October 2014 - 389-users - Fedora mailing-lists

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

multi-valued nsAccountLock
by Pierre ROUDIER 10 Jul '15

10 Jul '15

Hi all, RedHat DS's doc states that the nsAccountLock attribute is multi-valued [1]. Some tests with 389ds led me to think it's also true for 389ds. I cannot think of any reason explaining why it would have to be multi-valued. Do you have any idea? Thank you. [1] https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server…

3 2

changelog
by Denise Cosso 16 Apr '15

16 Apr '15

Hi, How to modify the attribute nsslapd-encryptionalgorithm in Centos? Thanks, Denise Stop Master servers and set nsslapd-encryptionalgorithm. The allowed value is AES or 3DES. dn: cn=changelog5,cn=config [...] nsslapd-encryptionalgorithm: AES --- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu: De: Rich Megginson <rmeggins(a)redhat.com> Assunto: Re: [389-users] changelog Para: "Denise Cosso" <guanaes51(a)yahoo.com.br> Data: Terça-feira, 4 de Junho de 2013, 16:34 On 06/04/2013 01:26 PM, Denise Cosso wrote: Hi, Rich CentOS release 6.3 (Final) 389-ds-base-libs-1.2.10.2-20.el6_3.x86_64 389-ds-1.2.2-1.el6.noarch 389-dsgw-1.1.10-1.el6.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-ds-console-doc-1.2.6-1.el6.noarch 389-ds-base-1.2.10.2-20.el6_3.x86_64 As far as replication goes - you will need to use a security layer (SSL, TLS, or GSSAPI) to protect the clear text password on the wire As far as encrypting it in the changelog - not sure Denise --- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu: De: Rich Megginson <rmeggins(a)redhat.com> Assunto: Re: [389-users] changelog Para: "General discussion list for the 389 Directory server project." <389-users(a)lists.fedoraproject.org> Cc: "Denise Cosso" <guanaes51(a)yahoo.com.br> Data: Terça-feira, 4 de Junho de 2013, 16:11 On 06/04/2013 12:39 PM, Denise Cosso wrote: Hi, Description of problem: When a userPassword is changed in a server with changelog, the hashed password is logged and also a cleartext pseudo-attribute version. It looks like this: change:: replace: userPassword userPassword: {SHA256}vqtiN2LHdrEUOJUKu+IBVqAVFsAlvFw+11kD/Q== - replace: unhashed#user#password unhashed#user#password: secret12 This unhashed version is used in winsync where the cleartext version of the password must be written to the AD. Now if the DS is involved in replication with another DS, the change will be replayed exactly as it is logged to the other DS replicas, including the cleartext pseudo-attribute password. What platform? What version of 389-ds-base are you using? thanks, Denise -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

2 2

389 GUI/Console
by Gonzalo Fernandez Ordas 03 Mar '15

03 Mar '15

Hi I got 389 running on a remote linux box,and I would like to get use of the Console without the need of exporting the X-Windows whenever I want to make a change as I also would prefer not to keep tweaking the configuration files all the time. is there anyway of doing this through any remote client? Any advise on this matter? Thanks very much

4 11

How to get password expiration working?
by Paul Tobias 15 Dec '14

15 Dec '14

Hi guys, We need to implement password expiration because of some policy. The problem is users are not able to bind to ldap anymore, after I switch on password expiration for our ou=People subtree . The ldap command line tools and 389-console both just hang forever when trying to connect. This happens even when the user changes the password right before switching on the password expiration so the password cannot be expired yet. When I use the wrong password, then I get "ldap_bind: Invalid credentials (49)", but when I use the correct password, then it's just a hang. If I switch off password expiration then everything returns to normal again. I've followed the guide at https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.2/… I've tried both 389ds 1.2.11.32 on CentOS 6 and 389ds 1.3.2.23 on Fedora 20 with the same results. Is password expiration working in 389ds at all? Thanks in advance, Paul Tobias

2 2

Please take an action: 389 Directory Server 1.2.11.X Discontinued for EL6
by Noriko Hosoi 06 Nov '14

06 Nov '14

389 Directory Server 1.2.11.X Discontinued for EL6 The 389 Directory Server team announces the binary release of 389-ds-base version 1.2.11 for EL6 will be stopped via temporary COPR repository. We encourage you to switch it to the official version included in the Red Hat Enterprise Linux 6 distribution or its equivalent OS. How to switch to the official version Remove a yum repo file which points to the temporary COPR repository (e.g., nhosoi-389-ds-base-epel6-epel-6.repo) from /etc/yum.repos.d. If the current 389 Directory Server 1.2.11 has the greater build number than 15, for instance, 1.2.11.32, downgrade it once by “yum downgrade” as follows. |yum downgrade 389-ds-base 389-ds-base-libs| Then, upgrade to make sure you have the latest version. |yum upgrade 389-ds-base| After upgrade completes, run *setup-ds-admin.pl -u* to update your directory server/admin server/console information. |setup-ds-admin.pl -u| See Install_Guide <http://www.port389.org/docs/389ds/legacy/install-guide.html> for more information about the initial installation, setup, and upgrade See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. http://www.port389.org/docs/389ds/releases/end-1-2-11.html

