389-users February 2021

389-users@lists.fedoraproject.org

16 participants
17 discussions

How to analyze large Multi Master Replication (test)-network?
by Eugen Lamers 28 Feb '21

28 Feb '21

We are testing scenarios with Multi Master Replication (MMR) with many replicas. We need to gather experience in this area. The current scenario is a star topology with one central server with replication agreements with all others, and the others only with the central server. It is scaled up to 63 servers replicating with the central server. To analyze the behaviour in certain situations we would like to have a reliable indicator for the status of the replications. What we found was the attribute nsds50ruv of the replication agreement. RedHat documentation says: Information about the replication topology — all of the suppliers which are supplying updates to each other and other replicas within the same replication group — is contained in a set of metadata called the replica update vector (RUV). The RUV contains information about the supplier like its ID and URL, its latest change state number for changes made on the local server, and the CSN of the first change. Both suppliers and consumers store RUV information, and they use it to control replication updates. 1. How is the attribute managed and used, and are there limitations for highly scaled MMR scenarios? 2. Is it necessary that all replicas of all servers in the MMR are listed in this attribute? Are the entries automatically distributed, and who controls this? 3. How do those entries have to look like for the certain server "types": certal servier with replication agreements to all others (1) resp. the "others" (2)? (1) {replicageneration} <ID> + n * {replica <replica ID> ldap://<FQDN>:389} (2) {replicageneration} <ID> + {replica <replica ID of central server> ldap://<FQDN of central server>:389} 4. Some entries end with some kind of IDs, possibly replication generation IDs, some don't. Why is that so? 5. What is the meaning of the identifier under the attribute nsruvreplicalastmodified; i.e: replica 1 ldap://<FQDN>:389} 00000000 6. What is a replication group and is that a way to help handling a highly scaled MMR scenario while limiting replication traffic and conflicts, or does "replication group" mean the complete network of the servers in the topology? 7. What must be the order to set up the MMR network? First set up all other MMR server and then setup the central server? 8. We have noticed that the entries are made only after a reboot of the central MMR server. Is this correct or are there other steps that are required to configure the MMR? Documentation read so far: [RHC 10, Ch. 3.1.16.12] : https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/h… [RHA 10, Ch. 15]: https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/h… https://www.port389.org/docs/389ds/design/csn-pending-lists-and-ruv-update.… https://directory.fedoraproject.org/docs/389ds/howto/howto-cleanruv.html Best regards, Eugen

3 2

Unindexed search
by Chase Miller 27 Feb '21

27 Feb '21

Why is a one letter wildcard search not hitting the index?...yet if you add two or more letters to the wildcard, the index is used. Yes cn does have 3 indexes on it. Example 26/Feb/2021:16:33:51.189998029 -0600] - NOTICE - ldbm_back_search - Unindexed search: search base="cn=users,o=Xxxxxx,O=Xxxx" scope=1 filter="(cn=a*)" conn=3 op=18 Yet if the filter is ab* it uses the index

3 2

Is there a good method for bootstrapping the global config settings without managing the entire dse.ldif?
by Trevor Vaughan 18 Feb '21

18 Feb '21

Hi All, I'm currently working around this through a LOT of ldapmodify commands, but I'd like to know if I'm missing an obvious method for populating select instance global configuration options at build time. Thanks, Trevor -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information --

2 3

Plugin for enforcing minimum attribute length
by Jan Tomasek 16 Feb '21

16 Feb '21

Hi, is there any plugin for enforcing minimum attribute length? I never needed such thing, but now it would be nice to be able to enforce min 3 characters for dc attribute in one subtree. Is it possible? Thanks -- ----------------------- Jan Tomasek aka Semik http://www.tomasek.cz/

3 2

Announcing 389 Directory Server 1.4.4.13
by Mark Reynolds 12 Feb '21

12 Feb '21

389 Directory Server 1.4.4.13 The 389 Directory Server team is proud to announce 389-ds-base version 1.4.4.13 Fedora packages are available on Fedora 33. Fedora 33: https://koji.fedoraproject.org/koji/taskinfo?taskID=61840324 <https://koji.fedoraproject.org/koji/taskinfo?taskID=61840324> - Koji https://bodhi.fedoraproject.org/updates/FEDORA-2021-23690b2925 <https://bodhi.fedoraproject.org/updates/FEDORA-2021-23690b2925> - Bohdi The new packages and versions are: * 389-ds-base-1.4.4.13-1 Source tarballs are available for download at Download 389-ds-base Source <https://github.com/389ds/389-ds-base/archive/389-ds-base-1.4.4.13.tar.gz> Highlights in 1.4.4.13 * Bug and Security fixes Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… <https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o…> If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base <https://github.com/389ds/389-ds-base> * Bump version to 1.4.4.13 * Update dscontainer (#4564) * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607) * Issue 4324 - Some architectures the cache line size file does not exist * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614) * Issue 4609 - CVE - info disclosure when authenticating -- 389 Directory Server Development Team

1 0

Announcing 389 Directory Server 1.4.3.20
by Mark Reynolds 12 Feb '21

12 Feb '21

389 Directory Server 1.4.3.20 The 389 Directory Server team is proud to announce 389-ds-base version 1.4.3.20 Fedora packages are available on Fedora 32. https://koji.fedoraproject.org/koji/taskinfo?taskID=61841707 <https://koji.fedoraproject.org/koji/taskinfo?taskID=61841707> - Fedora 32 The new packages and versions are: * 389-ds-base-1.4.3.20-1 Source tarballs are available for download at Download 389-ds-base Source <https://github.com/389ds/389-ds-base/archive/389-ds-base-1.4.3.20.tar.gz> Highlights in 1.4.3.20 * Bug and Security fixes Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. New UI Progress (Cockpit plugin) The new UI is complete and QE tested. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… <https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o…> If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base <https://github.com/389ds/389-ds-base> * Bump version to 1.4.3.20 * Issue 4324 - Some architectures the cache line size file does not exist * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614) -- 389 Directory Server Development Team

