August 2010 - 389-users - Fedora mailing-lists

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

Multi-Master setup
by Reinhard Nappert 30 Sep '10

30 Sep '10

Hi, I have seen the following message in the errors log file, when I set MMR agreements up: [10/Aug/2010:11:46:44 -0400] NSMMReplicationPlugin - repl_set_mtn_referrals: could not set referrals for replica o=base: 1 [10/Aug/2010:11:46:44 -0400] NSMMReplicationPlugin - multimaster_be_state_change: replica o=base is going offline; disabling replication [10/Aug/2010:11:46:46 -0400] - somehow, there are still 20 entries in the entrycache. :/ [10/Aug/2010:11:46:46 -0400] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database [10/Aug/2010:11:46:48 -0400] - BAD CACHE ASSERTION at ../ldap/servers/slapd/back-ldbm/cache.c/765: e->ep_refcnt > 0 [10/Aug/2010:11:46:52 -0400] - Fedora-Directory/1.1.2 B2009.090.1643 starting up [10/Aug/2010:11:46:52 -0400] - Detected Disorderly Shutdown last time DirectoryServer was running, recovering database. After I re-initialize the database from the supplier (setting attribute nsds5BeginReplicaRefresh to start of the agreement object), the database gets correctly imported. Any idea, what is going on? Thanks, -Reinhard

2 22

GOSA as a frontend for the 389 Directory Server?
by Stefan-Michael Guenther 15 Sep '10

15 Sep '10

Hello, one of our clients wants to use GOSA (https://oss.gonicus.de/labs/gosa/) as a frontend for the 389 DS. I found a number of postings that configuring GOSA to work with the 398 DS isn't easy. Therefore my question is whether anyone has a working combination and might publish a howto on it? Otherwise I would have to find my way through it and write the docu on it. Thanks for any hints & suggestions, Stefan

5 8

changelogdb has gotten large...
by Hartmann, Tim 09 Sep '10

09 Sep '10

Hi, I've run into a situation where one of the files in /var/lib/dirsrv/<instance>/changelogdb has grown almost as large as the partition it's on. In my directory server configs, I noticed I was keeping an unlimited changelog, so I set that to what seems like a reasonably long amount of time (18 weeks) but didn't see any decrease in the file size. I'm wondering now about the best course of action. I can a) move the whole dirsrv directory to another partition with more space available and symlink the old location to the new, which worked when I tested it, but I wanted to make sure I wouldn't be hosing something up the next time I upgrade. b) find some means of manually shrinking the *.db ( can you even do that?) c) point dirsrv at a new location, and reinitialize the consumers (which doesn't seem all that desirable) Has anyone else found it necessary to shrink your changelogdb? Thanks -Tim

4 3

ns-slapd processes not dying
by Angel Bosch Mora 08 Sep '10

08 Sep '10

hi, i had problems with "too many fds open" on some instances and after digging a bit i've found that ns-slapd dont die. i got 5 similar installations and this is happening just in two of them and i can't identify what is about. i've been recollecting process informations and i know for sure that the only process that keep increasing is ns-slapd and eventually, after some weeks, 389 starts refusing new connections and i got the "too many fds open" message. i can increase max fds but the problem of processes keeping alive is still there. anyone facing similar situation? regards, abosch

3 3

superior attributes (not object classes)
by Brian LaMere 02 Sep '10

02 Sep '10

Regarding superior attributes, I found this email from 4 years ago: https://www.redhat.com/archives/fedora-directory-users/2006-July/msg00059.h… In it, "Mike" said "Seems that my schema conversion tool doesn't support attribute inheritance...[snip]...I will keep this in mind for a feature enhancement." rfc2252 defines superior attributes, and it was something I was using in my schema definition since I have a lot of new attributes and all but 4 of them had one of 5 different configs of "EQUALITY|ORDERING" and "SYNTAX". Not only was it cleaner to be able to just inherit the syntax and matching rules, it also was faster ;) Obviously, it doesn't keep me from doing anything. Was this ever looked at again for a feature enhancement? Is it already available, if I do X thing? During the schema reload, I got this error (for context): dse - The entry cn=schema in file /etc/dirsrv/slapd-(server)/schema/97hosting.ldif is invalid, error code 21 (Invalid syntax) - attribute type nocastr128: Missing parent attribute syntax OID I got it because I was using "SUP nocastr128" in an attributeType, after defining an attributeType of nocastr128 with the base components I wanted to inherit. Thanks, Brian LaMere ps - I have 2 more emails I'm sending; since they are on different subjects, I thought I'd break them into different emails. Please let me know if this was a bad idea and I won't do it again.

3 6

Outlook VLV index and western europe diacritics
by Andrey Ivanov 01 Sep '10

01 Sep '10

Hi, I am testing the 389 latest git version. There is one thing i have noticed concerning Outlook browsing of LDAP and VLV indexes. Though i think the change has happened already some time ago, in one of the previous versions. To make the LDAP Outlook browsing work correctly i've always used the steps described in the doc (http://www.redhat.com/docs/manuals/dir-server/8.2/admin/html/Creating_Index…) : dn: cn=Outlook Browse,cn=userRoot,cn=ldbm database,cn=plugins,cn=config cn: Outlook Browse objectClass: top objectClass: vlvsearch vlvBase: ou=Utilisateurs,dc=id,dc=polytechnique,dc=edu vlvFilter: (&(mail=*)(cn=*)) vlvScope: 2 dn: cn=Outlook Browse Index,cn=Outlook Browse,cn=userRoot,cn=ldbm database,cn= plugins,cn=config cn: Outlook Browse Index objectClass: top objectClass: vlvindex vlvEnabled: 1 vlvSort: cn This creates a VLV index, sorts the entries by cn and shows them in Outlook : [24/Aug/2010:16:42:19 +0200] conn=24 op=2 SRCH base="ou=utilisateurs,dc=id,dc=polytechnique,dc=edu" scope=2 filter="(&(mail=*)(cn=*))" attrs="cn cn mail roleOccupant display-name displayName sn sn co o o givenName legacyexchangedn objectClass uid mailnickname title company physicalDeliveryOfficeName telephoneNumber" [24/Aug/2010:16:42:19 +0200] conn=24 op=2 SORT cn [24/Aug/2010:16:42:19 +0200] conn=24 op=2 VLV 0:0:xac 7860:8001 (0) [24/Aug/2010:16:42:19 +0200] conn=24 op=2 RESULT err=0 tag=101 nentries=1 etime=0.009000 [24/Aug/2010:16:42:19 +0200] conn=24 op=3 SRCH base="ou=utilisateurs,dc=id,dc=polytechnique,dc=edu" scope=2 filter="(&(mail=*)(cn=*))" attrs="cn cn mail roleOccupant display-name displayName sn sn co o o givenName legacyexchangedn objectClass uid mailnickname title company physicalDeliveryOfficeName telephoneNumber" [24/Aug/2010:16:42:19 +0200] conn=24 op=3 SORT cn [24/Aug/2010:16:42:19 +0200] conn=24 op=3 VLV 0:27:7859:8001 7860:8001 (0) [24/Aug/2010:16:42:19 +0200] conn=24 op=3 RESULT err=0 tag=101 nentries=28 etime=0.019000 In (relatively old) previous versions of the server the sorting took into account the accentuated letters (like é, for example). The CNs with these letters were sorted correctly (that is, é after d and before f). So the entries were sorted by VLV like this : ... Tdo Not Ten Toys Tén Toys <<<-- Tfk Nev Tgl Mu ... Tzzz Too Uart New ... With the recent versions the server orders the CN strictly according to ASCII (i think) : ... Tdo Not Ten Toys Tfk Nev Tgl Mu ... Tzzz Too Tén Toys <<<-- Uart New ... That is, all the diacritical letters appear after "z". I have looked into the vlv#outlookbrowseindex.db4 file by dbscan and the order corresponds exactly to what Outlook shows. The questions are : -whether it is how it should work and -how do i revert to the old server behavior. The sorting with collation (that is, smth like my $sort_control = Net::LDAP::Control::Sort -> new( order => "cn:2.16.840.1.113730.3.3.2.18.1.6", critical => 1) ) works perfectly (i.e. é is after d and before f). I've tried several ideas to return to the old behavior : *) i've tried to add collation rules to vlv index entries but putting the value of the attribute vlvSort to "cn:2.16.840.1.113730.3.3.2.18.1.6" or to "cn:fr" does not work either. Instead of changing the sorting order it produces some strange contents in the index vlv#outlookbrowseindex.db4 file. **) then i thought that maybe i should change the cn index ordering and i have added "nsMatchingRule: 2.16.840.1.113730.3.3.2.18.1" to the cn indexes in dse.ldif. However reindexing does not actually change the order (even after reindexing by smth explicit like db2index -n userRoot -t cn:eq,pres,sub:2.16.840.1.113730.3.3.2.18.1 ) in the index .db4 files. Any ideas/suggestions? Andrey Ivanov tel +33-(0)1-69-33-99-24 fax +33-(0)1-69-33-99-55 Direction des Systemes d'Information Ecole Polytechnique 91128 Palaiseau CEDEX France

3 3

Can Fedora DS dereference alias object?
by Chee Yang Chau 01 Sep '10

01 Sep '10

Hi, I have a Fedora DS + SSSD setup in Fedora 13 and it is working fine. However, I found out the alias object is not functioning. Is that anything I miss in the configuration? The deferencing works fine in OpenLDAP. -- Best regards, Chau Chee Yang

