389-users March 2017

389-users@lists.fedoraproject.org

9 participants
11 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

MemberOf group restrictions to a client system (server and client running CentOS 7)
by Janet Houser 06 Aug '20

06 Aug '20

Hi, I'm new to 389-ds and last week downloaded and installed the software. I have a running instance of the server, and I've added TLS/SSL. I've configured a CentOS 7 client to be able to query the server using TLS/SSL, and all appears working. I've created users and groups on the 389-ds server successfully. For each user and group, I've enabled posix attributes and my client can see the unix users and groups using the "getent password" or "getent group" commands. Now, here's where I'm getting tripped up.......... I need to limit which users have access to which systems. I've been trying to do this via memberOf group limitations. I found the following online resource (https://thornelabs.net/2013/01/28/aix-restrict-server-login-via-ldap-groups…) which is close enough to CentOS that the initial commands worked. I enabled the MemberOf plugin and changed the attributes per the link, and restarted the system. I created a test group (that I didn't enable a posix GID) and tried to add a single user via: Right click on group -- > click Properties --> then Members --> click Add --> Search for user --> click Add. When I try to go this route (which worked before enabling the memberOf plugin) it worked. Now it seems I get the error: "Cannot save to directory server. netscape.ldap.LDAPException: error resiult(65): Object class violation" And the messages file throws the error (/var/log/dirsrv/slapd-<instancename>/errors: "Entry "uid=test,ou=People,dc=int,dc=com" -- attribute "memberOf" not allowed [17/Feb/2016:11:22:58 -0700] memberof-plugin - memberof_postop_modify: failed to add dn (cn=testgroup,ou=Groups,dc=int,dc=com) to target. Error (65)" So it seems my server isn't quite using the memberOf plugin properly, but I'm not sure what else to enable. I'll have to solve this issue before I even try to filter login access via groups on my client system. I should mention that if I go under the advanced tab for one of the groups I created, I can add the the attribute "uniquemember", but I'm not sure what I should set the "value" to be. I've tried creating new users to see if I could set their "uniquemember" attributes, but no luck. It seems that I don't have the ability to set this attribute on individual users, only groups. This might not be the right road to head down when trying to restrict access to servers via groups, so I'm open to any suggestions. Any suggestions would be appreciated.

6 19

ldapsearch doesn't return the userpassword field
by Janet Houser 14 May '18

14 May '18

Hi, I've been looking through the archives for information, but I haven't stumbled on a solution to my problem. I'm running ds-389 (389-ds-base-1.3.4.0) on a centos 7 box (CentOS Linux release 7.2.1511). I have a centos OS client configured using SSL/TLS which queries the LDAP server. Per a previous thread, I configured the memeberOf plugin and all seems to be working properly. I have a php script that will run on the client and change the LDAP password for the user. The problem is, the script looks for the SSHA has of the password when an ldapsearch is issued. However, when I issue a general ldapsearch (anonymously) I don't get the userpassword field. I read in your archives that I might have to be the "directory manager" user in order to see the hashed password. I've been playing around with the ldapsearch syntax, but I can't quite get it right. Anyway, my question is, can I set a flag in 389-ds that will display the hashed userpassword? I think that will solve my problem with the php script returning an error that it can't retrieve the old password. Thanks,

5 12

Anyone still building 389 on HPUX?
by Mark Reynolds 31 Mar '17

31 Mar '17

Hello, Just curious if anyone is building 389 on HPUX? There is very old code in our server that is specific to HPUX that we'd like to remove. Most of it is probably not needed anymore(even on HPUX), but we want to check before we remove it. Thanks, Mark

3 3

TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.
by tuan88＠gmail.com 26 Mar '17

