389-users January 2012

389-users@lists.fedoraproject.org

20 participants
24 discussions

SNMP MIB's returning nothing
by Alan Milligan 21 Jan '12

21 Jan '12

I've been investigating an issue with the ldap-snmp suite and why my snmpwalk is not retrieving anything for dsOpsTable nor dsEntriesTable MIBs, just returning OIDs for dsEntityTable. I'm using http://linux.last-bastion.net/LBN/up2date/aim/13/389-ds-base-1.2.10-0.4.a4.… a vanilla build from Fedora-15-updates against essentially FC13, in particular with http://linux.last-bastion.net/LBN/up2date/core/13/net-snmp-5.5-17.lbn13.x86… (another vanilla FC13 package). There are no indication in the source code that this version of net-snmp is unsuitable, nor are there any warnings/errors out of the build. When I stick agentx debug on with snmpd, I see *all* of the OID's being requested, but the only ones coming back are the dsEntityTable ones (and the most useless ones for any sort of monitoring). So, the agentx registration of MIB's at least appears to be correct. A cn=snmp,cn=monitor ldapsearch retrieves a complete set of information, so I've no reason to suspect the information is not available. (I had been going to use the ZenPacks.community.FDS Zenoss MIB ZenPack to monitor a number of LDAP servers, but have had to write a new cn=monitor based one instead). Does anyone have any idea as to where this problem may reside? Regards, Alan

1 0

el6 testing repository out of date
by Orion Poplawski 19 Jan '12

19 Jan '12

I'm seeing 389-ds-base 1.2.10-0.6.a6.el5 in epel testing, but only 389-ds-base-1.2.9-0.2.a2.el6 in epel-testing-389-ds-base. Is this repo still active? -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)cora.nwra.com Boulder, CO 80301 http://www.cora.nwra.com

2 7

Re: [389-users] Need suggestions for email aliases in ldap
by Leo Pleiman 18 Jan '12

18 Jan '12

http://directory.fedoraproject.org/wiki/Howto:Postfix Might be worth a look Sent from my Samsung smartphone on AT&T -------- Original message -------- Subject: [389-users] Need suggestions for email aliases in ldap From: Orion Poplawski <orion(a)cora.nwra.com> To: "General discussion list for the 389 Directory server project." <389-users(a)lists.fedoraproject.org> CC: I'm looking for suggestions on storing email aliases in ldap. It seems that sendmail has one schema and postfix a different one. 389 doesn't appear to support either out of the box. Are there any standardization efforts out there? Thanks! -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)cora.nwra.com Boulder, CO 80301 http://www.cora.nwra.com -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

3 2

Need suggestions for email aliases in ldap
by Orion Poplawski 18 Jan '12

18 Jan '12

I'm looking for suggestions on storing email aliases in ldap. It seems that sendmail has one schema and postfix a different one. 389 doesn't appear to support either out of the box. Are there any standardization efforts out there? Thanks! -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)cora.nwra.com Boulder, CO 80301 http://www.cora.nwra.com

1 0

TLS handshake failure
by Iain Morgan 09 Jan '12

09 Jan '12

Hello, I'm attempting to configure 389 DS v1.2.9.14 on RHEL 6.2 to use TLS with a certificate issued by a CA. I was previously able to configure TLS support using a self-signed certificate on a test system using 389 DS 1.2.8.2, but I am not having any success with the CA-issued certificate. Using the GUI is not an option, but I have used certutil to create the key/certificate databases, generate a CSR, and subsequently install the CA certificate and the signed SSL certificate. The server has been configured to use the certificate and the LDAPS listener has been enabled. The server starts up without complaint and the error log shows that it is listening on both port 389 and 636. However, attempts to connect to the LDAPS port fail: ds1.imorgan % openssl s_client -connect localhost:636 CONNECTED(00000003) 140218505807688:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:184: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 113 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE --- ds1.imorgan % Unfortunately, there do not appear to be any log messages which indicate the source of the problem. I've played with the trust flags for the certificate and have even tried re-importing it; all to no avail. Any help would be appreciated. Thanks -- Iain Morgan

3 8

compile error in 389-ds-base Archlinux
by Sergio Morales 09 Jan '12

09 Jan '12

I'm compiling 389-ds-base (1.2.9.9 & 1.2.10.a3), but I have the following error: http://pastebin.com/UAh5ZgKE (ldap/servers/slapd/back-ldbm/dblayer.c:1227:9: error: ‘DB_ENV’ has no member named ‘set_tas_spins’) I'm using db5.2.36 and running Archlinux. Will this be the problem? Anyone can understand the origin of the error? Greetings and thank you. -- Sergio A. Morales Unidad de Servicios de Computación e Internet Departamento de Informática +56 032 265 4367 XMPP: smorales at inf.utfsm.cl

2 2

LDAP URL extension to support the server side sort control?
by Graham Leggett 09 Jan '12

09 Jan '12

Hi all, I am currently trying to find out whether there is a standard way of adding the server side sort control described in RFC2891 to an LDAP URL. LDAP URLs are described as having an "extensions" section, but I'm struggling to work out what the extensions should be that would add the sort control to a search URL. If a syntax already exists for this, I'm keen to use it rather than inventing my own. Or to state it another way: ldap://host.com:6666/o=University%20of%20Michigan, c=US??sub?(cn=Babs%20Jensen)?[what-goes-here-to-support-sorting] Is anyone able to confirm? Regards, Graham --

