389-users March 2015

389-users@lists.fedoraproject.org

30 participants
25 discussions

Referential Integrity
by William 18 Mar '15

18 Mar '15

Hi, According to dirsrv docs [1] referential integrity should only be enabled on a single server in a MMR scenario. My topology is: ROA <-- MA <--> MB --> ROB Where RO is a readonly, M is a master. Arrows indicate data flow direction. Updates to the DS are done through MA or MB. Should the advice of enabling on only a single host still be held true? What are the potential issues of enabling this on multiple hosts? In the future what would need to change in the plugin to support enabling on multiple hosts if not already possible? [1]: https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.1/… -- William <william(a)firstyear.id.au>

3 8

GUI console and Kerberos
by Paul Robert Marino 16 Mar '15

16 Mar '15

Hey every one I have a question I know at least once in the past i setup the admin console so it could utilize Kerberos passwords based on a howto I found once which after I changed jobs I could never find again. today I was looking for something else and I saw a mention on the site about httpd needing to be compiled with http auth support. well I did a little digging and I found this file /etc/dirsrv/admin-serv/admserv.conf in that file I found a lot of entries that look like this " <LocationMatch /*/[tT]asks/[Cc]onfiguration/*> AuthUserFile /etc/dirsrv/admin-serv/admpw AuthType basic AuthName "Admin Server" Require valid-user AdminSDK on ADMCgiBinDir /usr/lib64/dirsrv/cgi-bin NESCompatEnv on Options +ExecCGI Order allow,deny Allow from all </LocationMatch> " when I checked /etc/dirsrv/admin-serv/admpw sure enough I found the Password hash for the admin user. So my question is before I wast time experimenting could it possibly be as simple as changing the auth type to kerberos http://modauthkerb.sourceforge.net/configure.html keep in mind my Kerberos Servers do not use LDAP as the backend.

4 10

attribute to works same as a sequence number
by ghiureai 12 Mar '15

12 Mar '15

Hi 389 List, we have a need to use an existing attribute ( do not know wich one:nspentrydn ,nsbackendsufix) or create a new one use defined which will act similar as sequence number( integer values, incremental by 1 ,range values known) I understand we can not rely on nsUniqueId . Is there such an existing attribute in 389 , need to be unique , LDAP generate values with gap1 , range values can be controlled ? Isabella

2 1

LDAP allows null bases
by Kay Cee 11 Mar '15

11 Mar '15

All clients connecting to our 389-ds server showed up this vulnerability on the scan. How do I fix this on my 389-ds server? LDAP allows null bases Risk:High Application:ldap Port:389 Protocol:tcp ScriptID:10722 Summary: It is possible to disclose LDAP information. Description : Improperly configured LDAP servers will allow the directory BASE to be set to NULL. This allows information to be culled without any prior knowledge of the directory structure. Coupled with a NULL BIND, an anonymous user can query your LDAP server using a tool such as 'LdapMiner' Solution: Disable NULL BASE queries on your LDAP server CVSS Base Score : 5.0 Family name: Remote file access Category: infos Copyright: Copyright (C) 2000 John Lampe....j_lampe(a)bellsouth.net Summary: Check for LDAP null base Version: $Revision: 128 $

3 3

Review 389-ds install/upgrade procedures and requisites on http://directory.fedoraproject.org/docs/389ds/download.html
by Juan Carlos Camargo 10 Mar '15

10 Mar '15

I'd like to see an updated install/upgrade procedure for 389-ds. The info on the web page is outdated, links for coprs are not working either , maybe they are not valid anymore. As a user of Centos6x I'm somehow lost when I see versions of the product coming out whereas my servers are stuck with the older ones. Should I make the move to Fedora? *Tfn: 957-211157 / 650932877*