26 Mar '17

hi ii had been working before, recently i saw 2 errors on this server rh6.6, 389-ds-1.2.2-1 . 1) login to COnsole GUI not showing the 389 ldap server; after enter the password, just a folder not any sign of "+" 2) my certificate failed, i tried to restored *db and my cacert.asc files from last year, didn't help WHat can it be, is there someone update openssl, changing 389-setup? ..... the certificate just can't suddently stop to work (it is still valid for months) [root@mars slapd-NNIT]# ldapmodify -x -ZZ -h mars -D "cn=directory manager" -f /tmp/ldap.ldf -W ldap_start_tls: Connect error (-11) additional info: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user. cat /tmp/ldap.ldf dn: cn=Test,cn=tek,ou=Infr,dc=redh replace: passwordExpirationTime passwordExpirationTime: 19700101000000Z [root@mars slapd-redh]# certutil -L -d . Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI CA certificate CTu,u,u Consumer-Cert u,u,u Server-Cert u,u,u [root@mars slapd-redh]# [root@mars dirsrv]# echo | openssl s_client -showcerts -connect redh.site:636 CONNECTED(00000003) depth=1 CN = CAcert verify error:num=19:self signed certificate in certificate chain verify return:0 --- Certificate chain 0 s:/CN=redh.site i:/CN=CAcert -----BEGIN CERTIFICATE----- MIIBpzCCARCgAwIBAgICA/EwDQYJKoZIhvcNAQEFBQAwETEPMA0GA1UEAxMGQ0Fj ZXJ0MB4XDTE2MDQyMjEyNDQzMVoXDTM2MDQyMjEyNDQzMVowITEfMB0GA1UEAxMW a2VpZC5jb3JwLm5vdm9jb3JwLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC gYEAmmsNwXU81UfLvfKvwvoJHQDY2asXir0CEiSDWgyQXL7bjhKgcVietnamp5JQ lrC5wfE7KdWpsuDpEQXK1kV9FIyBnIpy65pX9Lt/lMPRQ7ts0ygGRk58NL8AQn0b 8hQi//sPs461GG9UpNkOiKiJ30aYZLILq6ONmjcru5+Oq80CAwEAATANBgkqhkiG 9w0BAQUFAAOBgQAb73EOR4gun33uTAG339RkxHBJjP+M8OXe7oO/t8DyZDtZTuan UueoPw3eZiAqeRZlwFZZ6pLQfRaIDVN1TpHDlQa6qZ7MlPl3zAN3DCZM3gZvAXs /Abho4vTXesNOFEE49jRcMb5wE/lwt7GExCfCMqXt4cWHfbg2yTUWdaJIg== -----END CERTIFICATE----- 1 s:/CN=CAcert i:/CN=CAcert -----BEGIN CERTIFICATE----- MIIBqTCCARKgAwIBAgICA/AwDQYJKoZIhvcNAQEFBQAwETEPMA0GA1UEAxMGQ0Fj ZXJ0MB4XDTE2MDQyMjEyNDQwM1oXDTM2MDQyMjEyNDQwM1owETEPMA0GA1UEAxMG Q0FjZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDRT36sEBN+6/DBO8mS A2oGKvPME3uiWFm/wJYAACzwoqIewTmbejyuPb63kEhK8koJshIhZodw+T5GSxkd kYmIAF5GGO7MUlZTVJRnrzThTFXf4JkXKVtsXSZ2H2lLjFR7QMDacPK/mxp3VI3l 8k/jZBa2t+Bure/Qkk8v2hvMLwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqG SIb3DQEBBQUAA4GBAHvx6Wr4rAfZlAMeQViK86rELTPeKfutSx66+s6vO52erc8o xTJCcVIPMXc2G7VpKKGkt0i2rpO/1poFp617jK2mngCsuwq1OJvWxxIGGMbxcKim PLmz5fFrj4Rl94VTSZkXqPokRnuIGHx70RJztdxHF2LE6gtChFZX8PXbG1+v -----END CERTIFICATE----- --- Server certificate subject=/CN=redh.site issuer=/CN=CAcert --- Acceptable client certificate CA names /CN=CAcert --- SSL handshake has read 1049 bytes and written 449 bytes --- New, TLSv1/SSLv3, Cipher is AES128-GCM-SHA256 Server public key is 1024 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : AES128-GCM-SHA256 Session-ID: 51B603F936EDBCEA7D2885A81F3AD9115A6EE8BF0BED22FA9AF6F56849617748 Session-ID-ctx: Master-Key: AF2B5A91C669F764C5995E326BAEAD6452CC9A989BD9BE16B110D5F7AE1E1A822DB026913BB3219112EBE6E882AC6FF7 Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1490455678 Timeout : 300 (sec) Verify return code: 19 (self signed certificate in certificate chain) --- DONE [root@mars dirsrv]# please help br van12

