389-users February 2011

389-users@lists.fedoraproject.org

31 participants
35 discussions

Install on RHEL 6....
by Daniel R. Gore 14 Feb '11

14 Feb '11

I have managed to get everything compiled and all packages installed, but when I go through the /usr/sbin/setup-ds-admin.pl script if fails with Could no start the admin server. Error: 256 Failed to create and configure the admin server. This appeared to be a problem with the scripted not correctly creating the /var/log/dirserv/admin-serv directory. When I create that before the install it then errors with Errot updating console.conf NMC_Status: 1 NMC_ErrType: NMC_ErrInfo: Cannot open file for reaing Could not update the httpd engine configuration. Failed to create and configure the admin server Exiting . . . Any clues? Thanks. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 4

Re: [389-users] Sync AD with 389-DS Unable to parse response
by Rich Megginson 14 Feb '11

14 Feb '11

> Date: > Fri, 21 Jan 2011 10:25:56 +0100 > To: > "General discussion list for the 389 Directory server project." > <389-users(a)lists.fedoraproject.org> > > > Hi Rich, > > Thanks for this usefull link. > > I have successfully initiate replica between Windows AD and my server > 389-DS. Ldapsearch is working. But even if everything seems to be ok, > the update does not work and I do not see any error in the log > files... So, my AD server stay empty, the accounts are not migrate... > > Here you have my access log file which is more verbose... > (mydomain.com <http://mydomain.com> for the example) : <snip> > Obviously I am connecting to the server 389-DS itself whereas it can > resolve the DNS name of my Windows server... There is no error in the > AD event viewer while I could see errors on it when it was > misconfigured (like DirSync errors)... So, basically, the Windows > server is contacted to my DS-Server over 2 different networks. > > Do you think I have to open the ports described in my message ? > > -Regards. I don't know. There is no winsync information in the access log. Note that the access log records client accesses to the directory server, and in winsync, the directory server itself acts as a client to AD, so winsync will log nothing in the access log. The errors log could be helpful, and especially using the replication log level (which is also used for winsync logging). The Windows Event Viewer is useless for winsync issues.

2 6

Performance tuning - where to begin?
by Daniel Fenert 10 Feb '11

10 Feb '11

Hi, I have performance problem on 389-ds server and don't really know where to start fine tuning. My current setup is master (2xQuadCore, 8GB RAM), few read-only slaves. It works (more or less) without problems, but I would like to migrate to multi master (2 master servers). To check if one master will handle the whole load, I've tried switching clients from slaves to master one by one. After switching clients from third slave, I've encountered weird problem - master was about 50% busy (looking at the cpu, no IO waits), but there was problem with new connections. Looking at the network level - there was SYN from client, but no ACK until one or two retransmissions of SYN. I've tried increasing thread number (from 30 to 60), but problem still exists. The problem is near 400-500 connections/second. My whole load is ~750conn/sec. Looking at the CPU usage, this server should handle the load. It works stable with load ~300conn/sec. There are plenty of configuration options, where should I look first? -- Daniel Fenert

4 7

pam_unix(sshd:auth): authentication failure;
by heiko.hess＠nextra.de 10 Feb '11

10 Feb '11

hi folks, i have strange entries in the secure log file and i ask me why the log say pam_unix(sshd:auth): authentication failure but the login works fine, is this a bug ? or can anyone tell me how can i fix this . Feb 10 11:08:38 hostname sshd[4461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xx.xx.xx.xx user=xxxx Feb 10 11:08:38 hostname sshd[4461]: Accepted password for xxxx from xx.xx.xx.xx port 56885 ssh2 Feb 10 11:08:38 hostname sshd[4461]: pam_unix(sshd:session): session opened for user xxxx by (uid=0) regards

1 0

1.2.8 Windows sync agreement initialization
by Juan Carlos Camargo 09 Feb '11

09 Feb '11

Hi, I'm running 389-ds version 1.2.8 on CentOS 5x and configured a windows sync agreement against a 2003 active directory server. Everything works as expected. However, everytime I restart the directory server (service dirsrv restart) I need to reinitialize the windows agreement. Messages such as "Replica has no update vector. It has never been initialized" continously filling the error log until I proceed with the init. But the replica was initialized and conversations between 389 and AD were working nicely. And what I would not want at all is to lose any changes made on either side as a result of the initialization process. My question then, is this the normal behaviour ? Thanks!

3 8

Giving up 389ds
by Juan Carlos Camargo 09 Feb '11

09 Feb '11

I must say, I'm giving up the product. It seems that I'm unable to setup a successful windows sync agreement to our active directory server. I got tired of trying, googling, checking the list, posting, getting wrong answers and so and so. Good luck!