6 11

Announcing 389 Console 1.1.9
by Noriko Hosoi 09 Mar '15

09 Mar '15

389 Console 1.1.9 The 389 Directory Server team is proud to announce 389-console version 1.1.9, 389-ds-console version 1.2.10, 389-admin-console version 1.1.10, and idm-console-framework version 1.1.9. Fedora packages are available from the EPEL7, Fedora 20, Fedora 21 and Rawhide repositories. The new packages and versions are: * 389-console-1.1.9-1 * 389-ds-console-1.2.10-1 * 389-admin-console-1.1.10-1 * idm-console-framework-1.1.9-1 Source tarballs are available for download at Download 389 Console Source <http://www.port389.org/binaries/389-console-1.1.9.tar.bz2>, Download 389 Ds Console Source <http://www.port389.org/binaries/389-ds-console-1.2.10.tar.bz2>, Download 389 Admin Console Source <http://www.port389.org/binaries/389-admin-console-1.1.10.tar.bz2> and Download Idm Console Framework Source <http://www.port389.org/binaries/idm-console-framework-1.1.9.tar.bz2>. Highlights in 389-console-1.1.9, 389-ds-console-1.2.10, 389-admin-console-1.1.10 and idm-console-framework-1.1.9-1 * Several bugs are fixed including security bugs – enable TLS version 1.1 and newer; stop using old SSL version. Installation and Upgrade See Download <http://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install, use *yum install 389-ds* yum install 389-ds After install completes, run *setup-ds-admin.pl* to set up your directory server. setup-ds-admin.pl To upgrade, use *yum upgrade* yum upgrade After upgrade completes, run *setup-ds-admin.pl -u* to update your directory server/admin server/console information. setup-ds-admin.pl -u See Install_Guide <http://www.port389.org/docs/389ds/legacy/install-guide.html> for more information about the initial installation, setup, and upgrade See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://admin.fedoraproject.org/mailman/listinfo/389-users and following pages: * https://admin.fedoraproject.org/updates/389-console-1.1.9-1.el7 <https://admin.fedoraproject.org/updates/389-console-1.1.9-1.el7> * https://admin.fedoraproject.org/updates/389-console-1.1.9-1.fc20 <https://admin.fedoraproject.org/updates/389-console-1.1.9-1.fc20> * https://admin.fedoraproject.org/updates/389-console-1.1.9-1.fc21 <https://admin.fedoraproject.org/updates/389-console-1.1.9-1.fc21> * https://admin.fedoraproject.org/updates/389-ds-console-1.2.10-1.el7 <https://admin.fedoraproject.org/updates/389-ds-console-1.2.10-1.el7> * https://admin.fedoraproject.org/updates/389-ds-console-1.2.10-1.fc20 <https://admin.fedoraproject.org/updates/389-ds-console-1.2.10-1.fc20> * https://admin.fedoraproject.org/updates/389-ds-console-1.2.10-1.fc21 <https://admin.fedoraproject.org/updates/389-ds-console-1.2.10-1.fc21> * https://admin.fedoraproject.org/updates/389-admin-console-1.1.10-1.el7 <https://admin.fedoraproject.org/updates/389-admin-console-1.1.10-1.el7> * https://admin.fedoraproject.org/updates/389-admin-console-1.1.10-1.fc20 <https://admin.fedoraproject.org/updates/389-admin-console-1.1.10-1.fc20> * https://admin.fedoraproject.org/updates/389-admin-console-1.1.10-1.fc21 <https://admin.fedoraproject.org/updates/389-admin-console-1.1.10-1.fc21> * https://admin.fedoraproject.org/updates/idm-console-framework-1.1.9-2.el7 <https://admin.fedoraproject.org/updates/idm-console-framework-1.1.9-2.el7> * https://admin.fedoraproject.org/updates/idm-console-framework-1.1.9-2.fc20 <https://admin.fedoraproject.org/updates/idm-console-framework-1.1.9-2.fc20> * https://admin.fedoraproject.org/updates/idm-console-framework-1.1.9-1.fc21 <https://admin.fedoraproject.org/updates/idm-console-framework-1.1.9-1.fc21> If you find a bug, or would like to see a new feature, file it in our Trac instance: https://fedorahosted.org/389 Detailed Changelog since 389-console-1.1.7 * Ticket 47604 - 389-console: remove versioned jars from %{_javadir} * Ticket 97 - 389-console should provide man page Detailed Changelog since 389-ds-console-1.2.7 * Bug 1022104 - Remove versioned jarfiles from _javadir (idm-console-framework) * Ticket 47994 - DS Console always sets nsSSL3 to “on” when a securty setting is adjusted * Ticket 47380 - RFE: Winsync loses connection with AD objects when they move from the console. * Ticket 135 - DS console - right clicking an object does not select that object * Ticket 47887 - DS Console does not correctly disable SSL * Ticket 47485 - DS instance cannot be restored from remote console * Ticket 47886 - DS Console - mouse wheel speed very slow * Ticket 176 - DS Console should timeout when mismatched port and protocol combination is chosen * Ticket 47883 - DS Console - java exception when refreshing schema * Ticket 96 - Window too large for Manage password policy Detailed Changelog since 389-admin-console-1.1.8 * Bug 1022104 - Remove versioned jarfiles from _javadir (idm-console-framework) * Ticket 47477 - Cannot restart SSL-admin server from console * Ticket 47467 - Improve online help for Add CRL dialog * Ticket 362 - Directory Console generates insufficient key strength Detailed Changelog since idm-console-framework-1.1.7 * Ticket 47929 - idm-console-framework - set default min to tls1.0 * Ticket 47946 - ACI’s are replaced by “ACI_ALL” after editing group of ACI’s including invalid one * Ticket 47929 - Console - add tls1.1 support * Ticket 47472 - Entries cannot be highlighted in the “Edit Aci” Rights panel * Ticket 47364 - Console does not support passwords containing 8-bit characters * Ticket 47604 - idm-console-framework: remove versioned jars from %{_javadir} * Ticket 47480 - Admin Console “server restart dialog” disppears after clicking OK * Ticket 47467 - Improve CRL import dialog text * Ticket 362 - Directory Console generates insufficient key strength http://www.port389.org/docs/389ds/releases/release-console-1-1-9.html