2 1

Announcing 389 Directory Server version 1.3.6.3
by Mark Reynolds 23 Mar '17

23 Mar '17

389 Directory Server 1.3.6.3 The 389 Directory Server team is proud to announce 389-ds-base version 1.3.6.3. Fedora packages are available from the Fedora 26 and Rawhide repositories. The new packages and versions are: * 389-ds-base-1.3.6.3-4 https://bodhi.fedoraproject.org/updates/FEDORA-2017-846f41cfeb Source tarballs are available for download at Download 389-ds-base Source <http://www.port389.org/binaries/389-ds-base-1.3.6.3.tar.bz2> Highlights in 1.3.6.3 * Secruity and Bug fixes and enhancements Installation and Upgrade See Download <http://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install, use *yum install 389-ds* yum install 389-ds After install completes, run *setup-ds-admin.pl* to set up your directory server. setup-ds-admin.pl To upgrade, use *yum upgrade* yum upgrade After upgrade completes, run *setup-ds-admin.pl -u* to update your directory server/admin server/console information. setup-ds-admin.pl -u See Install_Guide <http://www.port389.org/docs/389ds/legacy/install-guide.html> for more information about the initial installation, setup, and upgrade See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our Pagure project: https://pagure.io/389-ds-base * Bump verson to 1.3.6.3-4 * Issue 49177 - rpm would not create valid pkgconfig files(pt2) * Bump version to 1.3.6.3-3 * Issue 49186 - Fix NS to improve shutdown reliability * Issue 49174 - nunc-stans can not use negative timeout * Issue 49076 - To debug DB_DEADLOCK condition, allow to reset DB_TXN_NOWAIT flag on txn_begin * Issue 49188 - retrocl can crash server at shutdown * Issue 47840 - Add setup_ds test suite * Bump version to 1.3.6.3-2 * Fix srvcore version dependency * Bump version to 1.3.6.3-1 * Issue 48989 - Overflow in counters and monitor * Issue 49095 - targetattr wildcard evaluation is incorrectly case sensitive * Issue 49177 - rpm would not create valid pkgconfig files * Issue 49176 - Remove tcmalloc restriction from s390x * Issue 49157 - ds-logpipe.py crashes for non-existing users * Issue 49065 - dbmon.sh fails if you have nsslapd-require-secure-binds enabled * Issue 49095 - Fix double-free in _cl5NewDBFile() error path * Bump verson to 1.3.6.2-2 * Issue 49169 - Fix covscan errors(regression) * Issue 49172 - Fix test schema files * Issue 49171 - Nunc Stans incorrectly reports a timeout * Issue 49169 - Fix covscan errors * Bump version to 1.3.6.2-1 * Issue 49164 - Change NS to acq-rel semantics for atomics * Issue 49154 - Nunc Stans stress should assert it has 95% success rate * Issue 49165 - pw_verify did not handle external auth * Issue 49062 - Reset agmt update status after total init * Issue 49151 - Remove defunct selinux policy

