389-users November 2013

389-users@lists.fedoraproject.org

26 participants
31 discussions

Password Failure Lockout doesn't seem to work
by JLPicard 25 Nov '13

25 Nov '13

Hi, I am testing out 389_ds_base, version =1.2.11.15,REV=2013.01.31 running on mixed Solaris 10 servers (SPARC and X86) sourced from http://www.opencsw.org/packages/CSW389-ds-base in multi-master mode with 4 servers that is primarily used for authentication and user/group/netgroup management. Most of the Password policy components seem to work as they should, but password failure account lockout doesn't appear to engage after X-failed attempts. After creating a new account, testing a successful login, after 5+ failed logins with bad passwords, I can still login after I would expect to be locked out. I even created a new password policy and applied it to this user and it still doesn't lock him out after 5+ failed logins with bad passwords. The client server I am trying to login to is a Solaris 10 Sparc OS that successfully integrates into LDAP for authentication and user/group/netgroup management. Can someone recommend some steps to determine where to start attacking this issue? I assume this is an 389DS issue, but I provided a copy of our /etc/pam.conf and /etc/nsswitch.conf in case its a client-side configuration issues. I have provided some quick diagnostics of current settings as they are shown below in an ldapsearch-cmd in this environment (see below). Thanks in advance for any help you may provide. #Here is the global password policy: >>ldapsearch -x -ZZ -LLL -h ldap-dr01.my-domain.com -D 'cn=directory manager' -b 'cn=config' -s base 'objectClass=*' '*' passwordHistory | grep password passwordInHistory: 6 passwordUnlock: on passwordGraceLimit: 0 passwordMustChange: off passwordWarning: 86400 passwordLockout: off passwordMinLength: 8 passwordMinDigits: 0 passwordMinAlphas: 0 passwordMinUppers: 0 passwordMinLowers: 0 passwordMinSpecials: 0 passwordMin8bit: 0 passwordMaxRepeats: 0 passwordMinCategories: 3 passwordMinTokenLength: 3 passwordMaxFailure: 3 passwordHistory: off passwordMaxAge: 8640000 passwordResetFailureCount: 600 passwordisglobalpolicy: on passwordlegacypolicy: on passwordtrackupdatetime: off passwordChange: on passwordExp: off passwordLockoutDuration: 3600 passwordCheckSyntax: off passwordMinAge: 0 passwordStorageScheme: SSHA #Here is my newly created policy >>ldapsearch -x -ZZ -LLL -h "my-ldapHost01.my-domain.com" -b "cn=nsPwPolicyContainer,ou=people,dc=my-domain,dc=com" "(&(objectClass=ldapsubentry)(objectClass=passwordPolicy)(cn=TestNewPolicy))" dn: cn=TestNewPolicy,cn=nsPwPolicyContainer,ou=people,dc=my-domain,dc=com cn: TestNewPolicy objectClass: top objectClass: ldapsubentry objectClass: passwordPolicy passwordMustChange: on passwordChange: on passwordMinAge: 0 passwordKeepHistory: on passwordInHistory: 12 passwordExp: on passwordMaxAge: 86400 passwordWarning: 10000 passwordGraceLimit: 5 passwordLockout: on passwordMaxFailure: 4 passwordResetDuration: 600 passwordLockoutDuration: 3600 passwordCheckSyntax: on passwordMinLength: 6 passwordMinAlphas: 1 passwordMinCategories: 1 passwordMinDigits: 1 passwordMinLowers: 1 passwordMinUppers: 1 passwordMinSpecials: 0 passwordMin8bit: 0 passwordMaxRepeats: 0 passwordMinTokenLength: 3 passwordStorageScheme: SSHA #Here is my newly created user with the test policy applied to him >>ldapsearch -x -ZZ -LLL -h "my-ldapHost01.my-domain.com" -b "dc=my-domain,dc=com" "cn=test-user-account" dn: uid=test-user-account,ou=people,dc=my-domain,dc=com description: accountHasItsOwnPwdPolicy objectClass: posixAccount objectClass: shadowAccount objectClass: account objectClass: top uid: test-user-account cn: test-user-account uidNumber: 2853 gidNumber: 2600 gecos: User LDAP Test homeDirectory: /home/test-user-account loginShell: /bin/tcsh >>ldapsearch -x -ZZ -LLL -h "my-ldapHost01.my-domain.com" -b "dc=my-domain,dc=com" "cn=test-user-account" pwdPolicySubentry dn: uid=test-user-account,ou=people,dc=my-domain,dc=com pwdPolicySubentry: cn=TestNewPolicy,cn=nsPwPolicyContainer,ou=people,dc=my-domain,dc=com >>ldapsearch -x -ZZ -LLL -h "my-ldapHost01.my-domain.com" -b "dc=my-domain,dc=com" "cn=test-user-account" passwordExpirationtime dn: uid=test-user-account,ou=people,dc=my-domain,dc=com passwordExpirationtime: 20131126160316Z Here is my Solaris-based PAM file: /etc/pam.conf #ident "@(#)pam.conf 1.31 07/12/07 SMI" # # Copyright 2007 Sun Microsystems, Inc. All rights reserved. # Use is subject to license terms. # # PAM configuration # # Unless explicitly defined, all services use the modules # defined in the "other" section. # # Modules are defined with relative pathnames, i.e., they are # relative to /usr/lib/security/. Absolute path names, as # present in this file in previous releases are still acceptable. # # Authentication management # # login service (explicit because of pam_dial_auth) # login auth requisite pam_authtok_get.