for a dn that only has read access. Is an ACI what I need? If so, how? I've tried several, but they don't work as I intended. One thing I'm uncertain of, is which dn to associate the aci attribute with. I've tried these: cn=config cn=mapping tree,cn=config dc=example,dc=com and the actual dn of the replication agreement object. I'm also not certain of the target to use in the aci. I've tried these: (targetfilter = "(objectClass=nsds5ReplicationAgreement)") and (target="ldap:///cn=*,cn=replica,cn=*,cn=mapping tree,cn=config") Any ideas what I'm doing wrong? Thanks -- Jon Detert Sr. Systems Administrator Infinity Healthcare Milwaukee, Wisconsin 414-290-6759

3 5

dbmon.sh - tool to monitor db and cache usage
by Rich Megginson 06 Mar '13

06 Mar '13

There is a new tool used to monitor db, entry cache, and dn cache usage. https://github.com/richm/scripts/wiki/dbmon.sh If you find problems or have suggestions, please use https://github.com/richm/scripts/issues

1 0

How to get password expire time for user
by Fosiul Alam 06 Mar '13

06 Mar '13

HI Expert I am trying to find out a way to get password expire time for users so that i can sent them email i was looking in google , but i am not clear yet can any one please advise whats the best way to get password expire time ?? Thanks Fosiul.

4 5

Apache 2.4.4
by Tom Browder 06 Mar '13

06 Mar '13

Is there any work underway to get mod_nss working with the latest Apache? Thanks and best regards, -Tom

2 3

using PWM with 389 DS
by Elizabeth Jones 05 Mar '13

05 Mar '13

I was wondering if anyone here has integrated PWM into your 389 DS and might be able to help me out. We want to use PWM just for allowing users to change their passwords. I followed the documentation that is here https://docs.google.com/document/d/1I9u1xaVrIOTFj8Le7uzCM5zGqrODCi9Udo2gGZy… to add the users and aci's that PWM needs, following the directions in the doc (except that I had to change from replace to add to the aci section or it wiped out our existing acis). Following this doc, I added users pwmproxy and pwmtest to People,mycompany,com Using PWM, I can access the pwmproxy and pwmtest users at the People level and change their passwords. I can also add additional test/generic users at this level (People, mycompany, com)and access those using pwm. But if I try to access any of our existing users IDs that are below People, i.e. internal,people,company,com external,people,company,com PWM says it can't find those users. Any thoughts on what else I might need to do to get to those users? thanks EJ

2 3

Replication fails: id2entry.db4 too large?
by Luigi Santangelo 05 Mar '13

05 Mar '13

Hi, I have configured two server (called A and B) in replica multimaster mode. Server B is in read only mode. In server A I have configured succesfully replication to B of my userRoot. Today, the sync doesn't work: when A try to send replication data to B, B crashes with no error log. When I start the service on B, it works fine until the sync starts. If I disable the syncronization, B works fine. The problem could be the dimension of id2entry.db4? Now it is 10GB and in the DB I have only 100.000 entry. Can I reduce the dimension of the file? It seems too large for the number of records inside. Thanks in advance. Best regards. Luigi

2 3

AD group/user sync question
by Vesa Alho 04 Mar '13

04 Mar '13

Hi, I have now 389 to AD sync working (thanks Rich!). Another question related to that. There are currently two Windows sync agreements: 1. Users ou=People,dc=domain,dc=com <==> cn=Users,dc=domain,dc=com 2. Projects ou=Projects,ou=Groups,dc=domain,dc=com <==> ou=Projects,dc=domain,dc=com Problem: cn=Project1,ou=Projects,ou=Groups,dc=domain,dc=com has group members defined like this: ... uniqueMember: uid=user,ou=People,dc=domain,dc=com ... I get the following replication error: map_dn_values: this entry is not ours uid=user,ou=People,dc=domain,dc=com I guess it means that I can't mix groups and users from different sync agreements? How would I solve this scenario then? Mr. Vesa Alho

2 1

How to make sure that all slave server has same data
by Fosiul Alam 01 Mar '13

01 Mar '13

Hi I just wanted to know whats the best practice to make sure all Slave as same data as master. while reading on google, i got bellow command also 1 script to monitor ldap replication status. [root@blob]# ldapsearch -x -b "cn=mapping tree,cn=config" -D "cn=Directory Manager" -w YOURPASSWORD objectClass=nsDS5ReplicationAgreement nsds5replicaLastUpdateStatus -LL I have checked this against our 6 slave server and they all returned : nsds5replicaLastUpdateStatus: 0 Incremental update succeeded but still one of the slave did not have same data as master , after I reinitialise the slave replication , the data was Ok So if i want to create a script to monitor slave replication status and wants to make sure that all slave as same data as master what will be the best practice ?? Thanks Fosiul

2 1

invalid password syntax - passwords with storage scheme are not allowed
by Fosiul Alam 01 Mar '13

01 Mar '13

Hi Expert We have 389 server installed with ssl enabled. When we try to change password from centos 5 servers its fine . but from centos 6, i get bellow error : Changing password for user testuser Enter login(LDAP) password: New password: Retype new password: LDAP password information update failed: Constraint violation invalid password syntax - passwords with storage scheme are not allowed passwd: Authentication token manipulation error we have this in /etc/ldap.conf ssl start_tls tls_cacertfile /etc/openldap/cert/ourcert.crt pam_password clear same /etc/ldap.conf works fine in centos5 but for centos6 its looks like not working what shall i do ?? Thanks for help

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users March 2013