1 0

Announcing 389 Directory Server 2.0.3
by Mark Reynolds 12 Feb '21

12 Feb '21

389 Directory Server 2.0.3 The 389 Directory Server team is proud to announce 389-ds-base version 2.0.3 Fedora packages are available on Fedora 34 Fedora 34: https://koji.fedoraproject.org/koji/taskinfo?taskID=61843474 <https://koji.fedoraproject.org/koji/taskinfo?taskID=61843474> The new packages and versions are: * 389-ds-base-2.0.3-1 Source tarballs are available for download at Download 389-ds-base Source <https://github.com/389ds/389-ds-base/archive/389-ds-base-2.0.3.tar.gz> Highlights in 2.0.3 * Bug & security fixes Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… <https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o…> If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base <https://github.com/389ds/389-ds-base> * Bump version to 2.0.3 * Issue 4619 - remove pytest requirement from lib389 * Issue 4615 - log message when psearch first exceeds max threads per conn * Issue 4469 - Backend redesing phase 3a - implement dbimpl API and use it in back-ldbm (#4618) * Issue 4324 - Some architectures the cache line size file does not exist * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614) * Issue 4469 - Backend redesign phase 3a - bdb dependency removal from back-ldbm * PR 4564 - Update dscontainer * Issue 4149 - UI - port TreeView and opther components to PF4 * Issue 4577 - Add GitHub actions * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607) * issue 4612 - Fix pytest fourwaymmr_test for non root user (#4613) * Issue 4609 - CVE - info disclosure when authenticating * Issue 4348 - Add tests for dsidm * Issue 4571 - Stale libdb-utils dependency * Issue 4600 - performance modify rate: reduce lock contention on the object extension factory (#4601) * Issue 4577 - Add GitHub actions * Issue 4588 - BUG - unable to compile without xcrypt (#4589) * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584) * Issue 4581 - A failed re-indexing leaves the database in broken state (#4582) * Issue 4348 - Add tests for dsidm * Issue 4577 - Add GitHub actions * Issue 4563 - Failure on s390x: ‘Fails to split RDN “o=pki-tomcat-CA” into components’ (#4573) * Issue 4093 - fix compiler warnings and update doxygen * Issue 4575 - Update test docstrings metadata * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553) * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569) * Issue 4513 - Add DS version check to SSL version test (#4570) * Issue 5442 - Search results are different between RHDS10 and RHDS11 * Issue 4396 - Minor memory leak in backend (#4558) * Issue 4513 - Fix replication CI test failures (#4557) * Issue 4513 - Fix replication CI test failures (#4557) * Issue 4153 - Added a CI test (#4556) * Issue 4506 - BUG - fix oob alloc for fds (#4555) * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation * Issue 4506 - Temporary fix for io issues (#4516) * Issue 4535 - lib389 - Fix log function in backends.py * Issue 4534 - libasan read buffer overflow in filtercmp (#4541) * Issue 4544 - Compiler warnings on krb5 functions (#4545) * Update rpm.mk for RUST tarballs -- 389 Directory Server Development Team

1 0

Announcing 389 Directory Server 1.4.3.19
by thierry bordaz 11 Feb '21

11 Feb '21

389 Directory Server 1.4.3.19 The 389 Directory Server team is proud to announce 389-ds-base version 1.4.3.19 Fedora packages are available on Fedora 32. https://koji.fedoraproject.org/koji/taskinfo?taskID=61767145 <https://koji.fedoraproject.org/koji/taskinfo?taskID=61767145> - Fedora 32 https://bodhi.fedoraproject.org/updates/FEDORA-2021-e55a8d7545 <https://bodhi.fedoraproject.org/updates/FEDORA-2021-e55a8d7545> - Bodhi The new packages and versions are: * 389-ds-base-1.4.3.19-1 Source tarballs are available for download at Download 389-ds-base Source <https://github.com/389ds/389-ds-base/archive/389-ds-base-1.4.3.19.tar.gz> Highlights in 1.4.3.19 * Bug and Security fixes Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. New UI Progress (Cockpit plugin) The new UI is complete and QE tested. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base * bump version to 1.4.3.19 * Issue 4609 - CVE - info disclosure when authenticating * Issue 4581 - A failed re-indexing leaves the database in broken state (#4582) * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584) * Issue 4563 - Failure on s390x: ‘Fails to split RDN “o=pki-tomcat-CA” into components’ (#4573) * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553) * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569) * Issue 5442 - Search results are different between RHDS10 and RHDS11 * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation * Issue 4513 - Fix schema test and lib389 task module (#4514) * Issue 4534 - libasan read buffer overflow in filtercmp (#4541)

1 0

Any benefit to extracting the PEM files?
by Trevor Vaughan 10 Feb '21

10 Feb '21

I noticed that the server was extracting the PEM files from the keystore by default and was wondering if there was really any use for this being on by default. The relevant setting is nsslapd-extract-pemfiles. Thanks, Trevor -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information --

2 4

Disable LDAPv2
by Sahin, Erhan 09 Feb '21

09 Feb '21

Hello everyone, is it possible to deactivate LDAPv2 completely on server side and only allow LDAPv3? Stay safe! Best regards

3 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users February 2021