389-users November 2008

389-users@lists.fedoraproject.org

43 participants
59 discussions

[Fedora-directory-users] Replicate o=NetscapeRoot database
by Hugo Etievant 19 Nov '08

19 Nov '08

hello, - I have installed 2 Directory servers, the second (DS2) is registered on the first (DS1). - I have installed multi master replication between the both (DS1 and DS2) for user data on userRoot database. Here, that is working. - Finally, I try to configure multi master replication for o=NetscapeRoot database between 2 DS with the same way of conventional replication, after copying o=NetscapeRoot database from DS1 to DS2. Replication work, but Administration Server of DS2 refuse to start on the replica of NetscapeRoot. The Admin Guide is not clear about NetscapeRoot replication (8.14. Replicating o=NetscapeRoot for Administration Server Failover http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_Replication-R… ) It exists a way with GUI Console to configure replication for o=NetscapeRoot on existing architecture ? Who have experimented this point ? regards -- * Hugo Étiévant ***

3 6

[Fedora-directory-users] dbverify
by Dan Lannom 18 Nov '08

18 Nov '08

I plan to migrate to fds from SunOne 5.2 and so I want to validate the system. I'm currently running version 1.1.3-2 of the directory on RHEL 5.2. When I do searches against the server everything seems to work fine, but When I run /usr/lib/dirsrv/slapd-{{hostname}}/dbverify, with the server off, it fails with errors like: [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 2 [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 8 [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 11 [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 14 ... [28/Oct/2008:10:52:16 -0400] - libdb: /var/lib/dirsrv/slapd-hume/db/{{SUFFIX}}/{{attribute}}.db4: DB_VERIFY_BAD: Database verification failed [28/Oct/2008:10:52:16 -0400] DB verify - verify failed(-30975): /var/lib/dirsrv/slapd-{{hostname}}/db/userdata/{{attribute}}.db4 reindexing does not change anything and I find the same errors for both i386 and x86_64 and the errors are almost identical for the master and the slaves. Since I can find any evidence of the indexes identified as corrupted not working I wonder why dbverify is generating these errors. Thanks for any help, Dan Lannom UM-Dearborn

2 2

[Fedora-directory-users] [ioggstream] peculiar deploy of fedorads
by Roberto Polli 18 Nov '08

18 Nov '08

Hi all, I'm planning a mid-size deploy of fedora-ds. let's call the units of this deploy "island" islands are independent, data must be physically isolated betwen them * an island represent a scalable, multi-mastered deploy of fedora-ds made of 6+ nodes * I have more islands: island1, island2, .. * one island contains many mailDomain (foo.it, foo.net, foo.com) * a mailDomain is hosted on one island: if foo.it is on island1, it won't be on island2 * each island has its own services accessing ldap There's one Rule-Them-All (RTA) island with shared services. Services on the "RTA" must access all ldap using the same search for all the island ex. ldapsearch -h ruleThemAll "(mail=foo(a)bar.com)" should find the user independently on which island it is. question: how will you implement this requirements trying to limit the overhead? (somebody told me about a VirtualDS but I'd like to do it with FDS..) Peace, R.

1 0

[Fedora-directory-users] Windows Sync and Active Directory password complexity policies
by Hugo Etievant 18 Nov '08

18 Nov '08

hello, The admin Guid says that : "Make sure that the Active Directory password complexity policies are enabled so that the *Password Sync* service will run. Run |secpol.msc|, and select *Security Settings*, then *Account Policies*, and *Password Policy*. Make sure that |Password must meet complexity requirements| is selected. " ( cf http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Windows_Sync-Configuri… ) I done the installation same as required. But after a week, I have reconfigured Active Directory and unactivate the "|Password must meet complexity requirements|" attribute. Windows Sync continue to work without problem : new very simple password (for example, password identical to login) are synchronized between AD and FDS. Why the Admin Guide says this attribute is mandatory ? The facts show that it is not ! Is it a bug ? The |complexity requirements are too much complicated for my users (and are no configurable), i must unactivate it.| Regards -- * Hugo Étiévant *

2 1

[Fedora-directory-users] Recover directory database files when disk fills up!
by Howard Wilkinson 18 Nov '08

18 Nov '08

We had the disk with the directory database files fill up overnight, a rogue process :-[ Now the directory server will not start I get the following reported in the system logs. Jul 29 09:44:50 bastion ns-slapd: auxpropfunc error invalid parameter supplied Jul 29 09:44:50 bastion ns-slapd: sql_select option missing Jul 29 09:44:50 bastion ns-slapd: auxpropfunc error no mechanism available What can I do to recover the database so that I can start the server?

