October 2007 - 389-users - Fedora mailing-lists

[Fedora-directory-users] Centos5 does not install
by Maurizio Marini 28 Feb '08

28 Feb '08

As stated clearly here: http://www.mail-archive.com/fedora-directory-users@redhat.com/msg02579.html linux distro should be support apache 2.0 not 2.2 m.

3 3

Re: [Fedora-directory-users] Can't locate CSN in Multi-Master replica
by Dael Maselli 19 Nov '07

19 Nov '07

> Do you have a changelog configured on B? Is B configured as a multiple master? Is the replica ID for B different than A? Yes to all. I hope it's an error of mine, we are planning a big reorganization of our Authentication and Authorization Infrastructure, FDS seems to be great for our needs. I think it is a misconfiguration and maybe it work if I reinstall FDS, but i need to understand what's happening. Thank you. -- ___________________________________________________________________ Dael Maselli --- INFN-LNF Computing Service -- +39.06.9403.2214 ___________________________________________________________________ Democracy is two wolves and a lamb voting on what to have for lunch ___________________________________________________________________

2 14

[Fedora-directory-users] samba + PDC + FDS
by Satish Patel 06 Nov '07

06 Nov '07

dear all it is possible to implement samba as PDC + FDS and it will give fully functionality like Win 2003 DC ?? Regards $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- Forgot the famous last words? Access your message archive online. Click here.

2 1

[Fedora-directory-users] Admin Server with multiple Directory servers
by Matt Wells 31 Oct '07

31 Oct '07

I have 4 directory servers. I would really like to just run the admin-serv on one and let that interface control the others. How do I do that?

2 3

[Fedora-directory-users] RSA integration?
by Matt Wells 31 Oct '07

31 Oct '07

Has anyone used directory server with the RSA keyfobs for two factor authentication? Do I need to extend the schema? What do you think?

1 0

[Fedora-directory-users] setting up AIX clients with fds
by Maria Tsiolakki 31 Oct '07

31 Oct '07

Has anyone set-up an IBM AIX ver5.2 client to work with fds? regards Maria

2 1

[Fedora-directory-users] Question about caseIgnoreIA5Match
by Balaji Ganesan 31 Oct '07

31 Oct '07

I have the following entry in my schema, attributeTypes: ( someOID NAME ( 'mailAddress' ) DESC 'mailAddress' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) This attribute is indexed, using information below. dn: cn=mailAddress,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config objectClass:top objectClass:nsIndex cn:mailCurrentAddress nsSystemIndex:false nsIndexType:eq In our sample db, we have mailAddress set to foo(a)bar.com. When I run ldapsearch with mailAddress=foo(a)bar.com, it returns 1 record. When I search with mailAddres=Foo(a)bar.com I get 0 entries back. What do I need to change for FDS to perform a case-insensitive search? I tried changing my attribute type to directory string and equalit to caseIgnoreMatch and got the same results. Thanks in advance.

2 1

[Fedora-directory-users] show uesr's hash password
by Elisa Pellegrini 31 Oct '07

31 Oct '07

Hi! I want see user password. When I use console to create a new user in my ldap tree I can set user's password. FDS encrypt password automatically with the hash functione that I choose (in particular with SSHA) when I use ldapsearch -x "uid=SCarter" I see all SCarter attribute but not his password. Form me is important to see the hash of password: how can I do? I have an other question: what is the function of the attribute "nsuniqueid" Thanks!

2 1

[Fedora-directory-users] Problem with AES
by Andreas Kekkou 30 Oct '07

30 Oct '07

Hi all, I'm running FDS in multi-master mode with two servers. Both servers are configured with TLS support. One of the servers logs the following error: [25/Oct/2007:08:50:55 +0300] - attrcrypt_unwrap_key: failed to unwrap key for cipher AES [25/Oct/2007:08:50:55 +0300] - Failed to retrieve key for cipher AES in attrcrypt_cipher_init [25/Oct/2007:08:50:55 +0300] - Failed to initialize cipher AES in attrcrypt_init [25/Oct/2007:08:50:55 +0300] - attrcrypt_unwrap_key: failed to unwrap key for cipher AES [25/Oct/2007:08:50:55 +0300] - Failed to retrieve key for cipher AES in attrcrypt_cipher_init [25/Oct/2007:08:50:55 +0300] - Failed to initialize cipher AES in attrcrypt_init [25/Oct/2007:08:50:57 +0300] - slapd started. Listening on All Interfaces port 389 for LDAP requests [25/Oct/2007:08:50:57 +0300] - Listening on All Interfaces port 636 for LDAPS requests Both servers seems to work just fine. Any ideas how this can be resolved? Thanks, Andreas

2 5

Re: [Fedora-directory-users] problem with certificate
by Elisa Pellegrini 30 Oct '07

30 Oct '07

Sorry but I work with certificate last month an I don't remember the error. I don't solve problem but now is necessary to work with cert. I follow the guide and everything in cert installation seems correct but when I restart everything the messages is something like Ldap_sasl error. Can you help me? ---------- Initial Header -----------

2 1

[Fedora-directory-users] problem with certificate
by Elisa Pellegrini 30 Oct '07

30 Oct '07

Hi! I have some problem with certificate. I'm using Fc6 and here I install FDS. I follow the guide " Obtaining and Installing Server Certificates " and "Enabling SSL in the Directory Server, Admin Server, and Console" with console. Everything seems correct but when I estart the Admin Server and Directory Server from the command-line an error message appear and is impossible for me to restart server end console. What is the problem? Can You help me? Thanks!