1 0

Announcing 389 Admin Server 1.1.38
by Noriko Hosoi 09 Mar '15

09 Mar '15

389 Admin Server 1.1.38 The 389 Directory Server team is proud to announce 389-admin version 1.1.38 and 389-adminutil version 1.1.21. Fedora packages are available from the EPEL7, Fedora 20, Fedora 21 and Rawhide repositories. The new packages and versions are: * 389-admin-1.1.38-1 * 389-adminutil-1.1.21-1 Source tarballs are available for download at Download Admin Source <http://www.port389.org/binaries/389-admin-1.1.38.tar.bz2> and Download Adminutil Source <http://www.port389.org/binaries/389-adminutil-1.1.21.tar.bz2>. Highlights in 389-admin-1.1.38 and 389-adminutil-1.1.21 * Several bugs are fixed including security bugs – stop using DES and old SSL version. Installation and Upgrade See Download <http://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install, use *yum install 389-ds* yum install 389-ds After install completes, run *setup-ds-admin.pl* to set up your directory server. setup-ds-admin.pl To upgrade, use *yum upgrade* yum upgrade After upgrade completes, run *setup-ds-admin.pl -u* to update your directory server/admin server/console information. setup-ds-admin.pl -u See Install_Guide <http://www.port389.org/docs/389ds/legacy/install-guide.html> for more information about the initial installation, setup, and upgrade See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://admin.fedoraproject.org/mailman/listinfo/389-users and following pages: * https://admin.fedoraproject.org/updates/389-admin-1.1.38-1.el7 <https://admin.fedoraproject.org/updates/389-admin-1.1.38-1.el7> * https://admin.fedoraproject.org/updates/389-admin-1.1.38-1.fc20 <https://admin.fedoraproject.org/updates/389-admin-1.1.38-1.fc20> * https://admin.fedoraproject.org/updates/389-admin-1.1.38-1.fc21 <https://admin.fedoraproject.org/updates/389-admin-1.1.38-1.fc21> * https://admin.fedoraproject.org/updates/389-adminutil-1.1.21-2.el7 <https://admin.fedoraproject.org/updates/389-adminutil-1.1.21-2.el7> * https://admin.fedoraproject.org/updates/389-adminutil-1.1.21-1.fc20 <https://admin.fedoraproject.org/updates/389-adminutil-1.1.21-1.fc20> * https://admin.fedoraproject.org/updates/389-adminutil-1.1.21-1.fc21 <https://admin.fedoraproject.org/updates/389-adminutil-1.1.21-1.fc21> If you find a bug, or would like to see a new feature, file it in our Trac instance: https://fedorahosted.org/389 Detailed Changelog since 389-admin-1.1.35 * Ticket 48024 - repl-monitor invoked from adminserver cgi fails * Ticket 47995 - Admin Server: source code cleaning * Ticket 47891 - Admin Server reconfig breaks SSL config * Ticket 47929 - Admin Server - disable SSLv3 by default * Ticket 201 - nCipher HSM cannot be configured via the console * Ticket 47493 - Configuration Tab does not work with FIPS mode enabled * Ticket 47697 - Resource leak in lib/libdsa/dsalib_updown.c * Ticket 47860 - register-ds-admin.pl problem when following steps to replicate o=netscaperoot * Ticket 47548 - register-ds-admin does not register into remote config ds * Ticket 47893 - Admin Server should use Sys::Hostname instead Net::Domain * Ticket 47891 - Admin Server reconfig breaks SSL config * Ticket 47300 - Update man page for remove-ds-admin.pl * Ticket 47850 - “nsslapd-allow-anonymous-access: rootdse” makes login as “admin” fail at the first time * Ticket 47497 - Admin Express - remove “Security Level” * Ticket 47495 - admin express: wrong instance creation time * Ticket 47665 - Create new instance results in setting wrong ACI for the “cn=config” entry * Ticket 47478 - No groups file? error restarting Admin server * Ticket 47300 - [RFE] remove-ds-admin.pl: redesign the behaviour * Ticket 434 - admin-serv logs filling with “admserv_host_ip_check: ap_get_remote_host could not resolve “ * Ticket 47563 - cannot restart directory server from console * Ticket 222 - Admin Express issues “Internal Server Error” when the Config DS is down. * Ticket 418 - Error with register-ds-admin.pl * Ticket 377 - Unchecked use of SELinux command Reviewed by: rmeggins * Ticket 47498 - Error Message for Failed to create the configuration directory server Detailed Changelog since 389-adminutil-1.1.19 * Ticket 47929 - adminutil - future proof getSSLVersion * Ticket 47929 - Adminutil - do not use SSL3 by default * Ticket 47850 - “nsslapd-allow-anonymous-access: rootdse” makes login as “admin” fail at the first time * Ticket 47881 - crash during debug session in adminutil * Ticket 47680 - Upgraded 389-admin rpms and now I can’t start dirsrv-admin http://www.port389.org/docs/389ds/releases/release-admin-1-1-38.html