2 1

FYI and OT: PAM Weirdness
by Gerrard Geldenhuis 09 Feb '11

09 Feb '11

Hi I have seen an interesting problem which I thought would be useful for anyone on the list to know. I ran into it ones to many so sharing my solutions to spare others the suffering. :D If you have certificates in /etc/pki/tls/certs on a CentOS 5.5 box and one of the certificates has root:root 600 permissions it will break LDAP login if you use certificates. What happens is that as the client libs try to find the correct certificate it cycles through all of the certificates (as shown by strace) finds the correct certificates but also find an unreadable certificate and then refuses to connect to the LDAP server for some tasks. You can login but you will see something like the following: Last login: Wed Feb 9 09:56:32 2011 from 10.5.11.44 id: cannot find name for user ID xxxx id: cannot find name for group ID xxxx id: cannot find name for user ID xxxx [I have no name!@testbox ~]$ You will also see the following in /var/log/messages Feb 9 09:53:01 testserver nscd: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)... Feb 9 09:53:02 testserver nscd: nss_ldap: could not search LDAP server - Server is unavailable Arguably the file permissions should never be 600, but also arguable the PAM and or other libs should not be so sensitive to fail on only one file being wrong. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

1 0

Announcing 389 Directory Server version 1.2.8 Alpha 2
by Rich Megginson 08 Feb '11

08 Feb '11

The 389 Project team is pleased to announce the release of 389-ds-base-1.2.8 Alpha 2. This release has fixes for bugs found in 1.2.8 alpha 1 testing and earlier releases. Installation yum install 389-ds # or for EPEL yum install 389-ds setup-ds-admin.pl Upgrade yum upgrade 389-ds-base # or for EPEL yum upgrade 389-ds-base setup-ds-admin.pl -u How to Give Feedback The best way to provide feedback is via the Fedora Update system. Each update is broken down by package and platform. For example, if you are using Fedora 13, and you have successfully installed or upgraded all of the packages, and the console and etc. works, then go to the links below for Fedora 13 and provide feedback. * 389-ds-base-1.2.8.a2 ** EL-5 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8-0.2.a2.el5 ** Fedora 13 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8-0.2.a2.fc13 ** Fedora 14 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8-0.2.a2.fc14 scroll down to the bottom of the page, and click on the Add a comment >> link * select one of the Works for me or Does not work radio buttons, add text, and click on the Add Comment button If you are using a build on another platform, just send us an email to 389-users(a)lists.fedoraproject.org Reporting Bugs If you find a bug, or would like to see a new feature, you can enter it here - https://bugzilla.redhat.com/enter_bug.cgi?product=389 More Information * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download

1 0

Re: [389-users] Export/import with 389 DS 1.2.7.5
by Reinhard Nappert 08 Feb '11

08 Feb '11

I haven't seen any responses so far. Any idea? Thanks, -Reinhard ________________________________ From: Reinhard Nappert Sent: Tuesday, February 01, 2011 9:40 AM To: '389-users(a)lists.fedoraproject.org' Subject: Export/import with 389 DS 1.2.7.5 Hi, I have a working MM setup and I exported my db with db2ldif.pl with the -r option: db2ldif.pl -D 'cn=Directory Manager' -w password -n userRoot -r -a /tmp/db_replica.ldif The errors file do not indicate an issue: [01/Feb/2011:09:23:59 -0500] - Beginning export of 'userRoot' [01/Feb/2011:09:23:59 -0500] - export userRoot: Processed 1000 entries (10%). [01/Feb/2011:09:23:59 -0500] - export userRoot: Processed 2000 entries (21%). [01/Feb/2011:09:23:59 -0500] - export userRoot: Processed 3000 entries (32%). [01/Feb/2011:09:24:00 -0500] - export userRoot: Processed 4000 entries (43%). [01/Feb/2011:09:24:00 -0500] - export userRoot: Processed 5000 entries (54%). [01/Feb/2011:09:24:00 -0500] - export userRoot: Processed 6000 entries (65%). [01/Feb/2011:09:24:00 -0500] - export userRoot: Processed 7000 entries (76%). [01/Feb/2011:09:24:00 -0500] - export userRoot: Processed 8000 entries (87%). [01/Feb/2011:09:24:00 -0500] - export userRoot: Processed 9000 entries (98%). [01/Feb/2011:09:24:00 -0500] - export userRoot: Processed 9160 entries (100%). [01/Feb/2011:09:24:00 -0500] - Export finished. and the ldif file itself looks fine to me as well. Then, I tried to import the ldif file with ldif2db.pl -D 'cn=Directory Manager' -w password -n userRoot -i /tmp/db_replica.ldif This fails with the following errors log: [01/Feb/2011:09:29:45 -0500] - Bringing userRoot offline... [01/Feb/2011:09:29:45 -0500] NSMMReplicationPlugin - multimaster_be_state_change: replica o=umc is going offline; disabling replication [01/Feb/2011:09:29:46 -0500] - entrycache_clear_int: there are still 1 entries in the entry cache. :/ [01/Feb/2011:09:29:49 -0500] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database [01/Feb/2011:09:29:49 -0500] - import userRoot: Beginning import job... [01/Feb/2011:09:29:49 -0500] - import userRoot: Index buffering is disabled. [01/Feb/2011:09:29:49 -0500] - import userRoot: Processing file "/tmp/db_replica.ldif" [01/Feb/2011:09:29:49 -0500] - BAD CACHE ASSERTION at ../ldap/servers/slapd/back-ldbm/cache.c/883: e->ep_refcnt > 0 Any idea, what is going on there. Thanks, -Reinhard

