March 2014 - 389-users - Fedora mailing-lists

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

multi-valued nsAccountLock
by Pierre ROUDIER 10 Jul '15

10 Jul '15

Hi all, RedHat DS's doc states that the nsAccountLock attribute is multi-valued [1]. Some tests with 389ds led me to think it's also true for 389ds. I cannot think of any reason explaining why it would have to be multi-valued. Do you have any idea? Thank you. [1] https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server…

3 2

changelog
by Denise Cosso 16 Apr '15

16 Apr '15

Hi, How to modify the attribute nsslapd-encryptionalgorithm in Centos? Thanks, Denise Stop Master servers and set nsslapd-encryptionalgorithm. The allowed value is AES or 3DES. dn: cn=changelog5,cn=config [...] nsslapd-encryptionalgorithm: AES --- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu: De: Rich Megginson <rmeggins(a)redhat.com> Assunto: Re: [389-users] changelog Para: "Denise Cosso" <guanaes51(a)yahoo.com.br> Data: Terça-feira, 4 de Junho de 2013, 16:34 On 06/04/2013 01:26 PM, Denise Cosso wrote: Hi, Rich CentOS release 6.3 (Final) 389-ds-base-libs-1.2.10.2-20.el6_3.x86_64 389-ds-1.2.2-1.el6.noarch 389-dsgw-1.1.10-1.el6.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-ds-console-doc-1.2.6-1.el6.noarch 389-ds-base-1.2.10.2-20.el6_3.x86_64 As far as replication goes - you will need to use a security layer (SSL, TLS, or GSSAPI) to protect the clear text password on the wire As far as encrypting it in the changelog - not sure Denise --- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu: De: Rich Megginson <rmeggins(a)redhat.com> Assunto: Re: [389-users] changelog Para: "General discussion list for the 389 Directory server project." <389-users(a)lists.fedoraproject.org> Cc: "Denise Cosso" <guanaes51(a)yahoo.com.br> Data: Terça-feira, 4 de Junho de 2013, 16:11 On 06/04/2013 12:39 PM, Denise Cosso wrote: Hi, Description of problem: When a userPassword is changed in a server with changelog, the hashed password is logged and also a cleartext pseudo-attribute version. It looks like this: change:: replace: userPassword userPassword: {SHA256}vqtiN2LHdrEUOJUKu+IBVqAVFsAlvFw+11kD/Q== - replace: unhashed#user#password unhashed#user#password: secret12 This unhashed version is used in winsync where the cleartext version of the password must be written to the AD. Now if the DS is involved in replication with another DS, the change will be replayed exactly as it is logged to the other DS replicas, including the cleartext pseudo-attribute password. What platform? What version of 389-ds-base are you using? thanks, Denise -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

2 2

389 Master - Master Replication
by Santos Ramirez 03 Oct '14

03 Oct '14

Good Morning, We have a master - master replication agreement. When we initialize the replication it works perfectly we can see changes to a test user we have set up go up and down from the two servers. However at some point the replication stops and we cannot get replication to start once again. The only way we can get replication to start once again is to recreate the replication agreement and then it fails again. Can anyone please point us in a direction. I am relatively new to 389 so any help would be greatly appreciated. Santos U. Ramirez Linux Systems Administrator National DCP, LLC 150 Depot Street Bellingham, Ma. 02019 Phone: 508-422-3089 Fax: 508-422-3866 Santos.Ramirez(a)natdcp.com<mailto:Santos.Ramirez@natdcp.com> This email and any attachments are intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, do not copy or forward to any unauthorized persons, permanently delete the original and notify the sender by replying to this email.

3 9

Netscape Portable Runtime error -5982
by Paolo Barbato 04 Apr '14

04 Apr '14

After a while I start again to work on 389 ds. 389ds last released from epel, is installed on a rhel 6.5, that host also other services (bind, dhcpd, radius.....). Such server is configured with some virtual nic. I noticed starting 389ds the following error: intranet5...[14/Feb/2014:08:30:20 +0100] createprlistensockets - PR_Bind() on All Interfaces port 636 failed: Netscape Portable Runtime error -5982 (Local Network address is in use.) I've tried to insert in dse.ldif directives like nsslapd-listenhost: 192.168.60.23 nsslapd-securelistenhost: 192.168.60.23 but it comes a more "IP specific" error : intranet5...[14/Feb/2014:10:01:34 +0100] createprlistensockets - PR_Bind() on 192.168.60.23 port 636 failed: Netscape Portable Runtime error -5982 (Local Network address is in use.) finally I noticed: [root@intranet5 dirsrv]# netstat -anp | grep 636 udp 0 0 0.0.0.0:636 0.0.0.0:* 1342/portreserve such service clearly conflict with 389ds ldaps It seems I'm facing bug https://bugzilla.redhat.com/show_bug.cgi?id=848414 since I really have tested also openldap [root@intranet5 dirsrv]# more /etc/portreserve/slapd ldaps from portreserve man I read For each service configuration file, a socket is created and bound to the appropriate port. A service wishing to bind to its port must first run portrelease, which instructs portreserve to release the port associated with the service. It seems so that 389ds be not aware of portreserve . Shoud I simply remove /etc/portreserve/slapd and restart portreserve ? Regards, Paolo. ------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------

1 2

Windows sync agreement - Received result code 34
by Vesa Alho 03 Apr '14

03 Apr '14

Hi, I'm trying to get Windows AD sync working. When trying to start full re-syncronization, I get the errors listed below. I've tried to verify all settings, but haven't figured out what could cause this. It seems to use value (null) with DN, but why? Other information: 389 => 1.2.11.25 (dc=example,dc=com) AD => Windows 2012 R2 (dc=example,dc=login) ==> notice, domain names are different! Windows sync agreement details Windows domain: example.login DS subtree: ou=People,dc=example,dc=com Windows subtree: cn=People,dc=example,dc=login Replicated subtree: dc=example,dc=com My goal is to sync 389 users to one OU/CN under AD and groups to different OU/CN. I'm not sure if this even possible, but was hoping to achieve this by creating separate sync agreements for users and groups. PS. thanks for excellent software and support! -Vesa [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): map_entry_dn_inbound: problem looking for username: -1 [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): windows_process_total_entry: Looking dn="uid=user1,ou=People,dc=example,dc=com" (ours) [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): map_entry_dn_outbound: looking for AD entry for DS dn="uid=user1,ou=People,dc=example,dc=com" guid="c647c882ee76ab4aac2239ef81ebebb7" [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): map_entry_dn_outbound: looking for AD entry for DS dn="uid=user1,ou=People,dc=example,dc=com" username="user1" [12/Mar/2014:10:23:56 +0200] - Calling windows entry search request plugin [12/Mar/2014:10:23:56 +0200] - windows_search_entry: received 1 messages, 0 entries, 0 references [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): map_entry_dn_outbound: entry not found - rc 0 [12/Mar/2014:10:23:56 +0200] - Windows sync entry: Created new remote entry: dn:: Y249VHVvbWFzIFN5cmrDpG5lbiwobnVsbCk= objectClass: top objectClass: person objectClass: organizationalperson objectClass: user userprincipalname: user1(a)example.login cn:: VHVvbWFzIFN5cmrDpG5lbg== givenName: First mail: First.Last(a)example.com sAMAccountName: user1 accountExpires: 9223372036854775807 sn:: U3lyasOkbmVu telephoneNumber: codePage: 0 [12/Mar/2014:10:23:56 +0200] - Attempting to add entry cn=First Last,(null) to AD for local entry uid=user1,ou=People,dc=example,dc=com [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): Received result code 34 (0000208F: NameErr: DSID-03100225, problem 2006 (BAD_NAME), data 8350, best match of: '(null)' ) for add operation [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): windows_replay_update: Cannot replay add operation. [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): Beginning linger on the connection [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): windows_tot_run: failed to obtain data to send to the consumer; LDAP error - 1

