389-users October 2010

389-users@lists.fedoraproject.org

37 participants
47 discussions

Contributing to the wiki
by Gerrard Geldenhuis 26 Oct '10

26 Oct '10

Hi I would like to add a few notes to the wiki, is there a special page where I should be creating an account? This page http://directory.fedoraproject.org/wiki/Special:Userlogin says: We are not ready to accept contributions at this time. Is that still true, I am happy to just send a few notes via the mailing list for you to incorporate if you don't want to allow any direct edits. Best Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

1 0

access control
by Mike Li 25 Oct '10

25 Oct '10

I am using the latest 389 DS (1.1), on Linux. Searching the entries works but cannot do add/modify, ldap_add_s() and ldap_modify_s() APIs return: Insufficient access. How do I give the write access to a login (identified by a login DN and passwd) ? Searched everywhere but cannot find any help at all. Thanks.

4 5

Getting started with 389 DS
by harry.devine＠faa.gov 25 Oct '10

25 Oct '10

I just installed 389 DS on a laptop running CentOS 5.4 to start getting familiar with it. I got it installed correctly (answered all of the questions in the setup-ds-admin.pl script, verified that the dirsrv and dirsrv-admin services are running), but when I run the 389-console, I can't log in. I'm entering the username and password that I used in the setup script, but I keep getting "Cannot login because of an incorrect User ID, incorrect password, or Directory problem. java.io.InterruptedIOException: HTTP response timeout". What am I doing wrong? I'm trying to follow the docs at http://directory.fedoraproject.org/wiki/Documentation but they seem to jump all over the place. I did find a tutorial at http://www.linuxmail.info/389-directory-server-setup-howto-centos-5/, but I'm stuck at the first step under "Administering 389 Directory Server". Do I have to reinstall the 389 DS? Is there a place that I can clear out/reset the admin password to get in? Thanks, Harry Harry Devine Common ARTS Software Development AJT-144 (609)485-4218 Harry.Devine(a)faa.gov

4 11

Chaining woes again v2 - solutions
by Gerrard Geldenhuis 22 Oct '10

22 Oct '10

Hi Just a quick follow-up regarding this thread. We discovered the real problem.... encryption of the password. We have the following line in the ldif file to nsmultiplexorcredentials: {SSHA}VItDJ0gykk1q8rzsJmIkkj64mAW1kkaZY We got one server working with chaining and the other not. The difference turned out to be how the password was stored and on the one box we changed the password via the console to make sure it was correct. We have noted asmall inconsistencies which we would like to verify On our production system the entry in dse.ldif looks like follows: nsmultiplexorcredentials:: e0RFU31ZczJMghghdtZkpTakl5Y29OYVIwc0NUdnpMVmFUU1JDd1 hZNfsadfasdfsaZY143NkduYmJRenBK33sdfsadffdssiRUpvDlvQjRvUWR4ai9uZ2lWbzJQejduWj NMcHE4UWR4Sw== and on our test system it looks like follows: nsmultiplexorcredentials: {DES}slo6RKJHfEqtcfbpLWHdgQ== Apart from the length which is due to use using a much longer password in production why does the test system use a {DES} and the production system does not. In both cases we used the 389-console to make the changes. The version differences is: (test on the left, prod on the right) 389-admin-1.1.11-1.el5 | 389-admin-1.1.11-0.6.rc2.el5 389-admin-console-1.1.5-1.el5 | 389-admin-console-1.1.5-1.el5 389-admin-console-doc-1.1.5-1.el5 | 389-admin-console-doc-1.1.5-1.el5 389-adminutil-1.1.8-4.el5 | 389-adminutil-1.1.8-4.el5 389-console-1.1.4-1.el5 | 389-console-1.1.4-1.el5 389-ds-1.2.1-1.el5 | 389-ds-1.2.1-1.el5 389-ds-base-1.2.6.1-1.el5 | 389-ds-base-1.2.6-0.11.rc7.el5 389-ds-console-1.2.3-1.el5 | 389-ds-console-1.2.3-1.el5 389-ds-console-doc-1.2.3-1.el5 | 389-ds-console-doc-1.2.3-1.el5 389-dsgw-1.1.5-1.el5 | 389-dsgw-1.1.5-1.el5 On the client when we tried to do a password change the error we would see was operations error which is not very usefull. We did not see authentication issues on the consumer server with chaining setup nor on the provider server. I can double check it again, could you recommend a specific log level that would catch it. If I don't see the error message I will raise it as an enhancement request in bugzilla for the some more informative error messages for this particular problem. I will also add some relevant notes to the 389 wiki. Lastly I have been "reprimanded" for this on the list before and have paid the prices as explained above, but just to be perfectly clear and for the sake of writing a small bit on the wiki regarding this issue what is the policy regarding putting passwords in ldif files? For system settings like chaining should the password always be in clear text in the ldif file? Can/should you use pre-encrypted DES strings for passwords for system settings. Does the password encryption setting in the 389-console only apply to user passwords? Is all system passwords encrypted to DES by default? Can the system default if there is one by change to SSHA or whatever? Best Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 5

