389-users November 2011

389-users@lists.fedoraproject.org

31 participants
27 discussions

DNA configuration question
by cnu 09 Nov '11

09 Nov '11

Hello, I use 389 directory server 1.2.8.1 in a master slave replication configuration. One master and five slaves. Now I want to configure DNA plugin. Is it sufficient to activate the plugin only on the master server ? thanks, br cnu

2 2

Hiding key fields from ldap searches
by David Hoskinson 08 Nov '11

08 Nov '11

We have been able to run ldapsearchs that revealed what we consider private info on certain fields such as sambalmpassword, sambantpassword for example. Even though they are crypted we would like to restrict certain fields to directory managers and not anonymous searches. I believe this is what the aci's are for, but I am fuzzy on how this works. If someone could verify I would appreciate it and lead me in the right direction. We are trying to keep regular users from seeing these fields. thanks David Hoskinson | DATATRAK International Systems Engineer Mayfield Heights, Ohio, USA +1.440.443.0082 x 124 (p) | +1.216.280.5457 (m) david.hoskinson(a)datatrak.net<mailto:david.hoskinson@datatrak.net> | www.datatrak.net<http://www.datatrak.net/>

2 1

replication issues with promoting hub to master
by Anderson, Cary 08 Nov '11

08 Nov '11

All, I am having issues with replication breaking once I promote a hub to a multi-master. My test set-up has a master/hub/slave environment using basic replication. This works as intended. However, once I select multi-master and set the replica id for the hub/new master, replication no longer works to the new master to the slave. The only thing that I have been able to do is disable replication on the new master, re-enable replication, create a new replication id and setup a new replication agreement and re-initializing the slave. Is there a way to get replication working on a promoted hub without completely tearing down the existing replication setup and re-initializing the slave? Thanks Cary Anderson, System Software Specialist UNIX/Linux Services Data Center Section Information Technology Services Branch Technology Services & Support Division Phone: (916) 795-2588 Fax: (916) 795-2424 Email: Cary Anderson(a)calpers.ca.gov<mailto:Cary@calpers.ca.gov> From: 389-users-bounces(a)lists.fedoraproject.org [mailto:389-users-bounces@lists.fedoraproject.org] On Behalf Of Rich Megginson Sent: Tuesday, November 08, 2011 7:29 AM To: SHAW-MILLER, JOHN (Synetrix) Cc: General discussion list for the 389 Directory server project. Subject: Re: [389-users] 389 Suddenly Stops...... On 11/08/2011 08:27 AM, SHAW-MILLER, JOHN (Synetrix) wrote: Its CentosDS - but the other server doesn't have the issue? It may be an issue of operation origin - it may be that it is a problem with the processing of the original operation, or with the processing on the server that gets the operation as a replicated operation. I suggest upgrading. If you'd rather not, then I suggest following the steps http://directory.fedoraproject.org/wiki/FAQ#Debugging_Crashes regards, John Shaw-Miller Senior Unix Consultant ISP Services ITNS Professional Services M: 07920 824938 F:01252 405605 E: john.shaw-miller(a)synetrix.co.uk<mailto:john.shaw-miller@synetrix.co.uk> E: john.shaw-miller(a)capita.co.uk<mailto:john.shaw-miller@capita.co.uk> Synetrix House, 49-51 Victoria Road Farnborough, Hampshire, GU14 7PA http://www.synetrix.co.uk.uk<http://www.synetrix.co.uk.uk/> Part of The Capita Group plc www.capita.co.uk<http://www.capita.co.uk> From: Rich Megginson [mailto:rmeggins@redhat.com] Sent: 08 November 2011 15:24 To: General discussion list for the 389 Directory server project. Cc: SHAW-MILLER, JOHN (Synetrix) Subject: Re: [389-users] 389 Suddenly Stops...... On 11/08/2011 05:55 AM, SHAW-MILLER, JOHN (Synetrix) wrote: Hi Rich, To answer your questions Centos 5.6 X64 389-DS - 8.1.0 - Build 2009.134.1334 rpm -qi 389-ds-base or are you running redhat-ds-base or centos-ds-base? If this really is redhat-ds-base or centos-ds-base 8.1, I strongly encourage you to upgrade. Yes I have full administrative rights across all directory servers with an ACL The process doesn't run, it just drops right out - no core dumps, nothing, and the log files really aren't helpful but I