2 6

Serious write-performance problems on RHEL6
by Steve Holden 01 Apr '14

01 Apr '14

Hi, folks I'm hoping to use 389 DS to replace our ancient Sun DS 5.2 service. I've hit a snag with my 389 development server; it's performance far worse than the 10 year-old servers it's intended to replace. Things looked promising: the old directory data has been imported (with only minor changes), read requests perform reasonably well, and isolated write requests are ok. However, even after a small number (typically 6) of consecutive write requests (basic attribute changes to a single entry, say) the ns-slapd process hits >100% CPU (of 2 CPUs) and stays there for *at least* 10 seconds per update, and blocks the client process attempting the update. I can't see anything obvious in the performance counters or the logs to suggest a problem. The updates are logged with "etime=0" in the access log. I've tried enabling different log levels in the error log. Is it normal for the Plugin level to show constant re-scanning of CoS templates? I'd be very grateful for any suggestions of how I can go about tracing where the Problem might be and how to resolve it... Best wishes, Steve Details The RHEL6.5 server is a VMware ESXi VM with 8GB RAM and 2x CPUs, and is running the latest EPEL package for RHEL6 (v1.2.11.15-32). (After a package upgrade a few weeks ago, I ran "setup-ds-admin.pl -u"). The directory contains in excess of 200,000 entries, and its databases consume over 3.5GB on disk. The userRoot database has therefore been configured with a 4GB cache (and the general LDBM max cache is set at 6GB - though it's quite possible I haven't understood how to set these correctly - I've tried smaller numbers of each). The directory contains custom attributes, some of which are CoS, and many of which have been indexed (AFAIK, all attributes have been re-indexed). No replication has been configured so far. ___________________________________________________________ This email has been scanned by MessageLabs' Email Security System on behalf of the University of Brighton. For more information see http://www.brighton.ac.uk/is/spam/ ___________________________________________________________

3 7

Operations Error on object
by Michael Gettes 27 Mar '14

27 Mar '14

389-Directory/1.2.11.15 B2013.238.2155 starting up Linux 2.6.32-431.5.1.el6.x86_64 #1 SMP Fri Jan 10 14:46:43 EST 2014 x86_64 x86_64 x86_64 GNU/Linux I have an object which I am unable to operate on. I try to modify it or delete it and I get err=1 (Operations Error). it looks like: [25/Mar/2014:13:13:00 -0400] conn=348 op=3 DEL dn="nsuniqueid=cf397a8e-b11f11e3-9e1cd834-1f7e47a1,CN=Community:ByOU:XXXX,ou=Groups,dc=XXX,dc=XXX" [25/Mar/2014:13:13:00 -0400] conn=348 op=3 RESULT err=1 tag=107 nentries=0 etime=0 csn=5331b91e000000010000 Normally, the object is CN=Community:ByOU:XXXX,ou=Groups,dc=XXX,dc=XXX but when I search for CN=Community:ByOU:XXXX,ou=Groups,dc=XXX,dc=XXX I get back the nsuniqueid as part of the DN (shown above). I have dumped the LDIF and the nsuniqueid is NOT in the LDIF with this object. I have restarted the server to no avail. I have looked in bugzilla and can’t seem to find anything that looks like this problem. I am confused and seeking advice. I am somewhat worried I have objects I cannot modify or delete. I have 2 of these now and I am not sure how they are getting into this state. Any guidance is gratefully appreciated! /mrg

1 2

LAN vs WAN
by Amjad Farooq 27 Mar '14

27 Mar '14

Hi everyone, I have TWO linux machines in my office. One is on LAN (only locally-accessible) and the other on WAN (WWW-accessible). On the WAN, I have an apache server running but I also mounted a hard drive from the LAN machine using NFS so that I can easily access and transfer data files between the two machines. My question is: Is the hard drive from the LAN machine mounted on the WAN computer accessible from outside LAN? In other words, if an hacker breaks into my server on the WAN machine, will (s)he be able to access data on my NFS-mounted hard drive from the LAN machine? I would assume that since IP assigned to my LAN machine is only accessible locally, access from outside LAN to this hard drive will not be available. What do you think? Thank you for your suggestions. Amjad

3 2

Problem when trying to perform dereference searches
by Jonathan Vaughn 27 Mar '14

27 Mar '14

We've had problems with SSSD being slow sometimes, but not others, and there never seemed to be any obvious cause why, but I think I've tracked it down to problems with dereferencing. We do see errors about dereferencing in the log, but I didn't realize until now what it was referring to. In theory, a search like this should give us the cn and objectclass of all members of the group, but I get only the attributes of the group itself. Whether I give the "-E 'deref=...'" or not I get the same output. Redacted output below: ldapsearch [bind username and password stuff, etc] -E 'deref=uniqueMember:cn,objectclass' 'cn=Global System Administrators' # extended LDIF # # LDAPv3 # base <[our base DN]> (default) with scope subtree # filter: cn=Global System Administrators # requesting: ALL # with dereference control # # Global System Administrators, Groups, [our base DN] dn: cn=Global System Administrators,ou=Groups,[our base DN] control: 1.3.6.1.4.1.4203.666.5.16 false MIQAAAAA uniqueMember: uid=user1,ou=Users,ou=[Office1],[our base DN] uniqueMember: uid=user2,ou=Users,ou=[Office2],[our base DN] uniqueMember: uid=user3,ou=Users,ou=[Office2],[our base DN] uniqueMember: uid=user4,ou=Users,ou=[Office1],[our base DN] objectClass: top objectClass: groupofuniquenames objectClass: posixgroup cn: Global System Administrators gidNumber: 1001002 description: Global System Administrators # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1

2 1

_entry_set_tombstone_rdn - Failed to convert DN uid=x1 to RDN
by Felix Engel 26 Mar '14

