389-users July 2010

389-users@lists.fedoraproject.org

33 participants
38 discussions

Windows Sync
by Phil Daws 27 Jul '10

27 Jul '10

Hi, We have a Windows replication agreement in place which works great; plus we are using the PassSync on the Windows server itself. The issue we have is that when somebody changed their password on the Windows server it has got stuck due to a Constraint Violation on previous passwords and this is stopping any further password changes from that user. Is there anyway to remove that entry from a database somewhere ? I am guessing it may be secmod.db on the Windows server ? -- Thanks, Phil

2 1

How to let users change their passwords?
by Steven Truong 27 Jul '10

27 Jul '10

Dear, all. I have been searched low and high for a tool that can let users to change their passwords in 389 DS or OpenLDAP? I think there is a real need for such a tool and I hope that people already wrote such a tool... Please share your ways of how you allow your users to change their passwords or other setup/architecture that allow this function. Beside that, I also recommend Apache Studio as a great tool to work with LDAP servers..... Thank you in advance.

3 3

new 00core.ldif break other ldif
by Roberto Polli 23 Jul '10

23 Jul '10

Hi all, it seems that the new 00core.ldif doesn't contain the NAME alias for the fields (eg. "cn" "commonName") it cause other old ldif not to work under new releases of fds. Why are the aliases have been removed? Thx+Peace, R. -- Roberto Polli Babel S.r.l. - http://www.babel.it Tel. +39.06.91801075 - fax +39.06.91612446 Tel. cel +39.340.6522736 P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma) "Il seguente messaggio contiene informazioni riservate. Qualora questo messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto della legge in materia di protezione dei dati personali."

2 2

'mail' attribute is now case-sensitive?
by Dael Maselli 23 Jul '10

23 Jul '10

Hi, I installed a new 389 (389-ds-base-1.2.5-1.el5.x86_64) to replace the old FDS (fedora-ds-base-1.1.3-2.fc6.x86_64) and migrated the content. Now I realize that search behavior on 'mail' has changed, the old was case-insensitive and now is case-SENSITIVE. Schema definition on FDS was in 01common.ldif: attributeTypes: ( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822mailbox' ) DESC 'Standard LDAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 1274' ) on 389 is in 05rfc4524.ldif: attributeTypes: ( 0.9.2342.19200300.100.1.3 NAME 'mail' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} X-ORIGIN 'RFC 4524' ) Is the case-sensitive the right behavior? What's the meaning of caseIgnoreIA5Match then? ^^^^^^ Is there any method to get back the old (useful) case-insensitive behavior? Thank you. Regards, Dael. -- ___________________________________________________________________ Dael Maselli --- INFN-LNF Computing Service -- +39.06.9403.2214 ___________________________________________________________________ * Il Buco Nero * http://www.buconero.eu * ___________________________________________________________________ Democracy is two wolves and a lamb voting on what to have for lunch ___________________________________________________________________

2 1

Preventing ssh keys from granting a user access when LDAP account is disabled.
by Gerrard Geldenhuis 22 Jul '10

22 Jul '10

Hi There is a bugzilla raised concerns users still being able to login if they have ssh keys even if there ldap account is disabled. https://bugzilla.redhat.com/show_bug.cgi?id=455350 I have experimented a bit in PAM with ordering to try and find a solution but so far I have not been very successful. The solution/bugfix in the bugzilla is to store authorized keys centrally in LDAP. I was wondering that apart from that solution is there any other suggested solution or way of configuring PAM to disallow a person login when his/her account is disabled? Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

3 7

Large amount of users in Directory causes timeouts on client login.
by Gerrard Geldenhuis 22 Jul '10

22 Jul '10

Hi I have just created 20 000 users each with a private group on two masters 10 000 on each master, with the purpose of testing replication between two masters. I did not observe any errors in access log and there is no errors logged in the error log for either of the servers. I am seeing strange behavior though.... firstly a getent only returns 2028 rows according the wc. That is not a problem as I am aware that there is a setting somewhere that limits search size. What is strange though is that trying to login as any user just times out on me. if I do su - testuser39043 on a client machine pam creates the home directory but then nothing happens ( I have configured pam to create a home dir when it does not exist) I have the following errors in /var/log/messages Jul 21 16:19:32 client01 -bash: nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)... Jul 21 16:19:37 client01 -bash: nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)... Jul 21 16:19:45 client01 -bash: nss_ldap: reconnecting to LDAP server (sleeping 16 seconds)... Eventually after a while I get the following login: [I have no name!@client01 ~]$ with this error message before hand: id: cannot find name for user ID 7280 When I try to su - randomname I get an immediate response back to say that the user does not exist which is true. The console is also behaving in a strange way. I can see a number of users ( i have not increase the default limit of returned users in the console ) and when I double click on a user I get the relevant information back. However if I do a search for the same user by right clicking on people and typing in the username I don't get any results returned. When I retested the behavior for writing the email the behaviour has changed so I can now find a user when searching for it in the console but I still can't login to a box. The two masters have almost no CPU load and is not swapping. They are virtualboxes with only 500mb ram so maybe that is the source of the problem... I can see the request in the log file on the master server when I do a su - username on the client server but the information never gets returned back to pam. Any thoughts or steering in the right direction would be appreciated. The documentation states a few default indexes that gets created and I would have thought that these would be adequate for effectively finding a user in a larger database. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 4