3 5

389 DS is reseting connections
by Diego Woitasen 08 Feb '11

08 Feb '11

Hi, I have 389 DS 1.2.7.5 running on Debian Squeeze. It was working fine but the last days the process started to hang very often. I restart the service, works fine for a few minutes and hangs again. The process is running, accept connections but reset them. The only error message that I see is from ldapsearch: ldap_start_tls: Can't contact LDAP server (-1) ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) I ran ldapsearch with strace, the last lines: socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3 fcntl(3, F_SETFD, FD_CLOEXEC) = 0 setsockopt(3, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0 setsockopt(3, SOL_TCP, TCP_NODELAY, [1], 4) = 0 connect(3, {sa_family=AF_INET, sin_port=htons(389), sin_addr=inet_addr("140.191.48.138")}, 16) = 0 write(3, "0\35\2\1\1w\30\200\0261.3.6.1.4.1.1466.20037", 31) = 31 poll([{fd=3, events=POLLIN|POLLPRI|POLLERR|POLLHUP}], 1, -1) = 1 ([{fd=3, revents=POLLIN|POLLERR|POLLHUP}]) read(3, 0x11ed85f, 8) = -1 ECONNRESET (Connection reset by peer) write(2, "ldap_start_tls: Can't contact LD"..., 47ldap_start_tls: Can't contact LDAP server (-1) ) = 47 write(2, "ldap_sasl_bind(SIMPLE): Can't co"..., 55ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) ) = 55 exit_group(-1) I tried to trace ns-slapd, but I don't see anything special (except the ENOTCONN error in getpeername() but it's on a different FD): 2007 accept(6, {sa_family=AF_INET, sin_port=htons(53395), sin_addr=inet_addr("140.191.48. 138")}, [16]) = 34 2007 fcntl(34, F_GETFL) = 0x2 (flags O_RDWR) 2007 fcntl(34, F_SETFL, O_RDWR|O_NONBLOCK) = 0 2007 fcntl(34, F_DUPFD, 64) = 64 2007 close(34) = 0 2007 setsockopt(64, SOL_TCP, TCP_NODELAY, [0], 4) = 0 2007 getpeername(64, {sa_family=AF_INET, sin_port=htons(53395), sin_addr=inet_addr("140.1 91.48.138")}, [16]) = 0 2007 getsockname(64, {sa_family=AF_INET, sin_port=htons(389), sin_addr=inet_addr("140.191 .48.138")}, [16]) = 0 2007 getpeername(7, 0x7fff1acd6e90, [112]) = -1 ENOTCONN (Transport endpoint is not conne cted) 2007 poll([{fd=22, events=POLLIN}, {fd=6, events=POLLIN}, {fd=7, events=POLLIN}, {fd=-1}, {fd=64, events=POLLIN}], 5, 250) = 1 ([{fd=64, revents=POLLIN}]) 2007 close(64) = 0 2007 getpeername(7, 0x7fff1acd6e90, [112]) = -1 ENOTCONN (Transport endpoint is not conne cted) 2007 poll([{fd=22, events=POLLIN}, {fd=6, events=POLLIN}, {fd=7, events=POLLIN}, {fd=-1}] , 4, 250 <unfinished ...> 2010 <... select resumed> ) = 0 (Timeout) 2010 select(0, NULL, NULL, NULL, {0, 100000} <unfinished ...> 2012 <... select resumed> ) = 0 (Timeout) Any hint to help to find the problem? I tried with different slapd log levels but i don't see anything special. I don't except a magical solution, only a hint to discover what's happening. Regards, Diego -- Diego Woitasen

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users February 2011