2 1

cannot modify db-home-directory at runtime
by Alan Willis 02 Nov '14

02 Nov '14

I'm trying to setup a server which uses /dev/shm as the db home dir in much the same way described in this ticket: https://fedorahosted.org/389/ticket/469 >From the description in the ticket, it appears that the entry can be modified at runtime. However when I attempt this, I get an error stating that this value cannot be modified at runtime. The only way I have gotten this to work is by modifying the dse.ldif directly and adding the attribute. Can this be made to require a reboot to take effect? -alan -- [image: fist]Alan Willis Systems Administrator | Riot Games Email: alwillis at riotgames.com For, to speak out once for all, man only plays when in the full meaning of the word he is a man, and *he is only completely a man when he plays*. - J.C. Friedrich von Schiller - Letters upon the Æsthetic Education of Man

2 1

389 not authenticating expired passwords
by Enrique J. Terrazas 29 Oct '14

29 Oct '14

Hello, A few weeks ago dirsrv kept stopping, I’d have to go and manually restart the process. I wasn’t able to correctly diagnose the problem and instead opted to update to the latest release of 389-ds. After applying the update dirsrv became stable. However, any users with expired passwords or any new user accounts aren’t able to authenticate. My setup: Two servers in a mullti-master replication environment both running Cent-OS 5.10 and: 389-admin-console-1.1.8-1.el5 389-ds-base-libs-1.2.11.32-1.el5 389-ds-1.2.1-1.el5 389-dsgw-1.1.11-1.el5 389-console-1.1.7-3.el5 389-adminutil-1.1.20-1.el5 389-admin-1.1.29-1.el5 389-ds-console-1.2.6-1.el5 389-admin-console-doc-1.1.8-1.el5 389-ds-console-doc-1.2.6-1.el5 389-ds-base-1.2.11.32-1.el5 In addition to the above problem I’m also seeing the following entries in /var/log/dirsrv/slapd-INSTANCE/errors [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=cn\3DnsPwTemplateEntry\2Cou\3Dtest_policy\2Cou\3DPeople\2Cdc\3Dece\2Cdc\3Dtamu\2Cdc\3Dedu to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 2445, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=cn\3DnsPwPolicyEntry\2Cou\3Dtest_policy\2Cou\3DPeople\2Cdc\3Dece\2Cdc\3Dtamu\2Cdc\3Dedu to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 2444, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=cn\3DnsPwPolicyEntry\2Ccn\3Dtestpass\2Cou\3Dtest_policy\2Cou\3DPeople\2Cdc\3Dece\2Cdc\3Dtamu\2Cdc\3Dedu to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 2442, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=cn\3DnsPwTemplateEntry\2Cou\3Dtest_policy\2Cou\3DPeople\2Cdc\3Dece\2Cdc\3Dtamu\2Cdc\3Dedu to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 2440, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=cn\3DnsPwPolicyEntry\2Cou\3Dtest_policy\2Cou\3DPeople\2Cdc\3Dece\2Cdc\3Dtamu\2Cdc\3Dedu to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 2439, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=cn\3DnsPwTemplateEntry\2Cou\3Dtest_policy\2Cou\3DPeople\2Cdc\3Dece\2Cdc\3Dtamu\2Cdc\3Dedu to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 2432, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=cn\3DnsPwPolicyEntry\2Cou\3Dtest_policy\2Cou\3DPeople\2Cdc\3Dece\2Cdc\3Dtamu\2Cdc\3Dedu to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 2431, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=cn\3DnsPwPolicyEntry\2Cou\3Dtest_policy\2Cou\3DPeople\2Cdc\3Dece\2Cdc\3Dtamu\2Cdc\3Dedu to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 2429, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=cn\3DnsPwPolicyEntry\2Ccn\3Dtestpass\2Cou\3Dtest_policy\2Cou\3DPeople\2Cdc\3Dece\2Cdc\3Dtamu\2Cdc\3Dedu to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 2426, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=cn\3DnsPwTemplateEntry\2Cou\3Dtest_policy\2Cou\3DPeople\2Cdc\3Dece\2Cdc\3Dtamu\2Cdc\3Dedu to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 2424, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=cn\3DnsPwPolicyEntry\2Cou\3Dtest_policy\2Cou\3DPeople\2Cdc\3Dece\2Cdc\3Dtamu\2Cdc\3Dedu to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 2423, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=/softwares to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 1756, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=/homes to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 1754, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=/softwares to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 1752, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN cn=/homes to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 1751, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN uid=y0m8179 to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 1728, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN uid=s0k4167 to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 1727, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN uid=joj4506 to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 1726, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN uid=dc-449 to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 1725, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN uid=jp-449 to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 1724, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN uid=kp-449 to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 1723, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN uid=cmk-449 to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 1722, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN uid=cm-449 to RDN [28/Oct/2014:17:18:23 -0500] id2entry - str2entry returned NULL for id 1721, string="rdn" [28/Oct/2014:17:18:23 -0500] _entry_set_tombstone_rdn - Failed to convert DN uid=nma-449 to RDN As well as this: [28/Oct/2014:23:59:01 -0500] - export NetscapeRoot: Processed 186 entries (100%). [28/Oct/2014:23:59:01 -0500] - All database threads now stopped [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 [28/Oct/2014:23:59:02 -0500] ldif2dbm - _get_and_add_parent_rdns: Failed to position cursor at ID 17 [28/Oct/2014:23:59:02 -0500] - ldbm2ldif: Skip ID 17 It appears that I may have some database corruption though. Any help is greatly appreciated. Best regards, Enrique J. Terrazas

