May 2016 - 389-users - Fedora mailing-lists

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

MemberOf group restrictions to a client system (server and client running CentOS 7)
by Janet Houser 06 Aug '20

06 Aug '20

Hi, I'm new to 389-ds and last week downloaded and installed the software. I have a running instance of the server, and I've added TLS/SSL. I've configured a CentOS 7 client to be able to query the server using TLS/SSL, and all appears working. I've created users and groups on the 389-ds server successfully. For each user and group, I've enabled posix attributes and my client can see the unix users and groups using the "getent password" or "getent group" commands. Now, here's where I'm getting tripped up.......... I need to limit which users have access to which systems. I've been trying to do this via memberOf group limitations. I found the following online resource (https://thornelabs.net/2013/01/28/aix-restrict-server-login-via-ldap-groups…) which is close enough to CentOS that the initial commands worked. I enabled the MemberOf plugin and changed the attributes per the link, and restarted the system. I created a test group (that I didn't enable a posix GID) and tried to add a single user via: Right click on group -- > click Properties --> then Members --> click Add --> Search for user --> click Add. When I try to go this route (which worked before enabling the memberOf plugin) it worked. Now it seems I get the error: "Cannot save to directory server. netscape.ldap.LDAPException: error resiult(65): Object class violation" And the messages file throws the error (/var/log/dirsrv/slapd-<instancename>/errors: "Entry "uid=test,ou=People,dc=int,dc=com" -- attribute "memberOf" not allowed [17/Feb/2016:11:22:58 -0700] memberof-plugin - memberof_postop_modify: failed to add dn (cn=testgroup,ou=Groups,dc=int,dc=com) to target. Error (65)" So it seems my server isn't quite using the memberOf plugin properly, but I'm not sure what else to enable. I'll have to solve this issue before I even try to filter login access via groups on my client system. I should mention that if I go under the advanced tab for one of the groups I created, I can add the the attribute "uniquemember", but I'm not sure what I should set the "value" to be. I've tried creating new users to see if I could set their "uniquemember" attributes, but no luck. It seems that I don't have the ability to set this attribute on individual users, only groups. This might not be the right road to head down when trying to restrict access to servers via groups, so I'm open to any suggestions. Any suggestions would be appreciated.

6 19

ldapsearch doesn't return the userpassword field
by Janet Houser 14 May '18

14 May '18

Hi, I've been looking through the archives for information, but I haven't stumbled on a solution to my problem. I'm running ds-389 (389-ds-base-1.3.4.0) on a centos 7 box (CentOS Linux release 7.2.1511). I have a centos OS client configured using SSL/TLS which queries the LDAP server. Per a previous thread, I configured the memeberOf plugin and all seems to be working properly. I have a php script that will run on the client and change the LDAP password for the user. The problem is, the script looks for the SSHA has of the password when an ldapsearch is issued. However, when I issue a general ldapsearch (anonymously) I don't get the userpassword field. I read in your archives that I might have to be the "directory manager" user in order to see the hashed password. I've been playing around with the ldapsearch syntax, but I can't quite get it right. Anyway, my question is, can I set a flag in 389-ds that will display the hashed userpassword? I think that will solve my problem with the php script returning an error that it can't retrieve the old password. Thanks,

5 12

subtree password policy woes
by Morgan Jones 10 Jun '16

10 Jun '16

Hello, We are configuring password policy in 389 directory. We’re running what I believe is the latest stable version form the Epel repository on CentOS 6: [root@devldapm03 ~]# rpm -qa|grep 389 389-admin-1.1.35-1.el6.x86_64 389-console-1.1.7-1.el6.noarch 389-ds-console-doc-1.2.6-1.el6.noarch 389-ds-base-libs-1.2.11.15-72.el6_7.x86_64 389-admin-console-doc-1.1.8-1.el6.noarch 389-ds-base-1.2.11.15-72.el6_7.x86_64 389-adminutil-1.1.19-1.el6.x86_64 389-ds-1.2.2-1.el6.noarch 389-admin-console-1.1.8-1.el6.noarch 389-ds-console-1.2.6-1.el6.noarch 389-dsgw-1.1.11-1.el6.x86_64 [morgan@devldapm03 ~]$ uname -a Linux devldapm03.philasd.net 2.6.32-573.26.1.el6.x86_64 #1 SMP Wed May 4 00:57:44 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux [morgan@devldapm03 ~]$ cat /etc/redhat-release CentOS release 6.7 (Final) [morgan@devldapm03 ~]$ I just did a yum update, rebooted and installed 389 anew. The password policy works well if configured globally (from the Data node under Configuration) However when I attempt to create a subtree level policy (Directory->domain->employees, right click Manage Password Policy->for subtree) under ou=employees,dc=domain,dc=org the effect is as if there is no policy. If I subsequently disable the subtree policy I cannot get the global policy to take over. In fact the only way I’ve been able to get the global policy to work is to re-install from scratch. I also tried command line configuration and was unable to get the policy working at all though I have more confidence of my understanding of the process via the console. We’ve tried different policy settings but for testing purposes I’m just setting a minimum password length of 8 characters. Is there something I’m missing? thanks, -morgan