Synchronizing Account Inactivation with Account Disabling
by Glenn 22 Oct '10

22 Oct '10

We are still using Fedora Directory Server 1.0.4 and synchronizing with Active Directory. Our procedure for removing accounts includes a waiting period when the AD account is disabled. Disabling the AD account does not inactivate the corresponding FD account. The folks that do account maintenance do not have access to the FD java console, so rather than inactivating the FD account, they delete it using DSGW. Unfortunately, this also deletes the disabled AD account. Is there a way to make sync inactivate the FD account when the AD account is disabled? As an alternative, can we make account activation/inactivation available to our account people via DSGW? Some particulars would be appreciated. I know that setting the "ntuserdeleteaccount" attribute to "false" will prevent the AD account from being removed when the FD account is removed. But new accounts created in AD are duplicated by sync in FD with the attribute set to "true". If anyone could suggest a way to make this default to "false," that would be an improvement. Thanks. -G.

2 1

Re: [389-users] Debian packaging
by Angel Bosch Mora 22 Oct '10

22 Oct '10

----- Missatge original ----- > Hi everyone, > > I am the person behind the current FDS Packaging efforts for Debian. i think you should respect the name change in docs: http://wiki.debian.org/Teams/DebianFDSPackaging changing FDS to 389 is supposed to help people not to confuse the link between those two products. great work, anyway :) abosch

3 6

Re: [389-users] Debian packaging and Ubuntu issues
by Roberto Polli 21 Oct '10

21 Oct '10

On Thursday 21 October 2010 12:12:52 Roberto Polli wrote: > W: Impossibile trovare il pacchetto mozilla-ldap-sdk > Trying to download tarball using uscan > uscan warning: In debian/watch no matching hrefs for version 6.0.6+dfsg in > watch line > http://ftp.mozilla.org/pub/mozilla.org/directory/c- > sdk/releases/v(.*)/src/mozldap-(.*)\.tar\.gz > Couldn't find a tarball manually downloaded from http://acksyn.org/ubuntu/pool/main/m/mozilla-ldap-sdk/ Peace, R. -- Roberto Polli - Project Manager Babel S.r.l. - http://www.babel.it T: +39.06.91801075 M: +39.340.6522736 F: +39.06.91612446 P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma) CONFIDENZIALE: Questo messaggio ed i suoi allegati sono di carattere confidenziale per i destinatari in indirizzo. E' vietato l'inoltro non autorizzato a destinatari diversi da quelli indicati nel messaggio originale. Se ricevuto per errore, l'uso del contenuto e' proibito; si prega di comunicarlo al mittente e cancellarlo immediatamente.