1 0

restore into a new ds instance issues
by ghiureai 28 Oct '14

28 Oct '14

Hello List, I have create a new ds instance and used the rerstore dif2db cmd to populate the new isntance, the exisitng istance has txlogs cfg on a separate directory ( I copied the 99user.ldif file and macke chaged to db.ldif in new instance) , can't bring the new instance online: I rmeoved the existing log files and restore the path for txlogs to default location, I copied db2entry.db4 but stilll issues etected Disorderly Shutdown last time Directory Server was running, recovering database. [28/Oct/2014:13:04:08 -0700] - libdb: file NetscapeRoot/id2entry.db4 has LSN 1/1593380, past end of log at 1/1828 [28/Oct/2014:13:04:08 -0700] - libdb: Commonly caused by moving a database from one database environment [28/Oct/2014:13:04:08 -0700] - libdb: to another without clearing the database LSNs, or by removing all of [28/Oct/2014:13:04:08 -0700] - libdb: the log files from a database environment [28/Oct/2014:13:04:08 -0700] - libdb: /var/lib/dirsrv/slapd-devldap/db/NetscapeRoot/id2entry.db4: unexpected file type or format [28/Oct/2014:13:04:08 -0700] - dbp->open("NetscapeRoot/id2entry.db4") failed: Invalid argument (22) [28/Oct/2014:13:04:08 -0700] - dblayer_instance_start fail: Invalid argument (22) [28/Oct/2014:13:04:08 -0700] - start: Failed to start databases, err=22 Invalid argument [28/Oct/2014:13:04:08 -0700] - Failed to start database plugin ldbm database [28/Oct/2014:13:04:08 -0700] - WARNING: ldbm instance userRoot already exists

1 0

Re: [389-users] SSL connection with 'startTLS' problem [solved]
by Karel Lang AFD 25 Oct '14

25 Oct '14

Hi list, problem is solved. 1. i had to create real user with pw to search through the ldap because i tried to use machine printer acc at first, but ldap server wont allow user without pw doing bind ops more info https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.1/… 2. i had to specify username with full DN patch on the printer (not just 'username' e.g. 'smith' alone) after specifying uid=smith,ou=users,dc=example,dc=com in the ldap printer settings, printer started finally getting users authorized x 389ds. 3. The 'startTLS' inside SSL is probably a minor problem, because the 389ds can handle it (discard it) and then continue with regular user/pw authentication. very usefull were : https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.1/… https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.1/… to debug the 389ds log messages cheers, On 10/25/2014 02:00 PM, 389-users-request(a)lists.fedoraproject.org wrote: > Send 389-users mailing list submissions to > 389-users(a)lists.fedoraproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://admin.fedoraproject.org/mailman/listinfo/389-users > or, via email, send a message with subject or body 'help' to > 389-users-request(a)lists.fedoraproject.org > > You can reach the person managing the list at > 389-users-owner(a)lists.fedoraproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of 389-users digest..." > > > Today's Topics: > > 1. SSL connection with 'startTLS' problem (Karel Lang AFD) > 2. Please take an action: 389 Directory Server 1.2.11.X > Discontinued for EL6 (Noriko Hosoi) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 25 Oct 2014 00:20:59 +0200 > From: Karel Lang AFD <lang(a)afd.cz> > To: 389-users(a)lists.fedoraproject.org > Subject: [389-users] SSL connection with 'startTLS' problem > Message-ID: <544AD0CB.2080201(a)afd.cz> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi guys, > please anyone could help me to decode error in access log? > > Problem desr.: > I need to make Ricoh C3001 printer authenticate x 389 DS. > > The printer stubbornly tries to start TLS inside SSL connection (if i > read the log file correct?) and the authentication fails, because 389 > doesn't know what to make off it (i think) see: > > The server uses ldaps:// method of connection on 636 port (with > selfsigned certificates). > > [20/Oct/2014:18:31:50 +0200] conn=38 fd=70 slot=70 SSL connection from > 192.168.2.139 to 192.168.2.245 > [20/Oct/2014:18:31:50 +0200] conn=38 SSL 256-bit AES > [20/Oct/2014:18:31:50 +0200] conn=38 op=0 EXT > oid="1.3.6.1.4.1.1466.20037" name="startTLS" > [20/Oct/2014:18:31:50 +0200] conn=38 op=0 RESULT err=1 tag=120 > nentries=0 etime=0 > [20/Oct/2014:18:31:50 +0200] conn=38 op=1 BIND dn="RICOH2-SB$" > method=128 version=3 > [20/Oct/2014:18:31:50 +0200] conn=38 op=1 RESULT err=53 tag=97 > nentries=0 etime=0 > [20/Oct/2014:18:31:51 +0200] conn=38 op=2 UNBIND > [20/Oct/2014:18:31:51 +0200] conn=38 op=2 fd=70 closed - U1 > > The 'err=53' means "server is unwilling to perform" and i see same > message in the printer logs > > also, you can see the printer starts 'extended operation': > EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" > which i think it should not? (because it is already SSL conn from start?) > > different encryption (same result): > [root@srv-022 slapd-srv-022]# cat access | grep conn=48 > [20/Oct/2014:18:35:56 +0200] conn=48 fd=68 slot=68 SSL connection from > 192.168.2.139 to 192.168.2.245 > [20/Oct/2014:18:35:57 +0200] conn=48 SSL 128-bit RC4 > [20/Oct/2014:18:35:57 +0200] conn=48 op=0 EXT > oid="1.3.6.1.4.1.1466.20037" name="startTLS" > [20/Oct/2014:18:35:57 +0200] conn=48 op=0 RESULT err=1 tag=120 > nentries=0 etime=1 > [20/Oct/2014:18:35:57 +0200] conn=48 op=1 BIND dn="RICOH2-SB$" > method=128 version=3 > [20/Oct/2014:18:35:57 +0200] conn=48 op=1 RESULT err=53 tag=97 > nentries=0 etime=0 > [20/Oct/2014:18:35:57 +0200] conn=48 op=2 UNBIND > [20/Oct/2014:18:35:57 +0200] conn=48 op=2 fd=68 closed - U1 > > > Please note the different encryption i tried to use - for eg. 128-bit > RC4 and 256-bit AES etc, but all produces same result. > > > The printer has choice for usinge of ssl: > ssl 2.0 (set to 'yes) > ssl 3.0 (set to 'yes') > tls (i set this option to "NO" - but made no difference and result is > still same) > > Also, the printer has only 2options: > 1. > use SSL/TLS - if i check this, port 636 is automatically used > > 2. > dont use SSL/TLS - if i check this option, port 389 is used > > Not much else to pick on (ofc there is other LDAP things to fill up like > hostname etc.) > > I think this looks like client problem? Or do you think i can try to > tune up something on the server side? - anybody had experienced similar > troubles? > > -- *Karel Lang* *Unix/Linux Administration* lang(a)afd.cz | +420 731 13 40 40 AUFEER DESIGN, s.r.o. | www.aufeerdesign.cz

