[Fedora-directory-users] Re: WinSync userAccountControl bug (was Fedora-directory-users Digest, Vol 42, Issue 4)
by John Dickinson
Rich Megginson <rmeggins(a)redhat.com> wrote:
> Howard Chu wrote:
>>> Date: Tue, 04 Nov 2008 08:13:08 -0700
>>> From: Rich Megginson<rmeggins(a)redhat.com>
>>
>>> John Dickinson wrote:
>>>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins(a)redhat.com>
>>>> wrote:
>>
>>>> create user in AD userAccountControl: 512
>>>> (Normal)
>>>> create user in Fedora DS (console) userAccountControl: 546
>>>> (Normal +
>>>> PASSWD_NOTREQ + ACCOUNTDISABLE)
>>>>
>>>> Would there be anything wrong with Fedora DS just forcing
>>>> userAccountControl = 512? Or are more options needed in the user
>>>> creation dialog?
>>> I'm not sure. 1.1.3 included a "fix" for userAccountControl. The
>>> way
>>> it works now is this:
>>> add new AD entry over LDAP - no userAccountControl attribute is
>>> present,
>>> so it must use some sort of AD default value
>>> read the new AD entry - get the userAccountControl value
>>> set AD entry userAccountControl |= 0x200 # 512 == normal account)
>>>
>>> So you might try a simple test - add a new AD entry over LDAP
>>> outside of
>>> windows sync - see what the default userAccountControl value is -
>>> I'm
>>> guessing that adding a new AD entry without specifying
>>> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
>>
>> Yes, users created via LDAP are disabled unless you explicitly
>> provide
>> the userAccountControl attribute (with proper flags) in the LDAP Add
>> operation. I tripped over this myself the first time I loaded up a
>> test database in AD. (It also gave me a Fine Opportunity to time how
>> long it took to LDAP Modify all of the users in my test database.
>> ugh...)
>>
> Then this is a bug in the winsync code. In the ADD case, it should
> just
> force userAccountControl to the Normal value. In the MOD case, it
> should |= the value. John, can you open a bug about this issue?
> Thanks.
Done - https://bugzilla.redhat.com/show_bug.cgi?id=470224
There are other values of userAccountControl that an administrator
might want to set when creating users. One example is
DONT_EXPIRE_PASSWORD - so is there a need for the userAccountControl
flags to be configurable on a create user dialog such as that in
fedora-idm-console or phpldapadmin rather than hard coded?
John
P.S. Sorry about the totally useless subject line earlier in this
thread.
15 years, 5 months
[Fedora-directory-users] enforcing ssl
by Graham Seaman
Hi,
I'm trying to set up Fedora DS to be accessible only with SSL. My DS is
on a standalone remote server, with most ports firewalled. If I open
ports 389 and 636, I can run ldapsearch ok using SSL (the access log
shows 'SSL connection.. using 256-bit AES') but I can also choose not to
use SSL and still make queries. If I close port 389, I can't connect to
the server with or without SSL - I just get 'ldap_start_tls: Can't
contact LDAP server (-1)'. This is even if I explicitly specify port
636, not just relying on the '-Z' flag for ldapsearch.
Is it possible to close down non-SSL access? (I am not using the admin
server, so this needs to be through manual configuration)
Thanks for any advice
Graham
15 years, 5 months
[Fedora-directory-users] Problems migrating from libdb-4.4 to libdb-4.7
by Vitaly Kuznetsov
Hello!
I'm trying to build Fedora-DS for ALT Linux project with new libdb-4.7.
Old instances use libdb-4.4. I have some problems with data migration.
FDS with db4.7 does not want to read old (db4.4) data with errors. I
tried to delete logs and do db_upgrade - without success. New instances
work fine. Fedora DS versions (old and new) are both 1.1.3.
Errors:
[05/Nov/2008:13:56:37 +0300] - Fedora-Directory/1.1.3 B2008.310.1047
starting up
[05/Nov/2008:13:56:37 +0300] - Clean up db environment and start from
archive.