1 0

Announcing 389 Directory Server version 1.3.5.16
by Mark Reynolds 23 Mar '17

23 Mar '17

389 Directory Server 1.3.5.16 The 389 Directory Server team is proud to announce 389-ds-base version 1.3.5.16. Fedora packages are available from the Fedora 24, and 25. The new packages and versions are: * 389-ds-base-1.3.5.16-1 F24 - https://bodhi.fedoraproject.org/updates/FEDORA-2017-820e759d0f F25 - https://bodhi.fedoraproject.org/updates/FEDORA-2017-f66b866adb Source tarballs are available for download at Download 389-ds-base Source <http://www.port389.org/binaries/389-ds-base-1.3.5.16.tar.bz2> and Download nunc-stans Source <http://www.port389.org/binaries/nunc-stans-0.1.8.tar.bz2>. Highlights in 1.3.5.16 * Secruity and Bug fixes and enhancements Installation and Upgrade See Download <http://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install, use *yum install 389-ds* yum install 389-ds After install completes, run *setup-ds-admin.pl* to set up your directory server. setup-ds-admin.pl To upgrade, use *yum upgrade* yum upgrade After upgrade completes, run *setup-ds-admin.pl -u* to update your directory server/admin server/console information. setup-ds-admin.pl -u See Install_Guide <http://www.port389.org/docs/389ds/legacy/install-guide.html> for more information about the initial installation, setup, and upgrade See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… as well as https://admin.fedoraproject.org/updates/389-ds-base-1.3.5.16-1.fc24 <https://admin.fedoraproject.org/updates/389-ds-base-1.3.5.15-1.fc24>. If you find a bug, or would like to see a new feature, file it in our Trac instance: https://pagure.io/389-ds-base/new_issue * Bump version to 1.3.5.16-1 * Issue 49188 - retrocl can crash server at shutdown * Issue 49179 - Missing components in 1.3.5 defaults.inf * Issue 48989 - Overflow in counters and monitor * Issue 49095 - targetattr wildcard evaluation is incorrectly case sensitive * Issue 49065 - dbmon.sh fails if you have nsslapd-require-secure-binds enabled * Issue 49157 - ds-logpipe.py crashes for non-existing users * Issue 49045 - Fix double-free in _cl5NewDBFile() error path * Issue 49170 - sync plugin thread count not handled correctly * Issue 49158 - fix latest coverity issues * Issue 49122 - Filtered nsrole that uses nsrole crashes the server * Issue 49121 - ns-slapd crashes in ldif_sput due to the output buf size is less than the real size. * Issue 49008 - check if ruv element exists * Issue 49016 - (un)register/migration/remove may fail if there is no suffix on ‘userRoot’ backend * Issue 49104 - Add CI test * Issue 49104 - dbscan-bin crashing due to a segmentation fault * Issue 49079 - deadlock on cos cache rebuild * Issue 49008 - backport 1.3.5 : aborted operation can leave RUV in incorrect state * Issue 47973 - custom schema is registered in small caps after schema reload * Issue 49088 - 389-ds-base rpm postinstall script bugs * Issue 49082 - Adjusted the CI test case to the fix. * Issue 49082 - Fix password expiration related shadow attributes * Issue 49080 - shadowExpire should not be a calculated value * Issue 49074 - incompatible nsEncryptionConfig object definition prevents RHEL 7->6 schema replication * Issue 48964 - should not free repl name after purging changelog * Issue 48964 - cleanallruv changelog purging removes wrong rid * Issue 49072 - fix log refactoring * Issue 49072 - validate memberof fixup task args * Issue 49071 - Import with duplicate DNs throws unexpected errors * Issue 47966 - CI test: added test cases for ticket 47966 * Issue 48987 - Heap use after free in dblayer_close_indexes * Issue 49068 - 1.3.5 use std c99 * Issue 49020 - do not treat missing csn as fatal * Issue 48133 - v2 Non tombstone entry which dn starting with “nsuniqueid=…,” cannot be delete * Issue 47911 - Move dirsrv-snmp.service to 389-ds-base-snmp package