26 Mar '14

Hello, when init. the consumer (or replicating), I get the following two errors multiple times with different uids on the master (ldap): [26/Mar/2014:08:19:53 +0100] _entry_set_tombstone_rdn - Failed to convert DN uid=x1 to RDN [26/Mar/2014:08:19:53 +0100] id2entry - str2entry returned NULL for id 217, string="rdn" ... Yet in the end: [26/Mar/2014:08:19:58 +0100] NSMMReplicationPlugin - Finished total update of replica "agmt="cn=test" (ldap3:389)". Sent 432 entries. The master (ldap) is: 389-admin-console-doc-1.1.8-1.el5 389-ds-console-doc-1.2.6-1.el5 389-admin-console-1.1.8-1.el5 389-adminutil-1.1.15-1.el5 389-ds-1.2.1-1.el5 389-console-1.1.7-3.el5 389-admin-1.1.29-1.el5 389-dsgw-1.1.11-1.el5 389-ds-console-1.2.6-1.el5 389-ds-base-libs-1.2.11.25-1.el5 389-ds-base-1.2.11.25-1.el5 The consumer (ldap3) is: 389-ds-console-doc-1.2.6-1.el5 389-admin-console-1.1.8-1.el5 389-adminutil-1.1.15-1.el5 389-ds-1.2.1-1.el5 389-console-1.1.7-3.el5 389-admin-1.1.29-1.el5 389-dsgw-1.1.11-1.el5 389-ds-console-1.2.6-1.el5 389-ds-base-libs-1.2.11.25-1.el5 389-ds-base-1.2.11.25-1.el5 389-ds-base-libs-1.2.11.15-32.el6_5.x86_64 389-console-1.1.7-1.el6.noarch 389-admin-1.1.35-1.el6.x86_64 389-ds-base-1.2.11.15-32.el6_5.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-adminutil-1.1.19-1.el6.x86_64 How do I fix this and check if the replication did indeed work or which parts might have gone wrong? Maybe this has no impact at all? The data looks ok ... Thank you, Felix

1 0

what is the latest stable version of 389 directory server code base
by G, Rajendra Babu (STSD campus) 25 Mar '14

25 Mar '14

Dear All, This is Rajendra and I'm active user/community of 389 directory server. Could you please suggest me ,what is the latest stable version of 389 Directory server code base which I we can use. It would be great if you can provide the link as well. Thanks in Advance, Best Regards, Rajendra

2 1

certutil.exe is not a valid win32 application
by Isaac Gonzalez 19 Mar '14

19 Mar '14

Hi I downloaded and installed the 389-PassSync-1.1.5-i386.msi for my windows server 2003 active directory server. I first had to install a patch (WindowsServer2003-KB942288-v4-x86.exe) to get it to install as it said I didn't have the right service pack installed even though I am running service pack 2. After installing, I couldn't import the DS certificate into it using the certutil.exe application which is included in the 389 program files directory. It says certutil.exe is not a valid win32 application. It also says the same thing about the pk12util.exe, followed with access is denied from the command prompt. Installing the 64 bit version of the app on my 64 bit domain controllers seems to not have that issue.

2 2

multi-master replication setup problem: both suppliers do "not have permission to supply replication updates to the replica"
by Jon Detert 19 Mar '14

19 Mar '14

Hi, I have two 389-ds servers. I want them to do multi-master replication to each other. Beyond these 2, there are no other servers. I tried to do this via the command-line, following RedHat's guide [2]. However, /var/log/dirsrv/slapd-*/errors says this: [18/Mar/2014:15:02:10 -0500] NSMMReplicationPlugin - conn=22 op=3 replica="o=infinityhealthcare.com": Unable to acquire replica: error: permission denied [18/Mar/2014:15:07:02 -0500] NSMMReplicationPlugin - agmt="cn=o-ihccom-to-ds2" (test-ds2:389): Unable to acquire replica: permission denied. The bind dn "uid=replica-manager,cn=config" does not have permission to supply replication updates to the replica. Will retry later. [18/Mar/2014:15:07:02 -0500] NSMMReplicationPlugin - agmt="cn=dc-ihc-dc-com-to-ds2" (test-ds2:389): Unable to acquire replica: permission denied. The bind dn "uid=replica-manager,cn=config" does not have permission to supply replication updates to the replica. Will retry later. Any ideas what to do to fix? In case it helps explain the problem, here is what one of the replication agreements looks like: dn: cn=dc-ihc-dc-com-to-ds2,cn=replica,cn=dc\3Dinfinityhealthcare\2Cdc\3Dcom,c n=mapping tree,cn=config objectClass: top objectClass: nsDS5ReplicationAgreement description: agreement to replicate dc=ihc,dc=com tree from ds1 to ds2 cn: dc-ihc-dc-com-to-ds2 nsDS5ReplicaRoot: dc=infinityhealthcare,dc=com nsDS5ReplicaHost: test-ds2.infinityhealthcare.com nsDS5ReplicaPort: 389 nsDS5ReplicaBindDN: uid=replica-manager,cn=config nsDS5ReplicaBindMethod: SIMPLE nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE authorityRevocationLis t accountUnlockTime memberof nsDS5ReplicaCredentials: {DES}Nz0qsqM5nShesnQPldsB7vYKQXOj2azjan8bTsUWxNM= nsds5replicareapactive: 0 nsds5replicaLastUpdateStart: 0 nsds5replicaLastUpdateEnd: 0 nsds5replicaChangesSentSinceStartup: nsds5replicaLastUpdateStatus: 3 Replication error acquiring replica: permissio n denied nsds5replicaUpdateInProgress: FALSE nsds5replicaLastInitStart: 0 nsds5replicaLastInitEnd: 0 and here is the replica on the other server, that this agreement refers to: dn: cn=replica,cn=dc\3Dinfinityhealthcare\2Cdc\3Dcom,cn=mapping tree,cn=config objectClass: top objectClass: nsds5replica objectClass: extensibleObject cn: replica nsDS5ReplicaRoot: dc=infinityhealthcare,dc=com nsDS5ReplicaId: 7 nsDS5ReplicaType: 3 nsDS5Flags: 1 nsds5ReplicaPurgeDelay: 604800 nsDS5ReplicaBindDN: uid=replica-manager,cn=config nsState:: BwAAAAAAAACSnChTAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAA== nsDS5ReplicaName: 8d64c603-aecc11e3-b040c130-71875861 nsds5ReplicaChangeCount: 0 nsds5replicareapactive: 0 [1] https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server… [2] https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server… Thanks, -- Jon Detert Sr. Systems Administrator Infinity Healthcare Milwaukee, Wisconsin 414-290-6759

2 3

Upgraded 389-admin rpms and now I can't start dirsrv-admin
by Groten, Ryan 19 Mar '14

