389-users August 2014

389-users@lists.fedoraproject.org

24 participants
35 discussions

secure replication failing
by Elizabeth Jones 26 Aug '14

26 Aug '14

I have multimaster replication set up on 4 LDAP servers but can't get secure replication working on one of the servers. The setup is like this -- data center 1 data center 2 ldap1 <-------> ldap1 ^ | ^ | / | | | | v | v ldap2 ldap2 each server has its own self-signed cert. I can successfully replicate in all the directions indicated except for replication from data center1 ldap2 to data center1 ldap1. I know that I have the right certificate on ldap2. I can ldapsearch -ZZ from ldap2 to ldap1 successfully using this certificate. I can successfully replicate from data center 2 ldap1 to data center1 ldap1 using this certificate. But replication refuses to work from DC1 ldap2 to DC1 ldap1!!!! The logs say LDAP error: Can't contact LDAP server. Error Code: -1. I've disabled iptables on both data center 1 ldaps. I've rebuilt the replication agreement a dozen times. I've ldapsearch -zz'ed a dozen times. I've reinstalled the CA certificate (using the one from my openldap directory, so I know that it is the same one that is working for ldapsearch -ZZ, as well as exporting it from ldap1 again and reinstalling it). What else can I possibly do to get this working? These are my rpms - # rpm -qa | grep 389 389-ds-base-libs-1.2.11.25-1.el6.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-admin-1.1.35-1.el6.x86_64 389-ds-base-1.2.11.25-1.el6.x86_64 389-admin-console-1.1.8-1.el6.noarch 389-console-1.1.7-1.el6.noarch 389-adminutil-1.1.19-1.el6.x86_64 openssl-1.0.1e-16.el6_5.4.x86_64 # uname -a Linux dc1-ldap2 2.6.32-431.5.1.el6.x86_64

2 8

Replication error after initializing consumer
by Shilen Patel 25 Aug '14

25 Aug '14

Hi, I'm not sure if this is related to my previous email, but I'm also seeing issues when adding an entry while a suffix on a consumer is being initialized. Again, I'm running 1.2.11.30. Here are the details: 1. Using the console, I started to initialize a suffix. [19/Aug/2014:17:46:35 +0100] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=test5toSing1" (consumerhost:636)". 2. While that was happening, I added an entry to the suffix on the master. dn: uid=shilen3,ou=people,ou=test,dc=duke,dc=edu changetype: add objectclass: top objectclass: person objectclass: inetorgperson objectclass: organizationalperson cn: test sn: test uid: shilen3 [19/Aug/2014:17:47:04 +0100] conn=155 op=1 ADD dn="uid=shilen3,ou=people,ou=test,dc=duke,dc=edu" [19/Aug/2014:17:47:04 +0100] conn=155 op=1 RESULT err=0 tag=105 nentries=0 etime=0 csn=53f37f89000000050000 3. The init later finished. [19/Aug/2014:17:48:55 +0100] NSMMReplicationPlugin - Finished total update of replica "agmt="cn=test5toSing1" (consumerhost:636)". Sent 270 entries. At this point, the entry does exist on the consumer. Presumably it was added as part of the init. 4. However, the master still wants to send the ADD to the consumer. On the consumer, I have the following repeated every few seconds: [19/Aug/2014:17:48:54 +0100] conn=2002 op=56 ADD dn="uid=shilen3,ou=people,ou=test,dc=duke,dc=edu" [19/Aug/2014:17:48:54 +0100] conn=2002 op=56 RESULT err=53 tag=105 nentries=0 etime=0 csn=53f37f89000000050000 And on the master, I have this: [19/Aug/2014:17:48:58 +0100] NSMMReplicationPlugin - agmt="cn=test5toSing1" (consumerhost:636): Consumer failed to replay change (uniqueid 5d458a02-27c011e4-a066d327-58be45f0, CSN 53f37f89000000050000): Server is unwilling to perform (53). Will retry later. A cl-dump shows the following: changetype: add replgen: 53e0f14e000000050000 csn: 53f37f89000000050000 nsuniqueid: 5d458a02-27c011e4-a066d327-58be45f0 parentuniqueid: bcd34401-21ba11df-80799838-3cd697e9 dn: uid=shilen3,ou=people,ou=test,dc=duke,dc=edu change:: add: objectClass objectClass: top objectClass: person objectClass: inetorgperson objectClass: organizationalperson - add: cn cn: test - add: sn sn: test - add: uid uid: shilen3 - add: creatorsName creatorsName: cn=directory manager - add: modifiersName modifiersName: cn=directory manager - add: createTimestamp createTimestamp: 20140819164704Z - add: modifyTimestamp modifyTimestamp: 20140819164704Z - add: nsUniqueId nsUniqueId: 5d458a02-27c011e4-a066d327-58be45f0 - add: parentid parentid: 2 - add: entryid entryid: 277 - add: entrydn entrydn: uid=shilen3,ou=people,ou=test,dc=duke,dc=edu - If anyone has any thoughts on this one, that would be appreciated. Thanks! -- Shilen

