389-users May 2021

389-users@lists.fedoraproject.org

12 participants
14 discussions

ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0
by Graham Leggett 12 Dec '23

12 Dec '23

Hi all, We have a long standing 389ds master LDAP server that was found to be unable to contact it’s slaves. Most specifically, the slaves show nothing in their logs about any kind of connection, while the master is logging this: [12/Nov/2019:21:39:47.212715697 +0000] - ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0 (Unknown error, host “ldap01:636”) Key is "system error 0 (no error)”, which leaves us stumped. The error is obviously “success”. Has anyone seen this kind of thing before? This is 389ds running on CentOS7 as follows: 389-ds-base-1.3.9.1-10.el7.x86_64 Regards, Graham —

3 9

Plugin development licensing
by DUVERT Vincent 09 May '23

09 May '23

Hello, I have a question regarding the licensing of developed 389-ds plugins. The FAQ (https://directory.fedoraproject.org/docs/389ds/FAQ/licensing.html#directory…) indicates that the Directory Server core code is licensed under a GPL + Exception license that allows non-GPL 389-ds plugins to link to 389-ds and to use specific header files. However, the LICENSE file in the current 389-ds-base source does not contain this exception. It was apparently removed by the following commit, when the license was changed to GPLv3+: https://pagure.io/389-ds-base/c/88cae401aee39a19ac6b07c3c36ee8daa07192e7 Does that means that the license exception does not apply to the current version of 389-ds? Regards, Vincent Duvert

2 2

how could I set nsslapd-db-home-directory?
by Marco Favero 27 May '21

27 May '21

Hello, could you help me to set `nsslapd-db-home-directory`? I would like to change that path in order to move the cache in a RAM fs. I tried with ` /usr/sbin/dsconf -D "cn=Directory Manager" -w *** ldap://tst-example.com:389 backend config set --dbcachesize=209715200 --db-home-directory=/dev/shm/dirsrv/slapd-default/dbcache` but it fails with: `Error: Server is unwilling to perform - nsslapd-db-home-directory can't be modified while the server is running.` I tried to follow these instructions: https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/h… but even if I stop the directory, I change the entry in the dse, I restart the directory, then I still see: `nsslapd-db-home-directory: /var/lib/dirsrv/slapd-default/db` My 389ds-base is `1.4.3.22`. Thank you very much Kind Regards Marco

3 3

Monthly internal scheduled task failure resulting in segfault
by Mark Reynolds 26 May '21

26 May '21

On 5/26/21 12:12 PM, Nelson Bartley wrote: > Thank you for your assistance, I will be trying it in dour test > environment. Is there anything that I can do to artificially do to > trigger this issue to ensure it’s no longer a problem? So you are turning "off" compaction with my suggestion. So it should never run. There is no way to verify it except for the server not crashing. HTH, Mark > > Cheers > Nelson. > > On Thu, May 27, 2021 at 0:08 Mark Reynolds <mreynolds(a)redhat.com > <mailto:mreynolds@redhat.com>> wrote: > > > On 5/26/21 11:05 AM, Nelson Bartley wrote: >> I can confirm we do not have replication on these servers. > > Ok so you can use the workaround I mentioned about setting the > compact interval to 0 until we get the proper fix released. > > Thanks, > > Mark > >> >> On Wed, May 26, 2021 at 21:15 Mark Reynolds <mreynolds(a)redhat.com >> <mailto:mreynolds@redhat.com>> wrote: >> >> HI Nelsen, >> >> I'm working on a db compaction improvement., Now DB >> compaction occurs every 30 days, and I found a bug if you >> don't have replication set up then the server crashes when >> trying to compact a changelog (that does not exist). This >> only happens on 389-ds-base-1.4.3, or newer, and only if you >> don't have replication set up. Can you confirm if you are >> using replication on this server? >> >> Mark >> >> On 5/26/21 1:42 AM, Nelson Bartley wrote: >>> Good day, >>> >>> I previously messaged about this issue, but didn't have a core dump to provide. >>> >>> Almost exactly 1 month, to the minute, a scheduled task starts in our >>> 389-ds which results in a seg-fault. >>> >>> We are currently using Fedora 33, 389 packages 1.4.4.15-1.fc33. This >>> bug also occurred with an earlier package set as well (I do not >>> remember the version, same FC33). We have experienced this exact >>> segault now three times on schedule. >>> >>> I have attached to the email the cockpit information from the crash. >>> >>> You can get the coredump from this link:http://gofile.me/4kovq/KZB9Waixm <http://gofile.me/4kovq/KZB9Waixm> >>> >>> I was hoping it was possible to identify what scheduled service is >>> crashing, and if possible how to disable it temporarily until the >>> actual cause of the crash can be fixed in an updated binary? >>> >>> Nelson >>> >>> _______________________________________________ >>> 389-users mailing list --389-users(a)lists.fedoraproject.org <mailto:389-users@lists.fedoraproject.org> >>> To unsubscribe send an email to389-users-leave(a)lists.fedoraproject.org <mailto:389-users-leave@lists.fedoraproject.org> >>> Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/> >>> List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines> >>> List Archives:https://lists.fedoraproject.org/archives/list/389-users@lists.fedo… <https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject…> >>> Do not reply to spam on the list, report it:https://pagure.io/fedora-infrastructure <https://pagure.io/fedora-infrastructure> >> >> -- >> >> 389 Directory Server Development Team >> >> -- >> Sent from Gmail Mobile > > -- > > 389 Directory Server Development Team > > -- > Sent from Gmail Mobile -- 389 Directory Server Development Team

