389-users November 2008

389-users@lists.fedoraproject.org

43 participants
59 discussions

[Fedora-directory-users] Re: WinSync userAccountControl bug (was Fedora-directory-users Digest, Vol 42, Issue 4)
by John Dickinson 06 Nov '08

06 Nov '08

Rich Megginson <rmeggins(a)redhat.com> wrote: > Howard Chu wrote: >>> Date: Tue, 04 Nov 2008 08:13:08 -0700 >>> From: Rich Megginson<rmeggins(a)redhat.com> >> >>> John Dickinson wrote: >>>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins(a)redhat.com> >>>> wrote: >> >>>> create user in AD userAccountControl: 512 >>>> (Normal) >>>> create user in Fedora DS (console) userAccountControl: 546 >>>> (Normal + >>>> PASSWD_NOTREQ + ACCOUNTDISABLE) >>>> >>>> Would there be anything wrong with Fedora DS just forcing >>>> userAccountControl = 512? Or are more options needed in the user >>>> creation dialog? >>> I'm not sure. 1.1.3 included a "fix" for userAccountControl. The >>> way >>> it works now is this: >>> add new AD entry over LDAP - no userAccountControl attribute is >>> present, >>> so it must use some sort of AD default value >>> read the new AD entry - get the userAccountControl value >>> set AD entry userAccountControl |= 0x200 # 512 == normal account) >>> >>> So you might try a simple test - add a new AD entry over LDAP >>> outside of >>> windows sync - see what the default userAccountControl value is - >>> I'm >>> guessing that adding a new AD entry without specifying >>> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE >> >> Yes, users created via LDAP are disabled unless you explicitly >> provide >> the userAccountControl attribute (with proper flags) in the LDAP Add >> operation. I tripped over this myself the first time I loaded up a >> test database in AD. (It also gave me a Fine Opportunity to time how >> long it took to LDAP Modify all of the users in my test database. >> ugh...) >> > Then this is a bug in the winsync code. In the ADD case, it should > just > force userAccountControl to the Normal value. In the MOD case, it > should |= the value. John, can you open a bug about this issue? > Thanks. Done - https://bugzilla.redhat.com/show_bug.cgi?id=470224 There are other values of userAccountControl that an administrator might want to set when creating users. One example is DONT_EXPIRE_PASSWORD - so is there a need for the userAccountControl flags to be configurable on a create user dialog such as that in fedora-idm-console or phpldapadmin rather than hard coded? John P.S. Sorry about the totally useless subject line earlier in this thread.

2 1

[Fedora-directory-users] enforcing ssl
by Graham Seaman 06 Nov '08

06 Nov '08

Hi, I'm trying to set up Fedora DS to be accessible only with SSL. My DS is on a standalone remote server, with most ports firewalled. If I open ports 389 and 636, I can run ldapsearch ok using SSL (the access log shows 'SSL connection.. using 256-bit AES') but I can also choose not to use SSL and still make queries. If I close port 389, I can't connect to the server with or without SSL - I just get 'ldap_start_tls: Can't contact LDAP server (-1)'. This is even if I explicitly specify port 636, not just relying on the '-Z' flag for ldapsearch. Is it possible to close down non-SSL access? (I am not using the admin server, so this needs to be through manual configuration) Thanks for any advice Graham

2 3

[Fedora-directory-users] How to configure Multimaster Replication - doubts with the documentation
by Morenisco 05 Nov '08

05 Nov '08

Hi, I worked by almost a year with OID (Oracle Internet Directory), and now I would like to learn Fedora Directory Server with multimaster replication. I'm reviewing the existing documentation and I found information related to multimaster replication in the URL: http://directory.fedoraproject.org/wiki/Howto:MultiMasterReplication But I have the following doubt: In the requeriments I understand that I need three scripts; the old-mmr.pl, the newer mmr.pl and the modified mmr.pl. Then, really I need to apply these three scritps, or just I can use the newer mmr.pl script if I want to use the standard ports? Thanks a lot. -- Morenisco. Centro de Difusión del Software Libre. http://www.cdsl.cl Blog: http://morenisco.belvil.eu

2 1

[Fedora-directory-users] Problems migrating from libdb-4.4 to libdb-4.7
by Vitaly Kuznetsov 05 Nov '08

