389-users July 2010

389-users@lists.fedoraproject.org

33 participants
38 discussions

Announcing 389 Directory Server 1.2.6 Release Candidate 3
by Rich Megginson 19 Jul '10

19 Jul '10

The 389 team is pleased to announce the availability of Release Candidate 3 of version 1.2.6. This release has a few bug fixes. ***We need your help! Please help us test this software.*** It is a release candidate, so it may have a few glitches, but it has been tested for regressions and for new feature bugs. The Fedora system strongly encourages packages to be in Testing until verified and pushed to Stable. If we don't get any feedback while the packages are in Testing, the packages will remain in limbo, or get pushed to Stable. The more testing we get, the faster we can release these packages to Stable. See the Release Notes for information about how to provide testing feedback (or just send an email to 389-users(a)lists.fedoraproject.org). The packages that need testing are: * 389-ds-base-1.2.6.rc3 - 389-ds-base More information * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download === Bugs Fixed === This release contains a couple of bug fixes. The complete list of bugs fixed is found at the link below. Note that bugs marked as MODIFIED have been fixed but are still in testing. * Tracking bug for 1.2.6 release - https://bugzilla.redhat.com/showdependencytree.cgi?id=543590&hide_resolved=0 ** Bug 606920 - anonymous resource limit - nstimelimit - also applied to "cn=directory manager" ** Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll ** Bug 605827 - In-place upgrade: upgrade dn format should not run in setup-ds-admin.pl ** Bug 578296 - Attribute type entrydn needs to be added when subtree rename switch is on ** Bug 609256 - Selinux: pwdhash fails if called via Admin Server CGI ** Bug 603942 - null deref in _ger_parse_control() for subjectdn

3 9

Re: [389-users] Users added in group via add member not able to authenticate
by Prashanth Sundaram 19 Jul '10

19 Jul '10

For apache, to enforce group member restriction follow below syntax. AuthLDAPURL ldap://ldap.airius.com/o=Airius?uid Require group cn=Administrators, o=Airius Yours should be: ldap://10.209.22.65:389/ou=People?uid Require group cn=IT, ou=shared,ou=people,dc=ldapser,dc=com More examples and explanation here: http://httpd.apache.org/docs/2.0/mod/mod_auth_ldap.html -- Thanks, Prashanth

1 1

Users added in group via add member not able to authenticate
by ashish nair 19 Jul '10

19 Jul '10

Hi, I am trying to setup 389 ldap server which went fine without any problems. But I am stuck with the group authentication.I wanted to have common groups in a few OU's. For ex: I have a pool of users in the directory server. I created a group under one OU and added those users(which are not in this tree) via add member option.But when I provide DN of this OU for authentication the users of this group are not able to do so. But when I create users under this tree directly it works. I tried many options but its not working. Please help. Regards Ashish

2 5

Host based ACI and LDAPI
by Deyan Stoykov 16 Jul '10

16 Jul '10

Hi! I'm running centos-ds-8.1.0-1.el5. When I set up a list of allowed hosts for an ACI, in addition to non-matching hosts, requests via LDAPI are rejected as well. This does make sense, but is there a way to allow connections from a list of remote hosts and via LDAPI? TIA, Deyan -- Deyan Stoykov, dstoykov(a)uni-ruse.bg System administrator University of Ruse

3 4

Modify dse.ldif using commands
by Juan Asensio Sánchez 14 Jul '10

14 Jul '10

Hi To modify some parameters of the conguration, like nsslapd-cachememsize, it is required to stop the server and manually change the setting in the dse.ldif. Is there any way/command/utility to modify that file without using grep and sed? I say this because when doing this, we must be careful to check if the attribute is defined, if not create or replace its value using sed; or change that value only for certain databases, not for all. It should be like an ldapmodify, but not using an LDAP server, just loading the specified dse.ldif file and applying the changes specified in other ldif file. Any suggestion? Regards.