2 2

ACI's not replicating
by Terry Soucy 31 Aug '10

31 Aug '10

Running 389-server 1.2.5 on RHEL 5 (Intel) We have a single master replicating to two consumers. When I update the ACIs on the master using ldapmodify, the ACIs are applied to the supplier without error ... [31/Aug/2010:09:18:37 -0300] conn=100572906 fd=81 slot=81 connection from 131.202.5.14 to 131.202.5.15 [31/Aug/2010:09:18:37 -0300] conn=100572906 op=0 BIND dn="cn=directory manager" method=128 version=3 [31/Aug/2010:09:18:37 -0300] conn=100572906 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [31/Aug/2010:09:18:37 -0300] conn=100572906 op=1 MOD dn="dc=unb,dc=ca" [31/Aug/2010:09:18:37 -0300] conn=100572906 op=1 RESULT err=0 tag=103 nentries=0 etime=0 csn=4c7cf31d000000010000 [31/Aug/2010:09:18:37 -0300] conn=100572906 op=2 UNBIND [31/Aug/2010:09:18:37 -0300] conn=100572906 op=2 fd=81 closed - U1 One the consumer, I get the following ... [31/Aug/2010:09:18:36 -0300] conn=30854964 fd=66 slot=66 connection from 131.202.5.15 to 131.202.5.14 [31/Aug/2010:09:18:36 -0300] conn=30854964 op=0 BIND dn="cn=replication manager, cn=config" method=128 version=3 [31/Aug/2010:09:18:36 -0300] conn=30854964 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=replication manager,cn=config" [31/Aug/2010:09:18:36 -0300] conn=30854964 op=1 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [31/Aug/2010:09:18:36 -0300] conn=30854964 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [31/Aug/2010:09:18:36 -0300] conn=30854964 op=2 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [31/Aug/2010:09:18:36 -0300] conn=30854964 op=2 RESULT err=0 tag=101 nentries=1 etime=0 [31/Aug/2010:09:18:36 -0300] conn=30854964 op=3 EXT oid="2.16.840.1.113730.3.5.3" name="Netscape Replication Start Session" [31/Aug/2010:09:18:36 -0300] conn=30854964 op=3 RESULT err=0 tag=120 nentries=0 etime=0 [31/Aug/2010:09:18:36 -0300] conn=30854964 op=4 SRCH base="cn=replica,cn=\22dc=unb,dc=ca\22,cn=mapping tree,cn=config" scope=0 filter="(objectClass=*)" attrs="nsDS5ReplicaId" [31/Aug/2010:09:18:36 -0300] conn=30854964 op=4 RESULT err=32 tag=101 nentries=0 etime=0 [31/Aug/2010:09:18:36 -0300] conn=30854964 op=5 MOD dn="dc=unb,dc=ca" [31/Aug/2010:09:18:36 -0300] conn=30854964 op=5 RESULT err=0 tag=103 nentries=0 etime=0 csn=4c7cf31d000000010000 [31/Aug/2010:09:18:38 -0300] conn=30854964 op=6 EXT oid="2.16.840.1.113730.3.5.5" name="Netscape Replication End Session" [31/Aug/2010:09:18:38 -0300] conn=30854964 op=6 RESULT err=0 tag=120 nentries=0 etime=0 [31/Aug/2010:09:19:38 -0300] conn=30854964 op=7 UNBIND [31/Aug/2010:09:19:38 -0300] conn=30854964 op=7 fd=66 closed - U1 Of particular interest is the err=32 on the search for the nsDS5ReplicaId. All other replication, including schema, is working as expected. For some reason, just the ACI won't replicate. Any thoughts? Terry -- Terry Soucy, Systems Analyst Integrated Technology Services University of New Brunswick, Fredericton Campus http://www.unbf.ca/its Voice: 506.447.3018 Fax: 506.453.3590 E-mail: tsoucy(a)unb.ca ** ITS is a scent-reduced workplace - www.unbf.ca/its/policies **

2 2

Announcing CN=Monitor 1.3
by Andreas Andersson 30 Aug '10

30 Aug '10

Hi! It’s been a year since I announced the 1.0 release of my little open source project CN=Monitor (LDAP Monitoring) here on the 389 Users list. A lot of features and improvements have been added since then. If you are running 389 DS / CentOS DS or Red Hat DS and needs a web application to monitor your directory server environment(s) you should download the today released stable version 1.3. Features: * Live monitoring to view current load * Collect historical events and view trends * Replication, Cache status verification * Verify server performance and load balancing * Mobile phone GUI support Project website: http://cnmonitor.sourceforge.net/ Freshmeat: http://freshmeat.net/projects/cnmonitor Best Regards - Andreas Andersson

2 1

Set of Attributes Uniqueness
by A Robinson 30 Aug '10

30 Aug '10

Hello, I'm trying to check that values contained in one than one attribute is unique. A solution exists for other directory servers, but I wondered if it was achievable in 389? Is there an equivalent to the NSUniqueAttrSet plugin -- which appears similar to NSUniqueAttr, but for across multiple attributes? http://docs.sun.com/app/docs/doc/819-4438/gcfeh?l=en&n=1&a=view nsslapd-pluginInitfunc: NSUniqueAttrSet_Init nsslapd-pluginType: preoperation nsslapd-pluginEnabled: on nsslapd-pluginarg0: attributeset=mail,mailalternateaddress,mailequivalentaddress nsslapd-pluginarg1: ugldapbasedn Thanks, A Robinson

2 1

Console breaks when enabling no anoymous binding
by Gerrard Geldenhuis 27 Aug '10

27 Aug '10

Hi If I set nsslapd-allow-anonymous-access: off I am not able to login to the 389-console. I can remedy this by checking the checkbox "Use SSL in Console" in the Encryption tab on the Directory Server console. This seems a strange solution to the problem. Why would disabing anonymous access break console access and why would enabling "Use SSL in Console" fix it? I get another interesting error as well with the "Use SSL in Console" checkbox checked. Login to Management Console Open Directory Console Click on Configuration tab Click on Encryption tab I get "An error has occured" Could not open file(null). File does not exist or filename is invalid. After I click on OK, I can proceed to the Encryption tab. Is this a bug or me not configuring something. The error message is not very helpfull. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

3 10

Security Level = Domestic
by Gerrard Geldenhuis 27 Aug '10

27 Aug '10

Hi In the management console there is a Security level: domestic I found no reference to this in the documentation and a quick google revealed this page: http://docs.sun.com/source/816-5567-10/3_consol.htm which suggest that this has to do with the type and level of encryption used. Thus this refer to the level of encryption used in the SSL certificates? Best Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 4

entryrdn-index error message in error log
by Andrey Ivanov 26 Aug '10

26 Aug '10

Hi, i'm continuing to test the latest version of 389. Here are the error messages that i've seen (it happened only once for now) in error log : [25/Aug/2010:17:21:10 +0200] entryrdn-index - entryrdn_index_read: Param error: Failed to convert cn=salon d&#039,honneur,ou=objets,dc=id,dc=polytechnique,dc=edu to Slapi_RDN [25/Aug/2010:17:21:10 +0200] - dn2entry: Failed to get id for cn=salon d&#039,honneur,ou=objets,dc=id,dc=polytechnique,dc=edu from entryrdn index (34) [25/Aug/2010:17:21:10 +0200] entryrdn-index - entryrdn_index_read: Param error: Failed to convert honneur,ou=objets,dc=id,dc=polytechnique,dc=edu to Slapi_RDN [25/Aug/2010:17:21:10 +0200] - dn2entry: Failed to get id for honneur,ou=objets,dc=id,dc=polytechnique,dc=edu from entryrdn index (34) The object in question is cn=SALON D'HONNEUR,ou=Objets,dc=id,dc=polytechnique,dc=edu departmentNumber: DG/SG/MG/REST objectClass: top cn: SALON D'HONNEUR What is the problem with this entry, conversion to Slapi_DN and entryrdn index? Here are the corresponding entries extracted with dbscan : 5370:cn=salon d'honneur ID: 5370; RDN: "cn=SALON D'HONNEUR"; NRDN: "cn=salon d'honneur" C3106:ou=objets ID: 5370; RDN: "cn=SALON D'HONNEUR"; NRDN: "cn=salon d'honneur" P5370:cn=salon d'honneur ID: 3106; RDN: "ou=Objets"; NRDN: "ou=objets" I have not made any upgrades of the existing server. Instead, i have exported the ldif by db2ldif and then imported it into the new server, so there was no conversion phase. Andrey Ivanov tel +33-(0)1-69-33-99-24 fax +33-(0)1-69-33-99-55 Direction des Systemes d'Information Ecole Polytechnique 91128 Palaiseau CEDEX France

4 11

Incremental Replication over SSL ( and startTLS) with simple bind crashes the latest version
by Andrey Ivanov 25 Aug '10

25 Aug '10

I wanted to configure the replication over SSL (both with SSL mechanism which was available in previous versions) and by TLS using simple bind (both in multimaster or single master-dedicated consumer models). I've tried to configure it with command line and with the console. The configuration and the initial initialisation are ok : [25/Aug/2010:18:30:44 +0200] NSMMReplicationPlugin - replica_config_delete: Warning: The changelog for replica dc=id,dc=polytechnique,dc=edu is no longer valid since the replica config is being deleted. Removing the changelog. [25/Aug/2010:18:34:33 +0200] NSMMReplicationPlugin - multimaster_be_state_change: replica dc=id,dc=polytechnique,dc=edu is going offline; disabling replication [25/Aug/2010:18:34:33 +0200] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database [25/Aug/2010:18:34:39 +0200] - import userRoot: Workers finished; cleaning up... [25/Aug/2010:18:34:40 +0200] - import userRoot: Workers cleaned up. [25/Aug/2010:18:34:40 +0200] - import userRoot: Indexing complete. Post-processing... [25/Aug/2010:18:34:40 +0200] - import userRoot: Flushing caches... [25/Aug/2010:18:34:40 +0200] - import userRoot: Closing files... [25/Aug/2010:18:34:40 +0200] - import userRoot: Import complete. Processed 9523 entries in 7 seconds. (1360.43 entries/sec) [25/Aug/2010:18:34:40 +0200] NSMMReplicationPlugin - multimaster_be_state_change: replica dc=id,dc=polytechnique,dc=edu is coming online; enabling replication But when i continue and try to make a change on a master the consumer server crashes. So the total replica initialisation is ok but even a single incremental update crashes the consumer server. And there is nothing helpful in logs. I haven't tried the 1.2.6.rc7 version, i've tried the latest code version (as of today). Don't know if it matters (there seem to be a lot of coverity defects that have been fixed between rc7 and a1). Andrey Ivanov tel +33-(0)1-69-33-99-24 fax +33-(0)1-69-33-99-55 Direction des Systemes d'Information Ecole Polytechnique 91128 Palaiseau CEDEX France