1 0

SSL connection with 'startTLS' problem
by Karel Lang AFD 25 Oct '14

25 Oct '14

Hi guys, please anyone could help me to decode error in access log? Problem desr.: I need to make Ricoh C3001 printer authenticate x 389 DS. The printer stubbornly tries to start TLS inside SSL connection (if i read the log file correct?) and the authentication fails, because 389 doesn't know what to make off it (i think) see: The server uses ldaps:// method of connection on 636 port (with selfsigned certificates). [20/Oct/2014:18:31:50 +0200] conn=38 fd=70 slot=70 SSL connection from 192.168.2.139 to 192.168.2.245 [20/Oct/2014:18:31:50 +0200] conn=38 SSL 256-bit AES [20/Oct/2014:18:31:50 +0200] conn=38 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [20/Oct/2014:18:31:50 +0200] conn=38 op=0 RESULT err=1 tag=120 nentries=0 etime=0 [20/Oct/2014:18:31:50 +0200] conn=38 op=1 BIND dn="RICOH2-SB$" method=128 version=3 [20/Oct/2014:18:31:50 +0200] conn=38 op=1 RESULT err=53 tag=97 nentries=0 etime=0 [20/Oct/2014:18:31:51 +0200] conn=38 op=2 UNBIND [20/Oct/2014:18:31:51 +0200] conn=38 op=2 fd=70 closed - U1 The 'err=53' means "server is unwilling to perform" and i see same message in the printer logs also, you can see the printer starts 'extended operation': EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" which i think it should not? (because it is already SSL conn from start?) different encryption (same result): [root@srv-022 slapd-srv-022]# cat access | grep conn=48 [20/Oct/2014:18:35:56 +0200] conn=48 fd=68 slot=68 SSL connection from 192.168.2.139 to 192.168.2.245 [20/Oct/2014:18:35:57 +0200] conn=48 SSL 128-bit RC4 [20/Oct/2014:18:35:57 +0200] conn=48 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [20/Oct/2014:18:35:57 +0200] conn=48 op=0 RESULT err=1 tag=120 nentries=0 etime=1 [20/Oct/2014:18:35:57 +0200] conn=48 op=1 BIND dn="RICOH2-SB$" method=128 version=3 [20/Oct/2014:18:35:57 +0200] conn=48 op=1 RESULT err=53 tag=97 nentries=0 etime=0 [20/Oct/2014:18:35:57 +0200] conn=48 op=2 UNBIND [20/Oct/2014:18:35:57 +0200] conn=48 op=2 fd=68 closed - U1 Please note the different encryption i tried to use - for eg. 128-bit RC4 and 256-bit AES etc, but all produces same result. The printer has choice for usinge of ssl: ssl 2.0 (set to 'yes) ssl 3.0 (set to 'yes') tls (i set this option to "NO" - but made no difference and result is still same) Also, the printer has only 2options: 1. use SSL/TLS - if i check this, port 636 is automatically used 2. dont use SSL/TLS - if i check this option, port 389 is used Not much else to pick on (ofc there is other LDAP things to fill up like hostname etc.) I think this looks like client problem? Or do you think i can try to tune up something on the server side? - anybody had experienced similar troubles? -- *Karel Lang*