2 9

[Fedora-directory-users] Personal Address book In FDS
by stupid stupid 18 Nov '08

18 Nov '08

Hello, I am new to FDS and LDAP world. I have installed FDS on a server and would like to use it for Address book lookup. The address book look up is working from different mail clients, but I wanted to know how to allow users to add their own Personal Address book entries to the Fedora DS. Please help. Thanks

1 1

[Fedora-directory-users] ACI deny matching with macros
by John A. Sullivan III 17 Nov '08

17 Nov '08

Hello, all. This post is a follow up to an IRC chat with Rich Megginson and others. Rich, I did not report the problem as a bug because upon several more hours of testing, it does not appear to be a conflict between userdn and roledn permissions. Rather, it appears to be a wildcard globbing issue. To bring the everyone else up to speed, in a multi-tenant environment, we have an allow ACI to permit clients to administer their own portion of the tree. However, their portions of the tree also contain some system type accounts used to by the host to enable certain client functions. These should not be viewable by the client admins so there is an ACI to deny access to these. We also want to use macros to create a single ACI at the root which will apply to all clients rather than creating ACIs for each client. To grant client access, we create a role at the top of their tree named ldapadmins and assign it to the appropriate client admins. We create a root level ACI as follows: (targetattr = "*") (target = "ldap:///($dn),dc=ssiservices, dc=biz") (version 3.0;acl "Client Administrators";allow (all)(roledn = "ldap:///cn=ldapadmins,[$dn],dc=ssiservices,dc=biz");) It works fine. The tree looks something like this: root /com /client1 /Users /Internal /Contacts /SysAccounts No one would have access to SysAccounts except client ldapadmins from the above ACI. We don't want that so we create the following ACI to deny access to SysAccounts: (targetattr = "*") (target = "ldap:///ou=sysaccounts,($dn),dc=ssiservices,dc=biz") (version 3.0;acl "Protect sysaccounts";deny (all)(userdn = "ldap:///uid=*,ou=users,[$dn],dc=ssiservices,dc=biz");) We had contemplated (targetattr = "*") (target = "ldap:///ou=sysaccounts,($dn),dc=ssiservices,dc=biz") (version 3.0;acl "Protect sysaccounts";deny (all)(userdn = "ldap:///uid=*[$dn],dc=ssiservices,dc=biz");) but did not want to take the chance that the SysAccounts uses could not see themselves. Let's say we have a client admin at uid=terry,ou=internal,ou=users,dc=client1,dc=com,dc=ssiservices,dc=biz. The * after uid and with no comma before ou=users should match anything in users including "uid=terry,ou=internal,". It doesn't. The deny rule is not applied to Terry. If I change the ACI to: (targetattr = "*") (target = "ldap:///ou=sysaccounts,($dn),dc=ssiservices,dc=biz") (version 3.0;acl "Protect sysaccounts";deny (all)(userdn = "ldap:///uid=*ou=internal,ou=users,[$dn],dc=ssiservices,dc=biz");) it still fails. However, if I change it to: (targetattr = "*") (target = "ldap:///ou=sysaccounts,($dn),dc=ssiservices,dc=biz") (version 3.0;acl "Protect sysaccounts";deny (all)(userdn = "ldap:///uid=*,ou=internal,ou=users,[$dn],dc=ssiservices,dc=biz");) it works. The deny matches Terry and is enforced. This seems to be an explicit contradiction of the documentation. http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_Access_Contro… userdn = "ldap:///uid=*,dc=example,dc=com"; The bind rule is evaluated to be true if the user binds to the directory using any distinguished name of the specified pattern. For example, both of the following bind DNs would be evaluated to be true: uid=ssarette,dc=example,dc=com uid=tjaz,ou=Accounting,dc=example,dc=com Are we doing something wrong or is this just a mismatch between code and docs? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

1 0

[Fedora-directory-users] DSGW user authorization problem
by Lev Dudko 17 Nov '08

17 Nov '08

Dear Directory server experts, could you help me, please, to solve the problem with DSGW authorization. I have successfully setup FDS on Fedora 9 with setup-ds-admin.pl setup ssl with the help of script from this page: http://www.linuxmail.info/fedora-directory-server-setup-howto-centos-5/ and run setup-ds-dsgw Now, the directory server works, administration server works and I can configure everything in DS and Admin server with console fedora-idm-console -a https://localhost:9830 ldap and ldaps ports are open and accept requests. I can point my browser to https://localhost:9830 and use DSGW to search successfully, but I can not do authorization, when I try to authorize as some user (normal user, Directory Manager or admin) I got the error: Authentication Failed Authentication failed because the password you supplied is incorrect. Please click the Retry button and try again. If you have forgotten the password for this entry, a directory administrator must reset the password for you. Of course, I am sure that the password is correct. There are no so much useful information in the log files. The executable /usr/lib64/dirsrv/dsgw-cgi-bin/doauth do this authorization. I have read available documentation rather careful, but did not find the answer. Looks like one of the solution is to use binddnfile directive with special text file, but it looks strange for me that it is impossible to use normal authorization in LDAP with DSGW. Have I missed something during the configuration or forgot to add some special ACL? Lev