2 1

difficulties upgrading from 1.2.5 to 1.2.6.1-2
by Barry Sitompul 20 Oct '10

20 Oct '10

Hi Guys, I'm having problems upgrading from 1.2.5 Here's what I did: # yum upgrade 389-ds-base -runs fine # setup-ds-admin.pl -u -error encountered: The server 'ldap://myldapserver.com:389/o=NetscapeRoot' is not reachable. Error: unknown error It turns out that the 389-DS is not running because of these errors in its error log: 389-Directory/1.2.6.1 B2010.272.2313 myldapserver.com:389 (/etc/dirsrv/slapd-myldapserver) [20/Oct/2010:14:35:41 +1000] - 389-Directory/1.2.6.1 B2010.272.2313 starting up [20/Oct/2010:14:35:42 +1000] - Detected Disorderly Shutdown last time Directory Server was running, recovering database. [20/Oct/2010:14:35:42 +1000] - nsslapd-subtree-rename-switch is on, while the instance userRoot is in the DN format. Please run dn2rdn to convert the database format. [20/Oct/2010:14:35:42 +1000] - nsslapd-subtree-rename-switch is on, while the instance Root1 is in the DN format. Please run dn2rdn to convert the database format. [20/Oct/2010:14:35:42 +1000] - nsslapd-subtree-rename-switch is on, while the instance Root2 is in the DN format. Please run dn2rdn to convert the database format. [20/Oct/2010:14:35:42 +1000] - nsslapd-subtree-rename-switch is on, while the instance Root3 is in the DN format. Please run dn2rdn to convert the database format. [20/Oct/2010:14:35:42 +1000] - nsslapd-subtree-rename-switch is on, while the instance NetscapeRoot is in the DN format. Please run dn2rdn to convert the database format. [20/Oct/2010:14:35:42 +1000] - nsslapd-subtree-rename-switch is on, while the instance Root4 is in the DN format. Please run dn2rdn to convert the database format. [20/Oct/2010:14:35:42 +1000] - start: Failed to start databases, err=-1 Unknown error: -1 [20/Oct/2010:14:35:42 +1000] - Failed to start database plugin ldbm database [20/Oct/2010:14:35:42 +1000] - WARNING: ldbm instance userRoot already exists [20/Oct/2010:14:35:42 +1000] - WARNING: ldbm instance Root1 already exists [20/Oct/2010:14:35:42 +1000] - WARNING: ldbm instance Root2 already exists [20/Oct/2010:14:35:42 +1000] - WARNING: ldbm instance Root3 already exists [20/Oct/2010:14:35:42 +1000] - WARNING: ldbm instance NetscapeRoot already exists [20/Oct/2010:14:35:42 +1000] - WARNING: ldbm instance Root4 already exists [20/Oct/2010:14:35:42 +1000] binder-based resource limits - nsLookThroughLimit: parameter error (slapi_reslimit_register() already registered) [20/Oct/2010:14:35:42 +1000] - start: Resource limit registration failed [20/Oct/2010:14:35:42 +1000] - Failed to start database plugin ldbm database [20/Oct/2010:14:35:42 +1000] - Error: Failed to resolve plugin dependencies [20/Oct/2010:14:35:42 +1000] - Error: preoperation plugin 7-bit check is not started [20/Oct/2010:14:35:42 +1000] - Error: accesscontrol plugin ACL Plugin is not started [20/Oct/2010:14:35:42 +1000] - Error: preoperation plugin ACL preoperation is not started [20/Oct/2010:14:35:42 +1000] - Error: object plugin Class of Service is not started [20/Oct/2010:14:35:42 +1000] - Error: preoperation plugin deref is not started [20/Oct/2010:14:35:42 +1000] - Error: preoperation plugin HTTP Client is not started [20/Oct/2010:14:35:42 +1000] - Error: database plugin ldbm database is not started [20/Oct/2010:14:35:42 +1000] - Error: object plugin Legacy Replication Plugin is not started [20/Oct/2010:14:35:42 +1000] - Error: preoperation plugin Linked Attributes is not started [20/Oct/2010:14:35:42 +1000] - Error: object plugin Multimaster Replication Plugin is not started [20/Oct/2010:14:35:42 +1000] - Error: object plugin Roles Plugin is not started [20/Oct/2010:14:35:42 +1000] - Error: preoperation plugin Simple Kerberos 5 Auth is not started [20/Oct/2010:14:35:42 +1000] - Error: object plugin Views is not started - I wanted to do the dn2rdn or just switch off the subtree-rename- switch, so... - I looked at the instance's dse.ldif and I can't find the: dn: cn=config,cn=ldbm database,cn=plugins,cn=config [...] nsslapd-subtree-rename-switch: on - But nsslapd-subtree-rename-switch exists is in this file: /usr/ share/dirsrv/data/template-dse.ldif. I tried changing the value to 'off' but I still got the same errors. - I also can't find the the dn2rdn tool in the slapd instance directory. I did a locate and only found it here: /usr/share/dirsrv/ script-templates/template-dn2rdn -So I got really confused and thought maybe I should do this: # setup-ds.pl -u -d = = = = = = ======================================================================== This program will update the 389 Directory Server. It is recommended that you have "root" privilege to perform the update. Tips for using this program: - Press "Enter" to choose the default and go to the next screen - Type "Control-B" or the word "back" then "Enter" to go back to the previous screen - Type "Control-C" to cancel the update Would you like to continue with update? [yes]: = = = = = = ======================================================================== The update process can work in one of two modes: - Online: The changes are made to the running directory servers using LDAP. The operations must be performed as an administrative user. You must provide the name and password, for each instance if there is more than one instance of directory server. Some operations may require a directory server restart to take effect. The update script will notify you if you need to restart the server. - Offline: The changes are made to the server configuration files. The servers MUST FIRST BE SHUTDOWN BY YOU. The script will not shutdown the servers for you. You MUST shutdown the servers in order to use this mode. A username and password are not required to use Offline mode. If the servers are not shutdown, CHANGES WILL BE LOST. To summarize: Online - servers remain running - you must provide admin name and password for each server - servers may need to be restarted Offline - servers must be shutdown - no username or password required Which update mode do you want to use? [quit]: offline +Running stage pre update /usr/share/dirsrv/updates/ 50addchainingsaslpwroles.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50bitstringsyntaxplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50deliverymethodsyntaxplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/50derefplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50disableurisyntaxplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50enhancedguidesyntaxplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/50entryusnindex.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50faxnumbersyntaxplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50faxsyntaxplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50guidesyntaxplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50linkedattrsplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/50memberofindex.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50memberofplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50nameuidsyntaxplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50numericstringsyntaxplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50printablestringsyntaxplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50retroclprecedence.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50schemareloadplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50smd5pwdstorageplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50syntaxvalidplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50teletexterminalidsyntaxplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/ 50telexnumbersyntaxplugin.ldif +Running stage pre update /usr/share/dirsrv/updates/50usnplugin.ldif Could not open the script template file '1/bak2db'. Error: No such file or directory Error: could not update the directory server. Exiting . . . - What is that '1/bak2db' script template file and why can't the setup- ds.pl find it ? I see on the http://directory.fedoraproject.org/wiki/Release_Notes stating that there is no problem upgrading from 1.2.5..Am I doing something completely wrong here? Any help is much appreciated! Thanks! Bazza