2 1

[Fedora-directory-users] netscape error
by Zahra Bahar 30 Oct '07

30 Oct '07

Hi all, I installed fedora-ds-1.0.4-1 and j2re-1.4.2_16-fcs. but now when I want to connect to the console there is this error: can not connect to the directory server: netscape.ldap.LDAPException:error result(34);invalid DN; invalid DN syntax what is wrong?what should I do? thanks

2 1

[Fedora-directory-users] Problem with getting FDS and AD to sync
by Timothy Hunt 26 Oct '07

26 Oct '07

I've taken over control of an FDS and an AD server which had been set up before I got to it. I'm still fairly new to LDAP and related things. I come from a unix background rather than windows. At some point, users put into FDS were replicated on the AD server correctly. Subsequently, the flat "structure" of the users in FDS was improved to be more hierarchical. However, new users added into FDS are not being added into AD. I'm also not familiar enough with AD to know where to see the OU structure that is present in FDS in AD. I'm not even sure if AD would have that structure. I'm at a bit of a loss as to how to start diagnosing where the problem is, let alone fixing it. I've looked at http://directory.fedoraproject.org/wiki/ Howto:WindowsSync but as that is focussed on setting it up initially, I'm not sure how much of it applies. Help on how to start solving this welcomed. Timothy

2 7

[Fedora-directory-users] Can't locate CSN in Multi-Master replica
by Dael Maselli 26 Oct '07

26 Oct '07

Hi all, I have a multiple master configured with SSL Authentication, it seemed to work correctly, but since a moment (I don't know when) it gave me errors and it doesn't work anymore. When I try to do an update from A to B it works, but from B to A I get this in the B log: [26/Oct/2007:16:53:08 +0200] agmt="cn=B-A" (A:636) - Can't locate CSN 47220f50000000020000 in the changelog (DB rc=-30990). The consumer may need to be reinitialized. The A logs is: [26/Oct/2007:16:47:09 +0200] conn=17 SSL 256-bit AES; client CN=B,L=Lecce,OU=Host,O=INFN,C=IT; issuer CN=INFN CA,O=INFN,C=IT [26/Oct/2007:16:47:09 +0200] conn=17 SSL client bound as cn=B,cn=config [26/Oct/2007:16:47:09 +0200] conn=17 op=0 BIND dn="" method=sasl version=3 mech=EXTERNAL [26/Oct/2007:16:47:09 +0200] conn=17 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=B,cn=config" [26/Oct/2007:16:47:09 +0200] conn=17 op=1 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [26/Oct/2007:16:47:09 +0200] conn=17 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [26/Oct/2007:16:47:09 +0200] conn=17 op=2 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [26/Oct/2007:16:47:09 +0200] conn=17 op=2 RESULT err=0 tag=101 nentries=1 etime=0 [26/Oct/2007:16:47:09 +0200] conn=17 op=3 EXT oid="2.16.840.1.113730.3.5.3" name="Netscape Replication Start Session" [26/Oct/2007:16:47:09 +0200] conn=17 op=3 RESULT err=0 tag=120 nentries=0 etime=0 [26/Oct/2007:16:47:10 +0200] conn=17 op=4 EXT oid="2.16.840.1.113730.3.5.5" name="Netscape Replication End Session" [26/Oct/2007:16:47:10 +0200] conn=17 op=4 RESULT err=0 tag=120 nentries=0 etime=0 as you can see there isn't the MOD line If I try to reinitialize A I get this error on B: NSMMReplicationPlugin - replica_reload_ruv: Warning: new data for replica dc=infn,dc=it does not match the data in the changelog. Recreating the changelog file. This could affect replication with replica's consumers in which case the consumers should be reinitialized. the parts exchanges and I can do updates from B to A and not from A to B. I tried to delete changelog as I read on the manual, also tried to delete and recreate all the replica and agreements but no way to get it work! Thank you! Dael. -- ___________________________________________________________________ Dael Maselli --- INFN-LNF Computing Service -- +39.06.9403.2214 ___________________________________________________________________ Democracy is two wolves and a lamb voting on what to have for lunch ___________________________________________________________________

2 1

[Fedora-directory-users] Windows Sync only works one way
by Glenn 25 Oct '07

25 Oct '07

I set up a Windows Sync agreement between Fedora Directory and Windows NT, but it only works one way. If I change the "description" attribute in FD and click "Send and Receive Updates", nothing happens. If I click "Send and Receive Updates" again, the description in FD is overwritten by the older description in NT. If I change the description in NT, it is immediately changed in FD. The same thing happens if I do a full resync. What possible causes could result in this one-way sync behavior? The one-way problem seems limited to our production NT server. I set up replication on a test system, and it works correctly. Thanks for any suggestions. -Glenn.

1 0

[Fedora-directory-users] gentoo and web console
by Kirill Petrov 25 Oct '07

25 Oct '07

Hello everybody, I installed FDS on Gentoo 2007.0 using the instructions provided at this url: http://gentoo-wiki.com/HOWTO_Install_Fedora_Directory_Server I did everything according to the manual except that I installed apache 2.2.6 and had to modify httpd.conf to load cgid module instead of cgi module. In general everything seems to work but when I tried to use the web console Fedora Administration Express <http://ld.farheap.com:46406/admin-serv/tasks/configuration/HTMLAdmin?op=ind…> it gave me a blank screen with a message: NMC_Status: 1 NMC_ErrType: NMC_ErrInfo: NMC_ErrDetail: The organization charts functionality does not work either, it gives me: Internal Server Error The server encountered an internal error or misconfiguration and was unable to complete your request. Please contact the server administrator, [no address given] and inform them of the time the error occurred, and anything you might have done that may have caused the error. More information about this error may be available in the server error log. The logs have the following records: Can't load '/opt/fedora-ds/lib/perl/arch/auto/Mozilla/LDAP/API/API.so' for module Mozilla::LDAP::API: libssl3.so: cannot open shared object file: No such file or di\ rectory at /usr/lib/perl5/5.8.8/i686-linux/DynaLoader.pm line 230. at /opt/fedora-ds/lib/perl/Mozilla/LDAP/Utils.pm line 32 Compilation failed in require at /opt/fedora-ds/lib/perl/Mozilla/LDAP/Utils.pm line 32. BEGIN failed--compilation aborted at /opt/fedora-ds/lib/perl/Mozilla/LDAP/Utils.pm line 32. Compilation failed in require at /opt/fedora-ds/lib/perl/Mozilla/LDAP/Conn.pm line 36. BEGIN failed--compilation aborted at /opt/fedora-ds/lib/perl/Mozilla/LDAP/Conn.pm line 36. Compilation failed in require at /opt/fedora-ds/clients/orgchart/bin/org line 79. BEGIN failed--compilation aborted at /opt/fedora-ds/clients/orgchart/bin/org line 79. [Wed Oct 24 08:15:01 2007] [error] [client 192.168.11.10] Premature end of script headers: org, referer: http://ld:46406/clients/orgchart/html/topframe.\ html Does anybody know how to install Fedora Directory Server properly on Gentoo? thanks, Kirill