3 3

Chaining backend + nsFarmServerUrl failover
by Jonathan Boulle 25 Aug '10

25 Aug '10

To try keep this short: https://bugzilla.redhat.com/show_bug.cgi?id=583622 Is this a widely known issue? I have hit it a few times when attempting to test the nsfarmserverurl failover, but I'm not sure whether it's a misconfiguration or a genuine bug. Is there any way of debugging the "failover" when one of the farm servers is down? I have tried every different debugging level, but still see nothing helpful in the error log on the server with the link configured. For example I would like to see which backend servers it is attempting to reach at what time. (To trigger the chain I'm attempting a password change on a client, which simply hangs when the first farm server is down) I can provide information to reproduce if necessary. Thanks ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

1 0

Re: [389-users] entryrdn-index error message in error log
by Andrey Ivanov 25 Aug '10

25 Aug '10

AI> i'm continuing to test the latest version of 389. Here are the error AI> messages that i've seen (it happened only once for now) in error log : AI> [25/Aug/2010:17:21:10 +0200] entryrdn-index - AI> entryrdn_index_read: Param error: Failed to convert cn=salon AI> d&#039,honneur,ou=objets,dc=id,dc=polytechnique,dc=edu to Slapi_RDN AI> [25/Aug/2010:17:21:10 +0200] - dn2entry: Failed to get id for AI> cn=salon d&#039,honneur,ou=objets,dc=id,dc=polytechnique,dc=edu from entryrdn index (34) AI> [25/Aug/2010:17:21:10 +0200] entryrdn-index - AI> entryrdn_index_read: Param error: Failed to convert AI> honneur,ou=objets,dc=id,dc=polytechnique,dc=edu to Slapi_RDN AI> [25/Aug/2010:17:21:10 +0200] - dn2entry: Failed to get id for AI> honneur,ou=objets,dc=id,dc=polytechnique,dc=edu from entryrdn index (34) These messages continue to appear, each time for a new entry. All these entries contain the apostrophe "'": [25/Aug/2010:18:34:31 +0200] entryrdn-index - entryrdn_index_read: Param error: Failed to convert cn=cadre d&#039,astreinte,ou=objets,dc=id,dc=polytechnique,dc=edu to Slapi_RDN [25/Aug/2010:18:34:31 +0200] - dn2entry: Failed to get id for cn=cadre d&#039,astreinte,ou=objets,dc=id,dc=polytechnique,dc=edu from entryrdn index (34) [25/Aug/2010:18:34:31 +0200] entryrdn-index - entryrdn_index_read: Param error: Failed to convert astreinte,ou=objets,dc=id,dc=polytechnique,dc=edu to Slapi_RDN [25/Aug/2010:18:34:31 +0200] - dn2entry: Failed to get id for astreinte,ou=objets,dc=id,dc=polytechnique,dc=edu from entryrdn index (34) ... Andrey Ivanov tel +33-(0)1-69-33-99-24 fax +33-(0)1-69-33-99-55 Direction des Systemes d'Information Ecole Polytechnique 91128 Palaiseau CEDEX France

1 0

About how to create new attribute in 389 Directory Server
by 馬小布 25 Aug '10

25 Aug '10

Hi, guys: I want to create new attribute value to define the VNC geometry setting . for example , if the users which is named test1, and when the vnc server start , then his vnc geometry setting could also start , like 1280x1024, 1024x768... so that it will save a lot of time , isn't it ? So how could I do ? Is there have some manual about it ? Thanks in advance .....

2 1

Jumping Jack
by Gerrard Geldenhuis 24 Aug '10

24 Aug '10

Hi This probably ties together with my previous question about not all masters begin equal. If I am using the concept of "edge" servers in each DC can each server that has been initialized as a multi-master be used in turn to initialize other multi masters? I am testing this at the moment but wanted to clarify this. The documentation refers to a data master and it is not clear whether this is a "relative master" or single server amongst the crowd that is the only authoritative source. dc1 dc2 master01 -> master 02 -> master03 -> master04 Thus, master01 initializes master02. master02 initializes master03 master03 initializes master04 Create repl agreements in the other direction but don't initialize and end up with: dc1 dc2 master01 <-> master 02 <-> master03 <-> master04 Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

1 1

not all masters are born equal?
by Gerrard Geldenhuis 24 Aug '10

24 Aug '10

Hi Just wanted to double check; We have not created replication agreements between all masters and in some instances it might take 2 hops for a change to be replicated everywhere. We are happy with this trade-off in delay for simplicity. Are we breaking some cardinal rule regarding multi-master or is this acceptable? The idea is to have edge servers in each DC that speaks to other DC edge servers and internally things are more verbal. A simplified attempt at a diagram. changes in dc1master02 will take two replications before it reaches dc2master02 dc1 dc2 master02 <-> master01 <-> master01 <-> master02 This question pertains both to a shared NetscapeRootDB and userDB databases. Best Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 1

Automatic master/consumer initialization
by Gerrard Geldenhuis 24 Aug '10

24 Aug '10

Hi Is there any difference between right clicking on a replication agreement just created and selecting the Initialize Consumer or letting "nature" go its course and letting replication happen in the next "cycle". Up until now I have created replication agreements using the GUI, but I have now started doing it via ldif files. If I don't immediately run: dn: cn=%repl-agreement-name%,cn=replica,cn=dc\3dCompany,cn=mapping tree,cn=config changetype: modify replace: nsds5beginreplicarefresh nsds5beginreplicarefresh: start It seems to start on its own anyway. Having checked the data nothing looks wrong so I thought I would just double check. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 2

AUTO : Serge Sterck est absent(e) (renvoi de Mer 01/09/2010)
by Serge.Sterck＠fmsb.be 24 Aug '10

24 Aug '10

Je suis absent(e) entre Lun 23/08/2010 et Mer 01/09/2010. Remarque : ceci est une réponse automatique à votre message "Re: [389-users] Automatic master/consumer initialization" envoyé le 24.8.10 3:31:17. C'est la seule notification que vous recevrez pendant l'absence de cette personne.

1 0

Inconsistency between GUI and ldapquery regarding replication agreements
by Gerrard Geldenhuis 24 Aug '10

24 Aug '10

Hi We ran into a very interesting problem... We can't run 389-console directly from the server on which it is running because it is just to slow to use. It takes almost 5 minutes just to login. We have thus resorted to running the console locally and doing port forwarding with ssh as 389 and 636 is blocked. This worked great until now. We created aliases to localhost for the server names eg: 127.0.0.1 authserver1.example.com authserver1 ssh -f -N -L 9830:authserver1:9830 authserver-ip ssh -f -N -L 389:authserver1:389 authserver-ip ssh -f -N -L 636:authserver1:636 authserver-ip This works for individual servers but we now have a shared netscaperoot. What happens is that when we open up the console and connect to the any directory server we are actually connecting to localhost and thus end up seeing the same information for each server (not completely) it confuses the GUI no end. This email's purpose is two fold, one is for the record and hopefully someone else will read this and not make the same mistake. Two, realizing that I have asked this before any suggestions for speeding up the console. It just seems odd that there is such a fast difference between running the console locally and running it remotely via ssh. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 1

Variables in ldif files
by Gerrard Geldenhuis 20 Aug '10

20 Aug '10

Hi Is there any standard script that comes with 389 that can take a set of parameters and replace those parameters in a ldif file? For example the parameters specified in /usr/share/dirsrv/data/template-suffix-db.ldif dn: cn=%ds_bename%,cn=ldbm database,cn=plugins,cn=config I can write my own but if there is something I can just adopt that would be very useful. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 1

Script to ingest audit file to database
by Juan Asensio Sánchez 20 Aug '10

20 Aug '10

Hi Has anyone developed a script to do that? I need this, but I want to be sure there is no a script that already exists. If not, I will do it. So, is there any library for Perl to analyze that file, i.e., give the list of entries, modifications made to that entries (add, modify, delete, modrdn), etc? Also, could the Directory Server redirect the output of the audit to the input of that script instead of the file? regards.