05 Nov '08

Hello! I'm trying to build Fedora-DS for ALT Linux project with new libdb-4.7. Old instances use libdb-4.4. I have some problems with data migration. FDS with db4.7 does not want to read old (db4.4) data with errors. I tried to delete logs and do db_upgrade - without success. New instances work fine. Fedora DS versions (old and new) are both 1.1.3. Errors: [05/Nov/2008:13:56:37 +0300] - Fedora-Directory/1.1.3 B2008.310.1047 starting up [05/Nov/2008:13:56:37 +0300] - Clean up db environment and start from archive. [05/Nov/2008:13:56:37 +0300] - libdb: Program version 4.7 doesn't match environment version 4.4 [05/Nov/2008:13:56:37 +0300] - libdb: Program version 4.7 doesn't match environment version 4.4 [05/Nov/2008:13:56:37 +0300] - Deleting log file: (/var/lib/fedora-ds/slapd-ldap1/db/log.0000000001) [05/Nov/2008:13:56:37 +0300] - Deleting log file: (/var/lib/fedora-ds/slapd-ldap1/db/log.0000000147) [05/Nov/2008:13:56:38 +0300] - attrcrypt_unwrap_key: failed to unwrap key for cipher AES [05/Nov/2008:13:56:38 +0300] - Failed to retrieve key for cipher AES in attrcrypt_cipher_init [05/Nov/2008:13:56:38 +0300] - Failed to initialize cipher AES in attrcrypt_init [05/Nov/2008:13:56:38 +0300] - libdb: file userRoot/id2entry.db4 has LSN 134/2584752, past end of log at 1/140 [05/Nov/2008:13:56:38 +0300] - libdb: Commonly caused by moving a database from one database environment [05/Nov/2008:13:56:38 +0300] - libdb: to another without clearing the database LSNs, or by removing all of [05/Nov/2008:13:56:38 +0300] - libdb: the log files from a database environment [05/Nov/2008:13:56:38 +0300] - libdb: /var/lib/fedora-ds/slapd-ldap1/db/userRoot/id2entry.db4: unexpected file type or format [05/Nov/2008:13:56:38 +0300] - dbp->open("userRoot/id2entry.db4") failed: Invalid argument (22) [05/Nov/2008:13:56:38 +0300] - dblayer_instance_start fail: Invalid argument (22) [05/Nov/2008:13:56:38 +0300] - attrcrypt_unwrap_key: failed to unwrap key for cipher AES [05/Nov/2008:13:56:38 +0300] - Failed to retrieve key for cipher AES in attrcrypt_cipher_init [05/Nov/2008:13:56:38 +0300] - Failed to initialize cipher AES in attrcrypt_init [05/Nov/2008:13:56:38 +0300] - libdb: file NetscapeRoot/id2entry.db4 has LSN 1/3096357, past end of log at 1/140 [05/Nov/2008:13:56:38 +0300] - libdb: Commonly caused by moving a database from one database environment [05/Nov/2008:13:56:38 +0300] - libdb: to another without clearing the database LSNs, or by removing all of [05/Nov/2008:13:56:38 +0300] - libdb: the log files from a database environment [05/Nov/2008:13:56:38 +0300] - libdb: /var/lib/fedora-ds/slapd-ldap1/db/NetscapeRoot/id2entry.db4: unexpected file type or format [05/Nov/2008:13:56:38 +0300] - dbp->open("NetscapeRoot/id2entry.db4") failed: Invalid argument (22) [05/Nov/2008:13:56:38 +0300] - dblayer_instance_start fail: Invalid argument (22) [05/Nov/2008:13:56:38 +0300] - start: Failed to start databases, err=22 Invalid argument [05/Nov/2008:13:56:38 +0300] - Failed to allocate 10000000 byte dbcache. Please reduce nsslapd-cache-autosize and Restart the server. [05/Nov/2008:13:56:38 +0300] - Failed to start database plugin ldbm database [05/Nov/2008:13:56:38 +0300] - WARNING: ldbm instance userRoot already exists [05/Nov/2008:13:56:38 +0300] - WARNING: ldbm instance NetscapeRoot already exists [05/Nov/2008:13:56:38 +0300] binder-based resource limits - nsLookThroughLimit: parameter error (slapi_reslimit_register() already registered) [05/Nov/2008:13:56:38 +0300] - start: Resource limit registration failed [05/Nov/2008:13:56:38 +0300] - Failed to start database plugin ldbm database [05/Nov/2008:13:56:38 +0300] - Error: Failed to resolve plugin dependencies [05/Nov/2008:13:56:38 +0300] - Error: preoperation plugin 7-bit check is not started [05/Nov/2008:13:56:38 +0300] - Error: accesscontrol plugin ACL Plugin is not started [05/Nov/2008:13:56:38 +0300] - Error: preoperation plugin ACL preoperation is not started Any ideas?

