389-users October 2021

389-users@lists.fedoraproject.org

9 participants
14 discussions

ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0
by Graham Leggett 11 Dec '23

11 Dec '23

Hi all, We have a long standing 389ds master LDAP server that was found to be unable to contact it’s slaves. Most specifically, the slaves show nothing in their logs about any kind of connection, while the master is logging this: [12/Nov/2019:21:39:47.212715697 +0000] - ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0 (Unknown error, host “ldap01:636”) Key is "system error 0 (no error)”, which leaves us stumped. The error is obviously “success”. Has anyone seen this kind of thing before? This is 389ds running on CentOS7 as follows: 389-ds-base-1.3.9.1-10.el7.x86_64 Regards, Graham —

3 9

Plugin development licensing
by DUVERT Vincent 09 May '23

09 May '23

Hello, I have a question regarding the licensing of developed 389-ds plugins. The FAQ (https://directory.fedoraproject.org/docs/389ds/FAQ/licensing.html#directory…) indicates that the Directory Server core code is licensed under a GPL + Exception license that allows non-GPL 389-ds plugins to link to 389-ds and to use specific header files. However, the LICENSE file in the current 389-ds-base source does not contain this exception. It was apparently removed by the following commit, when the license was changed to GPLv3+: https://pagure.io/389-ds-base/c/88cae401aee39a19ac6b07c3c36ee8daa07192e7 Does that means that the license exception does not apply to the current version of 389-ds? Regards, Vincent Duvert

2 2

Re: Unable to lock accounts with dsidm utility
by Michael Starling 26 Oct '21

26 Oct '21

I found the issue. Please disregard. ________________________________ From: Michael Starling <mlstarling31(a)hotmail.com> Sent: Tuesday, October 26, 2021 3:29 PM To: 389-users(a)lists.fedoraproject.org <389-users(a)lists.fedoraproject.org> Subject: [389-users] Unable to lock accounts with dsidm utility Running the command below as root: dsidm slapd-mydomainDS -b dc=mydomain,dc=com account lock uid=mstarlingt,ou=People,dc=mydomain,dc=com Error: Insufficient access - Insufficient 'write' privilege to the 'nsAccountLock' attribute of entry 'uid=mstarlingt,ou=people,dc=mydomain,dc=com'. Version: 389-ds-base-1.4.3.17-1.module_el8+10764+2b5f8656.x86_64

1 0

Unable to lock accounts with dsidm utility
by Michael Starling 26 Oct '21

26 Oct '21

Running the command below as root: dsidm slapd-mydomainDS -b dc=mydomain,dc=com account lock uid=mstarlingt,ou=People,dc=mydomain,dc=com Error: Insufficient access - Insufficient 'write' privilege to the 'nsAccountLock' attribute of entry 'uid=mstarlingt,ou=people,dc=mydomain,dc=com'. Version: 389-ds-base-1.4.3.17-1.module_el8+10764+2b5f8656.x86_64

1 0

Search directory for userCertificate by fingerprint?
by Graham Leggett 24 Oct '21

24 Oct '21

Hi all, (This is very tricky to google) Is there a mechanism by which it is possible, given the hash of a userCertificate, to search for userCertificates in a 389ds directory? Something like this: (userCertificate=sha256:0a:f0…) Obviously I can preprocess the directory and store the hash beside the certificate, however there does not seem to be a sensible attribute for that. Is this possible? Regards, Graham —