2 8

389-ds-base-1.3.5.4 doesn't build on Mageia
by Thomas Spuhler 30 May '16

30 May '16

389-ds-base-1.3.5.4 doesn't build on Mageia Altlinux reported the same problem with 389-ds-base-1.3.5.3 This is the error: /libslapd_la-ssl.o ldap/servers/slapd/ssl.c: In function 'svrcore_setup': ldap/servers/slapd/ssl.c:1291:5: error: unknown type name 'SVRCOREStdSystemdPinObj' SVRCOREStdSystemdPinObj *StdPinObj; ^ ldap/servers/slapd/ssl.c:1292:18: error: 'SVRCOREStdSystemdPinObj' undeclared (first use in this function) StdPinObj = (SVRCOREStdSystemdPinObj *)SVRCORE_GetRegisteredPinObj(); See log http://pkgsubmit.mageia.org/uploads/failure/cauldron/core/release/201605281… The attached patch makes it build -- Best regards Thomas Spuhler All of my e-mails have a valid digital signature ID 60114E63

2 3

Solaris and 389-ds
by zarko＠etcfstab.com 26 May '16

26 May '16

Hi, we've been using 389-ds running on RedHat7, our ldap clients are many devices and RedHat Linux, now we want to add Solaris 10/11. We have DUAProfile created and Solaris 11 ldap client initiation was successful, with command : "ldapclient -v init -a domainname=<example.com> -a profileName=solaris11 <server_ip>". The command "ldapclient list" show: NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_SERVERS= <ldap-server> NS_LDAP_SEARCH_BASEDN= dc=<example>,dc=com NS_LDAP_SEARCH_SCOPE= sub NS_LDAP_SEARCH_TIME= 30 NS_LDAP_CACHETTL= 43200 NS_LDAP_PROFILE= solaris11 NS_LDAP_SERVICE_SEARCH_DESC= passwd:l=AMER,dc=<example>,dc=com?sub NS_LDAP_SERVICE_SEARCH_DESC= shadow:l=AMER,dc=<example>,dc=com?sub NS_LDAP_SERVICE_SEARCH_DESC= group:ou=Groups,dc=<example>,dc=com?sub NS_LDAP_BIND_TIME= 10 NS_LDAP_ATTRIBUTEMAP= group:gidnumber=gidNumber NS_LDAP_ATTRIBUTEMAP= passwd:gidnumber=gidNumber NS_LDAP_ATTRIBUTEMAP= passwd:uidnumber=uidNumber NS_LDAP_ATTRIBUTEMAP= passwd:homedirectory=homeDirectory NS_LDAP_ATTRIBUTEMAP= passwd:loginshell=loginShell NS_LDAP_ATTRIBUTEMAP= shadow:userpassword=userPassword NS_LDAP_OBJECTCLASSMAP= shadow:shadowAccount=posixaccount NS_LDAP_OBJECTCLASSMAP= group:posixGroup=posixgroup NS_LDAP_OBJECTCLASSMAP= passwd:posixAccount=posixaccount Some other relevant files' configurations are: # grep ldap /etc/nsswitch.conf passwd: files ldap group: files ldap netgroup: ldap automount: files ldap printers: user files ldap # cat /etc/pam.d/login auth requisite pam_authtok_get.so.1 debug auth required pam_dhkeys.so.1 debug auth required pam_unix_cred.so.1 debug #auth binding pam_unix_auth.so.1 server_policy auth sufficient pam_unix_auth.so.1 server_policy debug auth required pam_ldap.so.1 debug # cat /etc/pam.d/other | grep -v ^# | grep -v ^$ auth definitive pam_user_policy.so.1 debug auth requisite pam_authtok_get.so.1 debug auth required pam_dhkeys.so.1 debug auth required pam_unix_cred.so.1 debug auth sufficient pam_unix_auth.so.1 server_policy debug auth required pam_ldap.so.1 debug account requisite pam_roles.so.1 account definitive pam_user_policy.so.1 account required pam_unix_account.so.1 account required pam_tsol_account.so.1 session definitive pam_user_policy.so.1 session required pam_unix_session.so.1 password definitive pam_user_policy.so.1 password include pam_authtok_common password required pam_authtok_store.so.1 Unfortunately, LDAP client cannot SSH, the logs are sshd[2497]: [ID 293258 auth.warning] libsldap: Status: 50 Mesg: LDAP ERROR (50): Insufficient access. sshd[2497]: [ID 717705 auth.debug] pam_user_policy: pam_sm_authenticate(flags = 0x1, argc = 1) sshd[2497]: [ID 771769 auth.debug] pam_user_policy: find_pam_policy: pam_policy = NULL for user 'zare' sshd[2497]: [ID 634615 auth.debug] pam_authtok_get:pam_sm_authenticate: flags = 1 sshd[2497]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate() sshd[2497]: [ID 285619 auth.debug] ldap pam_sm_authenticate(sshd-kbdint zare), flags = 1 sshd[2497]: [ID 316739 auth.error] pam_ldap: no legal authentication method configured sshd[2497]: [ID 800047 auth.info] Keyboard-interactive (PAM) userauth failed[9] while authenticating: Authentication failed sshd[2497]: [ID 800047 auth.notice] Failed keyboard-interactive for zdudic from 10.211.55.1 port 52876 ssh2 sshd[2497]: [ID 717705 auth.debug] pam_user_policy: pam_sm_authenticate(flags = 0x1, argc = 1) sshd[2497]: [ID 771769 auth.debug] pam_user_policy: find_pam_policy: pam_policy = NULL for user 'zare' sshd[2497]: [ID 634615 auth.debug] pam_authtok_get:pam_sm_authenticate: flags = 1 Any help is appreciated, thanks.