2 1

csngen_adjust_time: adjustment limit exceeded
by Juan Asensio Sánchez 20 Aug '10

20 Aug '10

Hi I am having problems with some replicas. Using 389 DS 1.2.5, CentOS 5.5. A few days ago, a server crashed, and when restarted, it had the time of the crash (more than 1 day). Just after the server started up, the time was sync with the NTP, but when dirsrv started, the time was wrong. Since that, the replication agreements of the multimaster database it hosts, is giving problems: "-1 Incremental update has failed and requires administrator actionSystem error". So, I am trying to initialize the rest of the servers from the "main" (tha server where the most os the modifications are done, we have 6 servers in multimaster mode for the database, and other databases in hub mode). When I try to initialize the server, i get this error on the supplier: "Replication error acquiring replica: excessive clock skew. Error Code: 2", although all the servers have the same time. In the consumer log, I get this: [16/Aug/2010:10:04:58 +0200] - csngen_adjust_time: adjustment limit exceeded; value - 1390893, limit - 86400 [16/Aug/2010:10:04:58 +0200] - CSN generator's state: [16/Aug/2010:10:04:58 +0200] - replica id: 5 [16/Aug/2010:10:04:58 +0200] - sampled time: 1281945898 [16/Aug/2010:10:04:58 +0200] - local offset: 0 [16/Aug/2010:10:04:58 +0200] - remote offset: 0 [16/Aug/2010:10:04:58 +0200] - sequence number: 111 I am stuck now. Tried to export database from supplier, import it in the consumer, and try to reinitialize without success. Also tried to disable the replica on both supplier and consumer, reenable it, and recreate the replication agreements without success. I have seen this bug https://bugzilla.redhat.com/show_bug.cgi?id=233642, but we have version 1.2.5, so his bug is supposed to be fixed. This is the result of the readNsState.py on the supplier (only for the database giving problems): nsState is BAAAADT2aEwAAAAAAQAAAAQAAAA= Little Endian For replica cn=replica, cn="dc=XXXXX,dc=XXXX", cn=mapping tree, cn=config fmtstr=[H2x3IH2x] size=20 len of nsstate is 20 CSN generator state: Replica ID : 4 Sampled Time : 1281947188 Gen as csn : 4c68f634000400040000 Time as str : Mon Aug 16 10:26:28 2010 Local Offset : 0 Remote Offset : 1 Seq. num : 4 System time : Mon Aug 16 10:26:42 2010 Diff in sec. : 14 Day:sec diff : 0:14 And this in the consumer: nsState is BQAAAPv1aEwAAAAAAAAAAAIAAAA= Little Endian For replica cn=replica, cn="dc=XXX,dc=XXXXX", cn=mapping tree, cn=config fmtstr=[H2x3IH2x] size=20 len of nsstate is 20 CSN generator state: Replica ID : 5 Sampled Time : 1281947131 Gen as csn : 4c68f5fb000200050000 Time as str : Mon Aug 16 10:25:31 2010 Local Offset : 0 Remote Offset : 0 Seq. num : 2 System time : Mon Aug 16 10:26:24 2010 Diff in sec. : 53 Day:sec diff : 0:53 I think the low remote offset (accoriding to the bug this number should increase with the changes) is due to the initialization of the database from the exports. Any help? All replication agreements are a disaster now :S. Regards and thanks in advance.

2 5

Help setting up a subsuffix
by Javier Aravena Claramunt 18 Aug '10

18 Aug '10

Hello, I'm trying to figure out how to create a subsuffix in its own database so I can syncronize a part of the directory in master-slave fashion, but I can't figure out how to. I create the subsuffix in the console by using the context menu in the root suffix in the Data part of the configuration tab, but I can't see the new ou. I've tried creating the ou before the subsuffix, but that doesn't seem to work either. I read something about the new subsuffix not having ACIs, but as I can't see the ou, I can't seem to configure the ACIs of the subsuffix. Any pointers on what to do between creating a new subsufix and using it would be really apreciated :) Regards, -- Javier Aravena Claramunt http://javier.aravenas.com javier(a)aravenas.com

1 0

Clarification on admin server and console
by Jonathan Boulle 18 Aug '10

18 Aug '10

I've been trawling through the documentation trying to get a better understanding of "best practices" for use of the console and admin server in an environment with a large number of directory servers. In the perfect scenario, we would like to be able to manage the entire estate (multiple locations) using one instance of the console; or perhaps one console per location. Unfortunately I'm not finding it straightforward. I understand that on a (physical/virtual) server there can be multiple directory server instances but only one admin server instance. However, what I'm wondering is whether it is possible for an instance of the admin server to manage directory servers on different boxes. For example, could I have one admin server per location - where a location houses X physical servers each running a DS instance (a mix of read-only consumers and read-write suppliers)? This brings obvious benefits as regards easier backup and a single point of administration, but also becomes a bit of a single point of failure. If not, is it necessary/standard to run an admin server per physical server, and then group them in the console by having them all share a single configuration server (as specified in setup-ds-admin.pl)? Although again this creates a single POF, at least with administration - or have I got the wrong end of the stick entirely? One more point: the Console and Admin Server documentation has diagrams which reference "external programs"; what kind of things does this refer to? Is there a typical use case? Thanks Jonathan ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

3 16

NetscapeRoot longevity
by Gerrard Geldenhuis 17 Aug '10

17 Aug '10

Hi The database name NetscapeRoot I assume is a leftover from when 389 was a netscape product. Is there any plans to eventually change this to 389-root or something similar. It would be a purely cosmetic change though and probably way to much work and introduce many bugs... but I thought I would ask. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 1

System configuration data
by Natr Brazell 17 Aug '10

17 Aug '10

All, I've been using 389 server for basic authentication only. I here folks use it for storing system information such as hostnames, IPs, MAC addresses etc and then generate dns file or DHCP files etc. I'm curious if there are any resoures that will tell me how to set up such an environment or if this forum can provide me with some howto's, example ldif files etc and perhaps some practical applications? Thanks, N

2 1

Replica ID uniqueness between NetscapeRoot and userRoot
by Gerrard Geldenhuis 16 Aug '10

16 Aug '10

Hi This is going to seem obvious but is the Replica ID unique to a server or unique to a database and server. What I mean is that if I setup both NetscapeRoot and UserRoot to replicate can I use Replica ID of x for both because they are on the same server or does it need to be x and x+1? Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 1

setup-ds-admin.pl complaining without cause?
by Gerrard Geldenhuis 16 Aug '10

16 Aug '10

Hi The setup-ds-admin.pl script complains about the following: ============================================================================== Your system has been scanned for potential problems, missing patches, etc. The following output is a report of the items found that need to be addressed before running this software in a production environment. 389 Directory Server system tuning analysis version 10-AUGUST-2007. NOTICE : System is x86_64-unknown-linux2.6.18-194.8.1.el5 (2 processors). Would you like to continue? [no]: yes ============================================================================== Why is that a haltable state? Is it because the of the x86-64-unknown or because of two processors being present? Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 2