1 0

Announcing 389 Directory Server version 1.3.6.1
by Mark Reynolds 10 Mar '17

10 Mar '17

389 Directory Server 1.3.6.1 The 389 Directory Server team is proud to announce 389-ds-base version 1.3.6.1 Fedora packages are available from the Fedora 26 and Rawhide repositories. The new packages and versions are: * 389-ds-base-1.3.6.1-2 Source tarballs are available for download at Download 389-ds-base Source <http://www.port389.org/binaries/389-ds-base-1.3.6.1.tar.bz2> Highlights in 1.3.6.1 * Security, Bug fixes, and enhancements Installation and Upgrade See Download <http://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install, use *yum install 389-ds* yum install 389-ds After install completes, run *setup-ds-admin.pl* to set up your directory server. setup-ds-admin.pl To upgrade, use *yum upgrade* yum upgrade After upgrade completes, run *setup-ds-admin.pl -u* to update your directory server/admin server/console information. setup-ds-admin.pl -u See Install_Guide <http://www.port389.org/docs/389ds/legacy/install-guide.html> for more information about the initial installation, setup, and upgrade See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! https://bodhi.fedoraproject.org/updates/FEDORA-2017-042d32a655 Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our Pagure project: https://pagure.io/389-ds-base * Bump version to 1.3.6.1 * Issue 49162 - Only check event.m4 if nunc-stans is enabled * Issue 49156 - Add more IDs and fix docstrings * Issue 49156 - Fix typo in the import * Ticket 49160 - Fix sds benchmark and copyright * Issue 47536 - Fix CI testcase * Issue 49159 - test_schema_comparewithfiles fails with python-ldap>=2.4.26 * Issue 49156 - Clean up test suites dir structure and docstrings * Issue 49158 - fix latest coverity issues * Ticket 49155 - Fix db2ldif path in test * Issue 49122 - Fix rpm build * Issue 49044 - Fix script usage and man pages * Ticket 48707 - Update rfc to accomodate that authid is mandatory * Ticket 49141 - Enable tcmalloc * Ticket 49142 - bytes vs unicode in plugin tests * Ticket 49139 - Update makefile and rpm for import * Ticket 49139 - Import libsds and nunc-stans for bundling * Issue 49122 - Filtered nsrole that uses nsrole crashes the server * Issue 49147 - Fix tests compatibility with older versions * Issue 49141 - Fix spec file for tcmalloc * Issue 49141 - Use tcmalloc by default * Ticket 49086 - SDN premangaling broken after SASL change * Ticket 49137 - Add sasl plain test - ds * Ticket 49138 - Increase systemd timout * Issue 48226 - Fix CI test * Ticket 49140 - Remove legacy inst reference in test * Ticket 49134 Remove hardcoded elements from db lock test * Fix compiler warning * Ticket 47925 - Move add and delete operation aci checks to be before plugins. * Ticket 49086 - public api compatability test for SDN changes. * Ticket 49116 - Pblock usage analytics * Ticket 49020 - Add CI test * Revise README for pagure * Ticket #49121 - ns-slapd crashes in ldif_sput due to the output buf size is less than the real size. * Ticket 48085 - Add replica acceptance test suite * Ticket 49008 - Fix regression in check if ruv element exists * Ticket 49108 - ds_selinux_port_query doesn’t detect ports labeled with range * Ticket 49057 - Fix tests failures on older versions of DS * Ticket 49111 - Integrate cmocka skeleton to Directory Server * Ticket 49016 - (un)register/migration/remove may fail if there is no suffix on ‘userRoot’ backend * Ticket 48085 - Add single master replication test suite * Ticket #49104 - Add CI test * Ticket #49104 - dbscan-bin crashing due to a segmentation fault * Ticket 49105 - Sig FPE when ns-slapd has 0 backends. * Ticket 49075 - Adjust log severity levels * Ticket 49008 - Add CI test * Ticket 49008 v2: aborted operation can leave RUV in incorrect state * Ticket 47973 - CI Test case (test_ticket47973_case) * Ticket 47973 - CI Test case (test_ticket47973_case) * Ticket 47973 - custom schema is registered in small caps after schema reload * Ticket 49089 - List library build deps * Ticket 49085 - Make a short topology fixture alias * Ticket #49088 - 389-ds-base rpm postinstall script bugs * Ticket 49028 - Autosize database cache by default. * Ticket 49089 - Fix invalid cxxlink statement from hpux * Ticket 49087 - ds resolve jenkins issues. * Ticket #49082 - Adjusted the CI test case to the fix. * Ticket #49082 - Fix password expiration related shadow attributes * Ticket #49080 - shadowExpire should not be a calculated value * Ticket 49027 - on secfailure do not store cleartext password content * Ticket 49031 - Improve memberof with a cache of ancestors for groups * Ticket 49079: deadlock on cos cache rebuild * Ticket 48665 - Fix RHEL6 test compatibility issues * Ticket 49055 - Fix create_test.py issues * Ticket 48797 - Add freebsd support to ns-slapd: main * Ticket 49055 - Refactor create_test.py * Ticket 49060 - Increase number of masters, hubs and consumers in topology * Ticket 49055 - Clean up test tickets and suites * Ticket 48964 - should not free repl name after purging changelog * Ticket 48050 - Refactor acctpolicy_plugin suite * Ticket 48964 - cleanallruv changelog purging removes wrong rid * Ticket 49073: nsDS5ReplicatedAttributeListTotal fails when excluding no attribute * Ticket 49074 - incompatible nsEncryptionConfig object definition prevents RHEL 7->6 schema replication * Ticket 48835 - package tests into python site packages - fix rpm * Ticket 49066 - Memory leaks in server - part 2 * Ticket 49072 - validate memberof fixup task args * Ticket 49071 - Import with duplicate DNs throws unexpected errors * Ticket 47858 - Add test case for nsTombstone * Ticket 48835 - Tests with setup.py.in * Ticket 49066 - Memory leaks in server * Ticket 47982 - Add CI test suite ds_logs * Ticket 49052 - Environment quoting on fedora causes ds to fail to start. * Ticket 47662 - Better input argument validation and error messages for cli tools * Ticket 48681 - logconv.pl lists sasl binds with no dn as anonymous * Ticket 48861: memberof plugin tests suite * Ticket 48861: Memberof plugins can update several times the same entry to set the same values * Ticket 48163 - Re-space schema.c * Ticket 48163 - Read schema from multiple locations * Ticket 48894 - improve entrywsi delete * Ticket 49051 - Enable SASL LOGIN/PLAIN support as a precursor to LDAPSSOTOKEN * Ticket 49020 - do not treat missing csn as fatal * Ticket 48133 v2 Non tombstone entry which dn starting with “nsuniqueid=…,” cannot be delete * Ticket 49055 - Clean up test suites * Ticket 48797 - Add freebsd support to ns-slapd: Configure and makefile. * Ticket 48797 - Add freebsd support to ns-slapd: Add freebsd support for ldaputil * Ticket 48797 - Add freebsd support to ns-slapd: Add support for dsktune * Ticket 48797 - Add freebsd support to ns-slapd: Add support for cpp in Fbsd * Ticket 48797 - Add freebsd support to ns-slapd: Header files * Ticket 48978 - Fix implicit function declaration * Ticket 49002 - Remove memset on allocation * Ticket 49021 - Automatic thread tuning * Ticket 48894 - Issues with delete of entrywsi with large entries. * Ticket 49054 - Fix sasl_map unused paramater compiler warnings. * Ticket 48050 - Add test suite to acctpolicy_plugin * Ticket 49048 - Fix rpm build failure * Ticket 49042 - Test failure that expects old default * Ticket 49042 - Increase cache defaults slightly * Ticket 48894 - Issue with high number of entry state objects. * Ticket 48978 - Fix more log refactoring issues * Ticket 48707 - Draft Ldap SSO Token proposal * Ticket 49024 - Fix the rest of the CI failures * Ticket #48987 - Heap use after free in dblayer_close_indexes * Ticket 48945 - Improve db2ldif error message. * Ticket 49024 - Fix inst_dir parameter in defaults.inf * Ticket 49024 - Fix dbdir paths and adjust