1 1

Fwd: Re: audio problems
by gil 23 May '16

23 May '16

-------- Messaggio Inoltrato -------- Oggetto: Re: audio problems Data: Mon, 23 May 2016 10:14:00 +0200 Mittente: gil <puntogil(a)libero.it> Rispondi-a: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> A: devel(a)lists.fedoraproject.org Il 23/05/2016 09:41, Samuel Sieb ha scritto: > On 05/22/2016 03:06 AM, gil wrote: >> Internal Audio Stereo analogic >> >> GK208 HDMI/DP Audio Controller Digital stereo >> > Is the internal audio output and not the HDMI selected? > sorry what you do mean? "GK208 HDMI/DP Audio Controller Digital stereo" is the audio device in my video card 04:00.1 Audio device: NVIDIA Corporation GK208 HDMI/DP Audio Controller (rev a1) Subsystem: ASUSTeK Computer Inc. Device 8576 Kernel driver in use: snd_hda_intel Kernel modules: snd_hda_intel , and i must use the 00:14.2 Audio device: Advanced Micro Devices, Inc. [AMD/ATI] SBx00 Azalia (Intel HDA) (rev 40) Subsystem: ASRock Incorporation Device 0892 Kernel driver in use: snd_hda_intel Kernel modules: snd_hda_intel but is not listed in kde pannel control ... >> aplay -l >> **** List of PLAYBACK Hardware Devices **** >> card 0: SB [HDA ATI SB], device 0: ALC892 Analog [ALC892 Analog] >> Subdevices: 1/1 >> Subdevice #0: subdevice #0 > > This shows that alsa knows about your hardware. > > Run alsamixer in a terminal. You should get a single volume control > for the pulseaudio output. Make sure that it is up and not muted. > Press F6 to select a different device and select 0, your HDA device. > Check that the volume controls and switches are set correctly. > Normally, pulseaudio should manage it, but this gives you a chance to > verify and test. > -- already done but dont solve anythings thanks best .g > devel mailing list > devel(a)lists.fedoraproject.org > http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org -- devel mailing list devel(a)lists.fedoraproject.org http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

2 1

Fwd: Re: audio problems
by gil 23 May '16

23 May '16

-------- Messaggio Inoltrato -------- Oggetto: Re: audio problems Data: Mon, 23 May 2016 10:14:00 +0200 Mittente: gil <puntogil(a)libero.it> Rispondi-a: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> A: devel(a)lists.fedoraproject.org Il 23/05/2016 09:41, Samuel Sieb ha scritto: > On 05/22/2016 03:06 AM, gil wrote: >> Internal Audio Stereo analogic >> >> GK208 HDMI/DP Audio Controller Digital stereo >> > Is the internal audio output and not the HDMI selected? > sorry what you do mean? "GK208 HDMI/DP Audio Controller Digital stereo" is the audio device in my video card 04:00.1 Audio device: NVIDIA Corporation GK208 HDMI/DP Audio Controller (rev a1) Subsystem: ASUSTeK Computer Inc. Device 8576 Kernel driver in use: snd_hda_intel Kernel modules: snd_hda_intel , and i must use the 00:14.2 Audio device: Advanced Micro Devices, Inc. [AMD/ATI] SBx00 Azalia (Intel HDA) (rev 40) Subsystem: ASRock Incorporation Device 0892 Kernel driver in use: snd_hda_intel Kernel modules: snd_hda_intel but is not listed in kde pannel control ... >> aplay -l >> **** List of PLAYBACK Hardware Devices **** >> card 0: SB [HDA ATI SB], device 0: ALC892 Analog [ALC892 Analog] >> Subdevices: 1/1 >> Subdevice #0: subdevice #0 > > This shows that alsa knows about your hardware. > > Run alsamixer in a terminal. You should get a single volume control > for the pulseaudio output. Make sure that it is up and not muted. > Press F6 to select a different device and select 0, your HDA device. > Check that the volume controls and switches are set correctly. > Normally, pulseaudio should manage it, but this gives you a chance to > verify and test. > -- already done but dont solve anythings thanks best .g > devel mailing list > devel(a)lists.fedoraproject.org > http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org -- devel mailing list devel(a)lists.fedoraproject.org http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