19 Mar '14

Just upgraded my packages from: 389-ds-console-1.2.6-1.el5 389-console-1.1.7-1.el5 389-ds-console-doc-1.2.6-1.el5 389-admin-console-1.1.8-1.el5 389-admin-console-doc-1.1.8-1.el5 389-ds-base-1.2.9.9-1.el5 389-dsgw-1.1.7-2.el5 389-adminutil-1.1.14-1.el5 389-admin-1.1.23-1.el5 389-ds-base-libs-1.2.9.9-1.el5 To: 389-ds-console-1.2.6-1.el5 389-console-1.1.7-3.el5 389-ds-console-doc-1.2.6-1.el5 389-adminutil-1.1.19-1.el5 389-admin-console-1.1.8-1.el5 389-admin-1.1.29-1.el5 389-admin-console-doc-1.1.8-1.el5 389-dsgw-1.1.11-1.el5 389-ds-base-1.2.11.25-1.el5 389-ds-base-libs-1.2.11.25-1.el5 +perl-NetAddr-IP.x86_64 0:4.027-5.el5 +perl-Socket6.x86_64 0:0.19-3.fc6 After that I ran "setup-ds-admin.pl -u". Now I'm having problems starting dirsrv-admin: # service dirsrv-admin start Starting dirsrv-admin: httpd.worker: Syntax error on line 136 of /etc/dirsrv/admin-serv/httpd.conf: Cannot load /usr/lib64/dirsrv/modules/mod_admserv.so into server: /usr/lib64/libadminutil.so.0: undefined symbol: ldap_explode Server failed to start !!! Please check errors log for problems [FAILED] # cat /etc/redhat-release Red Hat Enterprise Linux Server release 5.9 (Tikanga) I checked any error logs I could think of but found nothing. Thanks in advance for the help! Ryan ________________________________ This communication, including any attached documentation, is intended only for the person or entity to which it is addressed, and may contain confidential, personal and/or privileged information. Any unauthorized disclosure, copying, or taking action on the contents is strictly prohibited. If you have received this message in error, please contact us immediately so we may correct our records. Please then delete or destroy the original transmission and any subsequent reply.

3 4

Sun One 5.2 to 389 DS
by Dustin Rice 18 Mar '14

18 Mar '14

Hello there, I wanted to see if anyone else out there has gone through a migration/upgrade from Sun One Directory 5.2 server to 389 DS? I'm currently working on doing just that at my organization and I've been running into a few snags. Ideally we'd want to setup a 389 consumer replica attached to our Sun One master. Over time we replace the Sun One replicas with 389 replicas until eventually all servers are 389 DS. Anywho, I do have a 389 DS consumer replica that appears to be replicating from our Sun One master, however I'm seeing a number of LDAP error 53 (server was unwilling) errors. When I upped the log level it looks like the master is trying to do an ldapadd when it should be doing an ldapmodify. So that's where I'm slightly stuck now, if anyone out there has any ideas. Thanks! -- ===================================== Dustin Rice UNIX System Administrator - CIS Portland State University =====================================

2 3

389 Management Console - How add server to list?
by Parasit Hendersson 14 Mar '14

14 Mar '14

Hi, We have four servers in our "cluster", one master and three slaves. Everything works fine with one way replication. Problem is in "389 Management Console", in tab "Servers and Applications" are only 3 servers (master and 2 slaves), how add to this list third slave?? Best Regards Parasit Hendersson

1 0

Possible memory leak in proxy auth control
by Chris Chatfield 13 Mar '14

13 Mar '14

Hi, I've been running some load tests against version 389-ds-base-1.2.11.15-30.el6_5.x86_64 on Centos 6.5. When looking at the vmsize of the ns-slapd process it appears to grow linearly, rather than reaching a plateau. After some modifications to the load test it appears that the memory usage is flat if we remove the portion that performs the proxied authentication control. I'd estimate that the size of the leak is 282 bytes per operation. Is this a known issue? Is there any extra logging or configuration that would allow me to help pinpoint the problem further? Thanks for your help, Chris

1 1

UserPassword + SambaNTPassword
by Nehal J Wani 12 Mar '14

12 Mar '14

When users login into a ldap configured machine, and type passwd to change their password, only the attribute userPassword gets changed, how do I enforce updation of sambaNTPassword also? -- Nehal J Wani

1 0

Changing default group object in 389-console
by Groten, Ryan 12 Mar '14

12 Mar '14

When adding a group from the 389-console, it creates a groupOfUniqueNames object. I'm curious if it's possible to change it so that by default only a posixGroup object is created and/or the group icon is displayed for posixGroup type objects instead. Thanks, Ryan

1 0

DS 1.3.2.14 on Sparc: Authentication method not supported
by Carsten Grzemba 12 Mar '14

12 Mar '14

some tests later I stumble in this problem: [14/03/12:10:03:41] - [Setup] Info Could not authenticate as user 'uid=admin,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot' to server 'ldap://testcsw.contac.lan:389/o=NetscapeRoot'. Error: Authentication method not supported [14/03/12:10:03:41] - [Setup] Fatal Could not register the directory server with the configuration directory server. I found in the mail archive a similar thread for PPC: [389-users] Authentication method not supported (https://lists.fedoraproject.org/pipermail/389-users/2013-July/016073.html) was there a solution found or a ticket created? THX

2 1

Re: [389-users] problem on Sparc with DS 1.3.2: Skipping entry ... which has no parent
by Carsten Grzemba 12 Mar '14

12 Mar '14

Am 11.03.14 schrieb Rich Megginson <rmeggins(a)redhat.com>: > > > > > > On 03/11/2014 07:32 AM, Carsten Grzemba wrote: > > > > > > > > Am 11.03.14 schrieb Rich Megginson <rmeggins(a)redhat.com> <rmeggins(a)redhat.com>: > > > > > > > > > > > > > > > > > > On 03/11/2014 05:57 AM, Carsten Grzemba wrote: > > > > > > > > > > interessting: it is only on 32bit build. 64bit build on Solaris10 Sparc works as expected. > > > > > > > > > > > > > > I'm not sure. I guess we could try to reproduce on Fedora 32-bit. > > > > > > > > > > > > > > the Solaris10 i386 build works without problems, only on Sparc. > > > > Then I suspect the slapi_counter code . . . > > > > was there anything changed since 1.2.11.15? In 1.2.11.15 works also all fine. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > 389 users mailing list > > > > 389-users(a)lists.fedoraproject.org > > > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > 389 users mailing list > > 389-users(a)lists.fedoraproject.org > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > > > >

5 6

Issues with PAM Pass Through and pam_krb5 with sssd
by Trey Dockendorf 11 Mar '14