2 5

[Fedora-directory-users] backup/dump--restore/import
by Linux Admin 24 Oct '07

24 Oct '07

Please forgive the newbee question here. What is the best way to backup/dump--restore/import a fedora ldap server (without downtime) TIA

4 19

[Fedora-directory-users] mandated TLS connections
by John gray 22 Oct '07

22 Oct '07

---------- Forwarded message ---------- From: John gray <gnulinux9(a)googlemail.com> Date: Oct 22, 2007 5:16 PM Subject: mandated TLS connections To: fedora-directory-users(a)redhat.com Hi all, I migrated from openldap to redhat directory server. In openldap I mandated TLS connections ie: [root@bjoshi ~]# ldapsearch -x -h 10.1.1.8 uid=bjoshi ldap_bind: Confidentiality required (13) additional info: TLS confidentiality required [root@bjoshi ~]# ldapsearch -x -LL -ZZ -h 10.1.1.8 uid=bjoshi mail version: 1 dn: uid=bjoshi,ou=people,dc=example,dc=com mail: bjoshi(a)example.com Below ioption in /etc/openldap/slapd.conf for enforcing. security ssf=128 update_ssf=128 simple_bind=128 update_tls=128 tls=128 On the rhds machines tls works, but it also allows plain text searches. Can anyone suggest configuration in rhds to force tls search only Also note, follow the below documentation http://directory.fedoraproject<http://directory.fedoraproject.org/wiki/Howto:SSL#Configure_LDAP_clients> .org/wiki/Howto:SSL#Configure_LDAP_clients <http://directory.fedoraproject.org/wiki/Howto:SSL#Configure_LDAP_clients> and enabling nsServerSecurity: on does not solve the problem. Only SSL is not option Regards, Bhargav

2 1

[Fedora-directory-users] Samba schema
by Matthias Dieter Wallnöfer 20 Oct '07

20 Oct '07

Hi! I asked myself many times why the Fedora Directory Server isn't bundeled with a schema for Samba 3. I think, this is nearly as important as the RFC and Java schema, because many people use this software in combination with Samba. So, is there a special reason why this wasn't done yet? Maybe a second step would be to write a Samba-Plugin for the management console. Matthias

1 0

[Fedora-directory-users] Virtual Views problem
by Fabrice Durand 17 Oct '07

17 Oct '07

Hi, i try to understand what's wrong with my virtual views. I've got an 'ou' where all my users are (ou=People,dc=test,dc=fr) So i create a virtual views with différent ou with objectclass : nsview and with nsViewFilter: (something) like this: dn: ou=entreprise,ou=annuaire,dc=test,dc=fr modifytimestamp: 20071005102053Z modifiersname: cn=directory manager ou: Cap l'Orient objectClass: organizationalUnit objectClass: top objectClass: nsview creatorsname: cn=directory manager createtimestamp: 20060130145928Z nsuniqueid: fad66382-1dd111b2-8076e5f7-b3860000 parentid: 323 entryid: 324 entrydn: ou=entreprise,ou=annuaire,dc=test,dc=fr numsubordinates: 8 subschemasubentry: cn=schema hassubordinates: TRUE dn: ou=Services Fonctionnels,ou=entreprise,ou=annuaire,dc=test,dc=fr modifytimestamp: 20071008122956Z modifiersname: cn=directory manager nsViewFilter: (departmentnumber=DGSF*) objectClass: organizationalUnit objectClass: top objectClass: nsview ou: DG Services Fonctionnels creatorsname: cn=directory manager createtimestamp: 20060130145928Z nsuniqueid: fad66383-1dd111b2-8076e5f7-b3860000 parentid: 324 entryid: 325 entrydn: ou=services fonctionnels,ou=entreprise,ou=annuaire,dc=test,dc=fr numsubordinates: 3 subschemasubentry: cn=schema hassubordinates: TRUE dn: ou=Ressources Humaines,ou=Services Fonctionnels,ou=entreprise,ou=annuaire,dc=test,dc=fr modifytimestamp: 20071005102032Z modifiersname: cn=directory manager nsViewFilter: (departmentnumber=DGSF-RH) objectClass: organizationalUnit objectClass: top objectClass: nsview ou: Ressources humaines creatorsname: cn=directory manager createtimestamp: 20060130145928Z nsuniqueid: fad66384-1dd111b2-8076e5f7-b3860000 parentid: 325 entryid: 326 entrydn: ou=ressources humaines,ou=services fonctionnels,ou=entreprise,ou=annuaire,dc=test,dc=fr numsubordinates: 0 subschemasubentry: cn=schema hassubordinates: FALSE .... The problem is when it try to get all the hierarchy with a perl script or with php under ou=entreprise,ou=annuaire,dc=test,dc=fr , FDS doesn't return all the ou. (with phpldapadmin i can see the hierarchy) The perl script i use to get all the hierarchy: use Net::LDAP; use Switch; $ldup = Net::LDAP->new( '127.0.0.1' ) or die "$@"; $masg = $ldup->bind ; # an anonymous bind $masg = $ldup->search( # perform a search base => "ou=entreprise,ou=annuaire,dc=caplorient,dc=com", scope => 'sub', filter => "(objectClass=nsview)" ); $masg->code && die $masg->error; foreach $entry ($masg->entries) { $uid=$cn=$givenname=$mail=$sn="NULL"; $dn=$entry->dn(); foreach $attr ($entry->attributes) { if($attr eq ou) { $uid=$entry->get_value($attr); print $dn."\n"; print $uid."\n"; } } } $mesg = $ldup->unbind; # take down session If anyone has got the same type of problem , thank you in advance for the answer Fabrice

