389-users October 2015

389-users@lists.fedoraproject.org

31 participants
32 discussions

Help with understanding 389-ds, multiple server setup and TLS/SSL
by Tom Fallon 20 Oct '15

20 Oct '15

Hi folks I've inherited a 389-ds server (let's call that Server1) running version 389-Management-Console/1.1.7 B2011.172.2016 on which I've been tasked with getting replication working on a second server (Server2). I am not new to Linux but am new to System Administration having made the jump from Helpdesk recently so please bear with me if these seem like stupid questions.... I've struck one hurdle already whereby I can no longer log in on the Console to Server1 and am getting error: Error: Cannot logon because of an incorrect User ID Incorrect password or Directory problem. java.io interruptedIOException: HTTP response timeout I think this has occurred while I tried to get SSL certs copied/exported to a Server2 as log files show the following. [06/Oct/2015:23:46:46 +0100] attrcrypt - attrcrypt_cipher_init: symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [06/Oct/2015:23:46:46 +0100] attrcrypt - All prepared ciphers are not available. Please disable attribute encryption. [06/Oct/2015:23:46:46 +0100] attrcrypt - attrcrypt_unwrap_key: failed to unwrap key for cipher AES [06/Oct/2015:23:46:46 +0100] attrcrypt - attrcrypt_cipher_init: symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [06/Oct/2015:23:46:46 +0100] attrcrypt - attrcrypt_unwrap_key: failed to unwrap key for cipher 3DES [06/Oct/2015:23:46:46 +0100] attrcrypt - attrcrypt_cipher_init: symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [06/Oct/2015:23:46:46 +0100] attrcrypt - All prepared ciphers are not available. Please disable attribute encryption. [06/Oct/2015:23:46:47 +0100] - Skipping CoS Definition cn=nsAccountInactivation_cos,dc=example,dc=com--no CoS Templates found, which should be added before the CoS Definition. [06/Oct/2015:23:46:47 +0100] - slapd started. Listening on All Interfaces port 389 for LDAP requests [06/Oct/2015:23:46:47 +0100] - Listening on All Interfaces port 636 for LDAPS requests So in theory I recreate the SSL certs on Server1 export to Server2 and continue on. I'd appreciate if someone could help in my understanding of how this is supposed to work in a multi server environment as despite reading the documentation here: https://access.redhat.com/documentation/en/red-hat-directory-server/ I'm struggling to get my head around things. My understanding is there are these main components (I'm ignoring SNMP bit for now): - Directory Server located at /etc/dirsrv/slapd-instance and containing all the LDAP server pieces and command line tools - Admin Server located at /etc/dirsrv/admin-serv - docs refer to the controlling portals which access LDAP server and refers to "Using the Admin server" guide - I'm presuming this is the Administration Guide now - Directory Server console - various docs I've read refer to this as the Directory Server Console or the Admin Console which then bamboozles me as to whether its incorporated in Directory Server or Admin Server. I've been trying to follow this guide to multi-master SSL setup - http://directory.fedoraproject.org/docs/389ds/howto/howto-walkthroughmultim… and tweaking for my version of OS (Centos 6.7) and 389-ds but not getting very far. Can anyone point me to a more up to date guide or provide some form of idiot-proof guide to get this working? I've been banging my head on this for a couple weeks now and despite reading the docs and a load of googling I'm not getting very far. I have the install part down ok including disktuning, file descriptors, keepalive, port ranges etc and 389-ds itself of course. And on Server2 I can log in to the console using http and a basic LDAP test works fine using: ldapsearch -x -b "dc=example,dc=com" I think whoever setup the existing Directory Server used a self-signed cert as there are pwdfile and noise.txt files in the slapd-instance directory so looks like something like this was used to generate the CA Cert and Server Cert certutil -S -n "CA certificate" -s "cn=CAcert" -x -t "CT,," -m 1000 -v 120 -d *.* -z noise.txt -f pwdfile.txt certutil -S -n "Server-Cert" -s "cn=server.example.com ,cn=Directory Server" -c "CA certificate" -t "u,u,u" -m 1001 -v 120 -d *.* -z noise.txt -f pwdfile.txt What I don't have a note of is the unique numbers entered with the -m switch. Is there a way to tell what these are after the fact as I believe they need to be unique across servers, correct? Also can someone explain how I export the CA Cert from server 1 to server 2 - the docs don't cover that part as far as I can tell other than this command which as far as I can see exports the CA Cert on the server you run that command on to ascii format. certutil -L -d . -n "CA certificate" -a > cacert.asc Is it just a matter of copying the cacert.asc file to 2nd server in the slapd-instance directory and running another certutil command of some sort to import there? Secondly do I need to setup SSL on the Admin Server as well or for simple replication can we just get by with SSL on the Directory Server? If we need to do the Admin Server as well (I'm unsure of what functionality the Admin Server actually provides) is it a matter of same steps as for the Directory Server, same commands etc? Lastly is there a recommended way to redo the certificates on the existing (live) server other than just removing the files and starting again? Server1 is in production so I'm hesitant to play around with it too much until i know what I'm doing. Many thanks to anyone who takes the time to read this and provide any pointers. Cheers. Kiweegie.

