389-users September 2013

389-users@lists.fedoraproject.org

23 participants
27 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

multi-valued nsAccountLock
by Pierre ROUDIER 10 Jul '15

10 Jul '15

Hi all, RedHat DS's doc states that the nsAccountLock attribute is multi-valued [1]. Some tests with 389ds led me to think it's also true for 389ds. I cannot think of any reason explaining why it would have to be multi-valued. Do you have any idea? Thank you. [1] https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server…

3 2

changelog
by Denise Cosso 16 Apr '15

16 Apr '15

Hi, How to modify the attribute nsslapd-encryptionalgorithm in Centos? Thanks, Denise Stop Master servers and set nsslapd-encryptionalgorithm. The allowed value is AES or 3DES. dn: cn=changelog5,cn=config [...] nsslapd-encryptionalgorithm: AES --- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu: De: Rich Megginson <rmeggins(a)redhat.com> Assunto: Re: [389-users] changelog Para: "Denise Cosso" <guanaes51(a)yahoo.com.br> Data: Terça-feira, 4 de Junho de 2013, 16:34 On 06/04/2013 01:26 PM, Denise Cosso wrote: Hi, Rich CentOS release 6.3 (Final) 389-ds-base-libs-1.2.10.2-20.el6_3.x86_64 389-ds-1.2.2-1.el6.noarch 389-dsgw-1.1.10-1.el6.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-ds-console-doc-1.2.6-1.el6.noarch 389-ds-base-1.2.10.2-20.el6_3.x86_64 As far as replication goes - you will need to use a security layer (SSL, TLS, or GSSAPI) to protect the clear text password on the wire As far as encrypting it in the changelog - not sure Denise --- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu: De: Rich Megginson <rmeggins(a)redhat.com> Assunto: Re: [389-users] changelog Para: "General discussion list for the 389 Directory server project." <389-users(a)lists.fedoraproject.org> Cc: "Denise Cosso" <guanaes51(a)yahoo.com.br> Data: Terça-feira, 4 de Junho de 2013, 16:11 On 06/04/2013 12:39 PM, Denise Cosso wrote: Hi, Description of problem: When a userPassword is changed in a server with changelog, the hashed password is logged and also a cleartext pseudo-attribute version. It looks like this: change:: replace: userPassword userPassword: {SHA256}vqtiN2LHdrEUOJUKu+IBVqAVFsAlvFw+11kD/Q== - replace: unhashed#user#password unhashed#user#password: secret12 This unhashed version is used in winsync where the cleartext version of the password must be written to the AD. Now if the DS is involved in replication with another DS, the change will be replayed exactly as it is logged to the other DS replicas, including the cleartext pseudo-attribute password. What platform? What version of 389-ds-base are you using? thanks, Denise -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

2 2

389 Master - Master Replication
by Santos Ramirez 03 Oct '14

03 Oct '14

Good Morning, We have a master - master replication agreement. When we initialize the replication it works perfectly we can see changes to a test user we have set up go up and down from the two servers. However at some point the replication stops and we cannot get replication to start once again. The only way we can get replication to start once again is to recreate the replication agreement and then it fails again. Can anyone please point us in a direction. I am relatively new to 389 so any help would be greatly appreciated. Santos U. Ramirez Linux Systems Administrator National DCP, LLC 150 Depot Street Bellingham, Ma. 02019 Phone: 508-422-3089 Fax: 508-422-3866 Santos.Ramirez(a)natdcp.com<mailto:Santos.Ramirez@natdcp.com> This email and any attachments are intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, do not copy or forward to any unauthorized persons, permanently delete the original and notify the sender by replying to this email.

3 9

389 directory server crash
by Mitja Mihelič 21 Nov '13

21 Nov '13

Hi! We are having problems with some our 389-DS instances. They crash after receiving an update from the provider. The crash happened twice after about a week of running without problems. The crashes happened on two consumer servers but not at the same time. The servers are running CentOS 6x with the following 389DS packages installed: 389-ds-console-doc-1.2.6-1.el6.noarch 389-console-1.1.7-1.el6.noarch 389-adminutil-1.1.15-1.el6.x86_64 389-dsgw-1.1.10-1.el6.x86_64 389-ds-base-debuginfo-1.2.11.15-14.el6_4.x86_64 389-admin-1.1.29-1.el6.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-admin-console-doc-1.1.8-1.el6.noarch 389-ds-1.2.2-1.el6.noarch 389-ds-base-1.2.11.15-14.el6_4.x86_64 389-ds-base-libs-1.2.11.15-14.el6_4.x86_64 389-admin-console-1.1.8-1.el6.noarch We are in the process of replacing the Centos 5x base consumer+provider setup with a CentOS 6x base one. For the time being, the CentOS 6 machines are acting as consumers for the old server. They run for a while and then the replicated instances crash though not at the same time. One of the servers did not want to start after the crash, so I have run db2index on its database. It's been running for four days and it has still not finished. All I get from db2index now are these outputs: [09/Jul/2013:13:29:11 +0200] - reindex db: Processed 65095 entries (pass 1104) -- average rate 53686277.5/sec, recent rate 0.0/sec, hit ratio 0% The other instance did start up, but the replication process did not work anymore. I disabled the replication to this host and set it up again. I chose "Initialize consumer now" and the consumer crashed every time. I have enabled full error logging and could find nothing. I have read a few threads (not all, I admit) on this list and http://directory.fedoraproject.org/wiki/FAQ#Debugging_Crashes and tried to troubleshoot. The crash produced the attached core dump and I could use your help with understanding it. As well as any help with the crash. If more info is needed I will gladly provide it. Regards, Mitja