1 0

Announcing 389 Directory Server version 1.3.2.27
by Noriko Hosoi 08 Mar '15

08 Mar '15

389 Directory Server 1.3.2.27 The 389 Directory Server team is proud to announce 389-ds-base version 1.3.2.27. Fedora packages are available from the Fedora 20 repository. The new packages and versions are: * 389-ds-base-1.3.2.27-1 A source tarball is available for download at Download Source <http://www.port389.org/binaries/389-ds-base-1.3.2.27.tar.bz2> Highlights in 1.3.2.27 * Several bugs are fixed including security bugs – stop using old SSL version. Installation and Upgrade See Download <http://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install, use *yum install 389-ds* yum install 389-ds After install completes, run *setup-ds-admin.pl* to set up your directory server. setup-ds-admin.pl To upgrade, use *yum upgrade* yum upgrade After upgrade completes, run *setup-ds-admin.pl -u* to update your directory server/admin server/console information. setup-ds-admin.pl -u See Install_Guide <http://www.port389.org/docs/389ds/legacy/install-guide.html> for more information about the initial installation, setup, and upgrade See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://admin.fedoraproject.org/mailman/listinfo/389-users as well as https://admin.fedoraproject.org/updates/389-ds-base-1.3.2.27-1.fc20 <https://admin.fedoraproject.org/updates/389-ds-base-1.3.2.27-1.fc20>. If you find a bug, or would like to see a new feature, file it in our Trac instance: https://fedorahosted.org/389 Detailed Changelog since 1.3.2.26 * Bug 1199675 - CVE-2014-8112 CVE-2014-8105 389-ds-base: various flaws [fedora-all] * Ticket 48001 - ns-activate.pl fails to activate account if it was disabled on AD * Ticket 48027 - revise the rootdn plugin configuration validation http://www.port389.org/docs/389ds/releases/release-1-3-2-27.html

