389-users February 2007

389-users@lists.fedoraproject.org

46 participants
49 discussions

[Fedora-directory-users] Do not yum install fedora-ds or yum upgrade!
by Rich Megginson 16 Feb '07

16 Feb '07

There is a problem with the new fedora-ds in Fedora Extras. It conflicts with the old fedora-ds 1.0.x installation. If you do a 'yum install fedora-ds' or a 'yum update' on a system that has fedora-ds 1.0.x installed, the installation will remove the old binaries. You may be saying "So what? Isn't that what you want?" No, sadly. The fedora-ds 1.1.0a1 in Fedora Extras is the core only - when you upgrade, you remove all of the other files for admin server, console, etc. The good news is that none of the configuration or data is affected and you can easily recover by following these steps: * Find the fedora-ds 1.0.4 RPM you installed from originally, or download from http://directory.fedora.redhat.com/wiki/Download * rpm -Uvh --oldpackage fedora-ds-1.0.4-1......rpm We are working on a solution for this. We will hopefully figure out a way to install both 1.0.4 and 1.1 at the same time, but we may have to make the 1.1 Conflicts: fedora-ds < 1.1 or something like that. In the meantime, fedora-ds is being pulled from the Fedora Extras yum repos so that this doesn't happen again. I apologize for any inconvenience.

2 3

Re: [Fedora-directory-users] Stress tool to FDS
by Renato Ribeiro da Silva 16 Feb '07

16 Feb '07

Thank you, Is's a good tool. I found another one too called Apache JMeter. Best regards, Renato. > Renato Ribeiro da Silva wrote: > > Is there any stress tool to FDS? I need to simulate a large number of binds and searches in Directory. > > > > Thanks in advance, > > Renato. > > > > > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > Please take a look at /opt/fedora-ds/shared/bin/{rsearch, ldclt} if they > meet your requirements. > ===================================================== > Usage: rsearch -D binddn -w bindpw -s suffix -f filter [options] > -\? -- print Usage (this message) > -H -- print Usage (this message) > -h host -- ldap server host (default: localhost) > -p port -- ldap server port (default: 389) > -S scope -- search SCOPE [0,1,or 2] (default: 2) > -b -- bind before every operation > -u -- don't unbind -- just close the connection > -L -- set linger -- connection discarded when closed > -N -- No operation -- just bind (ignore mdc) > -v -- verbose > -y -- nodelay > -q -- quiet > -l -- logging > -m -- operaton: modify non-indexed attr (description). -B required > -M -- operaton: modify indexed attr (telephonenumber). -B required > -d -- operaton: delete. -B required > -c -- operaton: compare. -B required > -i file -- name file; used for the search filter > -B file -- [DN and] UID file (use '-B \?' to see the format) > -A attrs -- list of attributes for search request > -a file -- list of attributes for search request in a file > -- (use '-a \?' to see the format ; -a & -A are mutually > exclusive) > -n number -- (reserved for future use) > -j number -- sample interval, in seconds (default: 10) > -t number -- threads (default: 1) > -T number -- Time limit, in seconds; cmd stops when exceeds <number> > -V -- show running average > -C num -- take num samples, then stop > -R num -- drop connection & reconnect every num searches > -x -- Use -B file for binding; ignored if -B is not given > ===================================================== > usage: ldclt [-qQvV] [-E <max errors>] > [-b <base DN>] [-h <host>] [-p <port>] [-t <timeout>] > [-D <bind DN>] [-w <passwd>] > [-e <execParams>] [-a <max pending>] > [-n <nb threads>] [-i <nb times>] [-N <nb samples>] > [-I <err number>] [-T <total>] > [-r <low> -R <high>] > [-f <filter>] [-s <scope>] > [-S <slave>] [-P<master port>] > [-W <waitsec>] [-Z <certfile>] > > This tool is a ldap client targetted to validate the reliability of > the product under test under hard use. > > The valid options are: > -a Asynchronous mode, with max pending operations. > -b Give the base DN to use. Default "o=sun,c=us". > -D Bind DN. See -w > -E Max errors allowed. Default 1000. > -e Execution parameters: > add : ldap_add() entries. > append : append entries to the genldif file. > ascii : ascii 7-bits strings. > attreplace=name:mask : replace attribute of existing > entry. > attrlist=name:name:name : specify list of attribs to > retrieve > attrsonly=0|1 : ldap_search() parameter. Set 0 to read > values. > bindeach : ldap_bind() for each operation. > bindonly : only bind/unbind, no other operation is > performed. > close : will close() the fd, rather than > ldap_unbind(). > cltcertname=name : name of the SSL client certificate > commoncounter : all threads share the same counter. > counteach : count each operation not only successful ones. > delete : ldap_delete() entries. > dontsleeponserverdown : will loop very fast if server down. > emailPerson : objectclass=emailPerson (-e add > only). > esearch : exact search. > genldif=filename : generates a ldif file > imagesdir=path : specify where are the images. > incr : incremental values. > inetOrgPerson : objectclass=inetOrgPerson (-e > add only). > keydbfile=file : filename of the key database > keydbpin=password : password for accessing the key > database > noglobalstats : don't print periodical global > statistics > noloop : does not loop the incremental > numbers. > object=filename : build object from input file > person : objectclass=person (-e add only). > random : random filters, etc... > randomattrlist=name:name:name : random select attrib in > the list > randombase : random base DN. > randombaselow=value : low value for random generator. > randombasehigh=value : high value for random generator. > randombinddn : random bind DN. > randombinddnfromfile=fine : retrieve bind DN & passwd > from file > randombinddnlow=value : low value for random generator. > randombinddnhigh=value : high value for random generator. > rdn=attrname:value : alternate for -f. > referral=on|off|rebind : change referral behaviour. > scalab01 : activates scalab01 scenario. > scalab01_cnxduration : maximum connection duration. > scalab01_maxcnxnb : modem pool size. > scalab01_wait : sleep() between 2 attempts to > connect. > smoothshutdown : main thread waits till the > worker threads exit. > string : create random strings rather than random > numbers. > v2 : ldap v2. > withnewparent : rename with newparent specified as argument. > -f Filter for searches. > -h Host to connect. Default "localhost". > -i Number of times inactivity allowed. Default 3 (30 seconds) > -I Ignore errors (cf. -E). Default none. > -n Number of threads. Default 10. > -N Number of samples (10 seconds each). Default infinite. > -p Server port. Default 389. > -P Master port (to check replication). Default 16000. > -q Quiet mode. See option -I. > -Q Super quiet mode. > -r Range's low value. > -R Range's high value. > -s Scope. May be base, subtree or one. Default subtree. > -S Slave to check. > -t LDAP operations timeout. Default 30 seconds. > -T Total number of operations per thread. Default infinite. > -v Verbose. > -V Very verbose. > -w Bind passwd. See -D. > -W Wait between two operations. Default 0 seconds. > -Z certfile. Turn on SSL and use certfile as the certificate DB > >