1 0

Problem with ds setup
by Israel Nelken 09 Jan '12

09 Jan '12

I tried to install the directory server on a machine with a clean installation of Fedora 16, fully updated. the setup script failed at the state of starting the admin server. I fully removed the installation ( remove-ds-admin.pl -y -f, yum erase 389-ds-base-libs 389-adminutil idm-console-framework, rm -rf /etc/dirsrv /usr/lib*/dirsrv /var/*/dirsrv /etc/sysconfig/dirsrv*), reinstalled the packages, and had the same result. I repeated the same on another machine with a clean install of Fedora 16, exactly the same results. Details: I ran setup-ds-admin.pl -ddd The seemingly relevant lines from the Log file: [12/01/04:07:25:48] - [Setup] Info Starting admin server . . . [12/01/04:07:25:59] - [Setup] Info output: Starting dirsrv-admin (via systemctl): Job failed. See system logs and 'systemctl status' for details. [12/01/04:07:25:59] - [Setup] Info output: [FAILED] [12/01/04:07:25:59] - [Setup] Fatal Failed to create and configure the admin server [12/01/04:07:25:59] - [Setup] Fatal Exiting . . . from /var/log/messages: Jan 4 07:25:19 habanera ns-slapd[20694]: [04/Jan/2012:07:25:19 +0200] config - The configuration file /etc/dirsrv/slapd-admin/dse.ldif does not exist Jan 4 07:25:19 habanera ns-slapd[20694]: [04/Jan/2012:07:25:19 +0200] config - The backup configuration file /etc/dirsrv/slapd-admin/dse.ldif.tmp does not exist, either. Jan 4 07:25:19 habanera ns-slapd[20694]: [04/Jan/2012:07:25:19 +0200] schema - No schema files were found in the directory /etc/dirsrv/slapd-admin/schema Jan 4 07:25:19 habanera ns-slapd[20694]: [04/Jan/2012:07:25:19 +0200] dse - Please edit the file to correct the reported problems and then restart the server. Jan 4 07:25:19 habanera systemd[1]: dirsrv(a)admin.service: control process exited, code=exited status=1 Jan 4 07:25:19 habanera systemd[1]: Unit dirsrv(a)admin.service entered failed state. Jan 4 07:25:48 habanera dirsrv-admin[20825]: Starting dirsrv-admin: Jan 4 07:25:49 habanera dirsrv-admin[20825]: /usr/sbin/start-ds-admin: line 104: 20845 Segmentation fault $SELINUX_CMD $HTTPD $OMIT_DEFLATE -k start -f /etc/dirsrv/admin-serv/httpd.conf "$@" Jan 4 07:25:49 habanera kernel: [57576.961337] httpd.worker[20845]: segfault at c ip 008e1c67 sp bfc770f0 error 4 in libpthread-2.14.90.so [8d9000+17000] Jan 4 07:25:59 habanera dirsrv-admin[20825]: Server failed to start !!! Please check errors log for problems Jan 4 07:25:59 habanera dirsrv-admin[20825]: [FAILED] Jan 4 07:25:59 habanera systemd[1]: dirsrv-admin.service: control process exited, code=exited status=1 Jan 4 07:25:59 habanera systemd[1]: Unit dirsrv-admin.service entered failed state. slapd-habanera seems to run (I see it with ps -ef, and /var/log/dirsrv/slapd-habanera/access and error are getting filled up, nothing to comment about). /var/log/dirsrv/admin-serv/error: [Wed Jan 04 07:25:49 2012] [notice] Access Host filter is: *.ls.huji.ac.il [Wed Jan 04 07:25:49 2012] [notice] Access Address filter is: * -- Prof. Israel Nelken Dept. of Neurobiology The Alexander Silberman Institute of Life Sciences Edmond Safra Campus, Givat Ram Jerusalem 91904, ISRAEL Tel: ++972-2-6584229 Fax: ++972-2-6586077 israel(a)cc.huji.ac.il

3 8

Re: [389-users] Problem with ds setup
by Guillaume Chanaud 05 Jan '12

05 Jan '12

Hi, same here, there is a segfault in http.worker. It's the mod_nss fault (like always..). So here is the solution to get it working : In /etc/dirsrv/admin-serv/httpd.conf Comment lines : LoadModule nss_module /usr/lib64/httpd/modules/libmodnss.so Include /etc/dirsrv/admin-serv/nss.conf In /etc/dirsrv/admin-serv/console.conf Comment out everything after line Listen 0.0.0.0:9830 Aka : comment out everything related to NSS/certs Hope it'll help you. Guillaume

2 2

operational attributes
by Josh Ellsworth 05 Jan '12

05 Jan '12

We are in the process of migrating from Sun Directory Server to 389 Directory Server. In the past we used a pwdChangedTime operational attribute for one of our audit reports. Is there an equivalent attribute recorded by 389? -- Joshua Ellsworth System Administrator, Primatics Financial Phone: 571.765.7528 jellsworth(a)primaticsfinancial.com

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users January 2012