2 1

[Fedora-directory-users] Re:Re: Fedora-directory-users Digest, Vol 42, Issue 3
by Eric 05 Nov '08

05 Nov '08

oh I take a mistake, my ds is version 1.0.4, my question is 1.How can I remove a role from ds by using db or related files? I don't have console and my command part has error too. 2. I want to use last versions of fedora ds, I have backup of my fedora ds version 1.0.4, can I install last version on another system ( not upgrade this version) and then restore this backup? ( I saw that the directory of ds version 1.1 are differ from 1.0) On Mon, Nov 3, 2008 at 8:30 PM, <fedora-directory-users-request(a)redhat.com>wrote: > Send Fedora-directory-users mailing list submissions to > fedora-directory-users(a)redhat.com > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.redhat.com/mailman/listinfo/fedora-directory-users > or, via email, send a message with subject or body 'help' to > fedora-directory-users-request(a)redhat.com > > You can reach the person managing the list at > fedora-directory-users-owner(a)redhat.com > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Fedora-directory-users digest..." > > > Today's Topics: > > 1. Re: removing an entry using fedora-ds folder (Rich Megginson) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 03 Nov 2008 09:35:35 -0700 > From: Rich Megginson <rmeggins(a)redhat.com> > Subject: Re: [Fedora-directory-users] removing an entry using > fedora-ds folder > To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> > Message-ID: <490F2857.7050804(a)redhat.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Eric wrote: > > Hi, > > I use fedora-ds 4.0. > ? What version is that? > rpm -qi fedora-ds-base > > I had a view part.I made a Role in a wrong part ( under the another > > role) after that my ds hanged. > Check your directory server error log. > > slapd and admin are running but I cant open console to remove that > > wrong. when I want to use command line it can't. the error massage is: > > ldap_bind: Can't contact LDAP server (-1) > Are you sure slapd is running? > > how can I solve the problem? > > ------------------------------------------------------------------------ > > > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > > > > ------------------------------ > > -- > Fedora-directory-users mailing list > Fedora-directory-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > End of Fedora-directory-users Digest, Vol 42, Issue 3 > ***************************************************** >

2 1

[Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 42, Issue 4
by Howard Chu 04 Nov '08

04 Nov '08

> Date: Tue, 04 Nov 2008 08:13:08 -0700 > From: Rich Megginson<rmeggins(a)redhat.com> > John Dickinson wrote: >> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins(a)redhat.com> wrote: >> create user in AD userAccountControl: 512 (Normal) >> create user in Fedora DS (console) userAccountControl: 546 (Normal + >> PASSWD_NOTREQ + ACCOUNTDISABLE) >> >> Would there be anything wrong with Fedora DS just forcing >> userAccountControl = 512? Or are more options needed in the user >> creation dialog? > I'm not sure. 1.1.3 included a "fix" for userAccountControl. The way > it works now is this: > add new AD entry over LDAP - no userAccountControl attribute is present, > so it must use some sort of AD default value > read the new AD entry - get the userAccountControl value > set AD entry userAccountControl |= 0x200 # 512 == normal account) > > So you might try a simple test - add a new AD entry over LDAP outside of > windows sync - see what the default userAccountControl value is - I'm > guessing that adding a new AD entry without specifying > userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE Yes, users created via LDAP are disabled unless you explicitly provide the userAccountControl attribute (with proper flags) in the LDAP Add operation. I tripped over this myself the first time I loaded up a test database in AD. (It also gave me a Fine Opportunity to time how long it took to LDAP Modify all of the users in my test database. ugh...) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

[Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 41, Issue 24
by John Dickinson 04 Nov '08

