389-users July 2008

389-users@lists.fedoraproject.org

48 participants
46 discussions

[Fedora-directory-users] Recover directory database files when disk fills up!
by Howard Wilkinson 18 Nov '08

18 Nov '08

We had the disk with the directory database files fill up overnight, a rogue process :-[ Now the directory server will not start I get the following reported in the system logs. Jul 29 09:44:50 bastion ns-slapd: auxpropfunc error invalid parameter supplied Jul 29 09:44:50 bastion ns-slapd: sql_select option missing Jul 29 09:44:50 bastion ns-slapd: auxpropfunc error no mechanism available What can I do to recover the database so that I can start the server?

2 9

[Fedora-directory-users] Unable to SSL with Windows Sync Agreement
by Groot, Mathijs de (IDT Competence Java) 07 Aug '08

07 Aug '08

Hello everyone, I can use some help with setting up the Windows Sync. Ill give some context first, im trying to sync user, groups and passwords from a Windows 2003 server with Active Directory with a Red Hat enterprise 5, Red Hat Directory Server 8.0. It is a test environment with where I can access and configure the servers easily. But ive got some problems setting a new Windows Sync Agreement. It comes down to the following: I can't get an SSL connection with the a new Windows Sync Agreement, from the Red Hat DS to the Windows AD server. In the Windows Sync Server info screen I get the following message when clicking on next: "unable to contact Active Directory server, continue" (Windows Sync Server info screen located In the Directory Server Console -> Configuration tab -> Replication -> userRoot -> highlight the database -> Object -> New Windows Sync Agreement -> The second screen reads Windows Sync Server Info) But when I uncheck the checkbox "Using encrypted SSL connection" the connection works and the Windows AD server is reached. So this concludes (and ive tested) that the Windows Server and domain is reachable and the Bind DN is valid, and entered values are correct. The SSL connection seems to be setup correctly, the checks (ldapsearch query) described by the fedora manual outputs the correct result. Following: " http://directory.fedoraproject.org/wiki/Howto:WindowsSync Testing your Configuration Test to make sure you can talk SSL from Fedora Directory to AD This is how you test to verify that the Windows side SSL is enabled properly: ldapsearch -Z -P <RHDS-cert8.db> -h <AD/NT Hostname> -p <AD SSL port> -D "<sync manager user>" -w < sync manager password> -s <scope> -b "<AD base>" "<filter>" " My ldapsearch query: /usr/lib64/mozldap/dapsearch -Z -P /etc/dirsrv/slapd-<instance>/cert8.db -h compute.domain.com -p 636 -D "CN=Administrator,CN=Users,DC=domain,DC=com" -w <pwd> -s base -b "dc=domain,dc=com" "objectclass=top" But strangely enough there is not network traffic at all when the SSL connection is checked! (when clicking on next and the message "unable to contact Active Directory server, continue" appears) Ive done the following actions to make to monitor it: First I've disabled SELinux, in case that blocks something (just for testing). watch the tcp ip traffic with: tcpdump -nn -p port not ssh and ip host <Red Hat IP number> Here I can see that, when I don't use the SSL connection, there is traffic towards my Widows AD, but when ive check the SSL option, there is no traffic at all, nothing. As well when I look at the iptables: added an extra line: iptables -I OUTPUT 1 -d <Windows AD IP number> -j ACCEPT watch -d iptables -L -nv I see the same result, traffic when I don't use the SSL option and no traffic at all when the SSL option is checked. How can I get the message "unable to contact Active Directory server, continue" when there is no outgoing request from my Red Hat server. Ive made certificates at both sides (Windows and Red Hat) and exported and imported these certificated to the other server. Please advice on following steps I can take, what the problem can be and how it is possible that there is no traffic at all. Thanks in advanced. Matt Mathijs A. de Groot Consultant - Software Engineer _________________________________________ Logica - Releasing your potential George Hintzenweg 89 3068 AX Rotterdam Postbus 8566 3009 AN Rotterdam Nederland T: +31 (0) 10 253 7000 D: +31(0) 70 37 56627 E: math.de.groot(a)logica.com <mailto:math.de.groot@logica.com> www.logica.com <http://www.logica.com/> Logica Nederland B.V. Registered office in Amstelveen, The Netherlands Registration Number Chamber of Commerce: 33136004 This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 2

