389-users March 2014

389-users@lists.fedoraproject.org

38 participants
42 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

multi-valued nsAccountLock
by Pierre ROUDIER 10 Jul '15

10 Jul '15

Hi all, RedHat DS's doc states that the nsAccountLock attribute is multi-valued [1]. Some tests with 389ds led me to think it's also true for 389ds. I cannot think of any reason explaining why it would have to be multi-valued. Do you have any idea? Thank you. [1] https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server…

3 2

changelog
by Denise Cosso 16 Apr '15

16 Apr '15

Hi, How to modify the attribute nsslapd-encryptionalgorithm in Centos? Thanks, Denise Stop Master servers and set nsslapd-encryptionalgorithm. The allowed value is AES or 3DES. dn: cn=changelog5,cn=config [...] nsslapd-encryptionalgorithm: AES --- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu: De: Rich Megginson <rmeggins(a)redhat.com> Assunto: Re: [389-users] changelog Para: "Denise Cosso" <guanaes51(a)yahoo.com.br> Data: Terça-feira, 4 de Junho de 2013, 16:34 On 06/04/2013 01:26 PM, Denise Cosso wrote: Hi, Rich CentOS release 6.3 (Final) 389-ds-base-libs-1.2.10.2-20.el6_3.x86_64 389-ds-1.2.2-1.el6.noarch 389-dsgw-1.1.10-1.el6.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-ds-console-doc-1.2.6-1.el6.noarch 389-ds-base-1.2.10.2-20.el6_3.x86_64 As far as replication goes - you will need to use a security layer (SSL, TLS, or GSSAPI) to protect the clear text password on the wire As far as encrypting it in the changelog - not sure Denise --- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu: De: Rich Megginson <rmeggins(a)redhat.com> Assunto: Re: [389-users] changelog Para: "General discussion list for the 389 Directory server project." <389-users(a)lists.fedoraproject.org> Cc: "Denise Cosso" <guanaes51(a)yahoo.com.br> Data: Terça-feira, 4 de Junho de 2013, 16:11 On 06/04/2013 12:39 PM, Denise Cosso wrote: Hi, Description of problem: When a userPassword is changed in a server with changelog, the hashed password is logged and also a cleartext pseudo-attribute version. It looks like this: change:: replace: userPassword userPassword: {SHA256}vqtiN2LHdrEUOJUKu+IBVqAVFsAlvFw+11kD/Q== - replace: unhashed#user#password unhashed#user#password: secret12 This unhashed version is used in winsync where the cleartext version of the password must be written to the AD. Now if the DS is involved in replication with another DS, the change will be replayed exactly as it is logged to the other DS replicas, including the cleartext pseudo-attribute password. What platform? What version of 389-ds-base are you using? thanks, Denise -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

2 2

389 Master - Master Replication
by Santos Ramirez 03 Oct '14

03 Oct '14

Good Morning, We have a master - master replication agreement. When we initialize the replication it works perfectly we can see changes to a test user we have set up go up and down from the two servers. However at some point the replication stops and we cannot get replication to start once again. The only way we can get replication to start once again is to recreate the replication agreement and then it fails again. Can anyone please point us in a direction. I am relatively new to 389 so any help would be greatly appreciated. Santos U. Ramirez Linux Systems Administrator National DCP, LLC 150 Depot Street Bellingham, Ma. 02019 Phone: 508-422-3089 Fax: 508-422-3866 Santos.Ramirez(a)natdcp.com<mailto:Santos.Ramirez@natdcp.com> This email and any attachments are intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, do not copy or forward to any unauthorized persons, permanently delete the original and notify the sender by replying to this email.

3 9

Netscape Portable Runtime error -5982
by Paolo Barbato 04 Apr '14

04 Apr '14

After a while I start again to work on 389 ds. 389ds last released from epel, is installed on a rhel 6.5, that host also other services (bind, dhcpd, radius.....). Such server is configured with some virtual nic. I noticed starting 389ds the following error: intranet5...[14/Feb/2014:08:30:20 +0100] createprlistensockets - PR_Bind() on All Interfaces port 636 failed: Netscape Portable Runtime error -5982 (Local Network address is in use.) I've tried to insert in dse.ldif directives like nsslapd-listenhost: 192.168.60.23 nsslapd-securelistenhost: 192.168.60.23 but it comes a more "IP specific" error : intranet5...[14/Feb/2014:10:01:34 +0100] createprlistensockets - PR_Bind() on 192.168.60.23 port 636 failed: Netscape Portable Runtime error -5982 (Local Network address is in use.) finally I noticed: [root@intranet5 dirsrv]# netstat -anp | grep 636 udp 0 0 0.0.0.0:636 0.0.0.0:* 1342/portreserve such service clearly conflict with 389ds ldaps It seems I'm facing bug https://bugzilla.redhat.com/show_bug.cgi?id=848414 since I really have tested also openldap [root@intranet5 dirsrv]# more /etc/portreserve/slapd ldaps from portreserve man I read For each service configuration file, a socket is created and bound to the appropriate port. A service wishing to bind to its port must first run portrelease, which instructs portreserve to release the port associated with the service. It seems so that 389ds be not aware of portreserve . Shoud I simply remove /etc/portreserve/slapd and restart portreserve ? Regards, Paolo. ------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------