test cases * Ticket 48961 - Allow reset of configuration values to defaults. * Ticket #47911 - Move dirsrv-snmp.service to 389-ds-base-snmp package * Ticket bz1358565 - Fix compiler warning about unused variable * Ticket bz1358565 - clear and unsalted password types are vulnerable to timing attack * Ticket 49016 - (un)register/migration/remove may fail if there is no suffix on ‘userRoot’ backend * Ticket 397 - Add PBKDF2 to Directory Server password storage. * Ticket 49024 - Fix CI test failures and defaults.inf * Ticket 49026 - Support nunc-stans pkgconfig * Ticket 49025 - Upgrade nunc-stans to 0.2.1 * Ticket 48978 - error log refactoring error * Ticket 49013 - Correct signal handling with NS in DS * Ticket 49017 - Various minor test failures * Ticket 48947 - Update default password hash to SSHA512 * Ticket 48328 - Add missing dependency * Ticket 49009 - args debug logging must be more restrictive * Ticket 49011 - Remove configure artifacts * Ticket 48272 - Fix compiler warnings for addn * Ticket 49014 - ns-accountstatus.pl shows wrong status for accounts inactivated by Account policy plugin * Ticket 48978 - Fine tune error logging * Ticket 48982 - Comment about resolving failure to open plugin. * Ticket 48272 - ADDN Sytle prebind plugin * Ticket 49012 - Removed un-used counters * Ticket 47703 - remove search limit for aci group evaluation * Ticket 48978 - Fix logging format errors and replace LDAP_DEBUG * Ticket 49006 - Nunc stans use DS stack size * Ticket 49007 - Update configure scripts * Ticket 48538 - Failed to delete old semaphore * Ticket 48978 - Build fails on i686 * Ticket 48909 - Replication stops working in FIPS mode * Ticket 49007 - Update DS basic test to better work with systemd. * Ticket 49006 - Enable nunc-stans by default. * Ticket 48978 - refactor LDADebug() to slapi_log_err() * Ticket 49005 - Update lib389 to work in containers correctly * Ticket 48982 - When plugin doesn’t enable, actually log the path it used * Ticket 48996 - Fix rpm to work with ns 0.2.0 * Ticket 48996 - remove unused variable. * Ticket 48996 - update DS for ns 0.2.0 * Ticket 48982 - One line fix, remove unused variable. * Ticket 48982 - Enabling a plugin that has a versioned so causes overflow * Ticket 48986 - 47808 triggers overflow in uiduniq.c * Ticket 48978 - Convert slapi_log_error() to a variadic macro * Ticket 48992: Total init may fail if the pushed schema is rejected * Ticket 48978 - Fix CI test to account for new logging format * Ticket 48978 - Update error logging with new codes * Ticket 48832 - Fix CI test suite for password min age * Ticket 48984 - Add lib389 paths module * Ticket 48983 - Configure and Makefile.in from new default paths work. * Ticket 48944 - on a read only replica invalid state info can accumulate * Ticket 48983 - generate install path info from autotools scripts * use a consumer maxcsn only as anchor if supplier is more advanced * Ticket 48921 - CI Replication stress tests have limits set too low * Ticket 48906 Allow nsslapd-db-locks to be configurable online * Ticket 47978 - Refactor slapi_log_error * Ticket48978 - refactor LDAPDebug() * Ticket 48978 - Update the logging function to accept sev level * Ticket 48414 - cleanAllRUV should clean the agreement RUV * Ticket 48979 - Strict Prototypes * Ticket 48979 - Allow to compile 389ds with warning Wstrict-prototypes * Ticket 142 - Refactor and move CI test * Ticket 48278 - cleanAllRUV should remove keep-alive entry * Ticket #48969 - nsslapd-auditfaillog always has an explicit path * Ticket 48957 - Update repl-monitor to handle new status messages * Ticket 48805 - Sign comparison checks. * Ticket #48896 - CI test: test case for ticket 48896 * Ticket #48896 - Default Setting for passwordMinTokenLength does not work * Ticket 48805 - Sign comparison checks. * Ticket 48805 - Misleading indent and Uninitialised struct member * Bump version to 1.3.6.0