[Fedora-directory-users] SSL issue
by Dharmin Mandalia 06 Aug '08

06 Aug '08

Hello I am new to FDS, trying to configure Directory Server to use SSL, did few changes in Fedora Mgmt Console and now am getting below error msg :- # tail -f /var/log/dirsrv/admin-serv/error [Wed Jul 23 01:54:43 2008] [error] SSL_InheritMPServerSIDCache failed [Wed Jul 23 01:54:43 2008] [error] SSL Library Error: -8191 Library Failure [Wed Jul 23 01:54:44 2008] [notice] child pid 3884 exit signal Segmentation fault (11) [Wed Jul 23 01:54:45 2008] [error] SSL_InheritMPServerSIDCache failed [Wed Jul 23 01:54:45 2008] [error] SSL Library Error: -8191 Library Failure [Wed Jul 23 01:54:46 2008] [notice] child pid 3885 exit signal Segmentation fault (11) [Wed Jul 23 01:54:47 2008] [error] SSL_InheritMPServerSIDCache failed [Wed Jul 23 01:54:47 2008] [error] SSL Library Error: -8191 Library Failure [Wed Jul 23 01:54:48 2008] [notice] child pid 3886 exit signal Segmentation fault (11) [Wed Jul 23 01:54:49 2008] [error] SSL_InheritMPServerSIDCache failed [Wed Jul 23 01:54:49 2008] [error] SSL Library Error: -8191 Library Failure [Wed Jul 23 01:54:50 2008] [notice] child pid 3887 exit signal Segmentation fault (11) and when trying to login onto Fedora Mgmt Console, error I get is :- "Cannot login because of incorrect User ID" "Incorrect Password or Directory Problem " "java.io.IntruptedIOException: HTTP respose timeout" I know the username and password is correct. when run ps -ef nobody 3360 1 0 01:46 ? 00:00:02 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-matrix -i /var/run/dirs root 3873 1 0 01:54 ? 00:00:00 /usr/sbin/httpd.worker -k start -f /etc/dirsrv/admin-serv/httpd.conf root 3876 3873 0 01:54 ? 00:00:00 /usr/sbin/httpd.worker -k start -f /etc/dirsrv/admin-serv/httpd.conf matrix more /etc/redhat-release Fedora release 9 (Sulphur) matrix rpm -qa | egrep fedora-* fedora-ds-admin-1.1.5-1.fc9.i386 ffedora-ds-base-1.1.1-1.fc9.i386 fedora-ds-admin-console-1.1.1-3.fc9.noarch fedora-idm-console-1.1.1-2.fc9.i386 fedora-ds-1.1.1-3.fc9.i386 fedora-ds-console-1.1.1-3.fc9.noarch Any help on resolving the issue would be appreciated. Regards Dharmin _________________________________________________________________ Time for vacation? WIN what you need- enter now! http://www.gowindowslive.com/summergiveaway/?ocid=tag_jlyhm

4 3

[Fedora-directory-users] Passsync and Domain Controllers
by Mike Storvick 01 Aug '08

01 Aug '08

Hello All, I have successfully installed passsync on one of our domain controllers (32bit, the only one that would work) and only see changes of passwords being replicated from that single domain controller (not entirely useful because we hardly use that one for user changes etc.) Does this somehow need to be installed on ALL domain controllers that may processes the password change or is there some sort of replication problem between DC's? I change the password on any domain controller and it is reflected on our exchange outlook web access. Any insight is appreciated ,especially if you've had luck getting it to run on 64-bit Server 2003. Regards and thanks for your time, Michael Storvick - Network Administrator Textura Corporation 51 Sherwood Terrace Suite K Lake Bluff, IL 60044 Mobile: 847-204-7417 Office: 847-235-8470

1 0

[Fedora-directory-users] Announcing Fedora Directory Server version 1.1.1
by Rich Megginson 30 Jul '08

30 Jul '08

We are pleased to announce the release of Fedora Directory Server 1.1.1. This release is primarily a bug fix release, but does contain some new features, mostly to support freeIPA. Binary packages are available for Fedora 7, 8, 9, and rawhide. NOTE: Fedora 6/RHEL5 binaries are not yet available. They will be shortly. How to upgrade: yum upgrade fedora-ds-base No further setup should be required. This should restart the server - if not, a manual restart (service dirsrv restart) is required for the new code to take effect. * Release Notes - http://directory.fedoraproject.org/wiki/Release_Notes

2 2

[Fedora-directory-users] Sync AD users
by Peter Sørensen 30 Jul '08

30 Jul '08

Hi, I now have the fedora dirserver up and running on a RHES5 server. What i want to acomplish, is a way to have users replicated from Our AD servers. I need this because I want to add attributes concerning mail spam/virus management but still have the basic user attributes from the AD. I don't know anything about the AD and would like to keep it that way but I need som guidance on what to tell the people maintaining the AD on what to do. I don't need the password sync but only want a few user attributes like mail,proxyaddresses, cn, dn ... replicated. This should be a one way replication AD => FDS I have read the document concerning this but I'm still confused on what I need to do in the AD enviroment to get this up and running. Any other docs to read? Regards Peter Sorensen/University of Southern Denmark/mail: maspsr(a)sdu.dk