2 2

fractional replication and consumers Q
by ghiureai 19 Oct '15

19 Oct '15

Hi LIst, I have cfg a multimaster rep env with fractional rep, all agreements are already in placed between suppliers and consumers , all consumers had been cfg with Multi Master Replica option, reading trough RHES 389-ds there is some mentioning about "dedicated consumer" option in replica. We need to have a cfg which at anytime any of the DS can act as master ( write+read), would "Multi Master " replica option need to be replaced with "dedicated consumer"? Thank you Isabella

4 4

WinSync agreement deletes directoryt server users
by Mizrahi, Yair 19 Oct '15

19 Oct '15

Hi, I have setup a sync agreement between directory server and active directory 2012R2 and I'm getting a very strange behavior, if I am doing 2 way sync (the default) the sync completes successfully but not all the users are created in AD, not only that , they are also gets deleted from directory server (around 200 users from 550). I'm syncing to Blank OU in AD My DS version is 1.2.2-1 Thanks, [cid:image001.gif@01D1099A.FE66D260][cid:image002.png@01D1099A.FE66D260] Yair Mizrahi Sr Lab IT engineer Office: + 972 722563243 Mobile: + 972 54 2327687 Email: Yair.Mizrahi(a)emc.com<mailto:Yair.Mizrahi@emc.com> EMC² - XtremIO Glil Yam 46905, Herzliya, Israel www.emc.com<http://www.emc.com/>

2 3

seeing errors in MM Rep fractional replication
by ghiureai 16 Oct '15

16 Oct '15

Hi list, we completed the MMRep Fractional rep excluded (memberOf pluging) and on supplier seeing this error: repl5_inc_wait for_async_results timed out waiting for responses: 15 17 and consumer seeing this : slapi_ldap_bind - Error: timeout after [0.0] seconds reading bind response for [uid=rep_user,cn=config] mech [SIMPLE] [16/Oct/2015:13:46:35 -0700] NSMMReplicationPlugin - agmt="cn=2 to 01" 1:389): Replication bind with SIMPLE auth failed: LDAP error -5 (Timed out) ((null)) [16/Oct/2015:13:46:59 -0700] slapi_ldap_bind - Error: timeout after [0.0] seconds reading bind response for [uid=rep_user,cn=config] mech [SIMPLE] [16/Oct/2015:13:47:19 -0700] slapi_ldap_bind - Error: timeout after [0.0] seconds reading bind response for [uid=rep_user,cn=config] mech [SIMPLE] [16/Oct/2015:13:47:39 -0700] slapi_ldap_bind - Error: timeout after [0.0] seconds reading bind response for [uid=rep_user,cn=config] mech [SIMPLE] [16/Oct/2015:13:47:59 -0700] slapi_ldap_bind - Error: timeout after [0.0] seconds reading bind response for [uid=rep_user,cn=config] mech [SIMPLE] [16/Oct/2015:13:48:29 -0700] slapi_ldap_bind - Error: timeout after [0.0] seconds reading bind response for [uid=rep_user,cn=config] mech [SIMPLE] [16/Oct/2015:13:50:05 -0700] slapi_ldap_bind - Error: timeout after [0.0] seconds reading bind response for [uid=rep_user,cn=config] mech [SIMPLE] any help much appreciate it Thank you Isabella

2 3

using ipa_pwd_extop (freeIPA plugin) to update kerberos
by Winstanley, Anthony 16 Oct '15

16 Oct '15

Hello, We want regular 389-ds password changes to also update our MIT kerberos realm principals. It's my understanding that FreeIPA does this already via their ipa_pwd_extop 389-ds plugin. Does anybody have any comment on the feasibility of implementing this plugin in a vanilla 389-ds install without bringing much of FreeIPA along with it? Anybody have any better ideas? :) Thanks, Anthony Winstanley UBC Enterprise LDAP project