2 17

389 and snmp
by Michael Gettes 02 Oct '13

02 Oct '13

I have the ldap-agent working. All I see is snmpwalk -v 1 -c public localhost .1.3.6.1.4.1.2312 SNMPv2-SMI::enterprises.2312.6.5.1.1.389 = STRING: "389 Replica" SNMPv2-SMI::enterprises.2312.6.5.1.2.389 = STRING: "389-Directory/1.2.11.15" SNMPv2-SMI::enterprises.2312.6.5.1.3.389 = STRING: "Computing Services, Carnegie Mellon University" SNMPv2-SMI::enterprises.2312.6.5.1.4.389 = STRING: "Pittsburgh, PA" SNMPv2-SMI::enterprises.2312.6.5.1.5.389 = STRING: "YYY(a)lists.andrew.cmu.edu" SNMPv2-SMI::enterprises.2312.6.5.1.6.389 = STRING: "XXX" I get the impression I should be seeing a lot more. I followed instructions at: http://port389.org/wiki/Howto:SNMPMonitoring uname -a Linux XXX 2.6.32-358.18.1.el6.x86_64 #1 SMP Fri Aug 2 17:04:38 EDT 2013 x86_64 x86_64 x86_64 GNU/Linux Guidance appreciated. Thank you! /mrg

2 2

389 won't start - help please?
by Michael Gettes 30 Sep '13

30 Sep '13

We try to start the service and it dies very quickly. See trace below. This is one of our 2 masters running in MMR. Both masters feed the same 3 replicas. we even rebooted the system to no effect. suggestions appreciated. we've been running on this version of 389 and OS for about 3 weeks now. uname -a Linux ldap-master-01.andrew.cmu.edu 2.6.32-358.18.1.el6.x86_64 #1 SMP Fri Aug 2 17:04:38 EDT 2013 x86_64 x86_64 x86_64 GNU/Linux 389-Directory/1.2.11.15 B2013.238.2155 starting up yum list | grep 389 389-admin.x86_64 1.1.29-1.el6 @epel-x86_64-server-6 389-admin-console.noarch 1.1.8-1.el6 @epel-x86_64-server-6 389-admin-console-doc.noarch 1.1.8-1.el6 @epel-x86_64-server-6 389-adminutil.x86_64 1.1.15-1.el6 installed 389-console.noarch 1.1.7-3.el5 installed 389-ds.noarch 1.2.2-1.el6 @epel-x86_64-server-6 389-ds-base.x86_64 1.2.11.15-22.el6_4 @rhel-x86_64-server-6 389-ds-base-libs.x86_64 1.2.11.15-22.el6_4 @rhel-x86_64-server-6 389-ds-console.noarch 1.2.6-1.el6 @epel-x86_64-server-6 389-ds-console-doc.noarch 1.2.6-1.el6 @epel-x86_64-server-6 389-dsgw.x86_64 1.1.10-1.el6 @epel-x86_64-server-6 389-admin.i686 1.1.29-1.el6 epel-x86_64-server-6 389-adminutil.i686 1.1.15-1.el6 epel-x86_64-server-6 389-adminutil-devel.i686 1.1.15-1.el6 epel-x86_64-server-6 389-adminutil-devel.x86_64 1.1.15-1.el6 epel-x86_64-server-6 389-ds-base-debuginfo.x86_64 1.2.10.26-1.el6_3 389_rhel6_x86_64 389-ds-base-devel.i686 1.2.11.15-22.el6_4 rhel-x86_64-server-optional-6 389-ds-base-devel.x86_64 1.2.11.15-22.el6_4 rhel-x86_64-server-optional-6 389-ds-base-libs.i686 1.2.11.15-22.el6_4 rhel-x86_64-server-6 open("/var/run/dirsrv/slapd-cmu.pid", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 58 fstat(58, {st_mode=S_IFREG|0664, st_size=0, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa004a0d000 write(58, "31972\n", 6) = 6 close(58) = 0 munmap(0x7fa004a0d000, 4096) = 0 chmod("/var/run/dirsrv/slapd-cmu.pid", 0644) = 0 poll([{fd=56, events=POLLIN}, {fd=6, events=POLLIN}, {fd=7, events=POLLIN}, {fd=-1}], 4, 250 <unfinished ...> +++ killed by SIGSEGV +++