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 login auth required pam_dial_auth.so.1 login auth binding pam_unix_auth.so.1 server_policy login auth required pam_ldap.so.1 # # rlogin service (explicit because of pam_rhost_auth) # rlogin auth sufficient pam_rhosts_auth.so.1 rlogin auth requisite pam_authtok_get.so.1 rlogin auth required pam_dhkeys.so.1 rlogin auth required pam_unix_cred.so.1 rlogin auth binding pam_unix_auth.so.1 server_policy rlogin auth required pam_ldap.so.1 # # Kerberized rlogin service # # # rsh service (explicit because of pam_rhost_auth, # and pam_unix_auth for meaningful pam_setcred) # rsh auth sufficient pam_rhosts_auth.so.1 rsh auth required pam_unix_cred.so.1 rsh auth binding pam_unix_auth.so.1 server_policy rsh auth required pam_ldap.so.1 # # Kerberized rsh service # # # Kerberized telnet service # # # PPP service (explicit because of pam_dial_auth) # ppp auth requisite pam_authtok_get.so.1 ppp auth required pam_dhkeys.so.1 ppp auth required pam_dial_auth.so.1 ppp auth binding pam_unix_auth.so.1 server_policy ppp auth required pam_ldap.so.1 # # Default definitions for Authentication management # Used when service name is not explicitly mentioned for authentication # # other auth requisite pam_authtok_get.so.1 other auth required pam_dhkeys.so.1 other auth required pam_unix_cred.so.1 other auth binding pam_unix_auth.so.1 server_policy other auth required pam_ldap.so.1 # # passwd command (explicit because of a different authentication module) # passwd auth binding pam_passwd_auth.so.1 server_policy passwd auth required pam_ldap.so.1 # # cron service (explicit because of non-usage of pam_roles.so.1) # cron account required pam_unix_account.so.1 # # Default definition for Account management # Used when service name is not explicitly mentioned for account management # other account requisite pam_roles.so.1 other account binding pam_unix_account.so.1 server_policy other account required pam_list.so.1 allow=/etc/user.allow other account required pam_ldap.so.1 # # Default definition for Session management # Used when service name is not explicitly mentioned for session management # other session required pam_unix_session.so.1 # # Default definition for Password management # Used when service name is not explicitly mentioned for password management # other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 other password required pam_authtok_store.so.1 server_policy # # Support for Kerberos V5 authentication and example configurations can # be found in the pam_krb5(5) man page under the "EXAMPLES" section. # ppp auth required pam_unix_cred.so.1 ppp auth required pam_unix_auth.so.1 krlogin auth required pam_unix_cred.so.1 krlogin auth required pam_krb5.so.1 krsh auth required pam_unix_cred.so.1 krsh auth required pam_krb5.so.1 ktelnet auth required pam_unix_cred.so.1 ktelnet auth required pam_krb5.so.1 Here is my Solaris-based NSSWITCH file: /etc/nsswitch.conf # # Copyright 2006 Sun Microsystems, Inc. All rights reserved. # Use is subject to license terms. # # ident "@(#)nsswitch.ldap 1.10 06/05/03 SMI" # # /etc/nsswitch.ldap: # # An example file that could be copied over to /etc/nsswitch.conf; it # uses LDAP in conjunction with files. # # "hosts:" and "services:" in this file are used only if the # /etc/netconfig file has a "-" for nametoaddr_libs of "inet" transports. # LDAP service requires that svc:/network/ldap/client:default be enabled # and online. # the following two lines obviate the "+" entry in /etc/passwd and /etc/group. passwd: files ldap group: files ldap # consult /etc "files" only if ldap is down. hosts: files dns # Note that IPv4 addresses are searched for in all of the ipnodes databases # before searching the hosts databases. ipnodes: files dns networks: files protocols: files rpc: files ethers: files netmasks: files bootparams: files publickey: files netgroup: ldap automount: files ldap aliases: files ldap # for efficient getservbyname() avoid ldap services: files ldap printers: user files ldap auth_attr: files ldap prof_attr: files ldap project: files ldap tnrhtp: files ldap tnrhdb: files ldap owner(a)lists.fedoraproject.org.