3 2

[Fedora-directory-users] Re: Suddenly, all our LDAP servers segfaulted today?
by Philip Kime 15 Feb '07

15 Feb '07

> What OS? By the size of the numbers above, I'm assuming 64-bit? What has changed? > Did you recently update something related to sasl, gssapi, or kerberos? Did you > install or uninstall mysql or some other relational database client/server product? 64-bit RHEL4 (CentOS). I'm trying to track down what changes might have been made. All servers run over SSL but as far as I know, no sasl, kerberos or gssapi. None have mysql with SASL (or mysql at all). I'm asking all our ops people if they installed anything ...

1 0

[Fedora-directory-users] Suddenly, all our LDAP servers segfaulted today?
by Philip Kime 15 Feb '07

15 Feb '07

FDS 1.0.2 and suddenly today three out of four servers segfaulted (at different times) with this identical dump message: Feb 14 19:40:17 hqldap01 kernel: ns-slapd[2432]: segfault at 0000000000000008 rip 0000000000411b6f rsp 00000000404520c8 error 4 syslog also had a lot of this: Feb 13 03:15:26 hqldap02 ns-slapd: sql_select option missing Feb 13 03:15:26 hqldap02 ns-slapd: auxpropfunc error no mechanism available Feb 14 02:00:01 hqldap02 ns-slapd: sql_select option missing Feb 14 02:00:01 hqldap02 ns-slapd: auxpropfunc error no mechanism available Feb 14 02:00:04 hqldap02 ns-slapd: sql_select option missing Feb 14 02:00:04 hqldap02 ns-slapd: auxpropfunc error no mechanism available Feb 14 03:15:25 hqldap02 ns-slapd: sql_select option missing Feb 14 03:15:25 hqldap02 ns-slapd: auxpropfunc error no mechanism available This is really strange - any ideas? -- Philip Kime NOPS Systems Architect 310 401 0407