3 5

logconv.pl backward compatibility?
by Michael Gettes 25 Sep '13

25 Sep '13

Hi, I am currently on 389-ds-base 1.2.11.15-22.el6_4 and I am running logconv.pl on 5.5M line log file. At the end it hangs up - in a loop forever and doesn't finish generating the report. What I am wondering is if I installed 1.3 latest on another system and got the log file over there, will it be able to process the "older" style log file? I know I can try this but I am wondering if anyone has insight into this sort of thing. thanks! /mrg

2 5

Allow admin to change password w/ password in history
by Jared 24 Sep '13

24 Sep '13

We have passwordHistory enabled on our directory. When a user tries to change his own password to a value already in his personal password history, it prevents him from (re)setting that same password, which is desired. However, I'm working on a password synchronization service that will always need to be able to set the users password to a newly specified value, even if that value is already in the history. If this service is binding with an admin-level account, then I'd expect it to be able to do so, but instead it's also prevented from setting the password if it's already in the history. Even if I bind with 'cn=directory manager' (which I would think should be able to do anything it wants), I cannot set the password of it already exists in the history. Is there any particular trick to making this work? I'm hoping there's an ACI I set set for this, or (probably less likely) an option somewhere that I need to toggle. Or is this just a bug I'm encountering? Other directory products I'm familiar with (including Active Directory, for example) do allow administrators to override password history if needed when resetting passwords, so I'd expect that to be the case here as well. Thanks. Any suggestions would be most appreciated. -- Jared

2 1

upgrade 389ds from 1.2.10.12 to 1.3.1.8
by Alberto Viana 20 Sep '13

20 Sep '13

I'm trying to upgrade my 389DS version from 1.2.10.12 to 1.3.1.8. Notice that the new 389DS(1.3.1.8) is a fresh instalation, so I copied my backup files (backup using db2back.pl) from the old server to the new one and tried to restore the base: /opt/dirsrv/sbin/bak2db.pl -D "cn=Directory Manager" -w - -a RNP-2013_9_20_12_0_1/ I got these errors: [20/Sep/2013:14:58:24 -0300] - Beginning restore to 'ldbm database' [20/Sep/2013:14:58:24 -0300] - Bringing userRoot offline... [20/Sep/2013:14:58:24 -0300] - Bringing NetscapeRoot offline... [20/Sep/2013:14:58:24 -0300] - Waiting for 4 database threads to stop [20/Sep/2013:14:58:25 -0300] - All database threads now stopped [20/Sep/2013:14:58:25 -0300] - Deleting log file: (/opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/log.0000000001) [20/Sep/2013:14:58:25 -0300] - Restoring file 1 (/opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/userRoot/DBVERSION) [20/Sep/2013:14:58:25 -0300] - Restoring file 2 (/opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/log.0000000412) [20/Sep/2013:14:58:26 -0300] - Restoring file 3 (/opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/NetscapeRoot/DBVERSION) [20/Sep/2013:14:58:26 -0300] - Restoring file 4 (/opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/DBVERSION) [20/Sep/2013:14:58:26 -0300] - Clean up db environment and start from archive. [20/Sep/2013:14:58:26 -0300] - rename returned 2 (No such file or directory) [20/Sep/2013:14:58:26 -0300] - update_db_ext: index (userRoot) Failed to update index /opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/userRoot/id2entry.db4 -> /opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/userRoot/id2entry.db [20/Sep/2013:14:58:26 -0300] - rename returned 2 (No such file or directory) [20/Sep/2013:14:58:26 -0300] - update_db_ext: index (userRoot) Failed to update index /opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/userRoot/id2entry.db -> /opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/userRoot/id2entry.db4 [20/Sep/2013:14:58:26 -0300] - Upgrading instance userRoot failed [20/Sep/2013:14:58:26 -0300] - archive2db: Unable to restart 'userRoot' [20/Sep/2013:14:58:26 -0300] - rename returned 2 (No such file or directory) [20/Sep/2013:14:58:26 -0300] - update_db_ext: index (NetscapeRoot) Failed to update index /opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/NetscapeRoot/id2entry.db4 -> /opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/NetscapeRoot/id2entry.db [20/Sep/2013:14:58:26 -0300] - rename returned 2 (No such file or directory) [20/Sep/2013:14:58:26 -0300] - update_db_ext: index (NetscapeRoot) Failed to update index /opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/NetscapeRoot/id2entry.db -> /opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/NetscapeRoot/id2entry.db4 [20/Sep/2013:14:58:26 -0300] - Upgrading instance NetscapeRoot failed [20/Sep/2013:14:58:26 -0300] - archive2db: Unable to restart 'NetscapeRoot' [20/Sep/2013:14:58:26 -0300] - Restore finished. Someone can point me what I'm doing wrong? Thanks Alberto Viana

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users September 2013