2 2

Re: [Fedora-directory-users] Error performing an internal search
by Mac.gp 29 Jul '08

29 Jul '08

>You need to pass in a valid value -- I'd suggest reading the >SLAPI_PLUGIN_IDENTITY value from the Slapi_PBlock which is passed to >your module's initialization function, and saving it (along with >whatever else you like) for future use as your SLAPI_PLUGIN_PRIVATE >value. >>The value that SLAPI_PLUGIN_IDENTITY has when your search function is >called is the one which was passed in by the module that initiated the >search. Your own module will be called (along with others) to satisfy >your internal searches, so to avoid recursion, you'll probably want to >compare the pointer value that the Slapi_PBlock contains when the >function is called to the value for your module, and then return early >if they're the same. > >HTH, > >NalinThanks so much, it works really good now! -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: VACANZA RELAX RICCIONE In centro: piscina, idromassaggio, bagno turco, solarium, massaggi e trattamenti Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=8140&d=20080729

1 0

[Fedora-directory-users] Re: Can't start Fedora DS server or connect to Admin Console
by Carol Gibbons 29 Jul '08

29 Jul '08

Thank you, Wolf! After pulling a listing of all files inside the tar of a previous days backup that was good/working - I was able to recreate the unique permissions (not root) for directories and files that your ldap user has to own. This is for Fedora DS 1.0.4. And the server and console now start. I'm listing them in case others get stumped on why neither the Fedora DS server nor the Admin Console will start and the logs don't give enough clues Your defined ldap user and group of same name have to own: /opt/fedora-ds/slapd-mail/ (just the directory level) /opt/fedora-ds/slapd-mail/config /opt/fedora-ds/slapd-mail/db/ /opt/fedora-ds/slapd-mail/locks/ /opt/fedora-ds/slapd-mail/confbak/ /opt/fedora-ds/slapd-mail/ldif/ /opt/fedora-ds/slapd-mail/logs/ /opt/fedora-ds/slapd-mail/bak /opt/fedora-ds/slapd-mail/dsml/ /opt/fedora-ds/alias/ /opt/fedora-ds/bin/slapd/authck/ /opt/fedora-ds/clients/dsgw/context/default.conf /opt/fedora-ds/admin-serv/config/ /opt/fedora-ds/shared/

1 0

[Fedora-directory-users] Error performing an internal search
by Mac.gp 28 Jul '08

28 Jul '08

Hello everyone. I'm trying to perform an internal search from a PRE_SEARCH plugin, but I get this error in the logs:allow_operation: component identity is NULLI think it has some trouble with the slapi_componentid. I declare it in my plugin with this:static Slapi_ComponentId * plugin_id = NULL;Am I doing something wrong? Any suggestion to resolve this?Thanks to all from now. -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: Impazzisci per Vasco? Scarica ora il mondo che vorrei sul cellulare Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=7750&d=20080728

2 1

[Fedora-directory-users] Can't start Fedora DS server or connect to Admin Console
by Carol Gibbons 28 Jul '08

28 Jul '08

Good morning, Our Fedora DS server has stopped working. I believe it's v1.0.4. I replaced the non-working fedora-ds with a backup of the directory from last week when it _was_ working. The /opt/fedora-ds/slapd-servername directory logs (error and access) provide no clues. But, the /fedora-ds/admin-serv/log/ states: [Mon Jul 28 02:17:34 2008] [warn] Unable to bind as LocalAdmin to populate LocalAdmin tasks into cache. [Mon Jul 28 02:17:34 2008] [crit] host_ip_init(): PSET failure: Failed to create PSET handle (pset error = ) Configuration Failed [Mon Jul 28 02:17:35 2008] [warn] Unable to bind as LocalAdmin to populate LocalAdmin tasks into cache. [Mon Jul 28 02:17:35 2008] [crit] host_ip_init(): PSET failure: Failed to create PSET handle (pset error = ) Configuration Failed I found one posting on the internet that says permissions could be the issue. http://osdir.com/ml/redhat.fedora.directory.user/2006-03/msg00037.html I set the files in /opt/fedora-ds/admin-serv/config/ to my admin user for files. But, that hasn't helped. I tried to do an ldapsearch from /opt/fedora-ds/shared/bin/ and that failed. Error said it couldn't locate the ldap database. I put this in: ldapsearch [-x] -b o=netscaperoot -D "cn=directory manager" -w password "objectclass=nsAdminConfig" dn Error: ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) Am I making sense at 4AM? Any help would be appreciated. I can't decide if this is a BIND, SSL, permissions, or what have you issue. Thanks for your help, Carol

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users July 2008