2 1

Managing user quotas
by Mitja Mihelič 25 Nov '13

25 Nov '13

Hi! Is it possible to manage user quotas in 389DS? This would be the desired setup: 389DS - holds user information and is used at the primary authentication source Client - runs SSSD and all queries about the users get sent through SSSD to 389DS - manages user quota based on the information in 389DS Reagards, Mitja -- -- Mitja Mihelič ARNES, Tehnološki park 18, p.p. 7, SI-1001 Ljubljana, Slovenia tel: +386 1 479 8877, fax: +386 1 479 88 78

1 0

setup-ds-admin.pl --update and multiple masters
by Vesa Alho 25 Nov '13

25 Nov '13

Hi, I have the following setup: ldap1.example.com ldap2.example.com They are in Multiple Master configuration. After normal yum updates, I run setup-ds-admin.pl --update 1. What does this script actually do with --update parameter? Does it only update version numbers for Console? 2. How do I update version numbers for the second MM? ldap2 is configured to use ldap1 as configuration server. Also netscaperoot and userroot have replication agreements both ways. So, I assumed that running "setup-ds-admin.pl --update" to "ldaps://ldap1.example.com:636/o=NetscapeRoot" would update numbers to both MM servers. But it doesn't and if I try to use ldaps://ldap2.example.com:636/o=NetscapeRoot script gives "unknown error". Thanks! -Vesa

2 2

nsds5replicaLastInitStatus: -2 Total update abortedSystem error
by Graham Leggett 25 Nov '13