04 Nov '08

On 30 Oct 2008, at 16:00, Rich Megginson <rmeggins(a)redhat.com> wrote: > John Dickinson wrote: >> Hi, >> >> I am testing what happens when you create a new user and sync it to >> AD. Using Fedora DS 1.1.3 and AD 2003 R2 SP2. >> >> If I use the console to create a new user and tick the Enable NT User >> Attributes, Create New NT Account etc the new user appears in AD but >> is disabled. >> >> Looking at the code it seems that send_accountcontrol_modify() gets >> the userAccountControl settings from AD adds 0x0200 (Normal Account) >> and sends it back. >> >> Looking at the traffic between Fedora DS and AD it appears that >> Fedora >> DS is getting ACCOUNTDISABLE in userAccountControl from AD. >> >> Should FedoraDS be unsetting ACCOUNTDISABLE or should AD not be >> setting it in the first place? If it is a problem with AD then can >> anyone point me to where I tell it to do the right thing? > Does AD have some sort of setting that tells it to disable new > accounts? Not that I know about. But I am no windows expert. > What happens if you create new accounts directly in AD? When you create a new user in windows there is a tick box to disable the account but it is not ticked by default and the user is created in an enabled state. I see the following when: - Both Windows and Fedora DS set to enforce no password complexity constraints - Windows sync agreement and password sync working - When creating a user in AD only one option is selected by default - user must change password at next login. - The following options are not ticked by default: -- User cannot change password -- Password never expires -- Account is disabled create user in AD userAccountControl: 512 (Normal) create user in Fedora DS (console) userAccountControl: 546 (Normal + PASSWD_NOTREQ + ACCOUNTDISABLE) Would there be anything wrong with Fedora DS just forcing userAccountControl = 512? Or are more options needed in the user creation dialog? John

2 1

[Fedora-directory-users] removing an entry using fedora-ds folder
by Eric 03 Nov '08

03 Nov '08

Hi, I use fedora-ds 4.0. I had a view part.I made a Role in a wrong part ( under the another role) after that my ds hanged. slapd and admin are running but I cant open console to remove that wrong. when I want to use command line it can't. the error massage is: ldap_bind: Can't contact LDAP server (-1) how can I solve the problem?

2 1

Re: [Fedora-directory-users] dbverify
by Howard Chu 02 Nov '08

02 Nov '08

fedora-directory-users-request(a)redhat.com wrote: > Date: Fri, 31 Oct 2008 13:41:46 -0400 > From: Dan Lannom<dlannom(a)umd.umich.edu> > I've done exhaustive verification of equality and presence indexes for > my directory to verify that ldap is working properly so I'm going to > treat dbverify as buggy for now. dbverify is certainly not buggy. Most likely you're running on a Little-Endian machine, and FDS is not canonicalizing its keys into Big-Endian format. (Instead it must be using a custom key comparison function internally.) Since dbverify only uses the default key comparison function, it will see the keys as being out of order (even though they're in correct order according to FDS's custom function). > I can't find any pattern in my data to explain what the bug is though. > 22 of the 45 indexes are affected > syntaxes are oid,directorystring,ia5string,integer and telephonenumber > index types are either e,ep,eps or aeps > > I'll fill out a bug report later tonight, > > Dan Lannom > > I wrote in my earlier email: >> I plan to migrate to fds from SunOne 5.2 and so I want to validate the >> system. >> I'm currently running version 1.1.3-2 of the directory on RHEL 5.2. >> >> When I do searches against the server everything seems to work fine, but >> When I run /usr/lib/dirsrv/slapd-{{hostname}}/dbverify, with the >> server off, it fails with >> errors like: >> [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 2 >> [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 8 >> [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at >> entry 11 >> [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at >> entry 14 >> ... >> [28/Oct/2008:10:52:16 -0400] - libdb: >> /var/lib/dirsrv/slapd-hume/db/{{SUFFIX}}/{{attribute}}.db4: >> DB_VERIFY_BAD: Database verification failed >> [28/Oct/2008:10:52:16 -0400] DB verify - verify failed(-30975): >> /var/lib/dirsrv/slapd-{{hostname}}/db/userdata/{{attribute}}.db4 >> >> reindexing does not change anything and I find the same errors for >> both i386 and x86_64 and the errors are almost identical for the >> master and the slaves. >> >> Since I can find any evidence of the indexes identified as corrupted >> not working I wonder why dbverify is generating these errors. >> >> Thanks for any help, >> >> Dan Lannom >> UM-Dearborn -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2008