2 2

[Fedora-directory-users] Testing FDS 1.1
by carlopmart 17 Oct '07

17 Oct '07

Hi all, As fedora web says: "The code has been completed for the new features in Fedora DS 1.1. Our focus now is on whittling down the bug list, testing, and updating the documentation". From where can I download a test release?? Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

1 0

[Fedora-directory-users] Windows Sync and displayname Attribute
by Glenn 16 Oct '07

16 Oct '07

We are trying to populate Active Directory using Fedora Directory and Windows Sync. It works great if we make sure the FD data is in a format that AD will accept. There is one hitch -- we need to fill the displayname attribute in AD, since this will be used by our new Exchange address book. I tried adding the "displayname" attribute to an FD user record, but it doesn't replicate to AD, even after a full resync. Can anyone suggest how this could be done? Thanks. -Glenn.

1 0

[Fedora-directory-users] Automatically Full Re-syncronization Windows Synchronization agreement
by Fernando Muñoz 15 Oct '07

15 Oct '07

Hi, I have installed FDS-1.0.4 with a Windows Synchronization agreement against a Windows 2003 Domain Controller. If the directory it's shutdown (stop or fallback), when I start it, I have initiated Full Re-syncronization manually from console, because appear this error-log: [11/Oct/2007:14:02:08 +0200] NSMMReplicationPlugin - agmt="cn=GRS_ppal-GRS_DA" (10:636): Replica has no update vector. It has never been initialized. Is it posible initialized automatically this agreement, with a special attribute in the Synchronization agreement ldap entry? or in the init script? How? I review the "CLI" and I don't find the attribute to initialized automatically this agreement. thanks,

1 0

[Fedora-directory-users] AD with FDS with Dovecot
by Esteban Torres Rodriguez 15 Oct '07

15 Oct '07

I have installed my synchronous AD with FDS without no problem. The users I create all in AD. I want to install Postfix+Dovecot autenticando against FDS, but when I create a user in AD and synchronizes with FDS does not put the attributes to me to maildir, posixAccount, mailRecipient, etc... As I can solve this? If I synchronize of FDS to AD they appear to me? As I can modify the AD scheme? I need aid on this. Excuse for my english. Esteban Torres Rodríguez ÁREA DE SOPORTE TÉCNICO - Administración de Servidores Subdirección de Sistemas Informáticos Empresa Pública Desarrollo Agrario y Pesquero, email: etorres(a)dap.es

2 2

[Fedora-directory-users] Missing tasks directory
by Martin Eckel 12 Oct '07

12 Oct '07

2 5

[Fedora-directory-users] samba password change error
by Agnaldo Freitas 11 Oct '07

11 Oct '07

Hi everybody! After several tips in relation to the correct way of configuring samba with Fedora-DS, everything was going well. But a few days a go, i was trying to configure the CUPS, and as it did not initiate then i tried to remove it, reinstall it, and to update it with the commands "yum remove cups*", "yum install cups" and "yum update cups*". Since then, i observed that the "password change"(syncronism) stopped to function with an old error message (you don't have permission to change the password). Here, the passwords synchronization between samba and Fedora-DS only worked with "pam password": It will be that someone can help me? This is the configuration that functioned normally until i reinstalled the CUPS. (because, it is the only different thing that "i remember" i can have done). /etc/samba/smb.conf ## Sincronizacao de senhas samba com Linux via windows # ldap passwd sync = yes # here fails, i think it was because FDS doesn't have plugin for "pam_password exop" option. pam password change = yes unix password sync = Yes passwd chat = *New*password* %n *Retype*new*password* %n *passwd:*all*authentication*tokens*updated*successfully* passwd program = /usr/sbin/smbldap-passwd -u %u obey pam restrictions = no /etc/ldap.conf base dc=sei,dc=intranet host 192.168.2.3 rootbinddn cn=Directory Manager # It was my only problem in the past, i forgot this line! timelimit 120 pam_lookup_policy yes ssl no pam_password crypt /etc/nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap hosts: files dns bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files ldap rpc: files services: files ldap netgroup: files ldap publickey: nisplus automount: files ldap aliases: files nisplus /etc/openladap/ldap.conf URI ldap://127.0.0.1/ BASE dc=sei,dc=intranet /etc/pam.d/system-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so likeauth nullok auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_succeed_if.so uid < 100 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so retry=3 password sufficient pam_unix.so md5 shadow nullok use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so session required pam_limits.so session required pam_unix.so session optional pam_ldap.so Grateful for your attention, Agnaldo