4 15

Re: [389-users] Autofs Configuration with 389 Directory Server.
by Dhiraj Deshpande 24 Aug '14

24 Aug '14

Hi, I am trying to configure automount with 389 directory server. But facing strange issue. Even if i have added automountmap and automount objectclass it is not working. Debug log says it fails to fing objectclass. Please help me with it. Pasting the automount configuration as well as logs. dn: ou=auto.master,dc=win,dc=com ou: auto.master objectClass: top objectClass: organizationalunit objectClass: automountmap dn: ou=auto.direct,dc=win,dc=com ou: auto.direct objectClass: top objectClass: organizationalunit objectClass: automountmap dn: cn=/repo,ou=auto.direct,dc=win,dc=com objectClass: top objectClass: automount cn: /repo automountInformation: -rw,hard,intr,nfsvers=3,tcp,rsize=524288,wsize=524288 test1:/ifs/Projects03/Tech dn: cn=/-,ou=auto.master,dc=win,dc=com objectClass: top objectClass: automount cn: /- automountInformation: ldap:server1.win.com:ou=auto.direct,dc=win,dc=com Aug 23 21:07:24 ibm001 automount[8900]: Starting automounter version 5.0.5-54.el6, master map auto.master Aug 23 21:07:24 ibm001 automount[8900]: using kernel protocol version 5.02 Aug 23 21:07:24 ibm001 automount[8900]: lookup_nss_read_master: reading master files auto.master Aug 23 21:07:24 ibm001 automount[8900]: parse_init: parse(sun): init gathered global options: (null) Aug 23 21:07:24 ibm001 automount[8900]: lookup_read_master: lookup(file): read entry /net Aug 23 21:07:24 ibm001 automount[8900]: lookup_read_master: lookup(file): read entry /- Aug 23 21:07:24 ibm001 automount[8900]: master_do_mount: mounting /net Aug 23 21:07:24 ibm001 automount[8900]: automount_path_to_fifo: fifo name /var/run/autofs.fifo-net Aug 23 21:07:24 ibm001 automount[8900]: lookup_nss_read_map: reading map hosts (null) Aug 23 21:07:24 ibm001 automount[8900]: parse_init: parse(sun): init gathered global options: (null) Aug 23 21:07:24 ibm001 automount[8900]: mounted indirect on /net with timeout 300, freq 75 seconds Aug 23 21:07:24 ibm001 automount[8900]: st_ready: st_ready(): state = 0 path /net Aug 23 21:07:24 ibm001 automount[8900]: master_do_mount: mounting /- Aug 23 21:07:24 ibm001 automount[8900]: automount_path_to_fifo: fifo name /var/run/autofs.fifo-- Aug 23 21:07:24 ibm001 automount[8900]: lookup_nss_read_map: reading map ldap ldap:server1.win.com:ou=auto.direct,dc=win,dc=com Aug 23 21:07:24 ibm001 automount[8900]: parse_server_string: lookup(ldap): Attempting to parse LDAP information from string "ldap:server1.win.com:ou=auto.direct,dc=win,dc=com". Aug 23 21:07:24 ibm001 automount[8900]: parse_server_string: lookup(ldap): server "ldap://server1.win.com/", base dn "ou=auto.direct,dc=win,dc=com" Aug 23 21:07:24 ibm001 automount[8900]: parse_ldap_config: lookup(ldap): ldap authentication configured with the following options: Aug 23 21:07:24 ibm001 automount[8900]: parse_ldap_config: lookup(ldap): use_tls: 0, tls_required: 0, auth_required: 2, sasl_mech: PLAIN Aug 23 21:07:24 ibm001 automount[8900]: parse_ldap_config: lookup(ldap): user: proxyuser, secret: specified, client principal: (null) credential cache: (null) Aug 23 21:07:24 ibm001 automount[8900]: parse_init: parse(sun): init gathered global options: (null) Aug 23 21:07:25 ibm001 automount[8900]: do_bind: lookup(ldap): auth_required: 2, sasl_mech PLAIN Aug 23 21:07:25 ibm001 automount[8900]: sasl_bind_mech: Attempting sasl bind with mechanism PLAIN Aug 23 21:07:25 ibm001 automount[8900]: getuser_func: called with context (nil), id 16386. Aug 23 21:07:25 ibm001 automount[8900]: getuser_func: called with context (nil), id 16385. Aug 23 21:07:25 ibm001 automount[8900]: getpass_func: context (nil), id 16388 Aug 23 21:07:25 ibm001 automount[8900]: sasl_bind_mech: sasl bind with mechanism PLAIN succeeded Aug 23 21:07:25 ibm001 automount[8900]: do_bind: lookup(ldap): autofs_sasl_bind returned 0 Aug 23 21:07:25 ibm001 automount[8900]: get_query_dn: lookup(ldap): query succeeded, no matches for (objectclass=automountMap) Aug 23 21:07:25 ibm001 automount[8900]: do_bind: lookup(ldap): failed to get query dn Aug 23 21:07:25 ibm001 automount[8900]: do_bind: lookup(ldap): auth_required: 2, sasl_mech PLAIN Aug 23 21:07:25 ibm001 automount[8900]: sasl_bind_mech: Attempting sasl bind with mechanism PLAIN Aug 23 21:07:25 ibm001 automount[8900]: getuser_func: called with context (nil), id 16386. Aug 23 21:07:25 ibm001 automount[8900]: getuser_func: called with context (nil), id 16385. Aug 23 21:07:25 ibm001 automount[8900]: getpass_func: context (nil), id 16388 Aug 23 21:07:25 ibm001 automount[8900]: sasl_bind_mech: sasl bind with mechanism PLAIN succeeded Aug 23 21:07:25 ibm001 automount[8900]: do_bind: lookup(ldap): autofs_sasl_bind returned 0 Aug 23 21:07:25 ibm001 automount[8900]: get_query_dn: lookup(ldap): query succeeded, no matches for (objectclass=automountMap) Aug 23 21:07:25 ibm001 automount[8900]: do_bind: lookup(ldap): failed to get query dn Aug 23 21:07:25 ibm001 automount[8900]: lookup(ldap): couldn't connect to server ldap://server1.win.com/ Aug 23 21:07:25 ibm001 automount[8900]: mount_autofs_direct: failed to read direct map Aug 23 21:07:25 ibm001 automount[8900]: handle_mounts: mount of /- failed! Aug 23 21:07:25 ibm001 automount[8900]: master_do_mount: failed to startup mount -- Thanks & Regards Dhiraj S. Deshpande