huge memory usage
by nparpandet.ext＠orange-ftgroup.com 16 Aug '10

16 Aug '10

Hi, I'm using "redhat-ds-8.1.0-1.el5dsrv.x86_64", with multi-master and replication config. As you can see, slapd process is taking a lot of memory : ps xua|grep USR samnsdir 30246 5.7 90.4 16098112 14850016 ? Sl Aug13 271:32 /usr/sbin/ns-slapd -D /et... free total used free shared buffers cached Mem: 16411212 15688940 722272 0 221564 1934024 -/+ buffers/cache: 13533352 2877860 Swap: 33488888 3892288 29596600 Is there any kind of memory leak ? pmap -x 30246 30246: /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-USR -i /var/run/dirsrv/slapd-USR.pid -w /var/run/dirsrv/slapd-USR.startpid Address Kbytes RSS Anon Locked Mode Mapping 0000000000400000 328 - - - r-x-- ns-slapd 0000000000652000 8 - - - rw--- ns-slapd 0000000001c31000 1022872 - - - rw--- [ anon ] 0000000040326000 4 - - - ----- [ anon ] 0000000040327000 128 - - - rw--- [ anon ] 0000000040347000 4 - - - ----- [ anon ] 0000000040348000 10240 - - - rw--- [ anon ] 000000004160c000 4 - - - ----- [ anon ] 000000004160d000 10240 - - - rw--- [ anon ] 000000004200d000 4 - - - ----- [ anon ] 000000004200e000 10240 - - - rw--- [ anon ] 0000000042a0e000 4 - - - ----- [ anon ] 0000000042a0f000 10240 - - - rw--- [ anon ] 000000004340f000 4 - - - ----- [ anon ] 0000000043410000 10240 - - - rw--- [ anon ] 0000000043e10000 4 - - - ----- [ anon ] 0000000043e11000 10240 - - - rw--- [ anon ] 0000000044811000 4 - - - ----- [ anon ] 0000000044812000 128 - - - rw--- [ anon ] 0000000044832000 4 - - - ----- [ anon ] 0000000044833000 128 - - - rw--- [ anon ] 0000000044853000 4 - - - ----- [ anon ] 0000000044854000 128 - - - rw--- [ anon ] 0000000044874000 4 - - - ----- [ anon ] 0000000044875000 10240 - - - rw--- [ anon ] 0000000045275000 4 - - - ----- [ anon ] 0000000045276000 10240 - - - rw--- [ anon ] 0000000045c76000 4 - - - ----- [ anon ] 0000000045c77000 10240 - - - rw--- [ anon ] 0000000046677000 4 - - - ----- [ anon ] 0000000046678000 10240 - - - rw--- [ anon ] 0000000047078000 4 - - - ----- [ anon ] 0000000047079000 10240 - - - rw--- [ anon ] 0000000047a79000 4 - - - ----- [ anon ] 0000000047a7a000 10240 - - - rw--- [ anon ] 000000004847a000 4 - - - ----- [ anon ] 000000004847b000 10240 - - - rw--- [ anon ] 0000000048e7b000 4 - - - ----- [ anon ] 0000000048e7c000 10240 - - - rw--- [ anon ] 000000004987c000 4 - - - ----- [ anon ] 000000004987d000 10240 - - - rw--- [ anon ] 000000004a27d000 4 - - - ----- [ anon ] 000000004a27e000 10240 - - - rw--- [ anon ] 000000004ac7e000 4 - - - ----- [ anon ] 000000004ac7f000 10240 - - - rw--- [ anon ] 000000004b67f000 4 - - - ----- [ anon ] 000000004b680000 10240 - - - rw--- [ anon ] 000000004c080000 4 - - - ----- [ anon ] 000000004c081000 10240 - - - rw--- [ anon ] 000000004ca81000 4 - - - ----- [ anon ] 000000004ca82000 10240 - - - rw--- [ anon ] 000000004d482000 4 - - - ----- [ anon ] 000000004d483000 10240 - - - rw--- [ anon ] 000000004de83000 4 - - - ----- [ anon ] 000000004de84000 10240 - - - rw--- [ anon ] 000000004e884000 4 - - - ----- [ anon ] 000000004e885000 10240 - - - rw--- [ anon ] 000000004f285000 4 - - - ----- [ anon ] 000000004f286000 10240 - - - rw--- [ anon ] 000000004fc86000 4 - - - ----- [ anon ] 000000004fc87000 10240 - - - rw--- [ anon ] 0000000050687000 4 - - - ----- [ anon ] 0000000050688000 10240 - - - rw--- [ anon ] 0000000051088000 4 - - - ----- [ anon ] 0000000051089000 10240 - - - rw--- [ anon ] 0000000051a89000 4 - - - ----- [ anon ] 0000000051a8a000 10240 - - - rw--- [ anon ] 000000005248a000 4 - - - ----- [ anon ] 000000005248b000 10240 - - - rw--- [ anon ] 0000000052e8b000 4 - - - ----- [ anon ] 0000000052e8c000 10240 - - - rw--- [ anon ] 000000005388c000 4 - - - ----- [ anon ] 000000005388d000 10240 - - - rw--- [ anon ] 000000005428d000 4 - - - ----- [ anon ] 000000005428e000 10240 - - - rw--- [ anon ] 0000000054c8e000 4 - - - ----- [ anon ] 0000000054c8f000 10240 - - - rw--- [ anon ] 000000005568f000 4 - - - ----- [ anon ] 0000000055690000 10240 - - - rw--- [ anon ] 0000000056090000 4 - - - ----- [ anon ] 0000000056091000 10240 - - - rw--- [ anon ] 0000000056a91000 4 - - - ----- [ anon ] 0000000056a92000 10240 - - - rw--- [ anon ] 0000000057492000 4 - - - ----- [ anon ] 0000000057493000 10240 - - - rw--- [ anon ] 0000000057e93000 4 - - - ----- [ anon ] 0000000057e94000 10240 - - - rw--- [ anon ] 0000000058894000 4 - - - ----- [ anon ] 0000000058895000 10240 - - - rw--- [ anon ] 0000000059295000 4 - - - ----- [ anon ] 0000000059296000 10240 - - - rw--- [ anon ] 0000000059c96000 4 - - - ----- [ anon ] 0000000059c97000 10240 - - - rw--- [ anon ] 000000005a697000 4 - - - ----- [ anon ] 000000005a698000 10240 - - - rw--- [ anon ] 000000005b098000 4 - - - ----- [ anon ] 000000005b099000 10240 - - - rw--- [ anon ] 000000005ba99000 4 - - - ----- [ anon ] 000000005ba9a000 10240 - - - rw--- [ anon ] 000000005c49a000 4 - - - ----- [ anon ] 000000005c49b000 10240 - - - rw--- [ anon ] 000000005ce9b000 4 - - - ----- [ anon ] 000000005ce9c000 10240 - - - rw--- [ anon ] 000000005d89c000 4 - - - ----- [ anon ] 000000005d89d000 10240 - - - rw--- [ anon ] 000000005ec9e000 4 - - - ----- [ anon ] 000000005ec9f000 10240 - - - rw--- [ anon ] 00000030ef600000 176 - - - r-x-- libgssapi_krb5.so.2.2 00000030ef62c000 2048 - - - ----- libgssapi_krb5.so.2.2 00000030ef82c000 8 - - - rw--- libgssapi_krb5.so.2.2 000000324d800000 8 - - - r-x-- libcom_err.so.2.1 000000324d802000 2044 - - - ----- libcom_err.so.2.1 000000324da01000 4 - - - rw--- libcom_err.so.2.1 000000365ee00000 112 - - - r-x-- ld-2.5.so 000000365f01b000 4 - - - r---- ld-2.5.so 000000365f01c000 4 - - - rw--- ld-2.5.so 000000365f200000 1328 - - - r-x-- libc-2.5.so 000000365f34c000 2048 - - - ----- libc-2.5.so 000000365f54c000 16 - - - r---- libc-2.5.so 000000365f550000 4 - - - rw--- libc-2.5.so 000000365f551000 20 - - - rw--- [ anon ] 000000365f600000 8 - - - r-x-- libdl-2.5.so 000000365f602000 2048 - - - ----- libdl-2.5.so 000000365f802000 4 - - - r---- libdl-2.5.so 000000365f803000 4 - - - rw--- libdl-2.5.so 000000365fa00000 152 - - - r-x-- libsmime3.so 000000365fa26000 2044 - - - ----- libsmime3.so 000000365fc25000 16 - - - rw--- libsmime3.so 000000365fe00000 192 - - - r-x-- libssl3.so 000000365fe30000 2048 - - - ----- libssl3.so 0000003660030000 12 - - - rw--- libssl3.so 0000003660200000 88 - - - r-x-- libpthread-2.5.so 0000003660216000 2044 - - - ----- libpthread-2.5.so 0000003660415000 4 - - - r---- libpthread-2.5.so 0000003660416000 4 - - - rw--- libpthread-2.5.so 0000003660417000 16 - - - rw--- [ anon ] 0000003660600000 520 - - - r-x-- libm-2.5.so 0000003660682000 2044 - - - ----- libm-2.5.so 0000003660881000 4 - - - r---- libm-2.5.so 0000003660882000 4 - - - rw--- libm-2.5.so 0000003660e00000 52 - - - r-x-- libgcc_s-4.1.2-20080825.so.1 0000003660e0d000 2048 - - - ----- libgcc_s-4.1.2-20080825.so.1 000000366100d000 4 - - - rw--- libgcc_s-4.1.2-20080825.so.1 0000003661600000 80 - - - r-x-- libz.so.1.2.3 0000003661614000 2044 - - - ----- libz.so.1.2.3 0000003661813000 4 - - - rw--- libz.so.1.2.3 0000003661a00000 212 - - - r-x-- libnspr4.so 0000003661a35000 2048 - - - ----- libnspr4.so 0000003661c35000 8 - - - rw--- libnspr4.so 0000003661c37000 12 - - - rw--- [ anon ] 0000003661e00000 96 - - - r-x-- libnssutil3.so 0000003661e18000 2044 - - - ----- libnssutil3.so 0000003662017000 20 - - - rw--- libnssutil3.so 0000003662200000 1312 - - - r-x-- libnss3.so 0000003662348000 2044 - - - ----- libnss3.so 0000003662547000 36 - - - rw--- libnss3.so 0000003662550000 4 - - - rw--- [ anon ] 0000003662600000 16 - - - r-x-- libplc4.so 0000003662604000 2044 - - - ----- libplc4.so 0000003662803000 4 - - - rw--- libplc4.so 0000003662a00000 920 - - - r-x-- libstdc++.so.6.0.8 0000003662ae6000 2044 - - - ----- libstdc++.so.6.0.8 0000003662ce5000 24 - - - r---- libstdc++.so.6.0.8 0000003662ceb000 12 - - - rw--- libstdc++.so.6.0.8 0000003662cee000 72 - - - rw--- [ anon ] 0000003662e00000 12 - - - r-x-- libplds4.so 0000003662e03000 2044 - - - ----- libplds4.so 0000003663002000 4 - - - rw--- libplds4.so 0000003919600000 12 - - - r-x-- libsvrcore.so.0.0.0 0000003919603000 2048 - - - ----- libsvrcore.so.0.0.0 0000003919803000 4 - - - rw--- libsvrcore.so.0.0.0 0000003919a00000 84 - - - r-x-- libselinux.so.1 0000003919a15000 2048 - - - ----- libselinux.so.1 0000003919c15000 8 - - - rw--- libselinux.so.1 0000003919c17000 4 - - - rw--- [ anon ] 0000003919e00000 580 - - - r-x-- libkrb5.so.3.3 0000003919e91000 2048 - - - ----- libkrb5.so.3.3 000000391a091000 16 - - - rw--- libkrb5.so.3.3 000000391a200000 208 - - - r-x-- libldap60.so 000000391a234000 2048 - - - ----- libldap60.so 000000391a434000 8 - - - rw--- libldap60.so 000000391a600000 8 - - - r-x-- libldif60.so 000000391a602000 2044 - - - ----- libldif60.so 000000391a801000 4 - - - rw--- libldif60.so 000000391aa00000 68 - - - r-x-- libresolv-2.5.so 000000391aa11000 2048 - - - ----- libresolv-2.5.so 000000391ac11000 4 - - - r---- libresolv-2.5.so 000000391ac12000 4 - - - rw--- libresolv-2.5.so 000000391ac13000 8 - - - rw--- [ anon ] 000000391ae00000 36 - - - r-x-- libcrypt-2.5.so 000000391ae09000 2044 - - - ----- libcrypt-2.5.so 000000391b008000 4 - - - r---- libcrypt-2.5.so 000000391b009000 4 - - - rw--- libcrypt-2.5.so 000000391b00a000 184 - - - rw--- [ anon ] 000000391b200000 96 - - - r-x-- libsasl2.so.2.0.22 000000391b218000 2048 - - - ----- libsasl2.so.2.0.22 000000391b418000 4 - - - rw--- libsasl2.so.2.0.22 000000391b600000 20 - - - r-x-- libprldap60.so 000000391b605000 2044 - - - ----- libprldap60.so 000000391b804000 4 - - - rw--- libprldap60.so 000000391be00000 236 - - - r-x-- libsepol.so.1 000000391be3b000 2048 - - - ----- libsepol.so.1 