1 0

[Fedora-directory-users] DB Recovery Help?
by Greg Copeland 11 Oct '07

11 Oct '07

I have two LDAP servers operating in a replication mode. This morning I found the replicated server is no longer running. I tried to restart it and I get this in the logs/errors files. How do I recovery my database? Fedora-Directory/1.0.2 B2006.060.1928 eng2.efjdfw.local:389 (/opt/fedora-ds/slapd-engldap2) [11/Oct/2007:08:56:29 -0500] - Fedora-Directory/1.0.2 B2006.060.1928 starting up [11/Oct/2007:08:56:29 -0500] - Detected Disorderly Shutdown last time Directory Server was running, recovering database. [11/Oct/2007:08:56:29 -0500] - libdb: Ignoring log file: /opt/fedora-ds/slapd-engldap2/db/log.0000000137: magic number 0, not 40988 [11/Oct/2007:08:56:30 -0500] - libdb: Invalid log file: log.0000000137: Invalid argument [11/Oct/2007:08:56:30 -0500] - libdb: First log record not found [11/Oct/2007:08:56:30 -0500] - libdb: PANIC: Invalid argument [11/Oct/2007:08:56:30 -0500] - Database Recovery Process FAILED. The database is not recoverable. err=-30978: DB_RUNRECOVERY: Fatal error, run database recovery [11/Oct/2007:08:56:30 -0500] - Please make sure there is enough disk space for dbcache (10485760 bytes) and db region files [11/Oct/2007:08:56:30 -0500] - start: Failed to init database, err=-30978 DB_RUNRECOVERY: Fatal error, run database recovery [11/Oct/2007:08:56:30 -0500] - Failed to start database plugin ldbm database [11/Oct/2007:08:56:30 -0500] - WARNING: ldbm instance userRoot already exists [11/Oct/2007:08:56:30 -0500] binder-based resource limits - nsLookThroughLimit: parameter error (slapi_reslimit_register() already registered) [11/Oct/2007:08:56:30 -0500] - start: Resource limit registration failed [11/Oct/2007:08:56:30 -0500] - Failed to start database plugin ldbm database [11/Oct/2007:08:56:30 -0500] - Error: Failed to resolve plugin dependencies [11/Oct/2007:08:56:30 -0500] - Error: preoperation plugin 7-bit check is not started [11/Oct/2007:08:56:30 -0500] - Error: accesscontrol plugin ACL Plugin is not started [11/Oct/2007:08:56:30 -0500] - Error: preoperation plugin ACL preoperation is not started [11/Oct/2007:08:56:30 -0500] - Error: postoperation plugin Class of Service is not started [11/Oct/2007:08:56:30 -0500] - Error: preoperation plugin HTTP Client is not started [11/Oct/2007:08:56:30 -0500] - Error: database plugin ldbm database is not started [11/Oct/2007:08:56:30 -0500] - Error: object plugin Legacy Replication Plugin is not started [11/Oct/2007:08:56:30 -0500] - Error: object plugin Multimaster Replication Plugin is not started [11/Oct/2007:08:56:30 -0500] - Error: preoperation plugin Pass Through Authentication is not started [11/Oct/2007:08:56:30 -0500] - Error: postoperation plugin referential integrity postoperation is not started [11/Oct/2007:08:56:30 -0500] - Error: postoperation plugin Roles Plugin is not started [11/Oct/2007:08:56:30 -0500] - Error: object plugin Views is not started Best Regards, Greg Copeland

1 0

[Fedora-directory-users] Howto issue Fedora-ds with an Microsoft Active Directory Enterprise Certificate
by Anthony Giggins 10 Oct '07

10 Oct '07

Can anyone tell me how I issue my Fedora-ds with a Microsoft Active Directory Enterprise Certificate Authority? As suggested in http://directory.fedoraproject.org/wiki/Howto:WindowsSync#Enabling_SSL_W ith_Fedora_Directory_Server Note: Its always better to use the same Certificate Authority to issue certificates to both Fedora Directory Server and Active Directory to minimize any trust issues that might occur. I already have my Microsoft Enterprise Certificate Authority imported into CA Certs in Fedora Management Console but how can I create a server certificate for my fedora directory server from my Microsoft Enterprise Certificate Authority so both Active Directory SSL LDAP & FDS SSL LDAP are using the same Certificate Authority? Regards, Anthony Giggins

1 0

[Fedora-directory-users] Error 12 on sorted queries
by Scott Lacy 10 Oct '07

10 Oct '07

I'm still a little new at this, so hopefully this isn't a FAQ question, but I am having issues with sorted queries. Single-user queries, and queries without sorts seem to go fine, but I get error 12 (unavailable critical extension) trying to do sorted queries, and returns zero results when it should return five. Log is below. Any idea? This is probably something I have to set up somewhere, but I can't find anything in Google... [10/Oct/2007:14:16:12 -0400] conn=49 fd=86 slot=86 connection from a.b.c.d to e.f.g.h [10/Oct/2007:14:16:12 -0400] conn=49 op=0 BIND dn="" method=128 version=3 [10/Oct/2007:14:16:12 -0400] conn=49 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [10/Oct/2007:14:16:12 -0400] conn=49 op=1 SRCH base="o=Mercer University" scope=2 filter="(&(departmentNumber=Art)(school=College of Liberal Arts))" attrs="a bunch of attributes here...." [10/Oct/2007:14:16:12 -0400] conn=49 op=1 SORT sn givenName (*) [10/Oct/2007:14:16:12 -0400] conn=49 op=1 RESULT err=12 tag=101 nentries=0 etime=0 notes=U Thanks, Scott

2 1

[Fedora-directory-users] ldapmodify and Fedora DS migration
by Scott Lacy 10 Oct '07

10 Oct '07

All, I am migrating an LDAP server off of Netscape I-Planet to Fedora Directory Server 1.0.4. I am having some issues with ldapmodify in that the command that worked in I-Planet 5.0 to do adds, modifiess, and deletes from the same run doesn't seem to work in Fedora DS. With I-Planet: ldapmodify -a -c -D "cn=Directory Manager" -w xxxxx -f updates.ldif would take updates.ldif and do the adds, modifies, and deletions that were in the ldif all in one run. However, to do the same thing in Fedora DS, I find that I am having to do: ldapmodify -c -x -D "cn=Directory Manager" -w xxxxx -f updates.ldif and then ldapmodify -a -c -x -D "cn=Directory Manager" -w xxxxx -f updates.ldif So I guess I wondering if there is a way to get one iteration of ldapmodify to handle changes, adds, and deletes as the I-Planet version did. Thanks!