1 0

Solaris 11 fails to find DUAProfile
by Ž D 20 May '16

20 May '16

Hi there, I have 389ds 1.3.4.0-26 running on OL7 and looks good related to RedHat and its clone clients. But I am having issue to initialize Solaris 11. The 389ds came with 60nis.ldif and 60rfc4876.ldif and I have them imported successfully, I believe below searches show this. # ldapsearch -h <ldapserver> -b "dc=domain,dc=com" -s sub "objectclass=duaconfigprofile" version: 1 dn: cn=solaris11,ou=Profile,dc=domain,dc=com serviceSearchDescriptor: passwd:l=AMER,dc=domain,dc=com?sub serviceSearchDescriptor: shadow:l=AMER,dc=domain,dc=com?sub serviceSearchDescriptor: group:ou=Groups,dc=domain,dc=com?sub defaultSearchScope: sub defaultSearchBase: dc=domain,dc=com defaultServerList: ldapserver.domain.com cn: solaris11 objectClass: top objectClass: duaconfigprofile # ldapsearch -h ca-ldap01 -b "dc=domain,dc=com" -s sub "objectclass=nisdomainobject" version: 1 dn: nisdomain=us.domain.com,dc=domain,dc=com nisDomain: us.domain.com objectClass: top objectClass: nisdomainobject And next step is failing. # ldapclient -v init -a profileName=solaris11 10.x.x.x Parsing profileName=solaris11 Arguments parsed: profileName: solaris11 defaultServerList: 10.x.x.x Handling init option About to configure machine by downloading a profile Can not find the solaris11 DUAProfile Please let me know if someone has any feedback or any additional information is needed, thanks in advance. -- Thanks, Zarko

2 3

x-forwarded-for
by Robert Viduya 18 May '16

18 May '16

We run a cluster of directory servers (4 masters, 2 hubs, 14 slaves) behind a set of F5 Bigip load balancers. Our Bigip admins recently decided to switch the boxes to "one-armed" mode and that services would have to use X-Forwarded-For headers or equivalent to get the actual client IP address. Obviously, LDAP has no equivalent. So, I've hacked something together and I'm posting it looking for feedback. If the stuff is actually usable for other folks, that's good too. On the load balancer side, the code is specifically for the F5 Bigips. But if other load balancers have similar abilities to trigger on events and can insert binary data into the datastream, it should be adaptable. Essentially what I've done is defined a new LDAP Extended Operation with a payload that's a string containing the source IP address of the incoming connection. The load balancer sends this LDAP operation as soon as it opens a connection to the LDAP server, before any other traffic gets sent. On the directory server side, I've written an Extended Operation plugin that then logs the string. All we need is logging, so that's good enough for us. There's room for improvement there though, like making the address available for IP based ACls (which we don't use). In order to insert an LDAP operation into the stream, the code on the load balancer needs to choose an LDAP message-id that hopefully the real client isn't going to use. Going on the assumption that the client will start at 0 and increment up, I had the code insert a message-id of 0x70000000. I initially thought I'd have to have the code on the load balancer look for the response message and throw it away so the client doesn't see it, but I've found that the clients just seem to ignore it with no ill effects, so I haven't bothered filtering the response out. The less the code on the load balancer does, the better. There's a possibility that the client could send it's own xff extended operation, but since the load balancer always sends first, we can just ignore any subsequent log entries. On the directory server plugin side, I needed to be able to log this to the access log, not to the error log. The slapi_log_access function isn't declared in the plugin header file, so I had to declare it manually. Here's what our log entries look like now, for both 636 (SSL) and 389 (cleartext before starttls): [17/May/2016:15:34:22 -0400] conn=230843 fd=156 slot=156 SSL connection from 130.207.167.12 to 130.207.183.16 [17/May/2016:15:34:22 -0400] conn=230843 op=0 EXT oid="1.3.6.1.4.1.636.2.11.11.1" name="forwarded-for extended op" [17/May/2016:15:34:22 -0400] conn=230843 op=0 forwarded for 130.207.167.12 [17/May/2016:15:34:22 -0400] conn=230843 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [17/May/2016:15:34:22 -0400] conn=230844 fd=156 slot=156 connection from 130.207.167.12 to 130.207.183.16 [17/May/2016:15:34:22 -0400] conn=230844 op=0 EXT oid="1.3.6.1.4.1.636.2.11.11.1" name="forwarded-for extended op" [17/May/2016:15:34:22 -0400] conn=230844 op=0 forwarded for 130.207.167.12 [17/May/2016:15:34:22 -0400] conn=230844 op=0 RESULT err=0 tag=120 nentries=0 etime=0 We haven't switched our Bigips yet, so the "connection from" line still shows the actual client IP address. F5 Bigip code fragments are called "irules" and are written in TCL. The tar file below contains two different irule files, one for cleartext streams and one for SSL streams. By SSL streams, I mean where SSL connections from the client are terminated at the load balancer and then re-SSLed to the ldap server. Sorry, I'm not writing the other kind.

4 6

Auditing Tool for Directory Server
by Dhiraj Deshpande 17 May '16

17 May '16

Hi Guys, Is there any auditing tool available for 389 directory server. For e.g to fetch inactive users from last 8 days,user's last login..etc. AdAudit does the same but works only with windows active directory which fetches all these related information from AD. Kindly let me know if there is any such tool which suffice this requirement. -- Thanks & Regards Dhiraj S. Deshpande