intend to try and "crash" it again and see if I can find out whats happening. The ONLY log entry in /var/log/messages is to a segfault Nov 7 14:08:35 cc-teh-pds-01 kernel: ns-slapd[8677]: segfault at 00000036c682e824 rip 00002b4232552842 rsp 000000004f0c2cd0 error 7 Is this segfault from around the time the server stops responding? If so, then this is likely the cause. See http://directory.fedoraproject.org/wiki/FAQ#Debugging_Crashes for information about how to get more information from server crashes. regards, John Shaw-Miller Senior Unix Consultant ISP Services ITNS Professional Services M: 07920 824938 F:01252 405605 E: john.shaw-miller(a)synetrix.co.uk<mailto:john.shaw-miller@synetrix.co.uk> E: john.shaw-miller(a)capita.co.uk<mailto:john.shaw-miller@capita.co.uk> Synetrix House, 49-51 Victoria Road Farnborough, Hampshire, GU14 7PA http://www.synetrix.co.uk.uk<http://www.synetrix.co.uk.uk/> Part of The Capita Group plc www.capita.co.uk<http://www.capita.co.uk> From: 389-users-bounces(a)lists.fedoraproject.org<mailto:389-users-bounces@lists.fedoraproject.org> [mailto:389-users-bounces@lists.fedoraproject.org] On Behalf Of Rich Megginson Sent: 07 November 2011 15:08 To: General discussion list for the 389 Directory server project. Cc: SHAW-MILLER, JOHN (Synetrix) Subject: Re: [389-users] 389 Suddenly Stops...... On 11/07/2011 07:17 AM, SHAW-MILLER, JOHN (Synetrix) wrote: All, I am wondering if any of you can help with this ...... Scenario: I log into 389 using my own credentials (not the directory manager), I have full permissions on all directory servers What platform? What version of 389-ds-base? What do you mean by "I have full permissions on all directory servers" - do you mean you have set up an ACI for your user to grant administrative access to your directory server data? Result: 389 Directory Server stops on the logged on server, nothing in the logs, and PID is still there Can you be more specific about what you mean by "stops"? Is the process still running? If so, is it not accepting any new connections? Is it running at 100% cpu? Is there anything in the errors log from around the time it "stops"? Are there any core files in /var/log/dirsrv/slapd-INSTANCE? Recovery: Restart the service.... When you restart the service, do you see any "disorderly shutdown detected" messages in the errors log? Any slapd messages in /var/log/messages? Has anyone seen this before? It DOESN'T occur if I log in as the Directory Manager, and replication is unaffected - it just starts up again when the service is restarted regards, John Shaw-Miller Senior Unix Consultant ISP Services ITNS Professional Services M: 07920 824938 F:01252 405605 E: john.shaw-miller(a)synetrix.co.uk<mailto:john.shaw-miller@synetrix.co.uk> E: john.shaw-miller(a)capita.co.uk<mailto:john.shaw-miller@capita.co.uk> Synetrix House, 49-51 Victoria Road Farnborough, Hampshire, GU14 7PA http://www.synetrix.co.uk.uk<http://www.synetrix.co.uk.uk/> Part of The Capita Group plc www.capita.co.uk<http://www.capita.co.uk> Synetrix (Holdings) Limited is a limited company registered in England and Wales. Registered number: 0349 1956. VAT number: GB618 1841 40. Registered office: Synetrix (Holdings) Ltd, 17-19 Rochester Row, London, SW1P 1QT. IMPORTANT NOTICE: This message is intended solely for the use of the Individual or organisation to whom it is addressed. It may contain privileged or confidential information. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you should not use, copy, alter, or disclose the contents of this message. All information or opinions expressed in this message and/or any attachments are those of the author and are not necessarily those of Synetrix Holdings Limited. Synetrix Holdings Limited accepts no responsibility for loss or damage arising from its use, including damage from virus. -- 389 users mailing list 389-users(a)lists.fedoraproject.org<mailto:389-users@lists.fedoraproject.org> https://admin.fedoraproject.org/mailman/listinfo/389-users Click here<https://www.mailcontrol.com/sr/hgg0daEl44jTndxI%21oX7Urw%21oDuajywvmozZsWxE…> to report this email as spam. -- 389 users mailing list 389-users(a)lists.fedoraproject.org<mailto:389-users@lists.fedoraproject.org> https://admin.fedoraproject.org/mailman/listinfo/389-users