3 3

[Fedora-directory-users] howto delete ldbm database ?
by PaLo 10 Oct '07

10 Oct '07

I'm using fedora-ds-1.0.4-1.RHEL4 I have created a LDBM database for a new tree in LDAP and now I´m trying to delete it. I have recursively deleted the entrys: cn=mydatabase, cn=ldbm database, cn=plugins, cn=config cn=mybasedn_of_mydatabase, cn=mapping tree, cn=config This operation has removed the tree in LDAP, but I need to delete de DB files located in /opt/fedora-ds/slapd-myinstance/db/mydatabase ¿How can I safely remove this files? THANKS

2 2

[Fedora-directory-users] Error Logging Performance
by Roman RATHLER 09 Oct '07

09 Oct '07

Hi, If I activate error logging for ACL Control Summary or similar, the machine totaly goes into IO-Wait. It just writes maybe 100K/second but is totaly unusable any more... From normal 1% CPU Load (on a 2 Way Xeon) it moves to 200% CPU Utilization. Debugging ACLs therefore is nearly impossible on a productive system... We run the Fedora-DS 1.0.4 (fedora-ds-1.0.4-1.RHEL4) on an up2date CentOS System... Is there any perfomance tuning option like with the log-buffering for access log. I can't see, why logging kills the machine! cheers.roman

3 2

[Fedora-directory-users] error loading startconsole
by jhon choptieso 09 Oct '07

09 Oct '07

Greetings. After of installation and configuration of fedora-ds, i have errors loading the console, here the log: [root@ds1 fedora-ds]# ./startconsole -u admin http://ds1.foo.com:9999/ Exception in thread "main" java.lang.UnsupportedClassVersionError: com/netscape/management/client/console/Console (Unsupported major.minor version 49.0) at java.lang.ClassLoader.defineClass0(Native Method) at java.lang.ClassLoader.defineClass(Unknown Source) at java.security.SecureClassLoader.defineClass(Unknown Source) at java.net.URLClassLoader.defineClass(Unknown Source) at java.net.URLClassLoader.access$100(Unknown Source) at java.net.URLClassLoader$1.run(Unknown Source) at java.security.AccessController.doPrivileged(Native Method) at java.net.URLClassLoader.findClass(Unknown Source) at java.lang.ClassLoader.loadClass(Unknown Source) at sun.misc.Launcher$AppClassLoader.loadClass(Unknown Source) at java.lang.ClassLoader.loadClass(Unknown Source) at java.lang.ClassLoader.loadClassInternal(Unknown Source) i have the last sun jre. -- jhon choptieso

1 0

[Fedora-directory-users] slapi search internal errors popping up in error log
by Richard Hesse 08 Oct '07

08 Oct '07

[06/Oct/2007:00:24:51 +0000] - slapi_search_internal ("CN=fds1.sv.powerset.com, OU=Domain Control Validated, O=fds1.sv.powerset.com", subtree, objectclass=*) err 32 I'm guessing that this is cert related, but the TLS/SSL operations are working fine. However, I noticed that I can no longer view the encryption tab for this server in the console. Any ideas what this error means or how to fix it? Thanks. -richard

2 7

[Fedora-directory-users] RE: Fedora-directory-users Digest, Vol 29, Issue 5
by Clementous Clement 08 Oct '07

08 Oct '07

Richard, I'm trying to use Netgroups to employ control access to groups of hosts to groups of users just as with NIS. I've searched the web for decent example to create the netgroup containter within FDS, but haven't discovered any. =-Clem -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of fedora-directory-users-request(a)redhat.com Sent: Thursday, October 04, 2007 9:00 AM To: fedora-directory-users(a)redhat.com Subject: Fedora-directory-users Digest, Vol 29, Issue 5 Send Fedora-directory-users mailing list submissions to fedora-directory-users(a)redhat.com To subscribe or unsubscribe via the World Wide Web, visit https://www.redhat.com/mailman/listinfo/fedora-directory-users or, via email, send a message with subject or body 'help' to fedora-directory-users-request(a)redhat.com You can reach the person managing the list at fedora-directory-users-owner(a)redhat.com When replying, please edit your Subject line so it is more specific than "Re: Contents of Fedora-directory-users digest..." Today's Topics: 1. Re: nss_ldap cannot authenticate vs FDS (Peter Santiago) 2. Re: problem with SSL and load balance (Enrico M. V. Fasanelli) 3. linux authentication though ds (lance raymond) 4. RE: problem with SSL and load balance (Richard Hesse) 5. Re: problem with SSL and load balance (Jazcek Braden) 6. Re: linux authentication though ds (Marc Sauton) 7. Re: problem with SSL and load balance (Marc Sauton) 8. Re: problem with SSL and load balance (Marc Sauton) 9. Fedora-DS/netgroup configuration (Clementous Clement) 10. Re: Fedora-DS/netgroup configuration (Steve Rigler) 11. Re: RedHat 4/Fedora-DS - SSL Cert DB not readable? (Glenn) ---------------------------------------------------------------------- Message: 1 Date: Thu, 04 Oct 2007 00:08:05 +0800 From: Peter Santiago <peters(a)psinergybbs.com> Subject: Re: [Fedora-directory-users] nss_ldap cannot authenticate vs FDS To: "General discussion list for the Fedora Directory server project." <fedora-directory-users(a)redhat.com>, Steve Rigler <srigler(a)marathonoil.com> Message-ID: <20071004000805.w0m9bmxk6cws4sk0(a)webmail.psinergybbs.com> Content-Type: text/plain; charset="iso-8859-1" Skipped content of type multipart/alternative-------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/pkcs7-signature Size: 3051 bytes Desc: S/MIME Cryptographic Signature Url : https://www.redhat.com/archives/fedora-directory-users/attachments/20071 004/cd9c6979/smime.bin ------------------------------ Message: 2 Date: Wed, 03 Oct 2007 19:49:56 +0200 From: "Enrico M. V. Fasanelli" <Enrico.M.V.Fasanelli(a)le.infn.it> Subject: Re: [Fedora-directory-users] problem with SSL and load balance To: "General discussion list for the Fedora Directory server project." <fedora-directory-users(a)redhat.com> Message-ID: <4703D644.9020608(a)le.infn.it> Content-Type: text/plain; charset="iso-8859-1" Hi Victor, have you tried with a certificate that contains the alternate name of the server? Something like X509v3 Subject Alternative Name: DNS:fds.mydomain.com, DNS:fds1.mydomain.com Ciao, Enrico Victor Hugo dos Santos wrote: > Hello List, > > I have the same problem that Alex Aka in Apr 2006 > http://www.redhat.com/archives/fedora-directory-users/2006-April/msg0002 2.html > > I have two FDS (fds1 and fds2) in MMR > > in the DNS I create this machines > > fds1 IN A 10.0.0.11 > fds2 IN A 10.0.0.12 > fds IN A 10.0.0.11 > fds IN A 10.0.0.12 > > in the clients, I configure the ldap.conf with this parameters: > > BASE dc=mydomain,dc=com > URI ldap://fds.mydomain.com > > this configuration work very,very fine !!!! exist replication between > servers and fault tolerance in the clients.. but i enable SSL in > server and in the clients (ldap.conf) > > > BASE dc=mydomain,dc=com > URI ldaps://fds.mydomain.com > TLS_CACERT /etc/ssl/certs/cacert.org.pem > TLS_REQCERT allow > > and "no" work !!! :-( i receive this error: > > ldap_bind: Can't contact LDAP server (-1) > > additional info: TLS: hostname does not match CN in peer certificate > > this problem, is derivate that i configured the servers with one > certificate and distinct CN for independent serves (fds1 and fds2)... > > if I config one same certificate with same CN (fds) for both nodes > (fds1 and fds2).. work fine in the clients, but the replication dont > work !!! :-( > > obs.: my certificates is sign in http://cacert.org > > any idea or suggestion ??? > > thanks > > -- Pochi conoscono cio' che ha veramente scoperto Einstein: quando mangiamo spaghetti, in effetti stiamo masticando un concentrato di Spazio-Tempo. (Antonino Zichichi)