[05/Nov/2008:13:56:37 +0300] - libdb: Program version 4.7 doesn't match
environment version 4.4
[05/Nov/2008:13:56:37 +0300] - libdb: Program version 4.7 doesn't match
environment version 4.4
[05/Nov/2008:13:56:37 +0300] - Deleting log file:
(/var/lib/fedora-ds/slapd-ldap1/db/log.0000000001)
[05/Nov/2008:13:56:37 +0300] - Deleting log file:
(/var/lib/fedora-ds/slapd-ldap1/db/log.0000000147)
[05/Nov/2008:13:56:38 +0300] - attrcrypt_unwrap_key: failed to unwrap
key for cipher AES
[05/Nov/2008:13:56:38 +0300] - Failed to retrieve key for cipher AES in
attrcrypt_cipher_init
[05/Nov/2008:13:56:38 +0300] - Failed to initialize cipher AES in
attrcrypt_init
[05/Nov/2008:13:56:38 +0300] - libdb: file userRoot/id2entry.db4 has LSN
134/2584752, past end of log at 1/140
[05/Nov/2008:13:56:38 +0300] - libdb: Commonly caused by moving a
database from one database environment
[05/Nov/2008:13:56:38 +0300] - libdb: to another without clearing the
database LSNs, or by removing all of
[05/Nov/2008:13:56:38 +0300] - libdb: the log files from a database
environment
[05/Nov/2008:13:56:38 +0300] - libdb:
/var/lib/fedora-ds/slapd-ldap1/db/userRoot/id2entry.db4: unexpected file
type or format
[05/Nov/2008:13:56:38 +0300] - dbp->open("userRoot/id2entry.db4")
failed: Invalid argument (22)
[05/Nov/2008:13:56:38 +0300] - dblayer_instance_start fail: Invalid
argument (22)
[05/Nov/2008:13:56:38 +0300] - attrcrypt_unwrap_key: failed to unwrap
key for cipher AES
[05/Nov/2008:13:56:38 +0300] - Failed to retrieve key for cipher AES in
attrcrypt_cipher_init
[05/Nov/2008:13:56:38 +0300] - Failed to initialize cipher AES in
attrcrypt_init
[05/Nov/2008:13:56:38 +0300] - libdb: file NetscapeRoot/id2entry.db4 has
LSN 1/3096357, past end of log at 1/140
[05/Nov/2008:13:56:38 +0300] - libdb: Commonly caused by moving a
database from one database environment
[05/Nov/2008:13:56:38 +0300] - libdb: to another without clearing the
database LSNs, or by removing all of
[05/Nov/2008:13:56:38 +0300] - libdb: the log files from a database
environment
[05/Nov/2008:13:56:38 +0300] - libdb:
/var/lib/fedora-ds/slapd-ldap1/db/NetscapeRoot/id2entry.db4: unexpected
file type or format
[05/Nov/2008:13:56:38 +0300] - dbp->open("NetscapeRoot/id2entry.db4")
failed: Invalid argument (22)
[05/Nov/2008:13:56:38 +0300] - dblayer_instance_start fail: Invalid
argument (22)
[05/Nov/2008:13:56:38 +0300] - start: Failed to start databases, err=22
Invalid argument
[05/Nov/2008:13:56:38 +0300] - Failed to allocate 10000000 byte dbcache.
Please reduce nsslapd-cache-autosize and Restart the server.
[05/Nov/2008:13:56:38 +0300] - Failed to start database plugin ldbm database
[05/Nov/2008:13:56:38 +0300] - WARNING: ldbm instance userRoot already
exists
[05/Nov/2008:13:56:38 +0300] - WARNING: ldbm instance NetscapeRoot
already exists
[05/Nov/2008:13:56:38 +0300] binder-based resource limits -
nsLookThroughLimit: parameter error (slapi_reslimit_register() already
registered)
[05/Nov/2008:13:56:38 +0300] - start: Resource limit registration failed
[05/Nov/2008:13:56:38 +0300] - Failed to start database plugin ldbm database
[05/Nov/2008:13:56:38 +0300] - Error: Failed to resolve plugin dependencies
[05/Nov/2008:13:56:38 +0300] - Error: preoperation plugin 7-bit check is
not started
[05/Nov/2008:13:56:38 +0300] - Error: accesscontrol plugin ACL Plugin is
not started
[05/Nov/2008:13:56:38 +0300] - Error: preoperation plugin ACL
preoperation is not started
Any ideas?