2 1

Replication frequency
by David Hoskinson 08 Nov '11

08 Nov '11

Should be an easy one... can anyone tell me how often replication takes place in a multimaster setup? Is this a timed event or does a change trigger the replication. Working on a status check and want to see which direction to go... thanks. David Hoskinson | DATATRAK International Systems Engineer Mayfield Heights, Ohio, USA +1.440.443.0082 x 124 (p) | +1.216.280.5457 (m) david.hoskinson(a)datatrak.net<mailto:david.hoskinson@datatrak.net> | www.datatrak.net<http://www.datatrak.net/>

3 2

389 Suddenly Stops......
by SHAW-MILLER, JOHN (Synetrix) 08 Nov '11

08 Nov '11

All, I am wondering if any of you can help with this ...... Scenario: I log into 389 using my own credentials (not the directory manager), I have full permissions on all directory servers Result: 389 Directory Server stops on the logged on server, nothing in the logs, and PID is still there Recovery: Restart the service.... Has anyone seen this before? It DOESN'T occur if I log in as the Directory Manager, and replication is unaffected - it just starts up again when the service is restarted regards, John Shaw-Miller Senior Unix Consultant ISP Services ITNS Professional Services M: 07920 824938 F:01252 405605 E: john.shaw-miller(a)synetrix.co.uk <mailto:john.shaw-miller@synetrix.co.uk> E: john.shaw-miller(a)capita.co.uk <mailto:john.shaw-miller@capita.co.uk> Synetrix House, 49-51 Victoria Road Farnborough, Hampshire, GU14 7PA http://www.synetrix.co.uk.uk <http://www.synetrix.co.uk.uk/> Part of The Capita Group plc www.capita.co.uk <http://www.capita.co.uk> Synetrix (Holdings) Limited is a limited company registered in England and Wales. Registered number: 0349 1956. VAT number: GB618 1841 40. Registered office: Synetrix (Holdings) Ltd, 17-19 Rochester Row, London, SW1P 1QT. IMPORTANT NOTICE:This message is intended solely for the use of the Individual or organisation to whom it is addressed. It may contain privileged or confidential information. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you should not use, copy, alter, or disclose the contents of this message. All information or opinions expressed in this message and/or any attachments are those of the author and are not necessarily those of Synetrix Holdings Limited. Synetrix Holdings Limited accepts no responsibility for loss or damage arising from its use, including damage from virus.

2 5

Corrupted entry - Replication error
by Moisés Barba Pérez 08 Nov '11

08 Nov '11

Hi, I have a problem with one entry in LDAP. Two ldap servers configured as hub replication, each one with its own db. It have been such a replication error or something like that, and it was created a entry in the read-only db of one of them with this format nsuniqueid=4e5f6001-1dd211b2-af5aa850-d3090000+uid=########L,ou=people,o=XXXX,dc=XXXX,dc=XX where the original is uid=########L,ou=people,o=XXXX,dc=XXXX,dc=XX having both of then in the read-only db and the correct one in the original ldap. I can't remove the wrong entry because in the original ldap there is only the correct one. How can I fix this entry (removing it, I guess) ??? My ldap version is 1.2.5 and the OS is centos5.5. Regards, Moses.

2 3

help with 'no such attribute' error?
by brandon 02 Nov '11

02 Nov '11

So I'm hoping somebody can assist with a confusing problem I am having. I am running 389-ds-1.2.1-1. I have nodes in a subtree where I am unable to modify the userPassword attribute through perl-LDAP, but I can through the 389-console. However, this same exact perl-LDAP code /can/ make changes to objects in a different subtree (works in ou=People, fails in ou=Special Users). The perl script uses an administrative account to make the changes (admin in ou=Administrators,ou=TopologyManagement,o=NetscapeRoot), which should have access to the entire tree. ACI's on the subtrees are identical, I have even compared them in the ldif export of the tree. The commit works if I use ldapmodify (same user/password), it works if I do it with 389-console, but it fails when I use perl-LDAP. I am current on perl-LDAP as well. The only reason I am still poking at the directory server, is because the directory server is returning the 'no such attribute' error 16, even in the logfiles. Is there any way to get some more .. readable logs from the directory server? Is there a way to filter the ds logs, perhaps? Specify that logs regarding specific nodes are sent at different levels? I suspect that perl-LDAP is committing the change in a manner differently than ldapmodify/389-console, but I cannot figure out how. What really confuses me is that perl-LDAP /works/ fine on ou=People, but not ou=Special Users. Thoughts? Help? Suggested directions to look? Thanks, -Brandon

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2011