2 7

[Fedora-directory-users] Error generating certificate-signing request
by Christopher Waltham 17 Nov '08

17 Nov '08

I'm having trouble generating a CSR on a pair of new DS 1.1.3 installs. I get this error message: "An error has occured. Unable to convert DN to certificate name. -----BEGIN NEW CERTIFICATE REQUEST-----" " (There is actually nothing listed under the "BEGIN NEW CERTIFICATE REQUEST" part). This is my DN of the request: CN="falls", OU="Information Technology",O="Bowdoin College",L="Brunswick",ST="Maine",C="US". I found this thread: http://www.linux-archive.org/fedora-directory/160707-error-creating-certifi… online and tried the suggestion, i.e. removing the " quotes in the DN. After that, the request was generated successfully -- however, I don't think that this is good behavior.. has anyone seen this issue before? Chris

1 0

[Fedora-directory-users] "Server failed to start !!!" when installing FDS 1.1.3 in RHEL5.2
by Christopher Waltham 17 Nov '08

17 Nov '08

I'm using RHEL5.2 (i386) and installing RPMs from the FDS repository that's mentioned on the FDS wiki. But I'm having trouble configuring FDS 1.1.3 due to errors that I believe are related to permissions on / var/run/dirsrv. Before installing DS, here are the permission on /var/run/dirsrv: [root@falls ~]# ls -ald /var/run/dirsrv drwxr-xr-x 3 root root 4096 Nov 14 09:24 /var/run/dirsrv When finishing the end of setup-ds-admin.pl, I see these messages: Are you ready to set up your servers? [yes]: Creating directory server . . . Server failed to start !!! Please check errors log for problems Possible timeout starting server: timeout=1226673415 now=1226673416 Could not start the directory server using command '/usr/lib/dirsrv/ slapd-falls/start-slapd'. The last line from the error log was '[14/ Nov/2008:09:26:55 -0500] - Fedora-Directory/1.1.3 B2008.269.157 starting up '. Error: Unknown error 256 Error: Could not create directory server instance 'falls'. Exiting . . . Log file is '/tmp/setupblsNWZ.log' There is nothing else of relevance in either /tmp/setupblsNWZ.log or / var/log/dirsrv/slapd-falls/errors If I try and start the directory server after the installation failed, I get this error: [root@falls ~]# /etc/init.d/dirsrv start Starting dirsrv: falls... [FAILED] *** Warning: 1 instance(s) failed to start If I manually chmod & chown the /var/run/dirsrv directory, it will start: [root@falls ~]# chmod 770 /var/run/dirsrv && chown nobody:nobody /var/ run/dirsrv [root@falls ~]# /etc/init.d/dirsrv start Starting dirsrv: falls... [ OK ] However, because the setup-ds-admin.pl process never completed, the admin server hasn't been configured (and I don't want to have to do that by hand). Note that I am using nobody:nobody in the FDS installer when asked who I want to run the services as. When I manually ( chmod 770 /var/run/dirsrv && chown nobody:nobody / var/run/dirsrv ) *before* I run setup-ds-admin.pl I get this error: [08/11/14:09:00:33] - [Setup] Info Are you ready to set up your servers? [08/11/14:09:00:34] - [Setup] Info yes [08/11/14:09:00:34] - [Setup] Info Creating directory server . . . [08/11/14:09:00:36] - [Setup] Info Your new DS instance 'ldap' was successfully created. [08/11/14:09:00:36] - [Setup] Info Creating the configuration directory server . . . [08/11/14:09:00:36] - [Setup] Fatal The suffix 'o=NetscapeRoot' already exists. Config entry DN 'cn="o=NetscapeRoot",cn=mapping tree,cn=config'. [08/11/14:09:00:36] - [Setup] Fatal Failed to create the configuration directory server [08/11/14:09:00:36] - [Setup] Fatal Exiting . . . Any thoughts? This is getting pretty frustrating :-\ Thanks, Chris

3 13

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2008