11 Mar '14

I have one 389 DS server successfully using PAM Pass through that goes to a pam.d file that uses pam_krb5 for auth. I've setup a new system and am now unable to get the pass through to work. The second system is identical except it's updated to EL 6.5 while working system is EL 6.4. The second system that's not working is using SSSD instead of the PADL stack. When performing either ldapsearch using my account for bind, or performing SSH login to a client configured in SSSD with 389DS as the LDAP server, I get these errors in /var/log/dirsrv/slapd-ldap01/errors [11/Mar/2014:11:33:31 -0500] pam_passthru-plugin - Error from PAM during pam_authenticate (7: Authentication failure) [11/Mar/2014:11:33:31 -0500] pam_passthru-plugin - Invalid PAM password for user id [treydock], bind DN [uid=treydock,ou=people,dc=org,dc=domain,dc=edu] Then these are in /var/log/secure Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: default/local realm 'DOMAIN.EDU' Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: configured realm 'DOMAIN.EDU' Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: debug Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flags: forwardable not proxiable Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no ignore_afs Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no null_afs Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: cred_session Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: user_check Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no krb4_convert Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: krb4_convert_524 Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: krb4_use_as_req Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: will try previously set password first Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: will let libkrb5 ask questions Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no use_shmem Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no external Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no multiple_ccaches Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: validate Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: warn Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: ticket lifetime: 86400s (1d,0h,0m,0s) Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: renewable lifetime: 86400s (1d,0h,0m,0s) Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: minimum uid: 500 Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: banner: Kerberos 5 Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: ccache dir: /tmp Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: ccname template: FILE:%d/krb5cc_%U_XXXXXX Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: keytab: FILE:/etc/krb5.keytab Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: token strategy: v4,524,2b,rxk5 Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: called to authenticate 'treydock', realm 'DOMAIN.EDU' Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: error resolving user name 'treydock' to uid/gid pair Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: error getting information about 'treydock' Mar 11 11:33:30 ldap01 ns-slapd: pam_unix(ldapserver:auth): check pass; user unknown Mar 11 11:33:30 ldap01 ns-slapd: pam_unix(ldapserver:auth): authentication failure; logname= uid=99 euid=99 tty= ruser= rhost= # cat /etc/krb5.conf [libdefaults] default_realm = DOMAIN.EDU default_tkt_enctypes = aes256-cts-hmac-sha1-96 des3-hmac-sha1 default_tgs_enctypes = aes256-cts-hmac-sha1-96 des3-hmac-sha1 clockskew = 300 [realms] DOMAIN.EDU = { kdc = kerberos-3.domain.edu:88 kdc = kerberos-1.domain.edu:88 kdc = kerberos-2.domain.edu:88 admin_server = kerberos-master.domain.edu:749 default_domain = domain.edu } [domain_realm] domain.edu = DOMAIN.EDU .domain.edu = DOMAIN.EDU [appdefaults] pam = { ticket_lifetime = 1d renew_lifetime = 1d forwardable = true krb4_convert = false proxiable = false retain_after_close = false minimum_uid = 500 debug = true } # cat /etc/pam.d/ldapserver auth required pam_env.so auth sufficient pam_krb5.so use_first_pass debug auth sufficient pam_unix.so nullok try_first_pass auth required pam_deny.so account include password-auth password include password-auth session include password-auth # cat /etc/pam.d/password-auth #%PAM-1.0 # Managed by puppet - do not modify! auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so # cat /etc/sssd/sssd.conf # Managed by puppet - do not modify [sssd] config_file_version = 2 debug_level = 0x02F0 reconnection_retries = 3 sbus_timeout = 30 services = nss,pam,sudo domains = LDAP [nss] debug_level = 0x02F0 reconnection_retries = 3 filter_groups = root,wheel filter_users = root [pam] debug_level = 0x02F0 reconnection_retries = 3 offline_credentials_expiration = 0 [sudo] [domain/LDAP] debug_level = 0x02F0 cache_credentials = TRUE entry_cache_timeout = 6000 enumerate = TRUE id_provider = ldap auth_provider = ldap chpass_provider = ldap access_provider = ldap sudo_provider = ldap ldap_uri = ldap://ldap01.org.domain.edu ldap_search_base = dc=org,dc=domain,dc=edu ldap_network_timeout = 3 ldap_tls_reqcert = demand ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.internal.crt ldap_schema = rfc2307bis ldap_id_use_start_tls = TRUE ldap_chpass_update_last_change = TRUE ldap_group_member = uniquemember ldap_group_object_class = posixGroup ldap_group_name = cn ldap_pwd_policy = none ldap_account_expire_policy = 389ds ldap_access_order = filter,expire ldap_access_filter = (objectclass=posixaccount) ldap_sudo_search_base = ou=sudoers,dc=org,dc=domain,dc=edu PAM pass through config: # PAM Pass Through Auth, plugins, config dn: cn=PAM Pass Through Auth,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject objectClass: pamConfig cn: PAM Pass Through Auth nsslapd-pluginPath: libpam-passthru-plugin nsslapd-pluginInitfunc: pam_passthruauth_init nsslapd-pluginType: preoperation nsslapd-pluginEnabled: on nsslapd-pluginloadglobal: true nsslapd-plugin-depends-on-type: database pamMissingSuffix: ALLOW pamExcludeSuffix: cn=config pamIDMapMethod: ENTRY pamIDAttr: tamuEduPersonNetID pamFallback: TRUE pamSecure: TRUE pamService: ldapserver nsslapd-pluginId: pam_passthruauth nsslapd-pluginVersion: 1.2.11.15 nsslapd-pluginVendor: 389 Project nsslapd-pluginDescription: PAM pass through authentication plugin pamIncludeSuffix: ou=People,dc=org,dc=domain,dc=edu pamFilter: (&(objectClass=tamuPerson)(tamuEduPersonNetID=*)) tamuPerson and tamuEduPersonNetID schema additions (from /etc/dirsrv/slapd-ldap01/schema/99user.ldif): objectclasses: ( 1.3.6.1.4.1.4391.1.0 NAME 'tamuPerson' DESC '' SUP top STRUCTURAL MAY tamuEduPersonNetID X-ORIGIN 'user defined' ) attributetypes: ( 1.3.6.1.4.1.4391.0.13 NAME 'tamuEduPersonNetID' DESC 'NetID (login username)' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE X-ORIGIN 'user defined' ) My account: # treydock, People, org.domain.edu dn: uid=treydock,ou=People,dc=org,dc=domain,dc=edu uid: treydock gidNumber: 999 mail: treydock(a)domain.edu sn: Dockendorf cn: Trey Dockendorf givenName: Trey tamuEduPersonNetID: treydock loginShell: /bin/bash homeDirectory: /home/treydock objectClass: inetOrgPerson objectClass: inetuser objectClass: organizationalPerson objectClass: person objectClass: posixAccount objectClass: tamuPerson objectClass: top uidNumber: 1380 Thanks - Trey

1 1

Non-contiguous attribute values
by Timothy Pollard 11 Mar '14

11 Mar '14

Hi, We received this strange error a few hours ago for one of our DNS entries: [10/Mar/2014:15:56:01 +0000] - str2entry_fast: Error. Non-contiguous attribute values for tXTRecord [10/Mar/2014:15:56:01 +0000] - Entry "relativeDomainName=testingstatus,zoneName=OURORG.com,dc=DNS,o=Internet" required attribute "objectclass" missing This is a monitor DNS entry that we update every four minutes to verify that our Replication is working across the board, so that next error repeats every four minutes as we try to update the entry. The entry looks like it's had everything except for the tXTRecord field deleted as well. Fortunately it's a testing entry, so we can easily rebuild it manually. This error occurred a few minutes after a bad restart which required a changelog regenerate, so that may be related. Anyone know what might cause this? -- TimP [http://blog.timp.com.au] [http://resume.timp.com.au]

2 10

Re: [389-users] problem on Sparc with DS 1.3.2: Skipping entry ... which has no parent
by Carsten Grzemba 11 Mar '14

11 Mar '14

Am 11.03.14 schrieb Rich Megginson <rmeggins(a)redhat.com>: > > > > > > On 03/11/2014 05:57 AM, Carsten Grzemba wrote: > > > > interessting: it is only on 32bit build. 64bit build on Solaris10 Sparc works as expected. > > > > > > I'm not sure. I guess we could try to reproduce on Fedora 32-bit. > > > > the Solaris10 i386 build works without problems, only on Sparc. > > > > > > > > > > -- > > 389 users mailing list > > 389-users(a)lists.fedoraproject.org > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > > > >

2 1

Re: [389-users] problem on Sparc with DS 1.3.2: Skipping entry ... which has no parent
by Carsten Grzemba 11 Mar '14

11 Mar '14

interessting: it is only on 32bit build. 64bit build on Solaris10 Sparc works as expected.