1 0

Modify schema for sn (lastname) attribute?
by Striker Leggette 15 Oct '15

15 Oct '15

Hi, Is there a good example of modifying the schema of 'sn' to change from 'MUST' to 'MAY' in order to make lastname optional? -- Striker

1 0

Bug 1251288, 389-ds-base-1.3.4.4-1.fc22.x86_64 , Fedora 22
by Juan Carlos Camargo 15 Oct '15

15 Oct '15

Listers, Do you know if this bug has been fixed on version 1.3.4.4-1 running on Fedora 22 x64? https://bugzilla.redhat.com/show_bug.cgi?id=1251288 I'm facing the same behaviour: attribute deletion is not forwarded to consumer replicas. Master works fine, but not consumer replicas. Regards! *Tfn: 957-211157*

2 4

ldap export/db2ldif Q's
by ghiureai 14 Oct '15

14 Oct '15

Hi List, I have 2 questions related to export/ db2ldif for a domain: -anything I need to be aware when using a export /db2ldif from a multimaster rep cfg ldap file to be imported/ldif2db in a non replication server cfg ldap ? or into another multimaster rep cf ldap ( are any rep internal counters to be reset etc?) -see the following message/warning when running export/db2ldif, the slapd errorlog level is set to 64 , can this be ignored? [07/Oct/2015:13:58:45 -0700] - All database threads now stopped Exported ldif file: /staging/proc/ldap_backup/xxxdump.20151007-135842 reading config file /etc/dirsrv/slapd-ldap/slapd-collations.conf [07/Oct/2015:13:58:45 -0700] - line 45: collation "" "" "" 1 3 2.16.840.1.113730.3.3.2.0.1 default [07/Oct/2015:13:58:45 -0700] - line 46: collation ar "" "" 1 3 2.16.840.1.113730.3.3.2.1.1 ar [07/Oct/2015:13:58:45 -0700] - line 47: collation be "" "" 1 3 2.16.840.1.113730.3.3.2.2.1 be [07/Oct/2015:13:58:45 -0700] - line 48: collation bg "" "" 1 3 2.16.840.1.113730.3.3.2.3.1 bg [07/Oct/2015:13:58:45 -0700] - line 49: collation ca "" "" 1 3 2.16.840.1.113730.3.3.2.4.1 ca [07/Oct/2015:13:58:45 -0700] - line 50: collation cs "" "" 1 3 2.16.840.1.113730.3.3.2.5.1 cs [07/Oct/2015:13:58:45 -0700] - line 51: collation da "" "" 1 3 2.16.840.1.113730.3.3.2.6.1 da [07/Oct/2015:13:58:45 -0700] - line 52: collation de "" "" 1 3 2.16.840.1.113730.3.3.2.7.1 de [07/Oct/2015:13:58:45 -0700] - line 53: collation de AT "" 1 3 2.16.840.1.113730.3.3.2.8.1 de-AT [07/Oct/2015:13:58:45 -0700] - line 54: collation de CH "" 1 3 2.16.840.1.113730.3.3.2.9.1 de-CH [07/Oct/2015:13:58:45 -0700] - line 55: collation el "" "" 1 3 2.16.840.1.113730.3.3.2.10.1 el [07/Oct/2015:13:58:45 -0700] - line 56: collation en "" "" 1 3 2.16.840.1.113730.3.3.2.11.1 en en-US [07/Oct/2015:13:58:45 -0700] - line 57: collation en CA "" 1 3 2.16.840.1.113730.3.3.2.12.1 en-CA [07/Oct/2015:13:58:45 -0700] - line 58: collation en GB "" 1 3 2.16.840.1.113730.3.3.2.13.1 en-GB [07/Oct/2015:13:58:45 -0700] - line 59: collation en IE "" 1 3 2.16.840.1.113730.3.3.2.14.1 en-IE [07/Oct/2015:13:58:45 -0700] - line 60: collation es "" "" 1 3 2.16.840.1.113730.3.3.2.15.1 es es-ES [07/Oct/2015:13:58:45 -0700] - line 61: collation et "" "" 1 3 2.16.840.1.113730.3.3.2.16.1 et [07/Oct/2015:13:58:45 -0700] - line 62: collation fi "" "" 1 3 2.16.840.1.113730.3.3.2.17.1 fi [07/Oct/2015:13:58:45 -0700] - line 63: collation fr "" "" 1 3 2.16.840.1.113730.3.3.2.18.1 fr fr-FR [07/Oct/2015:13:58:45 -0700] - line 64: collation fr BE "" 1 3 2.16.840.1.113730.3.3.2.19.1 fr-BE [07/Oct/2015:13:58:45 -0700] - line 65: collation fr CA "" 1 3 2.16.840.1.113730.3.3.2.20.1 fr-CA [07/Oct/2015:13:58:45 -0700] - line 66: collation fr CH "" 1 3 2.16.840.1.113730.3.3.2.21.1 fr-CH [07/Oct/2015:13:58:45 -0700] - line 67: collation hr "" "" 1 3 2.16.840.1.113730.3.3.2.22.1 hr [07/Oct/2015:13:58:45 -0700] - line 68: collation hu "" "" 1 3 2.16.840.1.113730.3.3.2.23.1 hu [07/Oct/2015:13:58:45 -0700] - line 69: collation is "" "" 1 3 2.16.840.1.113730.3.3.2.24.1 is [07/Oct/2015:13:58:45 -0700] - line 70: collation it "" "" 1 3 2.16.840.1.113730.3.3.2.25.1 it [07/Oct/2015:13:58:45 -0700] - line 71: collation it CH "" 1 3 2.16.840.1.113730.3.3.2.26.1 it-CH [07/Oct/2015:13:58:45 -0700] - line 72: collation iw "" "" 1 3 2.16.840.1.113730.3.3.2.27.1 iw [07/Oct/2015:13:58:45 -0700] - line 73: collation ja "" "" 1 3 2.16.840.1.113730.3.3.2.28.1 ja [07/Oct/2015:13:58:45 -0700] - line 74: collation ko "" "" 1 3 2.16.840.1.113730.3.3.2.29.1 ko [07/Oct/2015:13:58:45 -0700] - line 75: collation lt "" "" 1 3 2.16.840.1.113730.3.3.2.30.1 lt [07/Oct/2015:13:58:45 -0700] - line 76: collation lv "" "" 1 3 2.16.840.1.113730.3.3.2.31.1 lv [07/Oct/2015:13:58:45 -0700] - line 77: collation mk "" "" 1 3 2.16.840.1.113730.3.3.2.32.1 mk [07/Oct/2015:13:58:45 -0700] - line 78: collation nl "" "" 1 3 2.16.840.1.113730.3.3.2.33.1 nl [07/Oct/2015:13:58:45 -0700] - line 79: collation nl BE "" 1 3 2.16.840.1.113730.3.3.2.34.1 nl-BE [07/Oct/2015:13:58:45 -0700] - line 80: collation no "" "" 1 3 2.16.840.1.113730.3.3.2.35.1 no [07/Oct/2015:13:58:45 -0700] - line 81: collation no NO B 1 3 2.16.840.1.113730.3.3.2.36.1 no-NO-B [07/Oct/2015:13:58:45 -0700] - line 82: collation no NO NY 1 3 2.16.840.1.113730.3.3.2.37.1 no-NO-NY [07/Oct/2015:13:58:45 -0700] - line 83: collation pl "" "" 1 3 2.16.840.1.113730.3.3.2.38.1 pl [07/Oct/2015:13:58:45 -0700] - line 84: collation ro "" "" 1 3 2.16.840.1.113730.3.3.2.39.1 ro [07/Oct/2015:13:58:45 -0700] - line 85: collation ru "" "" 1 3 2.16.840.1.113730.3.3.2.40.1 ru [07/Oct/2015:13:58:45 -0700] - line 86: collation sh "" "" 1 3 2.16.840.1.113730.3.3.2.41.1 sh [07/Oct/2015:13:58:45 -0700] - line 87: collation sk "" "" 1 3 2.16.840.1.113730.3.3.2.42.1 sk [07/Oct/2015:13:58:45 -0700] - line 88: collation sl "" "" 1 3 2.16.840.1.113730.3.3.2.43.1 sl [07/Oct/2015:13:58:45 -0700] - line 89: collation sq "" "" 1 3 2.16.840.1.113730.3.3.2.44.1 sq [07/Oct/2015:13:58:45 -0700] - line 90: collation sr "" "" 1 3 2.16.840.1.113730.3.3.2.45.1 sr [07/Oct/2015:13:58:45 -0700] - line 91: collation sv "" "" 1 3 2.16.840.1.113730.3.3.2.46.1 sv [07/Oct/2015:13:58:45 -0700] - line 92: collation tr "" "" 1 3 2.16.840.1.113730.3.3.2.47.1 tr [07/Oct/2015:13:58:45 -0700] - line 93: collation uk "" "" 1 3 2.16.840.1.113730.3.3.2.48.1 uk [07/Oct/2015:13:58:45 -0700] - line 94: collation zh "" "" 1 3 2.16.840.1.113730.3.3.2.49.1 zh [07/Oct/2015:13:58:45 -0700] - line 95: collation zh TW "" 1 3 2.16.840.1.113730.3.3.2.50.1 zh-TW [07/Oct/2015:13:58:45 -0700] - line 97: collation "" "" "" 3 3 2.16.840.1.113730.3.3.2.0.3 [07/Oct/2015:13:58:45 -0700] - line 98: collation en "" "" 3 3 2.16.840.1.113730.3.3.2.11.3 [07/Oct/2015:13:58:45 -0700] plugin_mr_find - Error: matching rule plugin for [caseIgnoreOrderingMatch-default] not found [07/Oct/2015:13:58:45 -0700] plugin_mr_find - Error: matching rule plugin for [caseIgnoreSubstringMatch-default] not found [07/Oct/2015:13:58:45 -0700] plugin_mr_find - Error: matching rule plugin for [caseIgnoreOrderingMatch-default] not found [07/Oct/2015:13:58:45 -0700] plugin_mr_find - Error: matching rule plugin for [caseIgnoreSubstringMatch-default] not found [07/Oct/2015:13:58:45 -0700] plugin_mr_find - Error: matching rule plugin for [caseIgnoreSubstringMatch-default] not found