2 6

Sync problems with AD 2012 R2
by Alberto Viana 17 May '16

17 May '16

I'm trying to setup a new scenario with 389 and AD 2012 R2 (So far I'm using with AD 2008 R2 and everything works fine). 389-Directory/1.3.4.8 B2016.063.1654 Windows 2012 R2 64bits After configure the AD replication and Initiate a full sync, it starts to do some entries and I got the following error: [16/May/2016:16:36:47 -0300] NSMMReplicationPlugin - windows sync - agmt="cn=AD - DF-GTI-DC01" (gti-df-dc01:636): windows_process_total_add: Cannot replay add operation. And after that: [16/May/2016:16:36:47 -0300] NSMMReplicationPlugin - windows sync - agmt="cn=AD - DF-GTI-DC01" (gti-df-dc01:636): Replica has no update vector. It has never been initialized. [16/May/2016:16:36:47 -0300] NSMMReplicationPlugin - windows sync - agmt="cn=AD - DF-GTI-DC01" (gti-df-dc01:636): Replica has no update vector. It has never been initialized. [16/May/2016:16:36:51 -0300] NSMMReplicationPlugin - windows sync - agmt="cn=AD - DF-GTI-DC01" (gti-df-dc01:636): Replica has no update vector. It has never been initialized. I found a really old ticket that seems to be related to same error: https://fedorahosted.org/389/ticket/47589 but with win2008r2 and fixed. According to this link -> https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/10/h… 2012 R2 is supported, is that true? Any clues?

3 8

Latest version of 389 for Centos 7
by Richard Tearle 17 May '16

17 May '16

Hello What is the latest version of 389 (-ds-base) available via RPMs for Centos7? Yum is telling me it's 1.3.4.0-30.el7_2, which is from June last year. Is that correct, or have I messed up? Thanks in advance. -- Richard -- This email is sent on behalf of Northgate Public Services (UK) Limited and its associated companies including Rave Technologies (India) Pvt Limited (together "Northgate Public Services") and is strictly confidential and intended solely for the addressee(s). If you are not the intended recipient of this email you must: (i) not disclose, copy or distribute its contents to any other person nor use its contents in any way or you may be acting unlawfully; (ii) contact Northgate Public Services immediately on +44(0)1908 264500 quoting the name of the sender and the addressee then delete it from your system. Northgate Public Services has taken reasonable precautions to ensure that no viruses are contained in this email, but does not accept any responsibility once this email has been transmitted. You should scan attachments (if any) for viruses. Northgate Public Services (UK) Limited, registered in England and Wales under number 00968498 with a registered address of Peoplebuilding 2, Peoplebuilding Estate, Maylands Avenue, Hemel Hempstead, Hertfordshire, HP2 4NN. Rave Technologies (India) Pvt Limited, registered in India under number 117068 with a registered address of 2nd Floor, Ballard House, Adi Marzban Marg, Ballard Estate, Mumbai, Maharashtra, India, 400001.

2 2

Convert OpenLDAP ACIs to 389DS
by giuseppesarno＠fico.com 15 May '16

15 May '16

Hello, I have been trying to look for a tool to convert OpenLDAP ACIs as defined in slapd.conf (example http://www.openldap.org/doc/admin24/access-control.html) Into a format that can be imported in 389ds (LDIF for example: http://www.port389.org/docs/389ds/howto/howto-accesscontrol.html) Can anybody help ? Thanks, Giuseppe.

2 1

Is targetscope supported in 389ds ?
by giuseppesarno＠fico.com 14 May '16

14 May '16

Hello, I noticed that the aci filter "targetscope" is not listed under https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.2/… despite I have seen it in examples for other Directory Services. I tried to use it in a ldapsearch command together with "target" but I get the following error: MODIFY operation failed Result Code: 21 (Invalid Attribute Syntax) Additional Information: ACL Syntax Error(-5) ACI example: aci: (target="ldap:///cn=gsarno,dc=com")(targetscope="base")(version 3.0; acl "Self entry modification"; allow (read,search) userdn="........ Is targetscope supported in 389DS ? if not is there an alternative way to achieve the same functionality (apply aci to subtree or to the current node etc.) ? Thanks, Giuseppe.

2 1

admin console error : SSL related initialization failed
by sebweb＠gmail.com 13 May '16

13 May '16

Hello, I have some trouble with admin console to configure Admin server. I always get into following error: Status: Failure SSL related initialization failed If someone could help Thx

1 0

Solved? "LDAP Server will not perform" after DS upgrade/replica problems.
by Addison Laurent 11 May '16