2 1

help with cert expired
by Maurizio Marini 11 Mar '14

11 Mar '14

Hello I have this very old installation: 389-ds-1.1.3-5.fc12.noarch 389-ds-console-doc-1.2.0-5.fc12.noarch 389-ds-base-1.2.5-1.fc12.i686 389-ds-console-1.2.0-5.fc12.noarch 389-console-1.1.3-5.fc12.noarch 389-admin-console-1.1.4-2.fc12.noarch 389-dsgw-1.1.4-1.fc12.i686 389-admin-console-doc-1.1.4-2.fc12.noarch 389-adminutil-1.1.8-4.fc12.i686 389-admin-1.1.10-1.fc12.i686 into an old FC12. Now certs under /etc/httpd/alias are expired Certificate: Data: Version: 3 (0x2) Serial Number: 3 (0x3) Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption Issuer: "CN=Certificate Shack,O=example.com,C=US" Validity: Not Before: Mon Mar 01 10:50:54 2010 Not After : Sat Mar 01 10:50:54 2014 Subject: "CN=localhost4.localdomain4,O=example.com,C=US" and I have this error into log: [error] SSL Library Error: -8181 Certificate has expired the it suggests to " Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the prob lem can be resolved." I did, and it works. Now I wonder how can I renew that expired cert. I have googled around but I have not found any simple to re-create the cert. I find this http://directory.fedoraproject.org/wiki/Howto:SSL but it is not so easy to regenerate an expired certificate. Is there something simpler? Can you help me? My best rgards Maurizio

3 2

problem on Sparc with DS 1.3.2: Skipping entry ... which has no parent
by Carsten Grzemba 11 Mar '14

11 Mar '14

If I try to setup an DS1.3.2.13 DS intance on Solaris10 Sparc I got a error on setup-ds-admin.pl: ... +Entry cn=PD Managers,ou=groups,dc=contac,dc=lan is added +changeOwnerMode: changed mode of /tmp/ldifuO_wjV.ldif to 440 +changeOwnerMode: changed ownership of /tmp/ldifuO_wjV.ldif to user 389 group 389 +importing data ... [11/Mar/2014:09:26:40 +0100] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database [11/Mar/2014:09:26:40 +0100] - check_and_set_import_cache: pagesize: 8192, pages: 262144, procpages: 2640 [11/Mar/2014:09:26:40 +0100] - Import allocates 838856KB import cache. [11/Mar/2014:09:26:40 +0100] - import userRoot: Beginning import job... [11/Mar/2014:09:26:40 +0100] - import userRoot: Index buffering enabled with bucket size 100 [11/Mar/2014:09:26:41 +0100] - import userRoot: Processing file "/tmp/ldifuO_wjV.ldif" [11/Mar/2014:09:26:41 +0100] - import userRoot: Finished scanning file "/tmp/ldifuO_wjV.ldif" (9 entries) [11/Mar/2014:09:26:41 +0100] - import userRoot: WARNING: Skipping entry "dc=example,dc=lan" which has no parent, ending at line 17 of file "/tmp/ldifuO_wjV.ldif"[11/Mar/2014:09:26:41 +0100] entryrdn-index - _entryrdn_index_read: Suffix "dc=example,dc=lan" not found: Successful return: 0(0) ... a lot of such errors following and the userRoot db or base db is not setup correctly. I have tried the patch: https://fedorahosted.org/389/attachment/ticket/47734 without success. Your help is greatly appreciated.

1 0

multi-master changelog, tombstone entries
by Vesa Alho 10 Mar '14

10 Mar '14

Hi, 1. replication changelog I've been running multi-master replication setup for a while and realised hadn't configured expiration (changelog max age). Now my changelog file is rather big and I would like get size down. I'm planning to delete changelog and start with a fresh one following these instructions: https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server… But since I have two multi-master servers, I was wondering what is the best way to start with a fresh changelog? Guide says I need to re-initialize consumers again, but if both multi-master servers get new data during replication is off, I'm worried I get into trouble when trying to get replication running again. In case there is a risk, I rather keep the current state. 2. Tombstone entries I was reading this: https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server… => I noticed that at least in 1.2.11.25 value nsDS5ReplicaTombstonePurgeInterval is not set at all. I guess because it depends on environment? But is there a reason why it's not directly visible in Console => Configuration => Replication (on the same page as changelog max age)? Just saying I would not have noticed tombstone purging unless reading administration guide carefully. -Vesa

2 1

Importing Pre-Hashed Passwords
by Steven Crothers 10 Mar '14

10 Mar '14

Hello, I'm trying to accomplish a poor mans replication from OpenDS from Oracle/Sun. Basically the logic is as follows: OpenDS is attached to our corporate IDM. User is managed in OpenDS. User updates information in OpenDS. OpenDS read-replica is updated in our local read-slave. Python script notices there was a change in our local read-slave. Script isolates the change from our read-slave and sends the DNs to sync to my 389 (FreeIPA) server. FreeIPA replica receives input over the network from notification agent which includes DNs. DNs attributes are re-organized (OpenDS doesn't use anything logical, all 100% custom attributes/objectclasses). DNs with re-organized attributes are inserted/updated in 389 server (FreeIPA), minus the updated SSHA password hash. I get an error saying that adding pre-encoded passwords isn't allowed. But, that makes me say "How the hell do you import an LDIF" backup, and frankly, I can't find anything on the subject (albeit, I admittedly didn't quite know how to search this issue either). I've never seen a server not accept pre-encoded password hashes (or at least I don't recall this specific error in OpenDS/LDAP), so my question is, how can I store the SSHA password hash from OpenDS in my 389server (FreeIPA) server? Steven Crothers steven.crothers(a)gmail.com

2 4

groups issues
by Alberto Viana 10 Mar '14

10 Mar '14

Hello, I have the following scenario with multi master replication 389DS (389-Directory/1.3.2.13 B2014.066.1215) <-> AD (windows 2008R2) I'm having the following problem using groups on 389: What I DID Create a user test1 Added this user to group GROUP_TEST When I delete this user from 389DS via console or via windows, 389 DS does not removes the group entry. On the windows side everything seems to be ok, the user was deleted from the group too. So the user test1 does not exists anymore, but in the group (on 389DS), I still can see the entry: uniqueMember: uid=test1,ou=GTI,dc=homolog,dc=rnp

1 0

Disable tombstone
by carne_de_passaro 07 Mar '14

07 Mar '14

Hi, In my environment, I don't need to deal ( basically recover deleted entries) with the deleted entry. Is there a way to disable the creation of the nstombstone entries on the 389-ds? Regards

