389-users April 2011

389-users@lists.fedoraproject.org

26 participants
32 discussions

Re: [389-users] admin server fails to start with PSET failure: Failed to create PSET handle
by Angel Bosch Mora 07 Apr '11

07 Apr '11

----- Missatge original ----- > On 04/07/2011 04:37 AM, Angel Bosch Mora wrote: > > hi, > > > > im having problems starting admin server. i can see just this line > > on log: > > > > [Thu Apr 07 12:26:13 2011] [crit] host_ip_init(): PSET failure: > > Failed to create PSET handle (pset error = ) > > > > not sure if is related, but we had an accident that changed > > permissions on some files (recursive chmod on wrong directory). main > > instance seems to work ok, so im a bit lost here. > What platform? What version of 389-ds-base and 389-admin? > ls -al /etc/dirsrv/admin-serv sorry, i was a bit nervous this morning :) # lsb_release -a LSB Version: :core-3.1-ia32:core-3.1-noarch:graphics-3.1-ia32:graphics-3.1-noarch Distributor ID: CentOS Description: CentOS release 5.5 (Final) Release: 5.5 Codename: Final # rpm -qa | grep 389 389-admin-1.1.11-1.el5 389-ds-console-doc-1.2.3-1.el5 389-adminutil-1.1.8-4.el5 389-dsgw-1.1.5-1.el5 389-admin-console-doc-1.1.5-1.el5 389-admin-console-1.1.5-1.el5 389-ds-1.2.1-1.el5 389-ds-base-1.2.6.1-2.el5 389-ds-console-1.2.3-1.el5 389-console-1.1.4-1.el5 # ls -al /etc/dirsrv/admin-serv/ total 176 drwxrwx--- 2 root duser 4096 Nov 5 18:21 . drwxrwxr-x 7 root duser 4096 Nov 5 18:21 .. -rw-rw---- 1 root duser 544 Nov 5 18:21 adm.conf -rw-rw---- 1 root duser 40 Nov 5 18:21 admpw -rw-rw---- 1 root duser 3924 Aug 26 2010 admserv.conf -rw-rw---- 1 root duser 65536 Mar 15 12:44 cert8.db -rw-rw---- 1 root duser 4469 Nov 5 18:21 console.conf -rw-rw---- 1 root duser 26827 Nov 11 12:23 httpd.conf -rw-rw---- 1 root duser 16384 Mar 15 12:44 key3.db -rw-rw---- 1 root duser 9093 Mar 18 10:21 local.conf -rw-rw---- 1 root duser 4502 Aug 26 2010 nss.conf -rw-rw---- 1 root duser 16384 Nov 5 18:21 secmod.db this duser is the user/grup created before installation and used for setup-ds.pl if you need further info, pls just ask. thnaks, abosch

2 1

admin server fails to start with PSET failure: Failed to create PSET handle
by Angel Bosch Mora 07 Apr '11

07 Apr '11

hi, im having problems starting admin server. i can see just this line on log: [Thu Apr 07 12:26:13 2011] [crit] host_ip_init(): PSET failure: Failed to create PSET handle (pset error = ) not sure if is related, but we had an accident that changed permissions on some files (recursive chmod on wrong directory). main instance seems to work ok, so im a bit lost here. regards, abosch

2 1

Windows Sync and UserAccountControl
by Diego Woitasen 06 Apr '11

06 Apr '11

I setup Windows Sync between 389DS and W2008r2. Worked fine. Now we had to downgrade the Windows server to 2003 and I don't know why I can't setup the Sync again. The only error that I see in the 389-console (there is nothing in the error log) is "operations error", after creating the agreement. I sniffed the traffic between 389DS and W2003 and I saw an objectClass violation when 389 tried to add the userAccountControl atttr to a group. The group is created anyway. I've searched in the web and it looks like userAccountControl is only for users, not for groups. Looking at the Windows Sync code it looks like 389 DS always add that attribute for both. Regards, Diego -- Diego Woitasen

2 2

389-console fonts issue
by Orion Poplawski 04 Apr '11

04 Apr '11

I've got a strange issue that I find annoying. My desktop machine is running Fedora 14. If I ssh to my 389 server and run 389-console there, the fonts are messed up (see attached snapshot). Everything is fine though if I run the console from my desktop. Also, this used to be fine, but some update long ago seems to have caused it. Any thoughts or ideas on how to debug? I ran a diff of -D 9 -f console.log output from the two and no smoking guns there. -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA/CoRA Division FAX: 303-415-9702 3380 Mitchell Lane orion(a)cora.nwra.com Boulder, CO 80301 http://www.cora.nwra.com

2 5

A lot of sessions in LDAP 389
by Allan Hougham 02 Apr '11

02 Apr '11

Hi, I have a problem with sessions in LDAP 389 master and slave, this servers have accumulative sessions, I can see in logs: [root@zblhp36 ~]# netstat -na |grep 389 |wc -l 795 795 sessions and later the server is down, I have restart the server and later this is ok with less sessions: [root@zblhp36 ~]# netstat -na |grep 389 |wc -l 795 [root@zblhp36 ~]# service dirsrv restart Shutting down dirsrv: zblhp36... [ OK ] Starting dirsrv: zblhp36... [root@zblhp36 ~]# netstat -na |grep 389 |wc -l 12 In this time, both servers work fine, but a week or 10 days this problem is again with a lot a sessions What parameter I could to change? Thanks! Allan

2 1

389 DS and syslog logging
by Brian Provenzano 01 Apr '11

01 Apr '11

I've checked over the docs a bit, but in case I missed anything I was wondering if 389 DS has the ability to log to syslog. This would help tremendously with monitoring access / auths to the directory. Thanks, Brian

2 1

retrieving x509 certificates using java
by Luke Schierer 01 Apr '11

01 Apr '11

We have a java application that is attempting to pull the userCertificate attribute from our 389ds ldap server. Looking at the ldap logs, I see its request, and it looks like it should be working, except for one oddity, it is asking for the attribute "usercertificate;binary". By attaching eclipse to the application, we have determined that the general flow of the code is <get certificate from client and put it into myCert> LDAPCertStoreParameters loCertStoreParams = new LDAPCertStoreParameters(<ldap_host>,<ldap_port>); CertStore loCertStore = CertStore.getInstance("LDAP", loCertStoreParams, "Sun"); x509CertSelector loTargetConstraints = new X509CertSelector(); lsSubjectDN = CSFGlobalPKIUtil.getSubjectDNFromCertificate(myCert); //we have verified that everything works fine as far as this point. loTargetConstraints.setSubject(lsSubjectDN); Collection loCol = loCertStore.getCertificates(loTargetConstraints); Once the gall to getCertificates is made, a query is built and sent to the LDAP server using java internal classes, we believe it is ultimately the X509CertStoreLDAP class. We do not have the source to debug this part of the code, but at some point, without visible interaction in the source code we do have, it choses to ask for "usercertificate;binary" instead of just "usercertificate". Should the 389ds be able to understand "usercertificate;binary", and is this a misconfiguration on my part in the directory server, or is that not something I should be expecting the directory to understand? As a point of further information, when I try to replicate the behavior using ldapsearch, I also fail to retrieve a certificate when I request "usercertificate;binary" but succeed when I request only "usercertificate". Any help would be greatly appreciated. Thanks!! Luke

2 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users April 2011