11 May '16

Didn't see an answer to this problem we had, so for documentation purposes, posting it here, in case someone else runs across it. Configuration server was Centos 5.11, multi-master with 3 more replicas and a Windows Sync agreement. (We're working on moving to RHDS, so this was "frozen" in production while trying to get that project moving.) From the yum.log when the upgrade was committed: Apr 21 12:48:16 Updated: centos-ds-base-8.2.8-2.el5.centos.x86_64 Apr 21 12:48:18 Updated: centos-ds-admin-8.2.1-1.el5.centos.x86_64 Apr 21 12:48:18 Updated: centos-ds-console-8.2.0-4.el5.centos.noarch Apr 21 12:48:19 Updated: centos-ds-8.2.0-2.el5.centos.x86_64 Apr 21 12:48:44 Updated: centos-ds-base-8.2.8-2.el5.centos.x86_64 Just prior to upgrade: [21/Apr/2016:12:44:39 -0400] NSMMReplicationPlugin - Found replication agreement named "cn=ds0 to ds1, cn=replica, cn="dc=cise, dc=ufl, dc=edu", cn=mapping tree, cn=config". [21/Apr/2016:12:44:39 -0400] NSMMReplicationPlugin - agmt="cn=ds0 to ds1" (ds1:389): No linger to cancel on the connection [21/Apr/2016:12:44:39 -0400] NSMMReplicationPlugin - agmt="cn=ds0 to ds1" (ds1:389): Disconnected from the consumer [21/Apr/2016:12:44:39 -0400] NSMMReplicationPlugin - agmt="cn=ds0 to ds1" (ds1:389): State: start -> ready_to_acquire_replica [21/Apr/2016:12:44:39 -0400] NSMMReplicationPlugin - agmt="cn=ds0 to ds1" (ds1:389): State: ready_to_acquire_replica -> wait_for_changes [21/Apr/2016:12:44:40 -0400] NSMMReplicationPlugin - supplier: {replica ... And as the upgrade finished: ds1" (ds1:389): repl5_inc_stop: protocol stopped after 1 seconds [21/Apr/2016:12:48:44 -0400] NSMMReplicationPlugin - Found replication agreement named "cn=ds0 to ds1,cn=replica,cn=dc\3Dcise\2C dc\3Dufl\2C dc \3Dedu,cn=mapping tree,cn=config". [21/Apr/2016:12:48:44 -0400] NSMMReplicationPlugin - The replication agreement named "cn=ds0 to ds1,cn=replica,cn=dc\3Dcise\2C dc\3Dufl\2C dc \3Dedu,cn=mapping tree,cn=config" could not be correctly parsed. No replication will occur with this replica. [21/Apr/2016:12:49:20 -0400] NSMMReplicationPlugin - Found replication agreement named "cn=ds0 to ds1,cn=replica,cn=dc\3Dcise\2C dc\3Dufl\2C dc \3Dedu,cn=mapping tree,cn=config". [21/Apr/2016:12:49:20 -0400] NSMMReplicationPlugin - The replication agreement named "cn=ds0 to ds1,cn=replica,cn=dc\3Dcise\2C dc\3Dufl\2C dc \3Dedu,cn=mapping tree,cn=config" could not be correctly parsed. No replication will occur with this replica. [21/Apr/2016:12:50:09 -0400] NSMMReplicationPlugin - Replication agreement for agmt="cn=ds0 to ds1" (ds1:389) could not be updated. For replication to take place, please enable the suffix and restart the server [21/Apr/2016:12:50:09 -0400] NSMMReplicationPlugin - Replication agreement for agmt="cn=ds0 to ds1" (ds1:389) could not be updated. For replication to take place, please enable the suffix and restart the server What I saw in the logs that made me think this might be the problem: [09/May/2016:16:52:10 -0400] NSMMReplicationPlugin - replica_config_modify: replica does not exist for dc=cise,dc=ufl,dc=edu The solution that worked was to remove the replica from all the servers, and disable changelog on the partition. Then renabled changelog, and re-set with multi-master (ds0/configuration server first), I also changed the replica numbers ... just in case. Re-initialized the replicas, and re-set up the Windows synchronization. After that, the logs are looking normally, and replication is again working. Addison

1 0

Secondary Group not listing
by warron.french 10 May '16

10 May '16

Hello all, I am working with all CentOS-6.7 machines running 389-ds. I had created to groups in my DIT: 1. non-XYusers, and 2. XY-auditors I added 2 accounts to the DIT. Account1, is a member of non-XYusers, and was manually added through the 389-console to the XY-auditors group as well. The same is true of Account2; exact same configuration. Anyway, when I run on a centOS-6.7 client the following commands: *id -a Account1* (or Account2) all that I see listed is the primary Group = non-XYusers. *groups Account1* Any ideas on how to correct this behavior, so that both groups are listed? I am trying to do this so that I can enable these people to perform audit functions. Thanks in advance, -------------------------- Warron French