6 10

Problems compiling svrcore
by Stefan-Michael Guenther 14 Jul '10

14 Jul '10

Hi, I'm currently to compile and install the different components of the Directory Server on a Ubuntu 10.4 system: Here are the commands that I have used so far: cd /usr/src export CVSROOT=:pserver:anonymous@cvs-mirror.mozilla.org:/cvsroot cvs login export BUILD_OPT=1 cvs -z3 co -r NSPR_4_8_RTM mozilla/nsprpub mkdir target.debug cd target.debug/ ../mozilla/nsprpub/configure make cd pr/tests/ make cd /usr/src cvs -z3 co -r NSS_3_11_7_RTM mozilla/security/coreconf mozilla/security/nss mozilla/dbm mozilla/security/dbm cd mozilla/security/nss/ make nss_build_all cd /usr/src cvs -z3 co -r SVRCORE_4_0_4_RTM mozilla/security/svrcore cd mozilla/security/svrcore/ ./configure --with-nss-inc=/usr/include/ --with-nss-lib=/usr/lib/nss --with-nspr-inc=/usr/local/include/nspr/ --with-nspr-lib=/usr/local/lib/ make make stops with the following error: gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/ -I/usr/local/include/nspr/ -g -O2 -MT libsvrcore_la-alt.lo -MD -MP -MF .deps/libsvrcore_la-alt.Tpo -c alt.c -fPIC -DPIC -o .libs/libsvrcore_la-alt.o In file included from alt.c:48: ./svrcore.h:41:22: error: seccomon.h: No such file or directory ./svrcore.h:42:22: error: pk11func.h: No such file or directory find /usr/src/mozilla -name seccomon.h /usr/src/mozilla/security/nss/lib/util/seccomon.h /usr/src/mozilla/dist/public/nss/seccomon.h find /usr/src/mozilla -name pk11func.h /usr/src/mozilla/security/nss/lib/pk11wrap/pk11func.h /usr/src/mozilla/dist/public/nss/pk11func.h How to tell the system to use e.g. /usr/src/mozilla/dist/public/nss to find the files? The parameter --with-nss=/usr/src/mozilla/dist/public/nss returns an error: checking for --with-nss... configure: error: /usr/src/mozilla/dist/public/nss not found Thanks for any hints or suggestions, Stefan

2 9

Slow logging
by Gerrard Geldenhuis 14 Jul '10

14 Jul '10

Hi In my lab system I am seeing quite a long delay(10+seconds) between the actual ldap request and the logging of the request in the access log. Is this normal behavior? and can it be speeded up? Admittedly I have not investigated this much yet but noticed it and thought I would ask quickly. Using latest stable from EPEL and Centos 5.5 fully updated. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 1

Problems with running Management and Directory Consoles on remote servers
by Gerrard Geldenhuis 14 Jul '10

14 Jul '10

Hi We are experiencing problems in our test environment with running or even just logging into the Management console when you run it on a remote server. The steps are: ssh -X <remote server> 389-console & wait ages for splash screen to show login dialog box eventually appears (>2 min) but empty no controls is drawn its just the outline Enabling ssh compression makes very little difference We have resorted to running 389-console on a local box and the connecting to the remote server with port forwarding trickery and alias localhost. The servers we are ssh'ing to is running on VirtualBox, if we access them from the same machine on which the Virtualbox servers is running using ssh -X then there is no problem running the console, but if a colleague tries to access the Virtualbox machines from within the same network then the trouble starts. Trying to access a server running in Australia gives the same problem just a few times worse. Java version:java-1.6.0-openjdk-1.6.0.0-1.11.b16.el5 389: 389-dsgw-1.1.4-1.el5 389-ds-console-1.2.0-5.el5 389-console-1.1.3-6.el5 389-adminutil-1.1.8-4.el5 389-admin-1.1.10-1.el5 389-admin-console-1.1.4-3.el5 389-ds-console-doc-1.2.0-5.el5 389-ds-1.1.3-6.el5 389-ds-base-1.2.5-1.el5 389-admin-console-doc-1.1.4-3.el5 Centos 5.5 fully updated. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

5 11

problem with dirsrv-admin
by Stefano Manfredda 13 Jul '10

13 Jul '10

Hello all, In these days I have to take a look to a student who's partecipating to a stage, since my colleague, her tutor, is in vacations; her goal is to develop a php script to let people change some of their attributes on our LDAP; since we use a 389-directory running on a RH5 as LDAP, she has installed CentOS 5.5 on a virtual machine (she uses windows a s OS) and then 389-directory. She has set up the directory, imported the production LDAP schema and a reduced version of our production ou, the way to get experienced with 389-directory and to start develop in php. Until yesterday anything was OK but this morning she wasn't able to get into 389-console, the java-based UI; I've took a look and trying to start dirsrv-admin I've got a "service unknown" message; so I looked in system-configure-services just to know that dirsrv-admin service wasn't in services list as in /etc/rc.d ... it seems to be disappeared without traces in logs (at least into logs I've checked in the few time I've spent this morning), or better to have been deleted. So, finally, the question is: if I tell her to re-run setup-ds-admin, does she need to re-import the whole schema, ou and so on before re-starting doing her job? Thanks, Stefano

2 1

ACI woes - not doing what I want it to
by Anne (juniper) Cross 12 Jul '10

12 Jul '10

I have this syntactically correct ACI: (targetattr = "*") (targetfilter="(ou=mailrouting-listserver)") (version 3.0;acl "Listserver Administrator";allow (all) (userdn = "ldap:///uid=listserve,ou=resource accounts,ou=people,dc=itasoftware,dc=com");) It's set on the ou=mailrouting-listserver,ou=resource accounts,etc,etc branch. I can authenticate successfully using the uid=listserve account, but I cannot in fact write or change entries in the ou=mailrouting-listserver branch using the account. What have I missed? -- Anne "juniper" Cross Extropic Crusader, Email Plumber Information Technology, ITA Software

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users July 2010