3 2

Error code 51 and replication errors
by Shilen Patel 22 Oct '14

22 Oct '14

Hi, I'm running 1.2.11.32. I have 6 replicas (two of which are read-only). I ran into an issue where a DELETE operation failed on a server with error code 51 (ldap busy). [21/Oct/2014:23:44:44 -0400] conn=78160 op=39510 RESULT err=51 tag=107 nentries=0 etime=3 csn=5447282c000300050000 The application retried the delete several times for a couple of hours (while the server wasn't getting any other requests) and the result was always the same (err=51). Each time that happened, the error log had the following: [21/Oct/2014:23:44:44 -0400] - Retry count exceeded in delete My first question is, what would cause a problem like this? I simply restarted that directory and then the update succeeded. However, when the update went to the other 5 servers, they failed in the same way and the same error was logged in their log files. But the update wasn't retried. It was just skipped and future updates via replication succeeded on those 5 servers. My second question is, what's the best way to monitor for these types of replication errors? In this case, nsds5replicaLastUpdateStatus did not indicate a problem. If I had not been looking at the error file on those 5 hosts, I'm wondering how I would have known that a delete failed to replicate to them. If the answer is to just have something monitoring the error log files, are there specific search strings to look for to separate out updates that have failed and won't be retried from other errors (e.g. temporary connection issues)? Just curious if there is a best practice here. Thanks! - Shilen

2 7

Searching for userCertificate
by Graham Leggett 21 Oct '14

21 Oct '14

Hi all, I am trying to research how it might be possible to do a directory search for an exact match on a digital certificate storing in userCertificate. Most specifically, I want to do a simple lookup based on a binary match of the cert, its not enough to do the combination of DN and serial number. Does anyone know whether a simple search will work with 389ds or if there are any gotchas to look out for? Some googling would suggest that openldap can’t do it, I was wondering if 389ds had the same problem. Regards, Graham —

2 1

Re: [389-users] Searching for userCertificate
by Howard Chu 21 Oct '14

21 Oct '14

> Date: Tue, 21 Oct 2014 13:29:32 +0200 > From: Graham Leggett <minfrin(a)sharp.fm> > Hi all, > > I am trying to research how it might be possible to do a directory search for an exact match on a digital certificate storing in userCertificate. Most specifically, I want to do a simple lookup based on a binary match of the cert, its not enough to do the combination of DN and serial number. > > Does anyone know whether a simple search will work with 389ds or if there are any gotchas to look out for? Some googling would suggest that openldap can’t do it, I was wondering if 389ds had the same problem. The userCertificate attribute is defined in RFC4523 with a specific syntax, and only supports the certificateExactMatch matching rule. OpenLDAP implements this RFC, along with the rest of the LDAPv3 spec. In the past, before the certificateExactMatch matching rule was defined (LDAPv2 days), it was common practice to change the core.schema definition of userCertificate to use octetString syntax, and the corresponding octetStringMatch equality matching rule. You can still do this in OpenLDAP, although it obviously breaks compatibility with the standards. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

SASL configuration
by Dhiraj Deshpande 21 Oct '14

21 Oct '14

Hi folks, Need to configure sasl mecanism so that i can use DIGEST-MD5 mechanism with my autofs configuration. With PLAIN it is working fine but need to use DIGEST-MD5. Where i can specify. [root@ibm001 ~]# cat /etc/autofs_ldap_auth.conf <?xml version="1.0" ?>  <autofs_ldap_sasl_conf usetls="no" tlsrequired="no" authrequired="yes" authtype="DIGEST-MD5" user="proxyuser" secret="XXX" /> -- Thanks & Regards Dhiraj S. Deshpande

1 1

stable packages for Centos 7
by Angel Bosch 20 Oct '14

20 Oct '14

hi, I'm planing to migrate some of my servers to 1.3 branch and I don't know what packages to use. I've found packages from mreynolds: http://copr.fedoraproject.org/coprs/mreynolds/389-ds-base/ and dfas: http://copr.fedoraproject.org/coprs/dfas/389-ds-dfas/ first one seems to be a nightly and I would like to mantain an stable install. should I use dfas? by the way, is the policy-packages situation going to be solved anytime? I found very confusing having to deal with several repos to get a full installation of 389 DS, and I though this spliting thing was temporary just for EL6. thanks for your time, abosch --