2 2

How to add "dc=myExample,dc=com": Basic doubt
by Vimal Thomas 07 Mar '14

07 Mar '14

Hi, I am new to 389 and LDAP in general. I have 389 installed on my CentOS (389-ds-base-1.2.11.15-31.el6_5.x86_64) I have the basic dc=example,dc=com created when I did server setup. [*root@localhost vim]# ldapsearch -x -b "dc=example,dc=com" -s base* *# extended LDIF* *#* *# LDAPv3* *# base <dc=example,dc=com> with scope baseObject* *# filter: (objectclass=*)* *# requesting: ALL* *#* *# example.com <http://example.com>* *dn: dc=example,dc=com* *objectClass: top* *objectClass: domain* *dc: example* *# search result* *search: 2* *result: 0 Success* *# numResponses: 2* *# numEntries: 1* Now I am trying to create a new object on that line. I want to create *dc=myExample,dc=com* *[root@localhost vim]# ldapadd -f myExample.ldif -x -W* *Enter LDAP Password: * *adding new entry "dc=myExample,dc=com"* *ldap_add: No such object (32)* How can I create the entry *dc=myExample,dc=com?* The content of myExample.ldif is as follows (similar to see what I saw in search output of dc=example,dc=com ). *dn: dc=myExample,dc=comobjectClass: topobjectClass: domaindc: myExample* *Thanks,* *Vimal*

2 2

sasl/gssapi issue
by Robert Viduya 07 Mar '14

07 Mar '14

We're trying to get GSSAPI authentication working with 389 and following the doc page on the website, I think I've gotten it working a little too well. We're using the stock ldapsearch command that comes with RHN, I believe it's from openldap. Here's a command log $ kinit usera(a)PRISM.GATECH.EDU Password for usera(a)PRISM.GATECH.EDU: $ klist Ticket cache: FILE:/tmp/krb5cc_651342_Bepfv28166 Default principal: usera(a)PRISM.GATECH.EDU Valid starting Expires Service principal 03/06/14 16:55:07 03/07/14 16:55:07 krbtgt/PRISM.GATECH.EDU(a)PRISM.GATECH.EDU $ ldapsearch -Y GSSAPI -H ldap://servera.iem.gatech.edu -LLL -b '' -s base 'objectclass=*' > /dev/null SASL/GSSAPI authentication started SASL username: usera(a)PRISM.GATECH.EDU SASL SSF: 56 SASL data security layer installed. $ ldapsearch -X userb(a)PRISM.GATECH.EDU -Y GSSAPI -H ldap://servera.iem.gatech.edu -LLL -b '' -s base 'objectclass=*' > /dev/null SASL/GSSAPI authentication started SASL username: userb(a)PRISM.GATECH.EDU SASL SSF: 56 SASL data security layer installed. and here's the relevant access log entries: [06/Mar/2014:16:55:18 -0500] conn=1387 fd=64 slot=64 connection from 192.168.232.4 to 192.168.232.4 [06/Mar/2014:16:55:18 -0500] conn=1387 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI [06/Mar/2014:16:55:18 -0500] conn=1387 op=0 RESULT err=14 tag=97 nentries=0 etime=0, SASL bind in progress [06/Mar/2014:16:55:18 -0500] conn=1387 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [06/Mar/2014:16:55:18 -0500] conn=1387 op=1 RESULT err=14 tag=97 nentries=0 etime=0, SASL bind in progress [06/Mar/2014:16:55:18 -0500] conn=1387 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [06/Mar/2014:16:55:18 -0500] conn=1387 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=usera,ou=accounts,ou=gtaccounts,ou=departments,dc=gted,dc=gatech,dc=edu" [06/Mar/2014:16:55:18 -0500] conn=1387 op=3 SRCH base="" scope=0 filter="(objectClass=*)" attrs=ALL [06/Mar/2014:16:55:18 -0500] conn=1387 op=3 RESULT err=0 tag=101 nentries=1 etime=0 [06/Mar/2014:16:55:18 -0500] conn=1387 op=4 UNBIND [06/Mar/2014:16:55:18 -0500] conn=1387 op=4 fd=64 closed - U1 [06/Mar/2014:16:55:25 -0500] conn=1388 fd=64 slot=64 connection from 192.168.232.4 to 192.168.232.4 [06/Mar/2014:16:55:25 -0500] conn=1388 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI [06/Mar/2014:16:55:25 -0500] conn=1388 op=0 RESULT err=14 tag=97 nentries=0 etime=0, SASL bind in progress [06/Mar/2014:16:55:25 -0500] conn=1388 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [06/Mar/2014:16:55:25 -0500] conn=1388 op=1 RESULT err=14 tag=97 nentries=0 etime=0, SASL bind in progress [06/Mar/2014:16:55:25 -0500] conn=1388 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [06/Mar/2014:16:55:25 -0500] conn=1388 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=userb,ou=accounts,ou=gtaccounts,ou=departments,dc=gted,dc=gatech,dc=edu" [06/Mar/2014:16:55:25 -0500] conn=1388 op=3 SRCH base="" scope=0 filter="(objectClass=*)" attrs=ALL [06/Mar/2014:16:55:25 -0500] conn=1388 op=3 RESULT err=0 tag=101 nentries=1 etime=0 [06/Mar/2014:16:55:25 -0500] conn=1388 op=4 UNBIND [06/Mar/2014:16:55:25 -0500] conn=1388 op=4 fd=64 closed - U1 The issue is that if we do the ldapsearch without specifying an authzid (the "-X" option to ldapsearch), the bind correctly binds to DN that maps to the Kerberos principal name. However, if we specify an authzid that's different than what we kinitted to, the directory server binds to the DN that maps to that authzid even though we don't have the credentials for that user. It uses usera's credentials to bind to userb's DN. My question is, is there a configuration setting somewhere that would make the directory server ignore any passed in authzid when using GSSAPI and just use what's in the credential cache?

3 5

Multimaster Replication with 389
by Chaudhari, Rohit K. 06 Mar '14

06 Mar '14

Hello, How do I do multi-master replication on 389DS with two TLS/SSL enabled servers? Thanks, R

3 3

Local accounts vs 389 DS users
by Chaudhari, Rohit K. 06 Mar '14

06 Mar '14

I have a user that I have set locally on a Red Hat machine. I store that user in LDAP with the same Posix attributes, but their password differs. When I log in from the Red Hat machine, it uses the local cached credentials of that user (LDAP password and credentials never seem to matter). How can I synchronize the local and ldap version of the user so that I don't have to create it locally AND on LDAP on every single remote machine? Thanks, R

2 2

Multi-Master Replication Issue
by Chaudhari, Rohit K. 06 Mar '14

06 Mar '14

Hi All, I am trying to create multi-master replication in 389. But I am having trouble using ldapmodify to create a replication manager DN account I get the following error: Additional info: TLS error -8157: Certificate extension not found I went on the web and some people suggested I have a TLS_REQCERT=none line in /etc/openldap/ldap.conf, but this did not fix it either. My certificate in /etc/openldap/cacerts is called cacert.asc. Does anyone know how I can fix my problem? Thanks, R