3 2

[Fedora-directory-users] Announce: Net-LDAPapi version 2.00 released
by Quanah Gibson-Mount 15 Feb '07

15 Feb '07

A new release of Net::LDAPapi module is now available for Perl via CPAN. This release includes compilation against OpenLDAP libraries from version 2.1 forward. It now supports LDAPv3, including SASL binds. Support for the Netscape (now Mozilla) C SDK has been kept, but not tested. I welcome feedback on the usability with the Mozilla C SDK. Many thanks to Howard Chu and Symas Corporation for the work done to realize LDAPv3 support with Net::LDAPapi. Net::LDAPapi can be obtained from: <http://search.cpan.org/~mishikal/Net-LDAPapi-2.00/> For those who have never used Net::LDAPapi, it uses the C interface for its LDAP operations. This means that it is much faster than the pure perl Net::LDAP module from the perl-ldap package. However, it also relies on having the C libraries it was linked against available. --Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

3 2

[Fedora-directory-users] Stress tool to FDS
by Renato Ribeiro da Silva 14 Feb '07

14 Feb '07

Is there any stress tool to FDS? I need to simulate a large number of binds and searches in Directory. Thanks in advance, Renato.

2 1

Re: [Fedora-directory-users] Message in error log
by Renato Ribeiro da Silva 14 Feb '07

14 Feb '07

I tried turn on the aci summary log level but the Directory got so slow and stopped responding. However I checked the number of ACIs and there was a lot of acis in the container "ou=UserPreferences,ou=corp,o=NetscapeRoot". I deleted all entries inside this container and that problem was solved. Thank you, Renato > Renato Ribeiro da Silva wrote: > > The following message is frequently appearing in my slapd error log. > > [01/Feb/2007:15:36:52 -0200] acl__TestRights - cache overflown > > Any idea? > > > Try turning on the ACI summary log level > http://directory.fedora.redhat.com/wiki/FAQ#Troubleshooting > How many ACIs do you have in your server? > > Thanks in advance, > > Renato. > > > > > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > >

1 0

[Fedora-directory-users] Detecting password changes in fds
by Bliss, Aaron 13 Feb '07

13 Feb '07

Hi everyone, I thought that others may find this useful; we have migrated away from local accounts to fds, but needed a way to detect password changes to user objects in fds; there are 2 scripts involved with this; the first will generate a list of uids and their password expiration times ; the second script (a perl script) will use epoch time to determine if a given users password expiration time is 90 days from today; the scripts assume that there is an fds password policy set that will force user object passwords to expire 90 days after being set. I'm sure that others will be able to make these scripts more efficient, but they do get the job done....Enjoy. Aaron #!/bin/bash #this script is designed to detect user for password changes #located in the ldap directory #this script assumes your password policy is set so that user object's #will have a passwordExpiration time of 90 days after settting their passwords #generate a list of dn's ldapsearch -b ou=Users,dc=preferredcare,dc=org -x -ZZ uid | grep '^uid' | awk ' {print $2}' | sort > /tmp/listdns #lets process our logs exec < /tmp/listdns while read line do pswar=`ldapsearch -x -ZZ "(uid=$line)" passwordexpirationtime | grep passwordexpirationtime | grep -v '#' | awk '{print $2}' | cut -c 1-8` #setup some vars for the check pwmonth=`echo $pswar | cut -c 5-6` pwday=`echo $pswar | cut -c 7-8` pwyear=`echo $pswar | cut -c 1-4` pwuser=`echo $line | awk '{ print $1}'` if [ -e /tmp/$pwuser.out ] ; then rm -f /tmp/$pwuser.out fi #perl script expects input year month day /myepoch.pl $pwyear $pwmonth $pwday $pwuser # echo $line | awk '{ print $1}' #this is going to get our expiration dates for us #check to see if the temp file was created if [ -e /tmp/$pwuser.out ] ; then echo "$pwuser password was chagned" fi Done #! /usr/bin/perl use strict; use warnings; use Time::Local; #epoch secs for 2 weeks equal 1209600 #setup vars that were passed in year, month, day in that order my $varpass0 = $ARGV[0]; my $varpass1 = $ARGV[1]; my $varpass2 = $ARGV[2]; my $varpass3 = $ARGV[3]; #timelocal doesn't work for dates past the year 2038 if ($varpass0 >= 2038) { exit 0; } #get todays date and format it properly #beaware localtime is going to format year-1900 and month-1 my ($mday,$mmonth,$myear) = (localtime(time)) [3,4,5]; my $epdate = timelocal (0,0,0,$mday,$mmonth,$myear); #get epoch date for when password will expire #we have to format what was passed to us to make it usable by timelocal my $varpass00 = $varpass0 - 1900; my $varpass11 = $varpass1 - 1; my $passexp = timelocal (0,0,0,$varpass2,$varpass11,$varpass00); #subtract password expiration from today and see what we get my $passans = ($passexp - $epdate) / 86400; #lets see where we stand #and send a warning to the end users if necessary my $passans1 = int($passans); #set this to be 1 less than your password expiration policy if ($passans > 89) { open(NEW, "> /tmp/$varpass3.out"); print NEW "$passans1\n"; close NEW; } Confidentiality Notice: The information contained in this electronic message is intended for the exclusive use of the individual or entity named above and may contain privileged or confidential information. If the reader of this message is not the intended recipient or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that dissemination, distribution or copying of this information is prohibited. If you have received this communication in error, please notify the sender immediately by telephone and destroy the copies you received.