1 0

389-console in rhel7
by Pepe Charli 20 Aug '14

20 Aug '14

Is 389-console available for rhel7? Thanks,

2 2

Back up of database for desaster recovery
by Alberto Suárez 20 Aug '14

20 Aug '14

Hello: I would like to make a valid copy of the LDAP data so that I could restore it in another 389 installation in case of a crash. ¿What is the best way? I have tried the 389 commands but came across with issues. Thank you. Alberto Suárez

3 5

Replication error with userPassword
by Shilen Patel 19 Aug '14

19 Aug '14

Hi, I'm running 1.2.11.30 and having an issue replicating the userPassword attribute. The problem appears to only occur if I'm adding the attribute (rather than replacing) and when it is not in plaintext. For example, the following replicates without any issues: dn: uid=shilen3,ou=people,ou=test,dc=duke,dc=edu changetype: modify add: userPassword userPassword: test The following is good too: dn: uid=shilen3,ou=people,ou=test,dc=duke,dc=edu changetype: modify replace: userPassword userPassword: {SSHA}DMK4S6PK6+rKSLNOL1Hl01mVJmgGi5jH But the following updates successfully on the server that I'm directly hitting, but replication fails. dn: uid=shilen3,ou=people,ou=test,dc=duke,dc=edu changetype: modify add: userPassword userPassword: {SSHA}DMK4S6PK6+rKSLNOL1Hl01mVJmgGi5jH In all cases, userPassword had no values in the entry to begin with. When the error occurs, I receive the following message on the supplier: [19/Aug/2014:15:26:33 +0100] NSMMReplicationPlugin - agmt="cn=test5to6" (host:636): Consumer failed to replay change (uniqueid 1056b901-27aa11e4-a066d327-58be45f0, CSN 53f35e82000000050000): Protocol error (2). Will retry later. If I do a cl-dump, I see the following: changetype: modify replgen: 53e0f14e000000050000 csn: 53f35e82000000050000 nsuniqueid: 1056b901-27aa11e4-a066d327-58be45f0 dn: uid=shilen3,ou=people,ou=test,dc=duke,dc=edu change:: add: userPassword userPassword:: e1NTSEF9RE1LNFM2UEs2K3JLU0xOT0wxSGwwMW1WSm1nR2k1akg= - replace: modifiersname modifiersname: cn=directory manager - replace: modifytimestamp modifytimestamp: 20140819142609Z - add: unhashed#user#password - Any clues as to what the problem might be? Also, when a problem like this occurs, is there any way to fix it without having to re-init the suffix on all the consumers? Thanks! -- Shilen