1 0

Announcing 389 Directory Server version 1.3.3.9
by Noriko Hosoi 08 Mar '15

08 Mar '15

389 Directory Server 1.3.3.9 The 389 Directory Server team is proud to announce 389-ds-base version 1.3.3.9. Fedora packages are available from the Fedora 21, 22 and Rawhide repositories. The new packages and versions are: * 389-ds-base-1.3.3.9-1 A source tarball is available for download at Download Source <http://www.port389.org/binaries/389-ds-base-1.3.3.9.tar.bz2> Highlights in 1.3.3.9 * Several bugs are fixed including 2 security bugs Installation and Upgrade See Download <http://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install, use *yum install 389-ds* yum install 389-ds After install completes, run *setup-ds-admin.pl* to set up your directory server. setup-ds-admin.pl To upgrade, use *yum upgrade* yum upgrade After upgrade completes, run *setup-ds-admin.pl -u* to update your directory server/admin server/console information. setup-ds-admin.pl -u See Install_Guide <http://www.port389.org/docs/389ds/legacy/install-guide.html> for more information about the initial installation, setup, and upgrade See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://admin.fedoraproject.org/mailman/listinfo/389-users as well as https://admin.fedoraproject.org/updates/389-ds-base-1.3.3.9-1.fc21 <https://admin.fedoraproject.org/updates/389-ds-base-1.3.3.9-1.fc21> and https://admin.fedoraproject.org/updates/389-ds-base-1.3.3.9-1.fc22 <https://admin.fedoraproject.org/updates/389-ds-base-1.3.3.9-1.fc22>. If you find a bug, or would like to see a new feature, file it in our Trac instance: https://fedorahosted.org/389 Detailed Changelog since 1.3.3.8 * Bug 1199675 - CVE-2014-8112 CVE-2014-8105 389-ds-base: various flaws [fedora-all] * Ticket 47431 - Duplicate values for the attribute nsslapd-pluginarg are not handled correctly * Ticket 47451 - dynamic plugins - fix crash caused by invalid plugin config * Ticket 47728 - compilation failed with ‘ incomplete struct/union/enum’ if not set USE_POSIX_RWLOCKS * Ticket 47742 - 64bit problem on big endian: auth method not supported * Ticket 47801 - RHDS keeps on logging write_changelog_and_ruv: failed to update RUV for unknown * Ticket 47828 - DNA scope: allow to exlude some subtrees * Ticket 47836 - Do not return ‘0’ as empty fallback value of nsds5replicalastupdatestart and nsds5replicalastupdatestart * Ticket 47901 - After total init, nsds5replicaLastInitStatus can report an erroneous error status (like ‘Referral’) * Ticket 47936 - Create a global lock to serialize write operations over several backends * Ticket 47957 - Make ReplicaWaitForAsyncResults configurable * Ticket 48001 - ns-activate.pl fails to activate account if it was disabled on AD * Ticket 48003 - add template scripts * Ticket 48003 - build “suite” framework * Ticket 48005 - ns-slapd crash in shutdown phase * Ticket 48021 - nsDS5ReplicaBindDNGroup checkinterval not working properly * Ticket 48027 - revise the rootdn plugin configuration validation * Ticket 48030 - spec file should run “systemctl stop” against each running instance instead of dirsrv.target * Ticket 48048 - Fix coverity issues - 2015/2/24 * Ticket 48048 - Fix coverity issues - 2015/3/1 * Ticket 48109 - substring index with nssubstrbegin: 1 is not being used with filters like (attr=x*) http://www.port389.org/docs/389ds/releases/release-1-3-3-9.html

1 0

error upgrading the server
by Timo Aaltonen 05 Mar '15

05 Mar '15

Hi So I've bumped into an issue on my IPA install (debian), where the package tries to run an offline upgrade when it's updated, but fails: [15/03/05:01:13:10] - [Setup] Info Error adding entry 'cn=entryusn,cn=default indexes, cn=config,cn=ldbm database,cn=plugins,cn=config'. Error: No such object [15/03/05:01:13:10] - [Setup] Fatal Error: could not update the directory server. [15/03/05:01:13:10] - [Setup] Fatal Exiting . . . any ideas what's wrong? -- t

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users March 2015