2 1

Announcing 389 Directory Server version 1.3.5.3
by Noriko Hosoi 09 May '16

09 May '16

389 Directory Server 1.3.5.3 The 389 Directory Server team is proud to announce 389-ds-base version 1.3.5.3. Fedora packages are available from the Fedora 24 and Rawhide repositories. The new packages and versions are: * 389-ds-base-1.3.5.3-1 Source tarballs are available for download at Download 389-ds-base Source <http://www.port389.org/binaries/389-ds-base-1.3.5.3.tar.bz2> and Download nunc-stans Source <http://www.port389.org/binaries/nunc-stans-0.1.8.tar.bz2>. Highlights in 1.3.5.3 * Bug fixes and enhancements. Installation and Upgrade See Download <http://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install, use *yum install 389-ds* yum install 389-ds After install completes, run *setup-ds-admin.pl* to set up your directory server. setup-ds-admin.pl To upgrade, use *yum upgrade* yum upgrade After upgrade completes, run *setup-ds-admin.pl -u* to update your directory server/admin server/console information. setup-ds-admin.pl -u See Install_Guide <http://www.port389.org/docs/389ds/legacy/install-guide.html> for more information about the initial installation, setup, and upgrade See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… as well as https://admin.fedoraproject.org/updates/389-ds-base-1.3.5.1-2.fc24 <https://admin.fedoraproject.org/updates/389-ds-base-1.3.5.1-2.fc24>. If you find a bug, or would like to see a new feature, file it in our Trac instance: https://fedorahosted.org/389 Detailed Changelog since 1.3.5.1 * Ticket 47536 - Allow usage of OpenLDAP libraries that don’t use NSS for crypto * Ticket 47536 - CI test: added test cases for ticket 47536 * Ticket 47840 - default instance scripts if undefined. * Ticket 47888 - Add CI test * Ticket 47888 - DES to AES password conversion fails if a backend is empty * Ticket 47951 - Fix startpid from altering dev/null * Ticket 47968 - Disable journald logs by default * Ticket 47982 - HR Log timers, regression fix for subsystem logging * Ticket 48078 - CI test - paged_results - TET part * Ticket 48144 - Add /usr/sbin/status-dirsrv script to get the status of the directory server instance. * Ticket 48269 - ns-accountstatus status message improvement * Ticket 48342 - DNA: deadlock during DNA_EXTEND_EXOP_REQUEST_OID * Ticket 48342 - DNA Deadlock test cases * Ticket 48342 - Prevent transaction abort if a transaction has not begun * Ticket 48350 - Integrate ASAN into our rpm build process * Ticket 48374 - entry cache locks not released in error conditions * Ticket 48410 - 389-ds-base - Unable to remove / unregister a DS instance from admin server * Ticket 48447 - with-initddir should accept no * Ticket 48450 - Systemd password agent support * Ticket 48492 - heap corruption at schema replication. * Ticket 48597 - Deadlock when rebuilding the group of authorized replication managers * Ticket 48662 - db2index with no attribute args fail. * Ticket 48710 - auto-dn-suffix unrecognized option * Ticket 48769 - Fix white space in extendedop.c * Ticket 48769 - RFE: Be_txn extended operation plugin type * Ticket 48770 - Improve extended op plugin handling * Ticket 48775 - If nsSSL3 is on, even if SSL v3 is not really enabled, a confusing message is logged. * Ticket 48779 - Remove startpidfile check in start-dirsrv * Ticket 48781 - Vague error message: setup_ol_tls_conn - failed: unable to create new TLS context * Ticket 48782 - Make sure that when LDAP_OPT_X_TLS_NEWCTX is set, the value is set to zero. * Ticket 48783 - Fix ns-accountstatus.pl syntax error * Ticket 48784 - CI test: added test cases for ticket 48784 * Ticket 48784 - Make the SSL version set to the client library configurable. * Ticket 48798 - Enable DS to offer weaker DH params in NSS * Ticket 48799 - objectclass values could be dropped on the consumer * Ticket 48800 - Cleaning up error buffers * Ticket 48801 - ASAN errors during tests * Ticket 48802 - Compilation warnings from clang * Ticket 48808 - Add test case * Ticket 48808 - Paged results search returns the blank list of entries * Ticket 48813 - password history is not updated when an admin resets the password * Ticket 48815 - ns-accountstatus.sh does handle DN’s with single quotes * Ticket 48818 - In docker, no one can hear your process hang. * Ticket 48822 - (389-ds-base-1.3.5) Fixing coverity issues. * Ticket 48824 - Cleanup rpm.mk and 389 specfile

1 0

Announcing svrcore 4.1.2
by Noriko Hosoi 09 May '16

09 May '16

Svrcore 4.1.2 The 389 Directory Server team is proud to announce svrcore version 4.1.2. Source tarballs are available for download at Download 389-ds-base Source <http://www.port389.org/binaries/svrcore-4.1.2.tar.bz2>. Fedora packages are avaliable for Fedora 24 and Rawhide repositories. Highlights in 4.1.2 * Code quality and stability improvements Installation See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… as well as https://bodhi.fedoraproject.org/updates/svrcore-4.1.2-1.fc24 <https://bodhi.fedoraproject.org/updates/svrcore-4.1.2-1.fc24>. If you find a bug, or would like to see a new feature, file it in our Pagure instance: https://pagure.io/svrcore/ Detailed Changelog since 4.1.1 * Bug 1329002 - SVRCORE - Fixing coverity issues

1 0

Re: Erasing and rewriting 389
by Patrick Landry 06 May '16

06 May '16

Well, I am far from an expert but if the directory server is working properly then your scripts have to create your DIT. If you are running a script to create the dc=tld,dc=dn entry and it is not being created there must be some error there. ----- Original Message ----- From: "Charlie Mordant" <cmordant1(a)gmail.com> To: "General discussion list for the 389 Directory server project." <389-users(a)lists.fedoraproject.org> Sent: Tuesday, April 26, 2016 11:59:28 AM Subject: [389-users] Re: Erasing and rewriting 389 Hi Patrick, Yes, my script does the exact inverse of the procedure. I didn't see any error while reinstalling, setup-ds-admin.pl says that all is right... Regards Le 25 avr. 2016 23:35, "Patrick M. Landry" < patrick.landry(a)louisiana.edu > a écrit : <blockquote> That's pretty much the steps I follow to completely remove a 389 DS installation. I presume your "existing scripts" attempt to recreate your DIT. Do they produce any error messages? <blockquote> From: "Charlie Mordant" < cmordant1(a)gmail.com > To: "General discussion list for the 389 Directory server project." < 389-users(a)lists.fedoraproject.org > Sent: Monday, April 25, 2016 3:51:28 PM Subject: [389-users] Erasing and rewriting 389 Hi Laposte experts (French national mailing delivery)! I'm trying some experiments some simple things on 389 ds. I've an existing 389 installation, with some users, groups and acls (on fedora 21), and I'm trying to uninstall, erase my existing ldap to reinstall it. So my script is: * remove-ds-admin.pl -a -f -y * service stop (dirsrv@myldap, dirsrv-admin) * yum uninstall 389-* * rm -rf /**dirsrv*/** * then reinstalling with my existing script. As it looks like a nice thing, it seems that there's a catch: my dc=tld,dc=dn subgroups are not created. Is there something somewhere that I should be aware to be able to remove everything? Best regards, Charlie -- Charlie Mordant Full OSGI/EE stack made with Karaf: https://github.com/OsgiliathEnterprise/net.osgiliath.parent -- 389-users mailing list 389-users(a)lists.fedoraproject.org http://lists.fedoraproject.org/admin/lists/389-users@lists.fedoraproject.org -- Patrick Landry Director, UCSS University of Louisiana at Lafayette pml(a)louisiana.edu -- 389-users mailing list 389-users(a)lists.fedoraproject.org http://lists.fedoraproject.org/admin/lists/389-users@lists.fedoraproject.org </blockquote> -- 389-users mailing list 389-users(a)lists.fedoraproject.org http://lists.fedoraproject.org/admin/lists/389-users@lists.fedoraproject.org </blockquote> -- Patrick Landry Director, UCSS University of Louisiana at Lafayette pml(a)louisiana.edu