1 0

cannot make replication work over SSL
by Jon Detert 18 Aug '14

18 Aug '14

Hello, I'm failing to make replication work over SSL. Hoping one of you can see what I'm missing: My test involves one supplier (named test-ds1) and one consumer (named test-ds2), both running version 1.3.2.16. Both supplier and consumer are listening to tcp 389 and 636. I can query each over ldaps (e.g. like this: ldapsearch -LLL -x -H ldaps://test-ds2 -s sub -b dc=infinityhealthcare,dc=com uid=jdetert) Replication works fine when I don't try to use ssl: a change on test-ds1 is automatically made on test-ds2 as well. To try to use ssl, I delete the replication agreement and then recreate it, but specify nsDS5ReplicaPort as 636 instead of 389. Here's how the agreement looks when I've tried to use ssl: dn: cn=dc-ihc-dc-com-to-ds3,cn=replica,cn=dc\3Dinfinityhealthcare\2Cdc\3Dcom,c n=mapping tree,cn=config objectClass: top objectClass: nsDS5ReplicationAgreement description: agreement to replicate dc=ihc,dc=com tree from ds1 to ds3 cn: dc-ihc-dc-com-to-ds3 nsDS5ReplicaRoot: dc=infinityhealthcare,dc=com nsDS5ReplicaHost: test-ds3.infinityhealthcare.com nsDS5ReplicaPort: 636 nsDS5ReplicaBindDN: uid=replica-manager,cn=config nsDS5ReplicaBindMethod: SIMPLE nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE authorityRevocationLis t memberof nsDS5ReplicaCredentials: {DES}Nz0qsqM5nShesnQPldsB7vYKQXOj2azjan8bTsUWxNM= nsds5replicareapactive: 0 nsds5replicaLastUpdateStart: 0 nsds5replicaLastUpdateEnd: 0 nsds5replicaChangesSentSinceStartup: nsds5replicaLastUpdateStatus: 0 No replication sessions started since server s tartup nsds5replicaUpdateInProgress: FALSE nsds5replicaLastInitStart: 20140818205749Z nsds5replicaLastInitEnd: 0 nsds5replicaLastInitStatus: -5 - LDAP error: Timed out The supplier's error log says this: [18/Aug/2014:15:57:49 -0500] NSMMReplicationPlugin - agmt="cn=dc-ihc-dc-com-to-ds3" (test-ds3:636): Replication bind with SIMPLE auth failed: LDAP error -5 (Timed out) () [18/Aug/2014:16:07:49 -0500] slapi_ldap_bind - Error: timeout after [600.0] seconds reading bind response for [uid=replica-manager,cn=config] authentication mechanism [SIMPLE] The consumer's error log says nothing about the replication attempt. However, I know the supplier has spoken to the consumer over ssl, because: a) the consumer's access log shows that the supplier connected over SSL: [18/Aug/2014:16:07:50 -0500] conn=11 fd=64 slot=64 SSL connection from 192.168.190.9 to 192.168.190.13 and b) packet sniffing on the supplier shows the same. aTdHvAaNnKcSe for any help you lend, Jon Detert

3 5

Returned mail: see transcript for details
by Rich Megginson 16 Aug '14

16 Aug '14

This message was not delivered due to the following reason(s): Your message was not delivered because the destination computer was unreachable within the allowed queue period. The amount of time a message is queued before it is returned depends on local configura- tion parameters. Most likely there is a network problem that prevented delivery, but it is also possible that the computer is turned off, or does not have a mail system running right now. Your message was not delivered within 8 days: Host 93.134.249.199 is not responding. The following recipients could not receive this message: <389-users(a)lists.fedoraproject.org> Please reply to postmaster(a)redhat.com if you feel this message to be in error.

1 0

Dirsrv service at boot time
by Ghiurea, Isabella 15 Aug '14

15 Aug '14

Hi List, I need to know how to cfg dirsrv at boot time in EL6 , no systemctl available. Thank you Isabella

2 1

Re: [389-users] cfg archiving transactions log
by Ghiurea, Isabella 14 Aug '14

14 Aug '14

Thank you for feedback ! I would like to know if for recovery in time of db I need this files beside the log/transactions log file? Do I have to force to flush the trans to disk before running db2bak.pl script? I assume the output of db2bak.pl new directory c will re-store the whole DS , will this be the best option for disaster recovery ? ( better than export /db2ldif.?) Isabella

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users August 2014