25 Nov '13

Hi all, I have two LDAP servers in a multimaster replication setup that has worked fine for a while. Recently it was reported to me that the two LDAP servers had somehow gone out of sync and refused to replicate. I am trying to fix this by triggering an initialisation from what I've chosen to be authoritative source of data to the other using the instructions here: http://www.centos.org/docs/5/html/CDS/ag/8.0/Managing_Replication-Configuri… When the replication is triggered, a few thousand lines appear on the remote side's log that look like this: [23/Nov/2013:15:00:07 +0000] conn=4402 op=0 BIND dn="cn=Replication Manager,cn=config" method=128 version=3 [23/Nov/2013:15:00:07 +0000] conn=4402 op=0 RESULT err=0 tag=97 nentries=0 etime=1 dn="cn=replication manager,cn=config" [23/Nov/2013:15:00:07 +0000] conn=4402 op=1 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [23/Nov/2013:15:00:07 +0000] conn=4402 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [23/Nov/2013:15:00:07 +0000] conn=4402 op=2 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [23/Nov/2013:15:00:07 +0000] conn=4402 op=2 RESULT err=0 tag=101 nentries=1 etime=0 [23/Nov/2013:15:00:07 +0000] conn=4402 op=3 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [23/Nov/2013:15:00:07 +0000] conn=4402 op=3 RESULT err=0 tag=120 nentries=0 etime=0 [23/Nov/2013:15:00:08 +0000] conn=4402 op=4 EXT oid="2.16.840.1.113730.3.5.6" name="Netscape Replication Total Update Entry" [23/Nov/2013:15:00:08 +0000] conn=4402 op=4 RESULT err=0 tag=120 nentries=0 etime=0 [23/Nov/2013:15:00:08 +0000] conn=4402 op=5 EXT oid="2.16.840.1.113730.3.5.6" name="Netscape Replication Total Update Entry" [23/Nov/2013:15:00:08 +0000] conn=4402 op=5 RESULT err=0 tag=120 nentries=0 etime=0 [snip a few thousand log entries all saying err=0] The side that I initialised the replication from lists this message as the status, which is too vague to be useful: nsds5replicaLastInitStatus: -2 Total update abortedSystem error Does anyone know what the error "-2" means? Does anyone have any clear and unambiguous instructions for re-initialising two LDAP servers that have gone out of sync? Regards, Graham --

2 1

Announcing 389 Directory Server versions 1.2.11.25, 1.3.0.9, 1.3.1.15, 1.3.2.5
by Rich Megginson 22 Nov '13

22 Nov '13

389 Directory Server versions 1.2.11.25, 1.3.0.9, 1.3.1.15, 1.3.2.5 The 389 Directory Server team is proud to announce new 389-ds-base versions: * 1.2.11.25 for EL5 and EL6 * 1.3.0.9 for F18 * 1.3.1.15 for F19 * 1.3.2.5 for F20 and Rawhide These packages address CVE-2013-4485 https://bugzilla.redhat.com/show_bug.cgi?id=1024552 in addition to several other fixes, depending on the platform. Since these packages address a security issue they will be expedited into Stable. We strongly encourage you to try out the packages from the Testing repo and plan accordingly. The source tarballs for these releases are available at http://port389.org/wiki/Source See http://port389.org/wiki/Release_Notes for detailed information about each release. * Installation and Upgrade See http://port389.org/wiki/Download for information about setting up your yum repositories. To install, use yum install 389-ds. After install completes, run setup-ds-admin.pl to set up your directory server. To upgrade, use yum upgrade. After upgrade completes, run setup-ds-admin.pl -u to update your directory server/admin server/console information. See http://port389.org/wiki/Install_Guide<http://port389.org/wiki/Install_Guide> for more information about the initial installation, setup, and upgrade * Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users(a)lists.fedoraproject.org mailing list: https://admin.fedoraproject.org/mailman/listinfo/389-users If you find a bug, or would like to see a new feature, file it in our Trac instance: https://fedorahosted.org/389

1 0

389 directory server crash
by Mitja Mihelič 21 Nov '13

21 Nov '13

Hi! We are having problems with some our 389-DS instances. They crash after receiving an update from the provider. The crash happened twice after about a week of running without problems. The crashes happened on two consumer servers but not at the same time. The servers are running CentOS 6x with the following 389DS packages installed: 389-ds-console-doc-1.2.6-1.el6.noarch 389-console-1.1.7-1.el6.noarch 389-adminutil-1.1.15-1.el6.x86_64 389-dsgw-1.1.10-1.el6.x86_64 389-ds-base-debuginfo-1.2.11.15-14.el6_4.x86_64 389-admin-1.1.29-1.el6.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-admin-console-doc-1.1.8-1.el6.noarch 389-ds-1.2.2-1.el6.noarch 389-ds-base-1.2.11.15-14.el6_4.x86_64 389-ds-base-libs-1.2.11.15-14.el6_4.x86_64 389-admin-console-1.1.8-1.el6.noarch We are in the process of replacing the Centos 5x base consumer+provider setup with a CentOS 6x base one. For the time being, the CentOS 6 machines are acting as consumers for the old server. They run for a while and then the replicated instances crash though not at the same time. One of the servers did not want to start after the crash, so I have run db2index on its database. It's been running for four days and it has still not finished. All I get from db2index now are these outputs: [09/Jul/2013:13:29:11 +0200] - reindex db: Processed 65095 entries (pass 1104) -- average rate 53686277.5/sec, recent rate 0.0/sec, hit ratio 0% The other instance did start up, but the replication process did not work anymore. I disabled the replication to this host and set it up again. I chose "Initialize consumer now" and the consumer crashed every time. I have enabled full error logging and could find nothing. I have read a few threads (not all, I admit) on this list and http://directory.fedoraproject.org/wiki/FAQ#Debugging_Crashes and tried to troubleshoot. The crash produced the attached core dump and I could use your help with understanding it. As well as any help with the crash. If more info is needed I will gladly provide it. Regards, Mitja