2 2

How to delete bad entry based on ID?
by Addison Laurent 05 May '16

05 May '16

After an upgrade, replication has stopped. Looking at the problem, I (also?) found this: [05/May/2016:15:25:17 -0400] - str2entry returned NULL for id 72659, string="dn" dbscan -f /var/lib/dirsrv/slapd-fjord/db/userRoot/id2entry.db4 -K 72659 id 72659 id 72659 dn: cn=,ou=Groups,dc=cise,dc=ufl,dc=edu cn;vucsn-502edefb000000010000;mdcsn-502edefb000000010000: gidNumber;vucsn-502edefb000000010000: 11523 memberUid;vucsn-502edefb000000010000: ntUserDomainId;vucsn-502edefb000000010000: objectClass;vucsn-502edefb000000010000: top objectClass;vucsn-502edefb000000010000: groupofuniquenames objectClass;vucsn-502edefb000000010000: posixgroup objectClass;vucsn-502edefb000000010000: ntgroup uniqueMember;vucsn-502edefb000000010000: uid=,ou=Users,dc=cise,dc=ufl,dc=edu creatorsName;vucsn-502edefb000000010000: uid=suser,dc=cise,dc=ufl,dc=edu modifiersName;vucsn-502edefb000000010000: uid=suser,dc=cise,dc=ufl,dc=edu createTimestamp;vucsn-502edefb000000010000: 20120818001644Z modifyTimestamp;vucsn-502edefb000000010000: 20120818001644Z nsUniqueId: e8d26a81-e8c911e1-ba42b7ef-aa3939d0 parentid: 3 entryid: 72659 entrydn: cn=,ou=groups,dc=cise,dc=ufl,dc=edu How do I delete that based on id, since the cn is blank? Thanks, Addison

1 0

POODLE: cve-2014-3566
by Derek Belcher 03 May '16

03 May '16

The 389ds website is down. Can anyone tell me how to disable SSLv3 so I can protect against Poodle? This seems like it would be the right article, if I could only access it: http://directory.fedoraproject.org/docs/389ds/howto/howto-disable-sslv3.html "503 Service Unavailable No server is available to handle this request. " Thank you for your time. -Derek

3 4

Admin-server connection
by Job Cacka 03 May '16

03 May '16

Recently, I was researching samba connections, and noticed that the Linux 'Domain Users' group was displaying as the Unix GID number instead of the name. I went to login to the admin-server express from 'https://zigzag.ccbox.com:9830/dist/download' and that page loads but when I click on the link I get. " Internal Server Error The server encountered an internal error ormisconfiguration and was unable to completeyour request.Please contact the server administrator, [no address given] and inform them of the time the error occurred,and anything you might have done that may havecaused the error.More information about this error may be availablein the server error log.ADDRESS: Apache/2.2 Server at zigzag.ccbox.com Port 9830 " So I went over to the 389 Management Console on my Windows box and I enter cn=Directory Manager the password and https://zigzag.ccbox.com:9830 and I get a message saying the URL is not correct or the server is not running. For kicks and giggles I tried it with http instead of https and it gives an error that says,"Cannot logon because of an incorrect User ID, Incorrect password, or Directory problem. java.io.InterruptedIOExceptio: HTTP response timeout"Which indicates to me that the correct protocol should be https: To further verify this I ran the following command at the Linux CLI on the server and a server that communicates with it. ldapsearch -H ldaps://zigzag.ccbox.com [-x] -b o=netscaperoot -D "cn=directory manager" -W "objectclass=nsAdminConfig" This returns 129 responses, but I don't know if they are valid or make sense. They look like they are unique to my system. Here is a pastbin of some error logs I noticed after I restarted the admin server with stop-ds-admin and start-ds-admin. #357156 • Fedora Project Pastebin | | | | | | | | | | | #357156 • Fedora Project Pastebin Fedora Sticky Notes is a feature-rich, yet lightweight paste utility | | | | Job Cacka

3 14

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users May 2016