2 2

Safeguarding against to many established connections
by Gerrard Geldenhuis 19 Oct '10

19 Oct '10

Hi We have recently seen an issue were a single client opened up more than 800 established connections to our directory server. The client did have the proper settings configured and should have closed connections but it did'nt. Is there a way to limit the amount of connections per client or close connections from the server side after a certain period? Without just making the amount of connections ridicuosly high on the directory server how can you safeguard against rogue clients. Our client setting is as follows: idle_timelimit 5 timelimit 10 bind_timelimit 5 We were unable to log into client and it had file system issues so we could not do any further analyses there. I suspect that solutions to this problem probably falls outside of what can be configured in 389? Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

4 6

Greedy PAM
by Gerrard Geldenhuis 19 Oct '10

19 Oct '10

Hi Not strictly a 389 question but maybe 389 offers a solution. I have a tree structure as follows: dc=company ou=people,dc=company ou=groups,dc=company On my client the I have the following searchbase in /etc/ldap.conf dc=company If I login as user gerrard and look at the network traffic then every possible user is send to the client. This is not a problem yet but would be a problem on a slow link or with lots of users. Changing the base to ou=people,dc=company works in that the search results returned is way smaller, but breaks everything else because group membership is not in that base. Is there a way to dynamically have search basis when queries for certain data is done. How do you configure clients to be more selective when doing searches against a ldap directory. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users October 2010