2 2

Announcing 389 Directory Server version 1.3.2.24
by Noriko Hosoi 17 Oct '14

17 Oct '14

389 Directory Server 1.3.2.24 The 389 Directory Server team is proud to announce 389-ds-base version 1.3.2.24. Fedora packages are available from the Fedora 20 repository. The new packages and versions are: * 389-ds-base-1.3.2.24-1 A source tarball is available for download at Download Source <http://www.port389.org/binaries/389-ds-base-1.3.2.24.tar.bz2> Highlights in 1.3.2.24 * Various bugs were fixed. Installation and Upgrade See Download <http://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install, use *yum install 389-ds* yum install 389-ds After install completes, run *setup-ds-admin.pl* to set up your directory server. setup-ds-admin.pl To upgrade, use *yum upgrade* yum upgrade After upgrade completes, run *setup-ds-admin.pl -u* to update your directory server/admin server/console information. setup-ds-admin.pl -u See Install_Guide <http://www.port389.org/docs/389ds/legacy/install-guide.html> for more information about the initial installation, setup, and upgrade See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://admin.fedoraproject.org/mailman/listinfo/389-users If you find a bug, or would like to see a new feature, file it in our Trac instance: https://fedorahosted.org/389 Detailed Changelog since 1.3.2.23 * Ticket 47457 - default nsslapd-sasl-max-buffer-size should be 2MB * Ticket 47748 - Simultaneous adding a user and binding as the user could fail in the password policy check * Ticket 47750 - Creating a glue fails if one above level is a conflict or missing * Ticket 47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry’s DN must be adjusted. * Ticket 47875 - dirsrv not running with old openldap * Ticket 47885 - deref plugin should not return references with noc access rights * Ticket 47885 - did not always return a response control * Ticket 47889 - DS crashed during ipa-server-install on test_ava_filter * Ticket 47897 - Need to move slapi_pblock_set(pb, SLAPI_MODRDN_EXISTING_ENTRY, original_entry->ep_entry) prior to original_entry overwritten * Ticket 47900 - Adding an entry with an invalid password as rootDN is incorrectly rejected * Ticket 47900 - Server fails to start if password admin is set * Ticket 47907 - ldclt: assertion failure with -e “add,counteach” -e “object=,rdn=uid:test[A=INCRNNOLOOP(0;24 * Ticket 47918 - result of dna_dn_is_shared_config is incorrectly used * Ticket 47919 - ldbm_back_modify SLAPI_PLUGIN_BE_PRE_MODIFY_FN does not return even if one of the preop plugins fails. * Ticket 47920 - Encoding of SearchResultEntry is missing tag * Ticket 47922 - dynamically added macro aci is not evaluated on the fly http://www.port389.org/docs/389ds/releases/release-1-3-2-24.html

1 0

Announcing 389 Directory Server version 1.3.3.5
by Noriko Hosoi 17 Oct '14

17 Oct '14

389 Directory Server 1.3.3.5 The 389 Directory Server team is proud to announce 389-ds-base version 1.3.3.5. Fedora packages are available from the Fedora 21 and Rawhide repositories. The new packages and versions are: * 389-ds-base-1.3.3.5-1 A source tarball is available for download at Download Source <http://www.port389.org/binaries/389-ds-base-1.3.3.5.tar.bz2> Highlights in 1.3.3.5 * Several bugs are fixed. Installation and Upgrade See Download <http://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install, use *yum install 389-ds* yum install 389-ds After install completes, run *setup-ds-admin.pl* to set up your directory server. setup-ds-admin.pl To upgrade, use *yum upgrade* yum upgrade After upgrade completes, run *setup-ds-admin.pl -u* to update your directory server/admin server/console information. setup-ds-admin.pl -u See Install_Guide <http://www.port389.org/docs/389ds/legacy/install-guide.html> for more information about the initial installation, setup, and upgrade See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://admin.fedoraproject.org/mailman/listinfo/389-users If you find a bug, or would like to see a new feature, file it in our Trac instance: https://fedorahosted.org/389 Detailed Changelog since 1.3.3.3 * Ticket 47750 - Creating a glue fails if one above level is a conflict or missing * Ticket 47838 - harden the list of ciphers available by default (phase 2) * Ticket 47880 - provide enabled ciphers as search result * Ticket 47892 - Fix remaining compiler warnings * Ticket 47892 - coverity defects found in 1.3.3.x * Ticket 47897 - Need to move slapi_pblock_set(pb, SLAPI_MODRDN_EXISTING_ENTRY, original_entry->ep_entry) prior to original_entry overwritten * Ticket 47899 - Fix slapi_td_plugin_lock_init prototype * Ticket 47900 - Adding an entry with an invalid password as rootDN is incorrectly rejected * Ticket 47900 - Server fails to start if password admin is set * Ticket 47907 - ldclt: assertion failure with -e “add,counteach” -e “object=,rdn=uid:test[A=INCRNNOLOOP(0;24999;5)]” * Ticket 47908 - 389-ds 1.3.3.0 does not adjust cipher suite configuration on upgrade, breaks itself and pki-server * Ticket 47912 - Proper handling of “No original_tombstone for changenumber” errors * Ticket 47916 - plugin logging parameter only triggers result logging * Ticket 47918 - result of dna_dn_is_shared_config is incorrectly used * Ticket 47919 - ldbm_back_modify SLAPI_PLUGIN_BE_PRE_MODIFY_FN does not return even if one of the preop plugins fails. * Ticket 47920 - Encoding of SearchResultEntry is missing tag * Ticket 47922 - dynamically added macro aci is not evaluated on the fly http://www.port389.org/docs/389ds/releases/release-1-3-3-5.html