000000391c03b000 4 - - - rw--- libsepol.so.1 000000391c03c000 40 - - - rw--- [ anon ] 000000391c200000 8 - - - r-x-- libkeyutils-1.2.so 000000391c202000 2044 - - - ----- libkeyutils-1.2.so 000000391c401000 4 - - - rw--- libkeyutils-1.2.so 000000391c600000 32 - - - r-x-- libkrb5support.so.0.1 000000391c608000 2044 - - - ----- libkrb5support.so.0.1 000000391c807000 4 - - - rw--- libkrb5support.so.0.1 000000391ce00000 144 - - - r-x-- libk5crypto.so.3.1 000000391ce24000 2044 - - - ----- libk5crypto.so.3.1 000000391d023000 8 - - - rw--- libk5crypto.so.3.1 000000391e200000 1204 - - - r-x-- libcrypto.so.0.9.8e 000000391e32d000 2044 - - - ----- libcrypto.so.0.9.8e 000000391e52c000 132 - - - rw--- libcrypto.so.0.9.8e 000000391e54d000 16 - - - rw--- [ anon ] 00002aaaaaab9000 24 - - - rw-s- __db.001 00002aaaaaabf000 12808 - - - rw-s- __db.002 00002aaaab741000 96 - - - rw-s- __db.003 00002aaaab759000 648 - - - rw-s- __db.004 00002aaaab7fb000 56 - - - rw-s- __db.005 00002aaaab815000 16 - - - r-x-- libnss_dns-2.5.so 00002aaaab819000 2044 - - - ----- libnss_dns-2.5.so 00002aaaaba18000 4 - - - r---- libnss_dns-2.5.so 00002aaaaba19000 4 - - - rw--- libnss_dns-2.5.so 00002aaaac000000 65536 - - - rw--- [ anon ] 00002aaab0000000 65536 - - - rw--- [ anon ] 00002aaab4000000 65536 - - - rw--- [ anon ] 00002aaab8000000 65536 - - - rw--- [ anon ] 00002aaabc000000 393216 - - - rw--- [ anon ] 00002aaad4000000 262144 - - - rw--- [ anon ] 00002aaae8000000 393216 - - - rw--- [ anon ] 00002aab04000000 131072 - - - rw--- [ anon ] 00002aab0c000000 343040 - - - rw--- [ anon ] 00002aab28000000 196608 - - - rw--- [ anon ] 00002aab34000000 279552 - - - rw--- [ anon ] 00002aab4c000000 10240 - - - rw--- [ anon ] 00002aab50000000 65536 - - - rw--- [ anon ] 00002aab58000000 94208 - - - rw--- [ anon ] 00002aab60000000 458752 - - - rw--- [ anon ] 00002aab7c000000 131072 - - - rw--- [ anon ] 00002aab84000000 83076 - - - rw--- [ anon ] 00002aab8c000000 393216 - - - rw--- [ anon ] 00002aaba4000000 131072 - - - rw--- [ anon ] 00002aabb0000000 131072 - - - rw--- [ anon ] 00002aabb8000000 71680 - - - rw--- [ anon ] 00002aabc0000000 196608 - - - rw--- [ anon ] 00002aabcc000000 6276 - - - rw--- [ anon ] 00002aabd0000000 524288 - - - rw--- [ anon ] 00002aabf0000000 60416 - - - rw--- [ anon ] 00002aabf4000000 65536 - - - rw--- [ anon ] 00002aabfc000000 327680 - - - rw--- [ anon ] 00002aac14000000 262144 - - - rw--- [ anon ] 00002aac24000000 262144 - - - rw--- [ anon ] 00002aac38000000 786432 - - - rw--- [ anon ] 00002aac68000000 65536 - - - rw--- [ anon ] 00002aac70000000 710656 - - - rw--- [ anon ] 00002aac9c000000 459776 - - - rw--- [ anon ] 00002aacbc000000 327680 - - - rw--- [ anon ] 00002aacd0000000 917504 - - - rw--- [ anon ] 00002aad08000000 131072 - - - rw--- [ anon ] 00002aad14000000 678912 - - - rw--- [ anon ] 00002aad40000000 458752 - - - rw--- [ anon ] 00002aad5c000000 327680 - - - rw--- [ anon ] 00002aad74000000 1471976 - - - rw--- [ anon ] 00002aadcdd7a000 35352 - - - ----- [ anon ] 00002aadd0000000 295160 - - - rw--- [ anon ] 00002aade203e000 32520 - - - ----- [ anon ] 00002af500b47000 8 - - - rw--- [ anon ] 00002af500b49000 836 - - - r-x-- libslapd.so.0.0.0 00002af500c1a000 2044 - - - ----- libslapd.so.0.0.0 00002af500e19000 60 - - - rw--- libslapd.so.0.0.0 00002af500e28000 16 - - - rw--- [ anon ] 00002af500e35000 4 - - - rw--- [ anon ] 00002af500e36000 40 - - - r-x-- libssldap60.so 00002af500e40000 2048 - - - ----- libssldap60.so 00002af501040000 8 - - - rw--- libssldap60.so 00002af501042000 20 - - - rw--- [ anon ] 00002af501047000 336 - - - r-x-- libsoftokn3.so 00002af50109b000 2044 - - - ----- libsoftokn3.so 00002af50129a000 28 - - - rw--- libsoftokn3.so 00002af5012a1000 536 - - - rw--- [ anon ] 00002af501330000 40 - - - r-x-- libnss_files-2.5.so 00002af50133a000 2044 - - - ----- libnss_files-2.5.so 00002af501539000 4 - - - r---- libnss_files-2.5.so 00002af50153a000 4 - - - rw--- libnss_files-2.5.so 00002af50153b000 32 - - - r-x-- libsyntax-plugin.so 00002af501543000 2048 - - - ----- libsyntax-plugin.so 00002af501743000 4 - - - rw--- libsyntax-plugin.so 00002af501744000 24 - - - r-x-- libcollation-plugin.so 00002af50174a000 2044 - - - ----- libcollation-plugin.so 00002af501949000 4 - - - rw--- libcollation-plugin.so 00002af50194a000 8 - - - rw--- [ anon ] 00002af501955000 1252 - - - r-x-- libicui18n.so.36.0 00002af501a8e000 2048 - - - ----- libicui18n.so.36.0 00002af501c8e000 44 - - - rw--- libicui18n.so.36.0 00002af501c99000 1172 - - - r-x-- libicuuc.so.36.0 00002af501dbe000 2044 - - - ----- libicuuc.so.36.0 00002af501fbd000 56 - - - rw--- libicuuc.so.36.0 00002af501fcb000 8 - - - rw--- [ anon ] 00002af501fcd000 9916 - - - r---- libicudata.so.36.0 00002af50297c000 2044 - - - ----- libicudata.so.36.0 00002af502b7b000 4 - - - rw--- libicudata.so.36.0 00002af502b7c000 24 - - - r-x-- libpwdstorage-plugin.so 00002af502b82000 2044 - - - ----- libpwdstorage-plugin.so 00002af502d81000 4 - - - rw--- libpwdstorage-plugin.so 00002af502d82000 12 - - - r-x-- libdes-plugin.so 00002af502d85000 2044 - - - ----- libdes-plugin.so 00002af502f84000 4 - - - rw--- libdes-plugin.so 00002af502f85000 44 - - - r-x-- libdigestmd5.so.2.0.22 00002af502f90000 2048 - - - ----- libdigestmd5.so.2.0.22 00002af503190000 4 - - - rw--- libdigestmd5.so.2.0.22 00002af503191000 16 - - - r-x-- libcrammd5.so.2.0.22 00002af503195000 2048 - - - ----- libcrammd5.so.2.0.22 00002af503395000 4 - - - rw--- libcrammd5.so.2.0.22 00002af503396000 16 - - - r-x-- libanonymous.so.2.0.22 00002af50339a000 2044 - - - ----- libanonymous.so.2.0.22 00002af503599000 4 - - - rw--- libanonymous.so.2.0.22 00002af50359a000 28 - - - r-x-- libgssapiv2.so.2.0.22 00002af5035a1000 2044 - - - ----- libgssapiv2.so.2.0.22 00002af5037a0000 4 - - - rw--- libgssapiv2.so.2.0.22 00002af5037a1000 20 - - - r-x-- libattr-unique-plugin.so 00002af5037a6000 2048 - - - ----- libattr-unique-plugin.so 00002af5039a6000 4 - - - rw--- libattr-unique-plugin.so 00002af5039a7000 140 - - - r-x-- libacl-plugin.so 00002af5039ca000 2048 - - - ----- libacl-plugin.so 00002af503bca000 4 - - - rw--- libacl-plugin.so 00002af503bcb000 292 - - - r-x-- libns-dshttpd.so.0.0.0 00002af503c14000 2044 - - - ----- libns-dshttpd.so.0.0.0 00002af503e13000 24 - - - rw--- libns-dshttpd.so.0.0.0 00002af503e19000 12 - - - rw--- [ anon ] 00002af503e1c000 84 - - - r-x-- libchainingdb-plugin.so 00002af503e31000 2048 - - - ----- libchainingdb-plugin.so 00002af504031000 4 - - - rw--- libchainingdb-plugin.so 00002af504032000 36 - - - r-x-- libcos-plugin.so 00002af50403b000 2048 - - - ----- libcos-plugin.so 00002af50423b000 4 - - - rw--- libcos-plugin.so 00002af50423c000 40 - - - r-x-- libdna-plugin.so 00002af504246000 2044 - - - ----- libdna-plugin.so 00002af504445000 4 - - - rw--- libdna-plugin.so 00002af504446000 28 - - - r-x-- libhttp-client-plugin.so 00002af50444d000 2044 - - - ----- libhttp-client-plugin.so 00002af50464c000 4 - - - rw--- libhttp-client-plugin.so 00002af50464d000 432 - - - r-x-- libback-ldbm.so 00002af5046b9000 2048 - - - ----- libback-ldbm.so 00002af5048b9000 12 - - - rw--- libback-ldbm.so 00002af5048c5000 964 - - - r-x-- libdb-4.3.so 00002af5049b6000 2044 - - - ----- libdb-4.3.so 00002af504bb5000 20 - - - rw--- libdb-4.3.so 00002af504bba000 464 - - - r-x-- libreplication-plugin.so 00002af504c2e000 2044 - - - ----- libreplication-plugin.so 00002af504e2d000 12 - - - rw--- libreplication-plugin.so 00002af504e30000 4 - - - rw--- [ anon ] 00002af504e31000 28 - - - r-x-- libmemberof-plugin.so 00002af504e38000 2044 - - - ----- libmemberof-plugin.so 00002af505037000 4 - - - rw--- libmemberof-plugin.so 00002af505038000 16 - - - r-x-- libpassthru-plugin.so 00002af50503c000 2044 - - - ----- libpassthru-plugin.so 00002af50523b000 4 - - - rw--- libpassthru-plugin.so 00002af50523c000 16 - - - r-x-- libreferint-plugin.so 00002af505240000 2044 - - - ----- libreferint-plugin.so 00002af50543f000 8 - - - rw--- libreferint-plugin.so 00002af505441000 28 - - - r-x-- libretrocl-plugin.so 00002af505448000 2048 - - - ----- libretrocl-plugin.so 00002af505648000 4 - - - rw--- libretrocl-plugin.so 00002af505649000 28 - - - r-x-- libroles-plugin.so 00002af505650000 2044 - - - ----- libroles-plugin.so 00002af50584f000 4 - - - rw--- libroles-plugin.so 00002af505850000 8 - - - r-x-- libschemareload-plugin.so 00002af505852000 2044 - - - ----- libschemareload-plugin.so 00002af505a51000 4 - - - rw--- libschemareload-plugin.so 00002af505a52000 8 - - - r-x-- libstatechange-plugin.so 00002af505a54000 2044 - - - ----- libstatechange-plugin.so 00002af505c53000 4 - - - rw--- libstatechange-plugin.so 00002af505c54000 20 - - - r-x-- libviews-plugin.so 00002af505c59000 2044 - - - ----- libviews-plugin.so 00002af505e58000 4 - - - rw--- libviews-plugin.so 00002af505e59000 300 - - - r-x-- libfreebl3.so 00002af505ea4000 2048 - - - ----- libfreebl3.so 00002af5060a4000 4 - - - rw--- libfreebl3.so 00002af5060a5000 3836 - - - rw--- [ anon ] 00002af506464000 4 - - - rw-s- slapd-USR.stats 00002af506465000 4 - - - rw-s- sem.zTDl6x (deleted) 00002af506466000 65544 - - - rw--- [ anon ] 00002af50a468000 24 - - - rw-s- __db.001 00002af50a46e000 2097152 - - - rw-s- __db.002 00002af58a46e000 1056 - - - rw-s- __db.003 00002af58a576000 6696 - - - rw-s- __db.004 00002af58ac00000 56 - - - rw-s- __db.005 00007fff98fe0000 112 - - - rw--- [ stack ] ffffffffff600000 8192 - - - ----- [ anon ] ---------------- ------ ------ ------ ------ total kB 16106304 - - - Best regards. Nicolas ********************************* This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not the intended addressee of this message, please cancel it immediately and inform the sender. ********************************