2 17

setup-ds-admin.pl errors
by Alberto Viana 21 Nov '13

21 Nov '13

I'm trying to set up a new instance of 389 DS in my homologation enviroment: 389-ds-base-1.3.2.4 389-adminutil-1.1.18 389-admin-console-1.1.8 After I ran setup-ds-admin.pl, i'm getting the following errors: Are you ready to set up your servers? [yes]: Creating directory server . . . Could not import LDIF file '/tmp/ldif9lEZLw.ldif'. Error: 256. Output: ./ldif2db: 3: ./ldif2db: source: not found ./ldif2db: 5: ./ldif2db: libpath_add: not found ./ldif2db: 6: ./ldif2db: libpath_add: not found ./ldif2db: 7: ./ldif2db: libpath_add: not found ./ldif2db: 8: ./ldif2db: libpath_add: not found ./ldif2db: 84: ./ldif2db: get_init_file: not found ./ldif2db: 85: [: 127: unexpected operator importing data ... usage: ns-slapd ldif2db -D configdir [-d debuglevel] [-n backend_instance_name] [-O] [-g uniqueid_type] [--namespaceid uniqueID][{-s includesuffix}*] [{-x excludesuffix}*] [-E] [-q] {-i ldif-file}* Note: either "-n backend_instance_name" or "-s includesuffix" is required. Error: Could not create directory server instance 'RNP'. Exiting . . . Log file is '/tmp/setupBsGuLZ.log' I also tried "389-ds-base-1.3.1.12". Any clues?

2 1

Recommended Berkeley DB for compiling 389 DS 1.3.2.3 version
by Balaji P 21 Nov '13