2 1

[Fedora-directory-users] problem with SSL and load balance
by Victor Hugo dos Santos 05 Oct '07

05 Oct '07

Hello List, I have the same problem that Alex Aka in Apr 2006 http://www.redhat.com/archives/fedora-directory-users/2006-April/msg00022.h… I have two FDS (fds1 and fds2) in MMR in the DNS I create this machines fds1 IN A 10.0.0.11 fds2 IN A 10.0.0.12 fds IN A 10.0.0.11 fds IN A 10.0.0.12 in the clients, I configure the ldap.conf with this parameters: BASE dc=mydomain,dc=com URI ldap://fds.mydomain.com this configuration work very,very fine !!!! exist replication between servers and fault tolerance in the clients.. but i enable SSL in server and in the clients (ldap.conf) BASE dc=mydomain,dc=com URI ldaps://fds.mydomain.com TLS_CACERT /etc/ssl/certs/cacert.org.pem TLS_REQCERT allow and "no" work !!! :-( i receive this error: ldap_bind: Can't contact LDAP server (-1) additional info: TLS: hostname does not match CN in peer certificate this problem, is derivate that i configured the servers with one certificate and distinct CN for independent serves (fds1 and fds2)... if I config one same certificate with same CN (fds) for both nodes (fds1 and fds2).. work fine in the clients, but the replication dont work !!! :-( obs.: my certificates is sign in http://cacert.org any idea or suggestion ??? thanks -- -- Victor Hugo dos Santos Linux Counter #224399

6 8

[Fedora-directory-users] Samba - Fedora DS password update
by Alan Orlič Belšak 05 Oct '07

05 Oct '07

Hello, one question, is there a way to update both Samba and LDAP passwords at same time? I don't know what I'm doing wrong but whatever I do I'm able to update only Samba password. Because Samba an LDAP are both on same server I really don't like to install extra SSL/TLS. Here is Samba config. Also, why I newer get the password chat window as is defined in Samba? Alan Samba config: [global] workgroup = ZDL security = user netbios name=pdc passdb backend = ldapsam:ldap://pdc.zd-lj.lan ldap admin dn = "cn=Directory Manager" ldap suffix = dc=zd-lj,dc=lan ldap user suffix = ou=People ldap machine suffix = ou=Computers ldap group suffix = ou=Groups log file = /var/log/samba/%m.log log level = 2 socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 os level = 66 domain logons = yes domain master = yes local master = yes preferred master = yes wins support = yes idmap uid = 15000-20000 idmap gid = 15000-20000 passwd program = /opt/IDEALX/sbin/smbldap-passwd %u passwd chat = *old*password* %o\n *new*password* %n\n *new*password* %n\n *changed* #passwd chat timeout = 2 ldap passwd sync = no password server = PDC unix password sync = yes passwd chat debug = yes encrypt passwords = yes ...

1 0

[Fedora-directory-users] Roles, Groups and Samba
by denmat 04 Oct '07

04 Oct '07

Hi List, I am in the process of testing Fedora DS with a Samba installation on Fedora Core 7 (fedora-ds-1.0.4-1, samba-3.0.26a-0). As a general question, what has been the experience people have had with their installations of it? How have people dealt with Groups and Roles in relation to Samba? Especially in relation to samba Domain group mappings (Domain Admins, users, etc). Also has anyone used the CoS to share directories (both in samba and nfs automounts) as attributes in user DNs? Any handy doco people can point me to? Regards, Denmat

1 0

[Fedora-directory-users] RedHat 4/Fedora-DS - SSL Cert DB not readable?
by Travis 04 Oct '07

04 Oct '07

Hi, We're preparing to upgrade from the initial DS release to 1.0.4-1 on our RHEL4 servers. In testing, we've hit a brick wall while trying to set up SSL. We can install the server just fine, but when clicking on "Manage Certificates" in the console we get the following: could not open file slapd-$hostname-cert8.db We get the same type of error when trying to manage the admin server certs. This is a completely fresh install, and we've double checked file ownership, so permissions are not an issue. After working on this for a while, I tried installing the FC6 rpm on my FC6 desktop with the same settings and JVM, which worked just fine...so its something specific about the RHEL4 version or its dependencies. I found one other post about this kind of issue (From Nov 2006 by Graham Leggett), but I never saw a solution. I have even tried initializing the DBs by hand with certutil, but this does not appear to make a difference. Any advice? Thanks, Travis