15 years, 5 months
[Fedora-directory-users] Re:Re: Fedora-directory-users Digest, Vol 42, Issue 3
by Eric
oh I take a mistake, my ds is version 1.0.4, my question is
1.How can I remove a role from ds by using db or related files? I don't have
console and my command part has error too.
2. I want to use last versions of fedora ds, I have backup of my fedora ds
version 1.0.4, can I install last version on another system ( not upgrade
this version) and then restore this backup? ( I saw that the directory of ds
version 1.1 are differ from 1.0)
On Mon, Nov 3, 2008 at 8:30 PM,
<fedora-directory-users-request(a)redhat.com>wrote:
> Send Fedora-directory-users mailing list submissions to
> fedora-directory-users(a)redhat.com
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
> or, via email, send a message with subject or body 'help' to
> fedora-directory-users-request(a)redhat.com
>
> You can reach the person managing the list at
> fedora-directory-users-owner(a)redhat.com
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Fedora-directory-users digest..."
>
>
> Today's Topics:
>
> 1. Re: removing an entry using fedora-ds folder (Rich Megginson)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Mon, 03 Nov 2008 09:35:35 -0700
> From: Rich Megginson <rmeggins(a)redhat.com>
> Subject: Re: [Fedora-directory-users] removing an entry using
> fedora-ds folder
> To: "General discussion list for the Fedora Directory server project."
> <fedora-directory-users(a)redhat.com>
> Message-ID: <490F2857.7050804(a)redhat.com>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> Eric wrote:
> > Hi,
> > I use fedora-ds 4.0.
> ? What version is that?
> rpm -qi fedora-ds-base
> > I had a view part.I made a Role in a wrong part ( under the another
> > role) after that my ds hanged.
> Check your directory server error log.
> > slapd and admin are running but I cant open console to remove that
> > wrong. when I want to use command line it can't. the error massage is:
> > ldap_bind: Can't contact LDAP server (-1)
> Are you sure slapd is running?
> > how can I solve the problem?
> > ------------------------------------------------------------------------
> >
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >
>
>
>
> ------------------------------
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
>
> End of Fedora-directory-users Digest, Vol 42, Issue 3
> *****************************************************
>
15 years, 5 months
[Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 42, Issue 4
by Howard Chu
> Date: Tue, 04 Nov 2008 08:13:08 -0700
> From: Rich Megginson<rmeggins(a)redhat.com>
> John Dickinson wrote:
>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins(a)redhat.com> wrote:
>> create user in AD userAccountControl: 512 (Normal)
>> create user in Fedora DS (console) userAccountControl: 546 (Normal +
>> PASSWD_NOTREQ + ACCOUNTDISABLE)
>>
>> Would there be anything wrong with Fedora DS just forcing
>> userAccountControl = 512? Or are more options needed in the user
>> creation dialog?
> I'm not sure. 1.1.3 included a "fix" for userAccountControl. The way
> it works now is this:
> add new AD entry over LDAP - no userAccountControl attribute is present,
> so it must use some sort of AD default value
> read the new AD entry - get the userAccountControl value
> set AD entry userAccountControl |= 0x200 # 512 == normal account)
>
> So you might try a simple test - add a new AD entry over LDAP outside of
> windows sync - see what the default userAccountControl value is - I'm
> guessing that adding a new AD entry without specifying
> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
Yes, users created via LDAP are disabled unless you explicitly provide the
userAccountControl attribute (with proper flags) in the LDAP Add operation. I
tripped over this myself the first time I loaded up a test database in AD. (It
also gave me a Fine Opportunity to time how long it took to LDAP Modify all of
the users in my test database. ugh...)
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
15 years, 5 months
[Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 41, Issue 24
by John Dickinson
On 30 Oct 2008, at 16:00, Rich Megginson <rmeggins(a)redhat.com> wrote:
> John Dickinson wrote:
>> Hi,
>>
>> I am testing what happens when you create a new user and sync it to
>> AD. Using Fedora DS 1.1.3 and AD 2003 R2 SP2.
>>
>> If I use the console to create a new user and tick the Enable NT User
>> Attributes, Create New NT Account etc the new user appears in AD but
>> is disabled.