1 2

Windows sync agreement - Received result code 34
by Vesa Alho 03 Apr '14

03 Apr '14

Hi, I'm trying to get Windows AD sync working. When trying to start full re-syncronization, I get the errors listed below. I've tried to verify all settings, but haven't figured out what could cause this. It seems to use value (null) with DN, but why? Other information: 389 => 1.2.11.25 (dc=example,dc=com) AD => Windows 2012 R2 (dc=example,dc=login) ==> notice, domain names are different! Windows sync agreement details Windows domain: example.login DS subtree: ou=People,dc=example,dc=com Windows subtree: cn=People,dc=example,dc=login Replicated subtree: dc=example,dc=com My goal is to sync 389 users to one OU/CN under AD and groups to different OU/CN. I'm not sure if this even possible, but was hoping to achieve this by creating separate sync agreements for users and groups. PS. thanks for excellent software and support! -Vesa [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): map_entry_dn_inbound: problem looking for username: -1 [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): windows_process_total_entry: Looking dn="uid=user1,ou=People,dc=example,dc=com" (ours) [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): map_entry_dn_outbound: looking for AD entry for DS dn="uid=user1,ou=People,dc=example,dc=com" guid="c647c882ee76ab4aac2239ef81ebebb7" [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): map_entry_dn_outbound: looking for AD entry for DS dn="uid=user1,ou=People,dc=example,dc=com" username="user1" [12/Mar/2014:10:23:56 +0200] - Calling windows entry search request plugin [12/Mar/2014:10:23:56 +0200] - windows_search_entry: received 1 messages, 0 entries, 0 references [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): map_entry_dn_outbound: entry not found - rc 0 [12/Mar/2014:10:23:56 +0200] - Windows sync entry: Created new remote entry: dn:: Y249VHVvbWFzIFN5cmrDpG5lbiwobnVsbCk= objectClass: top objectClass: person objectClass: organizationalperson objectClass: user userprincipalname: user1(a)example.login cn:: VHVvbWFzIFN5cmrDpG5lbg== givenName: First mail: First.Last(a)example.com sAMAccountName: user1 accountExpires: 9223372036854775807 sn:: U3lyasOkbmVu telephoneNumber: codePage: 0 [12/Mar/2014:10:23:56 +0200] - Attempting to add entry cn=First Last,(null) to AD for local entry uid=user1,ou=People,dc=example,dc=com [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): Received result code 34 (0000208F: NameErr: DSID-03100225, problem 2006 (BAD_NAME), data 8350, best match of: '(null)' ) for add operation [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): windows_replay_update: Cannot replay add operation. [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): Beginning linger on the connection [12/Mar/2014:10:23:56 +0200] NSMMReplicationPlugin - agmt="cn=adsync" (hki-dc01:636): windows_tot_run: failed to obtain data to send to the consumer; LDAP error - 1

2 6

Serious write-performance problems on RHEL6
by Steve Holden 01 Apr '14

01 Apr '14

Hi, folks I'm hoping to use 389 DS to replace our ancient Sun DS 5.2 service. I've hit a snag with my 389 development server; it's performance far worse than the 10 year-old servers it's intended to replace. Things looked promising: the old directory data has been imported (with only minor changes), read requests perform reasonably well, and isolated write requests are ok. However, even after a small number (typically 6) of consecutive write requests (basic attribute changes to a single entry, say) the ns-slapd process hits >100% CPU (of 2 CPUs) and stays there for *at least* 10 seconds per update, and blocks the client process attempting the update. I can't see anything obvious in the performance counters or the logs to suggest a problem. The updates are logged with "etime=0" in the access log. I've tried enabling different log levels in the error log. Is it normal for the Plugin level to show constant re-scanning of CoS templates? I'd be very grateful for any suggestions of how I can go about tracing where the Problem might be and how to resolve it... Best wishes, Steve Details The RHEL6.5 server is a VMware ESXi VM with 8GB RAM and 2x CPUs, and is running the latest EPEL package for RHEL6 (v1.2.11.15-32). (After a package upgrade a few weeks ago, I ran "setup-ds-admin.pl -u"). The directory contains in excess of 200,000 entries, and its databases consume over 3.5GB on disk. The userRoot database has therefore been configured with a 4GB cache (and the general LDBM max cache is set at 6GB - though it's quite possible I haven't understood how to set these correctly - I've tried smaller numbers of each). The directory contains custom attributes, some of which are CoS, and many of which have been indexed (AFAIK, all attributes have been re-indexed). No replication has been configured so far. ___________________________________________________________ This email has been scanned by MessageLabs' Email Security System on behalf of the University of Brighton. For more information see http://www.brighton.ac.uk/is/spam/ ___________________________________________________________