5 10

[Fedora-directory-users] Fedora-DS/netgroup configuration
by Clementous Clement 04 Oct '07

04 Oct '07

Hello Everyone, I'm a newbie to configuring/depolying Fedora-DS. I've been lucky enough to complete the installation for Fedora-DS. I need a little guideance on setting up and configuring netgroups. I've located the link below and researched the the link below, but still can't get the feature to work. Any advice? http://directory.fedoraproject.org/wiki/Howto:Netgroups Thanks In Advance, Clementous Clement System Administrator cclementous(a)gmail.com

2 1

[Fedora-directory-users] linux authentication though ds
by lance raymond 03 Oct '07

03 Oct '07

Afternoon, I have been reading a lot on this and wish to see if I am on the right track. I wish to have all employees login information be stored in DS, and authenticate through him. I have subscribed to the list a few day's ago and the questions are pretty high level, so it does seem that people are using fedora's version, so I guess for starters, is this possible. I already have fedora ds running, added a few people, but I didn't see 2 much on authenticating though DS. Thanks ... lr

2 1

[Fedora-directory-users] nss_ldap cannot authenticate vs FDS
by Peter Santiago 03 Oct '07

03 Oct '07

Hi, I was able to finally configure FDS to sync with ADS with Winsync. Thanks a lot to the members here. Now I ran into another peculiar problem. NSS_LDAP seems not to be able to authenticate or do a successful query against FDS. I used ldapsearch to double check, I was able to do a successful query against FDS. Attached are two files from doing id and ldapsearch. I have enabled debugging. Could someone help explain why ldapsearch can successfully query FDS whereas NSS_LDAP cannot? Maybe there is a need to patch NSS_LDAP? I'm using nss_ldap 253 from fedora 6 package. -- Peter Santiago peters(a)psinergybbs.com My website: www.psinergybbs.com My spamtrap address: r34987y(a)psinergybbs.com ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

3 3

[Fedora-directory-users] problems with post/fedora-ds
by Jeffrey McDonald 03 Oct '07

03 Oct '07

Hi, I'm having some problems with fedora-ds and postfix in a high-rate environment. First, let me say that we are migrating from openldap-1.2.2 to Fedora-DS. The configuration with postfix+openldap has to be migrated to fedora-ds and the postfix+openldap works great in the high-rate environment. I have a relay_recipient_maps and a alias list which both use ldap. However, ldaps connections (and ldap) connections to fedora-DS seem to time out in a high-rate environment. In slow-rate environment were there are a few 10s of emails an hour, things work fine. In the high-rate where you receive 1-5 of emails per second, I am seeing lots of temporary lookup failures. My configuration looks exactly like the POSTFIX Wiki configuration on the directory.fedoraproject.org/wiki page. We did some debugging to take a look at postfix, which attempts to open a connection to the ldap server and does, then it wants to perform multiple lookups per connection but this doesn't work--it seems for some reason that postfix is unable to do more than one lookup per connection. The fedora-DS ends up with many connections from postfix which eventually time-out. Any ideas as to what could be wrong? Thanks, Jeff

1 0

Re: [Fedora-directory-users] fds vs passsync vs AD
by Paolo Barbato 03 Oct '07

03 Oct '07

Dear list, I repost original question on my troubles....anybody has any idea on why I'm facing such a problem ? Regards, Paolo. >Thanks for reply, but I suspect I'm facing a different problem. > >Talking about SSL. > >As far as I understand SSL is used both for passync (AD -> FDS) and >replication agreement (AD <-> FDS). Note two different tasks. > >In first case work cert.db8 certificates. I've installed on both AD >and FDS, my CA certificate and FDS server certificate. Passync works >without a hic. When I change pasword from windows it's exactly set >on FDS. > >Replication agreement is based on cert.db8 on FDS and MS >architecture on AD, I mean that I make use of mmc to install CA and >AD server signed certificate. > >Replication seems also work, since I see that AD and FDS users are >"merged" in one (almost) identical list. So users that were in AD >are created on FDS and viceversa, with (almost) all parameters >setted. > >My problem arise when from a linux machine authenticated on FDS I >issue and passwd change password. Really all seems go right, since >FDS register new password, and also AD tell me that the change has >been committed : > >first event >User Account Changed: > Target Account Name: barbato > Target Domain: TEST > Target Account ID: TEST\barbato > Caller User Name: sync manager > Caller Domain: TEST > Caller Logon ID: (0x0,0x318F76) > Privileges: - > Changed Attributes: > Sam Account Name: - > Display Name: - > User Principal Name: - > Home Directory: - >and after a while a second security event: > >User Account password set: > Target Account Name: barbato > Target Domain: TEST > Target Account ID: TEST\barbato > Caller User Name: sync manager > Caller Domain: TEST > Caller Logon ID: (0x0,0x318F76) > > >But when I try to log on AD with this new password AD tell me that >I'm usinig the wrong one. Note that also the previous doesn't work, >and this confirm that it has been really changed. > >Anybody has faced this ? Some other things to look into ? > >Regards, >Paolo. -- ------------------------------------------------------------------------------------------------ Paolo Barbato email: mailto:paolo.barbato@igi.cnr.it Network Administrator phone: (39-049)-829-5097 (39-049)-829-5000 Corso Stati Uniti,4 www: http://www.igi.cnr.it 35127 Camin-Padova PGP: http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp ITALY JabberID: rfx_paolo_barbato(a)messenger.efda.org ------------------------------------------------------------------------------------------------

4 5

[Fedora-directory-users] How can you monitor replication?
by Ian Meyer 02 Oct '07

02 Oct '07

Hello, We have a decent sized env. (1 master, 16 slaves in different datacenters across the world) and we're trying to find a way to effectively monitor the status of replication. When was the last update? How many changes were made? How long did it take from start to finish? I know you can get most of this information from the gui, but we need to tie it in to our monitoring application. Is this information stored in a db anywhere? In ldap itself? Any insight would be appreciated. Thanks in advance! - Ian

4 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users October 2007