1 0

replica from DS to AD: Replica has no update vector. It has never been initialized
by Mihai Carabas 13 Oct '15

13 Oct '15

Hello, After a power blackout we have some trouble with synchronization between 389ds and AD. Here are some debugging messages: [13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - windows sync - agmt="cn=ad.curs.pub.ro" (ad:636): State: start_backoff -> backoff [13/Oct/2015:09:34:39 +0300] - acquire_replica, supplier RUV: [13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - supplier: {replicageneration} 547f9354000000010000 [13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - supplier: {replica 1 ldap://ldap.curs.pub.ro:389} 547f9663000000010000 561ca5b8000000010000 561ca5b8 [13/Oct/2015:09:34:39 +0300] - acquire_replica, consumer RUV: [13/Oct/2015:09:34:39 +0300] - acquire_replica, consumer RUV = null [13/Oct/2015:09:34:39 +0300] - acquire_replica, supplier RUV is newer [13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - windows sync - agmt="cn=ad.curs.pub.ro" (ad:636): Cancelling linger on the connection [13/Oct/2015:09:34:39 +0300] - _csngen_adjust_local_time: gen state before 561ca5fb0001:1444718075:0:0 [13/Oct/2015:09:34:39 +0300] - _csngen_adjust_local_time: gen state after 561ca5ff0000:1444718079:0:0 [13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - windows sync - agmt="cn=ad.curs.pub.ro" (ad:636): State: backoff -> sending_updates [13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - windows sync - agmt="cn=ad.curs.pub.ro" (ad:636): Replica has no update vector. It has never been initialized. [13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - windows sync - agmt="cn=ad.curs.pub.ro" (ad:636): Beginning linger on the connection [13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - windows sync - agmt="cn=ad.curs.pub.ro" (ad:636): State: sending_updates -> start_backoff ^C What action should we take to solve this issue? Thank you, Mihai Carabas

2 2

Random dirsrv freezes and high CLOSE_WAITs
by Prashant Bapat 13 Oct '15

13 Oct '15

Hi, We have been using 389-ds as part of FreeIPA. In one of our environments, we have 2 389-ds installations with replication. Randomly, the 389-ds on either of them completely freezes and there are high number of CLOSE_WAITs on tcp/389 port. Only way to recover from this situation is to either reboot or "kill -9" the ns-slapd process. Graceful restarts get stuck indefinitely. One curious thing when this happens, a search using "ldapsearch" command seems to work but a search using a python-ldap client does not. FreeIPA does not work either. Any pointers on troubleshooting this would be appreciated. Thanks. --Prashant

4 9

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users October 2015