389 DS 1.2.5 on RHEL VM
by Barry Sitompul 22 Jul '10

22 Jul '10

Hi All, Has anyone had the experience of running the DS on a VM? I've got one set up running on a RHEL VM and it looks like the virtual memory usage keeps going up and stays up with every LDAP query (I just use top). I'm not sure if this is caused by the application problem or this is expected RHEL behaviour? Any help is much appreciated! Thanks! Bazza

7 9

Error initializing server
by Juan Asensio Sánchez 21 Jul '10

21 Jul '10

Hi I am having trouble initializaing a server. That server has some replicas in r/o mode, as hub, and one as multimaster. When I try to initialize the multimaster database of this server from another server that has also that database in multimaster mode, I get these errors: [12/Jul/2010:13:08:52 +0200] NSMMReplicationPlugin - multimaster_be_state_change: replica o=XXX,dc=XXXX,dc=es is going offline; disabling replication [12/Jul/2010:13:09:20 +0200] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database [12/Jul/2010:13:09:26 +0200] - ERROR bulk import abandoned [12/Jul/2010:13:09:26 +0200] - import o_XXXX_dc_XXXX_dc_es: Aborting all import threads... [12/Jul/2010:13:09:32 +0200] - import o_XXXX_dc_XXXX_dc_es: Import threads aborted. [12/Jul/2010:13:09:32 +0200] - import o_XXXX_dc_XXXX_dc_es: Closing files... [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/nscpEntryDN.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/mail.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/givenName.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/nsuniqueid.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/memberOf.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/ntUniqueId.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/member.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/ntUserDomainId.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/objectclass.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/cn.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/aci.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/seeAlso.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/sn.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/telephoneNumber.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/uid.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/uniquemember.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/parentid.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/entrydn.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/id2entry.db4: unable to flush: No such file or directory [12/Jul/2010:13:09:32 +0200] - import o_XXXX_dc_XXXX_dc_es: Import failed. [12/Jul/2010:13:09:33 +0200] - process_bulk_import_op: NULL backend [12/Jul/2010:13:09:34 +0200] NSMMReplicationPlugin - replica_replace_ruv_tombstone: failed to update replication update vector for replica o=XXXX,dc=XXXX,dc=es: LDAP error - 1 [12/Jul/2010:13:09:38 +0200] NSMMReplicationPlugin - replica_replace_ruv_tombstone: failed to update replication update vector for replica o=XXXX,dc=XXXX,dc=es: LDAP error - 1 [12/Jul/2010:13:09:41 +0200] NSMMReplicationPlugin - replica_replace_ruv_tombstone: failed to update replication update vector for replica o=XXXX,dc=XXXX,dc=es: LDAP error - 1 And the last message is repeating continiously. Also, the folder for that database in /var/lib/dirsrv/db/o_XXXX_dc_XXXX_dc_es, is removed, although is recreated when the server is restarted. So I can not initialize that database (the other hub replicas work fine). It looks the same as http://www.redhat.com/archives/fedora-directory-users/2007-March/msg00100.h…, which has not any definitive solution. Using CentOS 5.4 and 389 DS 1.2.5. Regards.

2 5

Announcing 389 Directory Server 1.2.6 Release Candidate 1
by Rich Megginson 21 Jul '10

21 Jul '10

The 389 team is pleased to announce the availability of Release Candidate 1 of version 1.2.6. This release a couple of bug fixes. ***We need your help! Please help us test this software.*** It is a release candidate, so it may have a few glitches, but it has been tested for regressions and for new feature bugs. The Fedora system strongly encourages packages to be in Testing until verified and pushed to Stable. If we don't get any feedback while the packages are in Testing, the packages will remain in limbo, or get pushed to Stable. The more testing we get, the faster we can release these packages to Stable. See the Release Notes for information about how to provide testing feedback (or just send an email to 389-users(a)lists.fedoraproject.org). The packages that need testing are: * 389-ds-base-1.2.6.rc1 - 389-ds-base * 389-admin-1.1.11.rc1 - 389-admin There are some new console/java packages too, and there is a new version of the 389-ds "meta" package - 1.2.1 * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download === Bugs Fixed === This release contains a couple of bug fixes. The complete list of bugs fixed is found at the link below. Note that bugs marked as MODIFIED have been fixed but are still in testing. * Tracking bug for 1.2.6 release - https://bugzilla.redhat.com/showdependencytree.cgi?id=543590&hide_resolved=0

2 9

problem with re-installation of 389-ds
by Martial TADJO 20 Jul '10

20 Jul '10

Hi, I got some problems with my 389-ds and I decided to re-install it by deleting some directories (/etc/dirsrv, /var/lib/dirsrv, /var/run/dirsrv, etc..), removing the package with "yum remove 389-ds" and installing a new one "yum install 389-ds. When i start the configuration with the following script : setup-ds-admin.pl, i have the following error at the end of configuration: Are you ready to set up your servers? [yes]: Creating directory server . . . Could not copy file '/etc/dirsrv/config/certmap.conf' to '/etc/dirsrv/slapd-kangourous/certmap.conf'. Error: No such file or directory Error: Could not create directory server instance 'kangourous'. Exiting . . . Log file is '/tmp/setup0m9X6x.log' Could anyone help me ? Thanks in advance. --------------- Elie MABO

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users July 2010