1 0

Here is a stretch query......
by Paul Whitney 07 Mar '17

07 Mar '17

I asked earlier if I could set up replication between DS 9 and DS 10. Answer was favorable and in fact is working fine as part of my transition. Here is the stretch: Can I temporarily replicate from DS 8 to DS 10? Paul M. Whitney E-mail: paul.whitney(a)mac.com Sent from my browser.

2 1

password not expire 389
by tuan88＠gmail.com 06 Mar '17

06 Mar '17

Hi with the new 1.2.2-1 389* the user can resure the same password Again & Again, the passwordhistory stop to Work and not showing anymore. see my test below. It is the first time i get this kind of issue [root@centos6 ~]# rpm -qa|grep 389 389-console-1.1.7-1.el6.noarch 389-adminutil-1.1.19-1.el6.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-ds-1.2.2-1.el6.noarch 389-ds-base-libs-1.2.11.15-85.el6_8.x86_64 389-admin-1.1.35-1.el6.x86_64 389-admin-console-1.1.8-1.el6.noarch 389-ds-base-1.2.11.15-85.el6_8.x86_64 [root@centos6 scripts]# cat test_passwd_history.ksh #!/bin/ksh #Ldap test passwd if it is expired or not - tng 20170226 ldapsearch -xLLL -ZZ -b dc=nnit '(&(uid=tnng))' passwordRetryCount passwordExpWarned accountUnlockTime passwordExpirationTime passwordHistory createtimestamp modifytimestamp retryCountResetTime passwordAllowChangeTime nsRoleDN ldappasswd -s 123 -w 12345678 -x -ZZ -D cn='directory manager' cn='Tuan Nguyen,cn=unixtek,ou=Infrastructure,dc=nnit' [root@centos6 scripts]# ./test_passwd_history.ksh dn: cn=Tuan Nguyen,cn=unixtek,ou=Infrastructure,dc=nnit passwordExpWarned: 0 passwordExpirationTime: 19700101000000Z createtimestamp: 20170114110541Z modifytimestamp: 20170226085143Z [root@centos6 scripts]# ./test_passwd_history.ksh dn: cn=Tuan Nguyen,cn=unixtek,ou=Infrastructure,dc=nnit passwordExpWarned: 0 passwordExpirationTime: 19700101000000Z createtimestamp: 20170114110541Z modifytimestamp: 20170226091223Z [root@centos6 scripts]# ./test_passwd_history.ksh dn: cn=Tuan Nguyen,cn=unixtek,ou=Infrastructure,dc=nnit passwordExpWarned: 0 passwordExpirationTime: 19700101000000Z createtimestamp: 20170114110541Z modifytimestamp: 20170226091224Z [root@centos6 scripts]# policy [root@centos6 scripts]# ldapsearch -xLLL -ZZ -b cn='cn\3DnsPwPolicyEntry\2Cou\3DInfrastructure\2Cdc\3Dnnit,cn=nsPwPolicyContainer,ou=Infrastructure,dc=nnit' -s base '(&(objectclass=passwordpolicy))' dn: cn=cn\3DnsPwPolicyEntry\2Cou\3DInfrastructure\2Cdc\3Dnnit,cn=nsPwPolicyCon tainer,ou=Infrastructure,dc=nnit passwordStorageScheme: ssha passwordGraceLimit: 1 passwordChange: on passwordWarning: 86400 passwordMinAge: 0 passwordExp: on passwordMustChange: on passwordMaxAge: 86400 objectClass: ldapsubentry objectClass: passwordpolicy objectClass: top cn: cn=nsPwPolicyEntry,ou=Infrastructure,dc=nnit Policy settings from GUI: www.chezmoi.dk/389-passwd-not-expire.png

6 23

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users March 2017