1 0

custom object classes and attributes
by Chase Miller 17 Oct '14

17 Oct '14

Hello, So I have a development ldap server up and running with all of my custom object classes and attributes. Now, is there a way to export these and import them on my new production boxes, so I don't have to re-create all of them. Chase

2 1

Regarding patch availability for RHBA-2014:1623-1
by Balaji P 17 Oct '14

17 Oct '14

Hi While analyzing this problem we noticed this issue is released for RHEL in version 1.2.11.15 version. Is it possible to deliver the fix in 1.2.8.2 and 1.2.11.32 streams? (or) Is there any patch available for this fix? Bug Fix Advisory - RHBA-2014:1623-1 ------------------------------------------------------------------------------ Summary: 389-ds-base bug fix update Updated 389-ds-base packages that fix one bug are now available for Red Hat Enterprise Linux 6. Description: The 389 Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. This update fixes the following bug: * Bug fixes for replication conflict resolution (BZ#1080185) introduced a memory leak bug, which increased the size of the Directory Server. With this update, the memory leak code has been fixed, and the size of the Directory Servers in the replication topology is now stable under the stress. (BZ#1147479) Users of 389-ds-base are advised to upgrade to these updated packages, which fix this bug. After installing this update, the 389 server service will be restarted automatically. Thanks, Balaji P

2 1

How relevant is Poodlebleed Bug to 389?
by Jan Tomasek 17 Oct '14

17 Oct '14

Hello, is http://poodlebleed.com/ related to 389? I think it is, this is not implementation flaw in OpenSSL, this seems to be related to the SSLv3 design. I've found: http://directory.fedoraproject.org/docs/389ds/design/nss-cipher-design.html but new syntax with -SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA doesn't seem to be working on my system: ldap-dev:~# yum list installed |grep 389 389-admin.x86_64 1.1.29-1.el5 389-admin-console.noarch 1.1.8-1.el5 389-admin-console-doc.noarch 1.1.8-1.el5 389-adminutil.x86_64 1.1.20-1.el5 389-console.noarch 1.1.7-3.el5 389-ds.noarch 1.2.1-1.el5 389-ds-base.x86_64 1.2.11.28-1.el5 389-ds-base-devel.x86_64 1.2.11.28-1.el5 389-ds-base-libs.x86_64 1.2.11.28-1.el5 389-ds-console.noarch 1.2.6-1.el5 389-ds-console-doc.noarch 1.2.6-1.el5 389-dsgw.x86_64 1.1.11-1.el5 I'm running on CentOS 5 with EPEL sources. Thanks -- ----------------------- Jan Tomasek aka Semik http://www.tomasek.cz/

5 8

restore ou use/groups
by Ghiurea, Isabella 16 Oct '14

16 Oct '14

Hi LIst, I'm testing my backups/rstore procedures , I need to know if there is away to restore user/groups using db2bak or db2bak.p ? or All this entries are stored only in dse.cfg file ? Isabella

1 0

Re: [389-users] 389 console
by Rich Megginson 16 Oct '14

16 Oct '14

On 10/16/2014 10:52 AM, Ghiurea, Isabella wrote: > OK, I had to restart both the ds and admin service on second host and admin console on host1, there is a lot of cacheing, every time for a new change to show up in Admin console. Please keep replies on-list. I'm not sure what you mean. There is no "caching". In order to see a change in the admin console, you should just have to go to View and do Refresh. At most, you should have to restart the console. > The setup-ds-admin.pl script re-create the whole ds instance , which I would prefered not .Do you know if there is a way to re-create only the admin server cfg part and keep my existing ds instance on second host? You might be able to use register-ds-admin.pl > > > Thank you Rich > Isabella > > > ________________________________________ > From: Rich Megginson [rmeggins(a)redhat.com] > Sent: Wednesday, October 15, 2014 7:03 PM > To: Ghiurea, Isabella; 389-users(a)lists.fedoraproject.org > Subject: Re: 389 console > > On 10/15/2014 04:55 PM, Ghiurea, Isabella wrote: >> Thank you Rich, >> I did that but I'm back to server1 ujsing 389UI Admin console and can't see the second host: server2.org , do I need to to register or reboot anything ? > setup-ds-admin.pl should have done that for you if you correctly > specified the configuration ds. If not, then I'm not sure what else you > can do except start over from scratch. > >> Isabella >> >> ________________________________________ >> From: Ghiurea, Isabella >> Sent: Wednesday, October 15, 2014 6:26 PM >> To: 389-users(a)lists.fedoraproject.org >> Subject: 389 console >> >> HI List, >> I need to know how can I add a second host entry to 389 UI Admin console under same Admin Domain , >> I already have an Admin domain :mytest.com and host name server1.org.com , need to add another server2.org.com same domain . >> >> Thank you >> Isabella

1 0

389 console
by Ghiurea, Isabella 15 Oct '14

15 Oct '14

HI List, I need to know how can I add a second host entry to 389 UI Admin console under same Admin Domain , I already have an Admin domain :mytest.com and host name server1.org.com , need to add another server2.org.com same domain . Thank you Isabella

3 4

RHEL / CentOS 7
by Gordon Messmer 15 Oct '14

15 Oct '14

What's the status of 389 DS on RHEL 7? As I recall, when Red Hat originally started shipping "389-ds-base" it lacked replication and windows sync, which were available with a separate paid subscription. Do the RHEL packages include those bits now? Are there any plans to get the admin and console packages into EPEL? Should I just move ahead building the Fedora srpms on my own system?