21 Nov '13

Hi All, I downloaded 389 directory server source code 1.3.2.3 from link (http://port389.org/sources/389-ds-base-1.3.2.3.tar.bz2) and try to compile in my CentOS release 4.9 (Final) environment. I noticed below error message and suspect with referring invalid Berkeley DB version. I am currently using Berkeley DB version is db4-4.2.52-7.3.el4 and the link recommended the same. http://directory.fedoraproject.org/wiki/Building#Berkeley_DB Anyone have idea about what is recommended release version of Berkely DB? Is any other dependencies require to compile the 389 DS 1.3.2.3 release version? Note: I have able to compile 389 DS 1.2.8.2 release version using this build environment. [root@ ~]# rpm -qa | grep db4 db4-4.2.52-7.3.el4 db4-4.2.52-7.3.el4 [root@ ~]# Error message: In function `checkpoint_threadmain': ../ldap/servers/slapd/back-ldbm/dblayer.c:4789: error: `DB_COMPACT' undeclared (first use in this function) ../ldap/servers/slapd/back-ldbm/dblayer.c:4789: error: (Each undeclared identifier is reported only once ../ldap/servers/slapd/back-ldbm/dblayer.c:4789: error: for each function it appears in.) ../ldap/servers/slapd/back-ldbm/dblayer.c:4789: error: syntax error before "c_data" ../ldap/servers/slapd/back-ldbm/dblayer.c:4791: error: `inst_obj' undeclared (first use in this function) ../ldap/servers/slapd/back-ldbm/dblayer.c:4794: error: `inst' undeclared (first use in this function) ../ldap/servers/slapd/back-ldbm/dblayer.c:4795: error: `rc' undeclared (first use in this function) ../ldap/servers/slapd/back-ldbm/dblayer.c:4795: error: `db' undeclared (first use in this function) ../ldap/servers/slapd/back-ldbm/dblayer.c:4809: error: `c_data' undeclared (first use in this function) ../ldap/servers/slapd/back-ldbm/dblayer.c:4809: error: `DB_FREE_SPACE' undeclared (first use in this function) ../ldap/servers/slapd/back-ldbm/dblayer.c:4691: error: label `error_return' used but not defined ../ldap/servers/slapd/back-ldbm/dblayer.c: At top level: ../ldap/servers/slapd/back-ldbm/dblayer.c:4857: error: syntax error before '{' token ../ldap/servers/slapd/back-ldbm/dblayer.c:4858: error: `li' undeclared here (not in a function) ../ldap/servers/slapd/back-ldbm/dblayer.c:4858: error: initializer element is not constant ../ldap/servers/slapd/back-ldbm/dblayer.c:4858: warning: data definition has no type or storage class ../ldap/servers/slapd/back-ldbm/dblayer.c:4859: error: syntax error before ':' token ../ldap/servers/slapd/back-ldbm/dblayer.c:4861: error: syntax error before '->' token ../ldap/servers/slapd/back-ldbm/dblayer.c:4861: warning: data definition has no type or storage class With Regards, Balaji P

2 1

Current state, groups of groups
by Deas, Jim 20 Nov '13

20 Nov '13

I am running a very old version of 389. I need to upgrade or switch to Mac OSX. The one positive aspect of Mac is the ability to create groups from sub groups. Do the newer versions of 389 have a way to add sub groups to other groups? Jim Deas PPS Engineering | Warner Bros. Post Production Sound 4000 Warner Blvd | Bld 150 Rm. 256 | Burbank Ca. 91522 Office (818)954-6570 | Cell (818)967-8354: | Skype jim.deas2 jim.deas(a)warnerbros.com

2 1

389-ds-base-1.2.10.14-3.2.el5: replication latency >= 300s, 400s, 900s..
by Justin Piszcz 20 Nov '13

20 Nov '13

Hi, Problem: During high levels of writes to the master server, _some_ LDAP search hosts replication_latency rises (and in some cases, does not recover) unless its removed from service or slapd is restarted. Version: 389-ds-base-1.2.10.14-3.2.el5 (x86_64) During normal operation, typical replication latency is <= 60 seconds in our environment. Questions: 1. Does slapd's BDB backend DB's suffer fragmentation over time? Will periodic restarts of the slapd improve performance? 2. There are search hosts running on a variety of hardware and it happens more or less across the board. We've tried specific tweaks on the hosts with the IO scheduler and other system tuning but this problem appears(?) to be at the application-level. Is there any system tuning that I am missing here or slapd tuning to avoid this problem? 3. Further, is there or are there plans to support network-level compression on the replication data from the master->hubs->search hosts? 4. Aside from removing the host from active service and/or restarting slapd and removing it from service, what are the recommended best practices to avoid this problem happening in the first place? Currently we are looking into automation to remove the hosts from service automatically when latency breaches a certain threshold-- but why does this occur and is there anyway to tweak/tune or limit search performance until the replication latency recovers? Example: Problem begins: replication_latency_sec=424 [ .. after a few min .. ] replication_latency_sec=549 replication_latency_sec=553 replication_latency_sec=555 replication_latency_sec=561 replication_latency_sec=564 [ .. after 10 min or so .. ] replication_latency_sec=780 replication_latency_sec=763 replication_latency_sec=768 replication_latency_sec=774 replication_latency_sec=779 replication_latency_sec=785 replication_latency_sec=791 replication_latency_sec=796 replication_latency_sec=802 replication_latency_sec=807 replication_latency_sec=813 replication_latency_sec=818 replication_latency_sec=824 Justin.

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2013