3 7

Operations Error on object
by Michael Gettes 27 Mar '14

27 Mar '14

389-Directory/1.2.11.15 B2013.238.2155 starting up Linux 2.6.32-431.5.1.el6.x86_64 #1 SMP Fri Jan 10 14:46:43 EST 2014 x86_64 x86_64 x86_64 GNU/Linux I have an object which I am unable to operate on. I try to modify it or delete it and I get err=1 (Operations Error). it looks like: [25/Mar/2014:13:13:00 -0400] conn=348 op=3 DEL dn="nsuniqueid=cf397a8e-b11f11e3-9e1cd834-1f7e47a1,CN=Community:ByOU:XXXX,ou=Groups,dc=XXX,dc=XXX" [25/Mar/2014:13:13:00 -0400] conn=348 op=3 RESULT err=1 tag=107 nentries=0 etime=0 csn=5331b91e000000010000 Normally, the object is CN=Community:ByOU:XXXX,ou=Groups,dc=XXX,dc=XXX but when I search for CN=Community:ByOU:XXXX,ou=Groups,dc=XXX,dc=XXX I get back the nsuniqueid as part of the DN (shown above). I have dumped the LDIF and the nsuniqueid is NOT in the LDIF with this object. I have restarted the server to no avail. I have looked in bugzilla and can’t seem to find anything that looks like this problem. I am confused and seeking advice. I am somewhat worried I have objects I cannot modify or delete. I have 2 of these now and I am not sure how they are getting into this state. Any guidance is gratefully appreciated! /mrg

1 2

LAN vs WAN
by Amjad Farooq 27 Mar '14

27 Mar '14

Hi everyone, I have TWO linux machines in my office. One is on LAN (only locally-accessible) and the other on WAN (WWW-accessible). On the WAN, I have an apache server running but I also mounted a hard drive from the LAN machine using NFS so that I can easily access and transfer data files between the two machines. My question is: Is the hard drive from the LAN machine mounted on the WAN computer accessible from outside LAN? In other words, if an hacker breaks into my server on the WAN machine, will (s)he be able to access data on my NFS-mounted hard drive from the LAN machine? I would assume that since IP assigned to my LAN machine is only accessible locally, access from outside LAN to this hard drive will not be available. What do you think? Thank you for your suggestions. Amjad

3 2

Problem when trying to perform dereference searches
by Jonathan Vaughn 27 Mar '14

27 Mar '14

We've had problems with SSSD being slow sometimes, but not others, and there never seemed to be any obvious cause why, but I think I've tracked it down to problems with dereferencing. We do see errors about dereferencing in the log, but I didn't realize until now what it was referring to. In theory, a search like this should give us the cn and objectclass of all members of the group, but I get only the attributes of the group itself. Whether I give the "-E 'deref=...'" or not I get the same output. Redacted output below: ldapsearch [bind username and password stuff, etc] -E 'deref=uniqueMember:cn,objectclass' 'cn=Global System Administrators' # extended LDIF # # LDAPv3 # base <[our base DN]> (default) with scope subtree # filter: cn=Global System Administrators # requesting: ALL # with dereference control # # Global System Administrators, Groups, [our base DN] dn: cn=Global System Administrators,ou=Groups,[our base DN] control: 1.3.6.1.4.1.4203.666.5.16 false MIQAAAAA uniqueMember: uid=user1,ou=Users,ou=[Office1],[our base DN] uniqueMember: uid=user2,ou=Users,ou=[Office2],[our base DN] uniqueMember: uid=user3,ou=Users,ou=[Office2],[our base DN] uniqueMember: uid=user4,ou=Users,ou=[Office1],[our base DN] objectClass: top objectClass: groupofuniquenames objectClass: posixgroup cn: Global System Administrators gidNumber: 1001002 description: Global System Administrators # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users March 2014