2 1

Freenode IRC channel #389 has been closed, please use Libera.chat (#389)
by Mark Reynolds 26 May '21

26 May '21

Everyone has been kicked out of the freenode channel. Please join irc://irc.libera.chat/389 to continue chatting about 389 Directory Server! Thanks -- 389 Directory Server Development Team

1 0

Monthly internal scheduled task failure resulting in segfault
by Nelson Bartley 26 May '21

26 May '21

Good day, I previously messaged about this issue, but didn't have a core dump to provide. Almost exactly 1 month, to the minute, a scheduled task starts in our 389-ds which results in a seg-fault. We are currently using Fedora 33, 389 packages 1.4.4.15-1.fc33. This bug also occurred with an earlier package set as well (I do not remember the version, same FC33). We have experienced this exact segault now three times on schedule. I have attached to the email the cockpit information from the crash. You can get the coredump from this link: http://gofile.me/4kovq/KZB9Waixm I was hoping it was possible to identify what scheduled service is crashing, and if possible how to disable it temporarily until the actual cause of the crash can be fixed in an updated binary? Nelson

2 2

Replication and operational attributes / cockpit-389-ds
by Tornóci László 22 May '21

22 May '21

Hi, I plan to set up a read only replica to my 389-ds server. I would like to have all my users authenticate againts the read only replica. Can I still use the account-policy plugin to store the lastLoginTime operational attribute? My other question is: I am using RHEL 8 with the latest 389-ds. I don't find the rpm for cockpit-389-ds plugin anywhere (which is available for Fedora), but the old admin console is gone, too. How can I use cockpit with 389-ds? Is that only available for redhat-ds? If yes, what can I do? Thanks: Laszlo

2 1

IRC server change
by Mark Reynolds 20 May '21

20 May '21

Same as #freeipa has done, we have also moved off of freenode and on to libera: irc://irc.libera.chat/389 Sooner than later we will shutdown the freenode channel #389 ... Thanks, Mark -------- Forwarded Message -------- Subject: [Freeipa-users] IRC server change Date: Wed, 19 May 2021 16:39:52 -0400 From: Rob Crittenden via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Reply-To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> CC: Rob Crittenden <rcritten(a)redhat.com> Due to the changes at freenode [1], the freeIPA IRC channel is transitioning to the libera.chat IRC server with the same channel name: irc://irc.libera.chat/freeipa There is currently no hard cut-off date but its likely to be sooner than later. rob [1] https://www.kline.sh/ _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

2 1

fips enabled error
by Angel Bosch Mora 18 May '21

18 May '21

Hi, is it possible to lower the severity of fips enabled info from ERR to WARN in messages like this? [17/May/2021:10:57:02.753271017 +0000] - ERR - slapd_system_isFIPS - Can not access /proc/sys/crypto/fips_enabled - assuming FIPS is OFF can seem a cosmetic change but it breaks my monitoring scripts. thanks in advance, abosch -- Institut Mallorqui d'Afers Socials. Aquest missatge, i si escau, qualsevol fitxer annex, es dirigeix exclusivament a la persona que n'es destinataria i pot contenir informacio confidencial. En cap cas no heu de copiar aquest missatge ni lliurar-lo a terceres persones sense permis expres de l'IMAS. Si no sou la persona destinataria que s'hi indica (o la responsable de lliurar-l'hi) us demanam que ho notifiqueu immediatament a l'adreca electronica de la persona remitent. Abans d'imprimir aquest missatge, pensau si es realment necessari.

3 4

389 console on Windows - command logging
by Joe Fletcher 18 May '21

18 May '21

Hi, Does the native windows version of 389 management console keep logs of commands executed and their results anywhere? If not is there a way to make it do so? I am working on a project to migrate to 389 and I have an instance whereby if I select "restart directory server" from the tasks page I get a message pop-up saying "Directory Server <instance-name> could not be restarted" but no explanation as to why. I have other instances where this functionality works fine. There doesn't appear to be anything in the access or error logs at the server end to signify the failed attempt. Any way to trace the issue? Regards This email with all information contained herein or attached hereto may contain confidential and/or privileged information intended for the addressee(s) only. If you have received this email in error, please contact the sender and immediately delete this email in its entirety and any attachments thereto.

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users May 2021