2 1

how to install a server cert the DS is down
by Ghiurea, Isabella 10 Oct '14

10 Oct '14

HI lIst, need to know how to replace an existing server cert , I have the new one signed by CA and need to know how to installed , I just copy in /etc/pki/tls/certs ( 389admin UI not working) Is this sufficient? Thank you

2 1

Re: [389-users] load balancing options
by Ghiurea, Isabella 09 Oct '14

09 Oct '14

Hi Paul, any estimate of cost the software ? any opensource available. you are aware ? is DNS round robin common used for DS load balancing cfg ? Thank you ________________________________________ From: Ghiurea, Isabella Sent: Thursday, October 09, 2014 2:12 PM To: 389-users(a)lists.fedoraproject.org Subject: load balancing options Hi List, I would like to know what other options people are using for DS laod balancing, beside round robin DNS? I'm interested in a software solution than hardaware :clustering . Thank you Isabell

3 2

load balancing options
by Ghiurea, Isabella 09 Oct '14

09 Oct '14

Hi List, I would like to know what other options people are using for DS laod balancing, beside round robin DNS? I'm interested in a software solution than hardaware :clustering . Thank you Isabell

2 1

Slapd stops processing queries or providing SSL certs
by William 03 Oct '14

03 Oct '14

Hi, Our slapd instance stopped responding to queries or processing queries this morning. There are no errors in the log that aren't normal for operation, nothing in abrt, and no apparent limits that we are hitting up against. Is this a known issue, or is there a way to start investigating this? Any tips are appreciated. -- William <william(a)firstyear.id.au>

2 2

389 Master - Master Replication
by Santos Ramirez 03 Oct '14

03 Oct '14

Good Morning, We have a master - master replication agreement. When we initialize the replication it works perfectly we can see changes to a test user we have set up go up and down from the two servers. However at some point the replication stops and we cannot get replication to start once again. The only way we can get replication to start once again is to recreate the replication agreement and then it fails again. Can anyone please point us in a direction. I am relatively new to 389 so any help would be greatly appreciated. Santos U. Ramirez Linux Systems Administrator National DCP, LLC 150 Depot Street Bellingham, Ma. 02019 Phone: 508-422-3089 Fax: 508-422-3866 Santos.Ramirez(a)natdcp.com<mailto:Santos.Ramirez@natdcp.com> This email and any attachments are intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, do not copy or forward to any unauthorized persons, permanently delete the original and notify the sender by replying to this email.

3 9

389DS memeberof plugin not working
by Ghiurea, Isabella 01 Oct '14

01 Oct '14

Hello 389 users, I'm having problems getting the memberof plugin work on 389-Directory/1.2.11.15 B2014.219.179. We are using groupofuniquenames groups. Here's the configuration of the memberof plugin: objectClass: extensibleObject (auxiliary) objectClass: nsSlapdPlugin (structural) objectClass: top (abstract) cn: MemberOf Plugin nssldap-pluginDescription: none nssldap-pluginEnabled: on nssldap-pluginId: none nssldap-pluginInitfunc: memberof_postop_init nssldap-pluginPath: libmemberof-plugin nssldap-pluginType: postoperation nssldap-pluginVendor: none nssldap-pluginVersion: none nssldap-plugin-depends-on-type: database memberofattr: memberOf memberofgroupattr: uniquemember Adding members to a group do not trigger the creation of the corresponding memberof attributes on those members. What are we missing? Thank you, Adrian

2 3

Proper handling of "No original_tombstone for changenumber" errors
by Anthony Joseph Messina 01 Oct '14

01 Oct '14

Using two fully updated FreeIPA F20 masters with freeipa- server-3.3.5-1.fc20.x86_64 and 389-ds-base-1.3.2.23-1.fc20.x86_64, I've noticed that I'm getting a lot of the following errors in the 389 DS error log, especially at server startup. "No original_tombstone for changenumber=511851,cn=changelog!!" Most often, the same changenumber repeats over and over, but there are some other changenumbers listed as well. The changenumbers are different on each master. My concern is I'm preparing my thought process about the upcoming upgrade from F20 to F21 and it looks like I may need to create a new FreeIPA master and "migrate" the Dogtag stuff, etc. rather than a simple "yum upgrade" on each master. Yuck! What is the proper way to correct for these apparent errors and get these masters working with each other in a clean manner? Thanks. -A -- Anthony - https://messinet.com/ - https://messinet.com/~amessina/gallery 8F89 5E72 8DF0 BCF0 10BE 9967 92DC 35DC B001 4A4E

2 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users October 2014