1 0

[Fedora-directory-users] FDS backup_now script
by Edward Capriolo 13 Feb '07

13 Feb '07

This is small backup script I wrote. Often times before minor changes I run a quick backup to be on the safe side. It assumes an ldap instance is the same as your hostname. bob.test.test.com instance name=bob #!/bin/sh # Edward Guy Capriolo # 2007 February 13 # Used to initiate a databackup of LDAP #Start user edit auth_dn="change_this" auth_ps="change_this" #End user edit USER_ID=`id -u` host_n=`hostname -s` # Standard format 2007_02_11_02_02_01 folder_name=`date +%Y_%m_%d_%H_%M_%S` if [ "$USER_ID" = "0" ]; then true else echo "Script must be run as root (0)" exit 1 fi /opt/fedora-ds/slapd-${host_n}/db2bak.pl -D "${auth_dn}" -w "${auth_ps}" -a /opt/fedora-ds/slapd-${host_n}/bak/${folder_name} echo "Backup Initiated: Run tail -f /opt/fedora-ds/slapd-${host_n}/logs/errors to monitor the backup status." exit 0 Hope this is useful. Edward Capriolo

1 0

Re: [Fedora-directory-users] sasl encryption not supported over ssl error
by Howard Chu 13 Feb '07

13 Feb '07

> Date: Mon, 12 Feb 2007 11:17:10 -0700 > From: David Boreham <david_list(a)boreham.org> >>Yu Joe wrote: >> > Dear all >> > >> > I tried to make my FDS work with sasl(digest-md5)+SSL. I can get >> > correct result by "ldapsearch -Y digest-md5 -U sasl1 ..." or >> > "ldapsearch -x -D 'cn=Directory Manager' -W -H >> > ldaps://rhds.example.com...". >> > But I got the error message such as "*sasl encryption not supported >> > over ssl"*, when I execute command like "ldapsearch -Y digest-md5 -U >> > sasl1 -H ldaps://rhds.example.com ...". Some of my friends tell me >> > this works on openldap. So I suggest it must be also working on FDS. >> > Is that right? If so, what's the probably reason causes this error? Or >> > it just really don't support? Please helps, thanks a lot. > > No, it really doesn't work. But why are you wanting both SSL and SASL > privacy ? Always an interesting question but yes, for the record, it works fine in OpenLDAP. > For the curious, the way the SSL I/O is layered in the server is not > compatible with > the implementation of SASL encryption (they're both trying to layer at > the same place > in the I/O stack). With sufficient motivation I suspect that SASL over > SSL could be done, > but the question is why would anyone want to do that.. The OpenLDAP implementation allows an arbitrary number of encoders/parsers to be layered on the I/O stack. http://www.openldap.org/devel/cvsweb.cgi/doc/man/man3/lber-sockbuf.3 As Pete Rowley would say, it's always better to have the choice available to you. You never know what future requirements may come along, after all, and some people may decide that triple-DES or AES by itself isn't strong enough (paranoid enough?). > Perhaps all you need to do is to turn off SASL payload encryption. SASL > authentication > with an SSL connection should work ok. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users February 2007