>>
>> Looking at the code it seems that send_accountcontrol_modify() gets
>> the userAccountControl settings from AD adds 0x0200 (Normal Account)
>> and sends it back.
>>
>> Looking at the traffic between Fedora DS and AD it appears that
>> Fedora
>> DS is getting ACCOUNTDISABLE in userAccountControl from AD.
>>
>> Should FedoraDS be unsetting ACCOUNTDISABLE or should AD not be
>> setting it in the first place? If it is a problem with AD then can
>> anyone point me to where I tell it to do the right thing?
> Does AD have some sort of setting that tells it to disable new
> accounts?
Not that I know about. But I am no windows expert.
> What happens if you create new accounts directly in AD?
When you create a new user in windows there is a tick box to disable
the account but it is not ticked by default and the user is created in
an enabled state.
I see the following when:
- Both Windows and Fedora DS set to enforce no password complexity
constraints
- Windows sync agreement and password sync working
- When creating a user in AD only one option is selected by default -
user must change password at next login.
- The following options are not ticked by default:
-- User cannot change password
-- Password never expires
-- Account is disabled
create user in AD userAccountControl: 512 (Normal)
create user in Fedora DS (console) userAccountControl: 546 (Normal +
PASSWD_NOTREQ + ACCOUNTDISABLE)
Would there be anything wrong with Fedora DS just forcing
userAccountControl = 512? Or are more options needed in the user
creation dialog?
John
15 years, 5 months
[Fedora-directory-users] removing an entry using fedora-ds folder
by Eric
Hi,
I use fedora-ds 4.0. I had a view part.I made a Role in a wrong part (
under the another role) after that my ds hanged. slapd and admin are running
but I cant open console to remove that wrong. when I want to use command
line it can't. the error massage is:
ldap_bind: Can't contact LDAP server (-1)
how can I solve the problem?
15 years, 5 months
Re: [Fedora-directory-users] dbverify
by Howard Chu
fedora-directory-users-request(a)redhat.com wrote:
> Date: Fri, 31 Oct 2008 13:41:46 -0400
> From: Dan Lannom<dlannom(a)umd.umich.edu>
> I've done exhaustive verification of equality and presence indexes for
> my directory to verify that ldap is working properly so I'm going to
> treat dbverify as buggy for now.
dbverify is certainly not buggy. Most likely you're running on a Little-Endian
machine, and FDS is not canonicalizing its keys into Big-Endian format.
(Instead it must be using a custom key comparison function internally.) Since
dbverify only uses the default key comparison function, it will see the keys
as being out of order (even though they're in correct order according to FDS's
custom function).
> I can't find any pattern in my data to explain what the bug is though.
> 22 of the 45 indexes are affected
> syntaxes are oid,directorystring,ia5string,integer and telephonenumber
> index types are either e,ep,eps or aeps
>
> I'll fill out a bug report later tonight,
>
> Dan Lannom
>
> I wrote in my earlier email:
>> I plan to migrate to fds from SunOne 5.2 and so I want to validate the
>> system.
>> I'm currently running version 1.1.3-2 of the directory on RHEL 5.2.
>>
>> When I do searches against the server everything seems to work fine, but
>> When I run /usr/lib/dirsrv/slapd-{{hostname}}/dbverify, with the
>> server off, it fails with
>> errors like:
>> [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 2
>> [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 8
>> [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at
>> entry 11
>> [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at
>> entry 14
>> ...
>> [28/Oct/2008:10:52:16 -0400] - libdb:
>> /var/lib/dirsrv/slapd-hume/db/{{SUFFIX}}/{{attribute}}.db4:
>> DB_VERIFY_BAD: Database verification failed
>> [28/Oct/2008:10:52:16 -0400] DB verify - verify failed(-30975):
>> /var/lib/dirsrv/slapd-{{hostname}}/db/userdata/{{attribute}}.db4
>>
>> reindexing does not change anything and I find the same errors for
>> both i386 and x86_64 and the errors are almost identical for the
>> master and the slaves.
>>
>> Since I can find any evidence of the indexes identified as corrupted
>> not working I wonder why dbverify is generating these errors.
>>
>> Thanks for any help,
>>
>> Dan Lannom
>> UM-Dearborn
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
15 years, 5 months