3 4

Some bind DNs sporadically can't search users
by Morgan Jones 06 Mar '14

06 Mar '14

We're pulling our hair out over this issue and wondering if it rings a bell for anyone or perhaps there's a bug fix in a later version of 389 that might resolve it. I've looked and not found anything but it's also not the easiest issue to search for. We are on CentOS DS now but can move to 389 of course but hesitate to put forth the effort if we aren't reasonably sure it will resolve our issue. Certain bind DNs (so far only service accounts) are unable to search for users. For instance: [20/Feb/2014:10:18:05 -0500] conn=15600927 op=1 BIND dn="uid=copier,ou=employees,dc=domain,dc=org" method=128 version=3 [20/Feb/2014:10:18:05 -0500] conn=15600927 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=copier,ou=employees,dc=domain,dc=org" [20/Feb/2014:10:18:05 -0500] conn=15600927 op=2 SRCH base="ou=employees,dc=domain,dc=org" scope=2 filter="(uid=user1)" attrs="cn mail uid" [20/Feb/2014:10:18:05 -0500] conn=15600927 op=2 RESULT err=0 tag=101 nentries=0 etime=0 I did a search of the directory at the same time on the same replica as myself and other users with the same access level and was able to search uid=user1. It sometimes only lasts a few minutes though in a few instances it was much longer. In one case we resolved it by adding a service account with a different name but the same access level and moved the application to that account. In another case where hundreds of copiers are configured with the binddn and thus changing the binddn wasn't practical we were able to resolve it by restoring the masters from a db2ldif and re-initializing the consumers. It's not isolated to once consumer--we've seen it on at least 2: one partial, one full. Our environment is CentOS DS on CentOS 5. We have ~35,000 entries in the directory, most of them users. We only have 9 acis, most of which provide access via groups. We have 2 multi-masters, 2 full consumers and until recently 2 partial replicas. We converted the partial replicas to full replicas recently as we know there are/were issues with partial replication and wanted to rule that out. We're at the latest version of CentOS DS: [morgan@ldap01 ~]$ rpm -qa|grep centos-ds centos-ds-admin-8.2.1-1.el5.centos centos-ds-console-8.2.0-4.el5.centos centos-ds-base-8.2.8-2.el5.centos centos-ds-8.2.0-2.el5.centos [morgan@ldap01 ~]$ This issue is killing us as it effectively denies access to a service for all users that use it. This could be the VPN for instance which many users depend on all day for their work. We are considering many options, primarily just moving to 389 on CentOS 6. That's a fairly big task for a site of our size so we'd like some confidence that we won't see a repeat of this issue. There's talk of considering other products which no one wants to do but we're all edgy as this has caused a fair amount of downtime and about all I can do at the moment is monitor for it and re-initialize when it happens which doesn't inspire confidence. thank you, -morgan

3 11

intermittent issues with the DNA plugin
by Paul Robert Marino 05 Mar '14

05 Mar '14

I'm trying the DNA plugin for the first time based on the document here http://directory.fedoraproject.org/wiki/Howto:DNA usually it works well but occasionally it doesnt seem to work correctly for GID numbers. Ive noticed that if I add a user via the ldapadd command and set the following " uidNumber: 99999 gidNumber: 99999 " the next value for the uidNumber and gidNumber is appropriately set but occasionally the dnanextvalue for gidNumber fails to increment. When this happens the next time I add a user the gid number get set to the same value as the previous user I added. furthermore the dnanextvalue doesn't increment again. if I manually update the dnanextvalue for the gidNumber it will then continue to work properly fro a time then eventually break down again. I haven't seen any thing on the logs to indicate why this is happening does any one have any pointers on what might cause this or how to debug it further more I have a question Ive noticed that when the plugin updates the value of dnanextvalue it only does it on the local server not all of them is there any way to get these fields to replicate.

2 1

Point to multiple LDAP servers
by Chaudhari, Rohit K. 05 Mar '14

05 Mar '14

Hello, I want to configure authconfig-tui on Red Hat to point to multiple 389 servers (in case one went inaccessible, the clients would automatically point to the 2nd or 3rd or 4th, etc. server). 1.How do I do this? 2.How would my /etc/hosts file look as a result of pointing to multiple servers. Would I have to list each server as a separate line by IP address? Thanks, Rohit

2 1

Kerberized admin server
by Paul Robert Marino 04 Mar '14

04 Mar '14

hello I know there use to be a document on doing this because I did it several years ago at a previous job but I cant seem to find it in the documentation now. I'm trying to make the the admin server accept Kerberos authentication. my kerberos servers are separate from my LDAP servers so this shouldn't cause an issue but I just cant find the doc on how to do it. I know I have to set KRB5_KTNAME in /etc/sysconfig/dirsrv-admin but beyond that Im just not sure. Do I need a specific principal in the key tab file other than ldap/<hostname>@<REALM.NAME> and do I need to set any other options in the configuration? if any one knows the answer or know of a doc that describes it that would be extremely helpful.

2 4

ACL processing
by Russell Beall 03 Mar '14

03 Mar '14

Hi all, We've just set up monster-sized server nodes to run 389 as a replacement to Sun DS. I've been running my tests and I am pleased to report that the memory issue seems to be in check with growth only up to double the initial memory usage after large quantities of ldapmodify calls. We have plenty of room in these boxes to accommodate caching the entire database. The key blocker on this is still the ACL processing times for which I have been unable to find a decent resolution. We have 135 ACIs at the root of the suffix. When I comment out most of them but leave one service account active, processing times are very nicely fast. When I leave them all on, that same service account takes 2.5 seconds to respond when only one request is pending. A new kink in the puzzle here which is probably going to be a deal breaker is that if I run the same request on multiple threads, each thread takes proportionately longer to respond depending on the number of threads. If I have 12 threads going doing a simple lookup, each thread responds in 45-55 seconds. If I have 24 threads going, each thread takes 1m45s - 1m55s to respond. The box has 32 cores available. While processing, each thread is burning 100% of an available CPU thread for the entire time. Theoretically when up to 32 requests are simultaneously processing, each thread should return in 2.5 seconds just as if it were one thread. Since all threads are burning 100% the entire time, it doesn't seem like that would be caused by simple thread locking where some threads are waiting for others. I'm thinking the system is not properly configured in some way and there is a system bottleneck blocking the processing. When burning the CPU there is very little percentage allocated to the user percentage, most of the CPU usage is listed under the system CPU usage. Is this normal, or is this indicative of some system layer that is bottlenecking the processing? Another question I posed earlier is whether or not it is possible to replicate three subtrees independently and then keep the aci entry at the root suffix independent so it can be set separately for multiple downstream replicants. That way we could possibly subdivide the service accounts across different nodes. Is that possible? Thanks, Russ. ============================== Russell Beall Systems Programmer IV Enterprise Identity Management University of Southern California beall(a)usc.edu<mailto:beall@usc.edu> ==============================

3 12

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users March 2014