1 0

Replication from Fedora DS to OpenLDAP
by Wes Rogers 13 Aug '10

13 Aug '10

I've been doing some investigation for getting replication between DS and OL working. According to http://directory.fedoraproject.org/wiki/Howto:OpenldapIntegration it is possible but not documented. After reading this http://lists.fedoraproject.org/pipermail/389-users/2007-September/006162.ht… it is obviously doable but my question is this : Has anyone accomplished this in a working fashion? And if so, are you willing to share with the list or off list directly to me your experience? Thanks, Wes

1 0

Clarification on admin server and console
by Jonathan Boulle 12 Aug '10

12 Aug '10

I've been trawling through the documentation trying to get a better understanding of "best practices" for use of the console and admin server in an environment with a large number of directory servers. In the perfect scenario, we would like to be able to manage the entire estate (multiple locations) using one instance of the console; or perhaps one console per location. Unfortunately I'm not finding it straightforward. I understand that on a (physical/virtual) server there can be multiple directory server instances but only one admin server instance. However, what I'm wondering is whether it is possible for an instance of the admin server to manage directory servers on different boxes. For example, could I have one admin server per location - where a location houses X physical servers each running a DS instance (a mix of read-only consumers and read-write suppliers)? This brings obvious benefits as regards easier backup and a single point of administration, but also becomes a bit of a single point of failure. If not, is it necessary/standard to run an admin server per physical server, and then group them in the console by having them all share a single configuration server (as specified in setup-ds-admin.pl)? Although again this creates a single POF, at least with administration - or have I got the wrong end of the stick entirely? One more point: the Console and Admin Server documentation has diagrams which reference "external programs"; what kind of things does this refer to? Is there a typical use case? Thanks Jonathan ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

1 0

Announcing 389 Directory Server 1.2.6 Release Candidate 7
by Rich Megginson 12 Aug '10

12 Aug '10

The 389 team is pleased to announce the availability of Release Candidate 7 of version 1.2.6. This release has one bug fix. WARNING: If you are upgrading from a previous 1.2.6 release candidate, you will need to run fixfiles to fix some SELinux AVCs, or directory server will not start. See bug https://bugzilla.redhat.com/show_bug.cgi?id=622882 To fix, run this: fixfiles -R 389-ds-base restore WARNING: If you are upgrading from a 1.2.6 alpha or release candidate, you will need to manually fix your entryrdn index files. See http://directory.fedoraproject.org/wiki/Subtree_Rename#warning:_upgrade_fro… for more information. If you are upgrading from 1.2.5 or earlier, there is no problem. ***We need your help! Please help us test this software.*** It is a release candidate, so it may have a few glitches, but it has been tested for regressions and for new feature bugs. The Fedora system strongly encourages packages to be in Testing until verified and pushed to Stable. If we don't get any feedback while the packages are in Testing, the packages will remain in limbo, or get pushed to Stable. The more testing we get, the faster we can release these packages to Stable. See the Release Notes for information about how to provide testing feedback (or just send an email to 389-users(a)lists.fedoraproject.org) The packages that need testing are: * 389-ds-base-1.2.6.rc7 - 389-ds-base More information * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download === Bugs Fixed === This release contains several bug fixes. The complete list of bugs fixed is found at the link below. Note that bugs marked as MODIFIED have been fixed but are still in testing. * Tracking bug for 1.2.6 release - https://bugzilla.redhat.com/showdependencytree.cgi?id=543590&hide_resolved=0 ** Bug 621928 - Unable to enable replica (rdn problem?) on 1.2.6 rc6

3 4

"Researching" ldif changes
by Gerrard Geldenhuis 12 Aug '10

12 Aug '10

Hi I was hoping someone can share a methodology of finding the ldif changes that happens when doing changes in the GUI. I would like to create equivalent ldif files for all changes that I do in the GUI. Thus far I have been doing before and after diffs of dse.ldif. I have not done that yet for netscaperoot. Is there any logic with regards to which settings gets stored in which database. As an example I have used this page: http://directory.fedoraproject.org/wiki/Howto:SSL#Verify_SSL_is_enabled to assist with ldif'ing ssl settings but what bothers me is that a comparison between dse.ldif with the ldif applied to enable ssl from the howto page and a dse.ldif with ssl enabled via the gui differs significantly. I am not referring to timestamp differences but to additional fields that gets added when enabling SSL via the GUI. Specifically for this example I have not been able to find where "Use SSL in Console" should be set and thus can't include it in my ldif file Best Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 1

Allow only SSL-connections
by Antony 12 Aug '10

12 Aug '10

Hi all. I'd like to make 389 Port DS allow only secure(SSL/TLS) connections and to disable listening for non-SSL connections. Is it possible? If so, how would I do that? Thanks in advance!

5 4

modifytimestamp -- how to get via ldap?
by brandon 10 Aug '10

10 Aug '10

In the IDM console under 'Advanced Properties' on an object you can see create and modify timestamp and other bits of info like this. How you can pull this info as an attribute via LDAP? By default, it is not appearing. -Brandon

2 1

selinux error on update to RC6
by Aaron Hagopian 10 Aug '10

10 Aug '10

I updated to the latest RC for 1.2.6 and now when I try to start dirsrv I get the attached error message. running 'restorecon -R /usr/lib64/dirsrv' did fix the problem for me, just letting you guys know. Thanks, Aaron

2 1

admin account expires, expire time refuses to update
by brandon 10 Aug '10

10 Aug '10

I am in a curious situation (and by curious I mean frustratingly annoying). I have enabled strong password policies, including expirations, across my tree (policy of the site). This has since effected my 'admin' account in uid=admin,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot. I discovered this was happening when I was no longer to login to the IDM/admin console. Unfortunately, the IDM gave a very obtuse error about not being able to find an object. I discovered the real problem when I tried an ldapsearch with the admin uid, and it then returned password expired. This is a side issue, not part of the core problem. I used ldapmodify with "cn=directory manager" and changed the password hash. I can then login with IDM again. I then go (in IDM) to the admin account and I change passwordexpirationtime to be 2040........Z (i.e. some time in the distant future). I save this change; restart the directory server and the account is expired again. If I go through the same reset process and pull up the value, it has not committed the passwordexpirationtime attribute, it is back to the original setting(!?) To be even more confusing, if I do an ldapsearch on the uid=admin account, it doesn't even show the passwordexpirationtime attribute (and thus cannot be updated). I can only see/change this via IDM. Can anybody explain this behavior? Is there a better way to exclude the admin account from the password policies of the server? Can somebody explain why I can see some attributes on uid=admin that cannot be seen with ldapsearch? Versions: 389-ds-console-1.2.0-5 389-admin-1.1.9-1 389-admin-console-1.1.4-2 389-console-1.1.3-5 389-ds-base-1.2.3-1 389-admin-console-doc-1.1.4-2 389-adminutil-1.1.8-4 389-ds-console-doc-1.2.0-5 389-dsgw-1.1.4-1 389-ds-1.1.3-5 RHEL 5.5 Any help/insight into this matter would be greatly appreciated. -B.G.

2 1

Multi-master replication + AD password synchronisation
by Johan Venter 09 Aug '10

09 Aug '10

Hi all, I have the following situation: - ds1 running 1.2.6.a3 - ds2 running 1.2.5.rc3 (yes, I will get around to bringing them up to the same version soon) - Multi-master replication agreements between both hosts - A synchronisation agreement to a Windows 2008 AD on ds1 Although I am sure I have tested password changes on ds2 synchronising to ds1 then to the AD I have recently put ds2 in production and found that this is not working. To be more specific: - Password changes on Windows work fine, as the Password Sync service picks them up, pushes them to ds1, which then replicates the change to ds2 - Password changes on ds1 work fine, are replicated to ds2 and are synchronised to AD - Password changes on ds2 replicate to ds1, and while there are entries in the Replication log on ds1 for a modification to the AD, the Windows password is not changed Looking at the documentation at http://www.redhat.com/docs/manuals/dir-server/8.1/admin/Windows_Sync.html#W… there are no caveats mentioned regarding multi-master replication and AD password sync, in fact their provided architecture diagram (lower part of the page) seems to indicate it should work in this situation. Furthermore, the text backs this up with: "The Directory Server relies on the Multi-Master Replication Plug-in to synchronize user and group entries. The same changelog that is used for multi-master replication is also used to send updates from the Directory Server to Active Directory as LDAP operations." and "Directory Server passwords are synchronized along with other entry attributes because plain-text passwords are retained in the Directory Server changelog." I did search the mailing list and turned up http://lists.fedoraproject.org/pipermail/389-users/2010-January/010903.html but I was hoping there is a different answer 6 months on. It seems to me that if 389 is storing password changes in the clear in the changelog that it should be able to push this cleartext password to AD when ds1 gets the replication? Alternatively if this is absolutely just not a supported feature, would it be possible to setup a second AD synchronisation agreement on ds2 to the AD but specify ONLY to sync userPassword attribute changes? (disabling the create/delete new user/group options in the sync agreement of course to try and not cause loops or other problems). The same documentation references above specifically says NOT to have different DS's syncing to the same AD domain, but does that still apply if it's a very limited attribute synchronisation? Any help appreciated. Cheers, Johan

2 3

ns-slapd segfault during db2ldif export
by Johan Venter 09 Aug '10

09 Aug '10

Hi all, Last night I attempted to upgrade my 389 cluster to the latest 1.2.6rc6. The node that I started with is currently running 1.2.6rc3 and after the yum upgrade (running on CentOS, so from epel-testing) I tried to follow the instructions at http://directory.fedoraproject.org/wiki/Subtree_Rename#warning:_upgrade_fro…. The db2ldif export of NetscapeRoot was fine, but the export of userRoot resulted in either 1 of 2 outcomes: 1. ns-slapd segfaulted 2. ns-slapd sat there doing nothing, using no CPU time at all I tried multiple times with reboots in between and found that (1) only happens the first time, then any attempt to rerun the same db2ldif command results in (2). I know this is not exactly a useful bug report, but I was hoping you could point me at what I need to do to report properly - can I just run gdb on the ns-slapd process and post the results or are there no debug symbols in the binary from the testing packages? Do I need to setup a VM, compile a debug build from source and see if I can replicate? Cheers, Johan

2 1

Missing encryption information
by Terry Soucy 09 Aug '10

09 Aug '10

Hi All, We have two instances of 389 server running as slaves to a single master. The master and one of the slaves have no troubles with SSL. The other slave does not allow me to choose the cipher family under the encryption tab in configuration. Also, when I click on "Manage Certificates", nothing pops up. The server is responding to queries on 636 with no problems, and I was able to import the new server cert without error using pk12util, but I can't change the server cert to use in the console. Any ideas? -- Terry Soucy, Systems Analyst Integrated Technology Services University of New Brunswick, Fredericton Campus http://www.unbf.ca/its Voice: 506.447.3018 Fax: 506.453.3590 E-mail: tsoucy(a)unb.ca ** ITS is a scent-reduced workplace - www.unbf.ca/its/policies **

2 1

389-console on OSX?
by Brian_Kosick＠McAfee.com 06 Aug '10

06 Aug '10

Hi All, Just curious if anyone has gotten the UI/console working on OSX? I did a quick look though the howto's but didn't see anything and did a google search and didn't come up with much... Since it's Java based, I was thinking that, with a little work, I could bastardize the Windows howto and get it running on OSX. Anyone try this before? Brian

2 1

replica/rdn problems with 1.2.6 rc6
by Jonathan Boulle 06 Aug '10

06 Aug '10

When trying to enable consumer replication on a database/root suffix, we get an "operations error" (in the GUI or command line with ldapmodify) and the following in the log: [05/Aug/2010:17:35:20 +0100] entryrdn-index - _entryrdn_insert_key: Suffix "dc=example" not found: DB_NOTFOUND: No matching key/data pair found(-30989) [05/Aug/2010:17:35:20 +0100] - add: attempt to index 1 failed [05/Aug/2010:17:35:20 +0100] NSMMReplicationPlugin - _replica_configure_ruv: failed to create replica ruv tombstone entry (dc=example); LDAP error - 1 However, the exact same procedure works fine on 1.2.5 (haven't tested with earlier RC versions of 1.2.6) When trying to troubleshoot - if I manually add the following to the directory: dn: dc=betfair dc: betfair objectClass: top objectClass: domain I no longer get the above error, and the "Enable Replica" step succeeds, but I see this in the log: [05/Aug/2010:17:45:14 +0100] NSMMReplicationPlugin - replica_add_by_dn: replica with dn (dc=example) already in the hash [05/Aug/2010:17:45:14 +0100] NSMMReplicationPlugin - replica_add_by_dn: replica with dn (dc=example) already in the hash Haven't tested past this point - although this was definitely not necessary on e.g. 1.2.5. I suspect it's related to the RDN shift mentioned in the changelogs, but I've reproduced the same issue with a) upgrades from previous versions of the packages (e.g. 1.2.5) b) clean installs of the above packages on a completely fresh CentOS 5.5 build Package versions: 389-ds-1.2.1-1.el5 389-admin-1.1.11-0.6.rc2.el5 389-ds-base-1.2.6-0.9.rc6.el5 Bugzilla time? Cheers ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

3 7

389 v. 1.2.6 (bug) boolean value are case sensitive (eg."true" doesn't work)
by Roberto Polli 06 Aug '10

06 Aug '10

Hi all, Since 1.2.6 I found this bug. * lowercase boolean values are refused. ex. this won't work anymore syncmlEnabled: true I must use: syncmlEnabled: TRUE quite strange behavior: Let me know + Peace, R. -- Roberto Polli Babel S.r.l. - http://www.babel.it Tel. +39.06.91801075 - fax +39.06.91612446 Tel. cel +39.340.6522736 P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma) "Il seguente messaggio contiene informazioni riservate. Qualora questo messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto della legge in materia di protezione dei dati personali."

2 2

Some "admin" questions
by Gerrard Geldenhuis 05 Aug '10

05 Aug '10

Hi Not important but just curious about why there is http://port389.org/ and http://directory.fedoraproject.org/ since port389 gets redirected anyway. And also is there any difference between RHDS (Redhat Directory Server) and 389? Is the relationship similar to Satellite and Spacewalk or is it purely a naming thing? Best Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 1

Announcing 389 Directory Server 1.2.6 Release Candidate 6
by Rich Megginson 05 Aug '10

05 Aug '10

The 389 team is pleased to announce the availability of Release Candidate 6 of version 1.2.6. This release has several bug fixes. Note: RC4 and RC5 were never released. ***We need your help! Please help us test this software.*** It is a release candidate, so it may have a few glitches, but it has been tested for regressions and for new feature bugs. The Fedora system strongly encourages packages to be in Testing until verified and pushed to Stable. If we don't get any feedback while the packages are in Testing, the packages will remain in limbo, or get pushed to Stable. The more testing we get, the faster we can release these packages to Stable. See the Release Notes for information about how to provide testing feedback (or just send an email to 389-users(a)lists.fedoraproject.org) The packages that need testing are: * 389-ds-base-1.2.6.rc6 - 389-ds-base * 389-admin-1.1.11.rc2 - 389-admin More information * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download === Bugs Fixed === This release contains several bug fixes. The complete list of bugs fixed is found at the link below. Note that bugs marked as MODIFIED have been fixed but are still in testing. * Tracking bug for 1.2.6 release - https://bugzilla.redhat.com/showdependencytree.cgi?id=543590&hide_resolved=0 ** Bug 617013 - repl-monitor.pl use cpu upto 90% ** Bug 616618 - 389 v1.2.5 accepts 2 identical entries with different DN format ** Bug 547503 - replication broken again, with 389 MMR replication and TCP errors ** Bug 613833 - Allow dirsrv_t to bind to rpc ports ** Bug 612242 - membership change on DS does not show on AD ** Bug 617629 - Missing aliases in new schema files ** Bug 619595 - Upgrading sub suffix under non-normalized suffix disappears ** Bug 616608 - SIGBUS in RDN index reads on platforms with strict alignments ** Bug 617862 - Replication: Unable to delete tombstone errors ** Bug 594745 - Get rid of dirsrv_lib_t label

1 1

Missing jar file
by Gerrard Geldenhuis 05 Aug '10

05 Aug '10

Hi I have just installed the latest RC6 release but when trying to run the Directory Server console I get Failed to install a local copy of 389-ds-1.2.3.jar .... There is no symlink or file with that name the version present is 389-ds-1.2.0.jar. Should it really be pointing to 389-ds-1.2.0.jar or is 1.2.3 missing from the packaging? I did a yum install 389-ds from epel and then a yum upgrade --enablerepo=epel-testing 389-ds-base 389-admin OS is Centos 5.5 fully updated. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users August 2010