2 1

Re: anonymous binds
by Mark Reynolds 21 Oct '21

21 Oct '21

On 10/21/21 9:26 AM, Michael Starling wrote: > > > ------------------------------------------------------------------------ > *From:* Mark Reynolds <mreynolds(a)redhat.com> > *Sent:* Tuesday, October 19, 2021 3:47 PM > *To:* General discussion list for the 389 Directory server project. > <389-users(a)lists.fedoraproject.org>; Michael Starling > <mlstarling31(a)hotmail.com> > *Subject:* Re: [389-users] anonymous binds > > > On 10/19/21 1:43 PM, Michael Starling wrote: >> Good afternoon. >> >> I have a few questions about anon binds. >> >> In theory if you have 3000 user objects in the directory and >> anonymous binds have a limit returning 2000 entries can you still use >> anonymous binds in LDAP client configurations without issues? > > So you have a "resource limit" setup for "anonymous binds" which sets > the sizelimit to 2000? If that is the case then your client will hit > this "2000" entry sizelimit - if it does an anonymous bind to the > server. If it provides credentials then it will not be restricted by > the configured anonymous resource limits. > >> Or does something else take place when a user logs in that only >> requires the LDAP clients (sssd or nscld) to parse that specific user >> dn and attributes? > > I'm not that familiar with sssd or nscld enough to say, but I'm pretty > sure they can be configured to use a specific bind dn and password. > >> >> Typically, with OpenLDAP I have created a "bind" user that can read >> all user/group objects with limited attributes and turned off anon >> binds so I don't fully understand the behavior of anonymous binds. > > In our server you can create users that have aci's that grant them > specific access as well. Anonymous access can also be disabled in our > server. > > To recap what an anonymous bind is, it is when a client connects to > the server but does not provide any credentials. The behavior of such > connections/operations will depend on what aci's and resource limits > you have configured. > > I don't think this is what you are asking about though, so can you > please clarify your questions? > > Thanks, > > Mark > > > Hi Mark. > > > Essentially, I'm asking anon binds have a search limit of 2000 objects > and you have 3000 user objects is it possible that you will have > problems with user's logging into to Linux clients? > It depends on how the client is performing the authentication. If it's searching for a single user, then you will be fine. Since this is a "size limit" that means it will not "send" more than 2000 entries back to the client. However, size limit does /not/ impact how far into the database a search can go. > > > > In this scenario user A uses ssh to login to a Linux client using sssd > as an authentication mechanism. Is sssd we are not specifying a bind > dn to handle the lookups to 389. > > > When user A initiates the connection to the client, sssd does the anon > lookup but hits the 2000 limit. If there are 3000 user entries, is it > possible that user A is unable to make a connection because this user > potentially is object 2001 and thus the information necessary to be > returned by 389 to the client fails? > If you know SSSD is hitting the sizelimit then yes it is absolutely possible that it will not find the entry and cause authentication to unexpectedly fail. > > > Is it a better practice with 389 to create a bind dn with no search > limit to avoid the scenario above? I understand I can bump the anon > bind limits but I think eventually I may just convince them to turn > anon binds off completely. For now, i just want to understand the > effects of the current implementation. > Ideally you should create a "bind user" that has the correct access you need. Opening up anonymous access is not ideal or recommended. Regards, Mark > > >> Mike >> >> _______________________________________________ >> 389-users mailing list --389-users(a)lists.fedoraproject.org <mailto:389-users@lists.fedoraproject.org> >> To unsubscribe send an email to389-users-leave(a)lists.fedoraproject.org <mailto:389-users-leave@lists.fedoraproject.org> >> Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/> >> List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines> >> List Archives:https://lists.fedoraproject.org/archives/list/389-users@lists.fedo… <https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject…> >> Do not reply to spam on the list, report it:https://pagure.io/fedora-infrastructure <https://pagure.io/fedora-infrastructure> > -- > Directory Server Development Team -- Directory Server Development Team

2 1

Re: anonymous binds
by Mark Reynolds 21 Oct '21

21 Oct '21

On 10/19/21 1:43 PM, Michael Starling wrote: > Good afternoon. > > I have a few questions about anon binds. > > In theory if you have 3000 user objects in the directory and anonymous > binds have a limit returning 2000 entries can you still use anonymous > binds in LDAP client configurations without issues? So you have a "resource limit" setup for "anonymous binds" which sets the sizelimit to 2000? If that is the case then your client will hit this "2000" entry sizelimit - if it does an anonymous bind to the server. If it provides credentials then it will not be restricted by the configured anonymous resource limits. > Or does something else take place when a user logs in that only > requires the LDAP clients (sssd or nscld) to parse that specific user > dn and attributes? I'm not that familiar with sssd or nscld enough to say, but I'm pretty sure they can be configured to use a specific bind dn and password. > > Typically, with OpenLDAP I have created a "bind" user that can read > all user/group objects with limited attributes and turned off anon > binds so I don't fully understand the behavior of anonymous binds. In our server you can create users that have aci's that grant them specific access as well. Anonymous access can also be disabled in our server. To recap what an anonymous bind is, it is when a client connects to the server but does not provide any credentials. The behavior of such connections/operations will depend on what aci's and resource limits you have configured. I don't think this is what you are asking about though, so can you please clarify your questions? Thanks, Mark > > Mike > > _______________________________________________ > 389-users mailing list --389-users(a)lists.fedoraproject.org > To unsubscribe send an email to389-users-leave(a)lists.fedoraproject.org > Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives:https://lists.fedoraproject.org/archives/list/389-users@lists.fedo… > Do not reply to spam on the list, report it:https://pagure.io/fedora-infrastructure -- Directory Server Development Team

2 1

Re: anonymous binds
by Marc Sauton 19 Oct '21

19 Oct '21

depending on the filters used, an error 11 / err=11 / ADMIN_LIMIT_EXCEEDED / "Administrative limit exceeded" could be returned, and depending on the LDAP client, it could be an important error. it may be a good idea to set a DN for nsslapd-anonlimitsdn , see https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/h… with its associated/dedicated values different from the global settings, for the attributes nsIdleTimeout , nsTimeLimit and nsSizeLimit or set a special user entry for those BINDs , with the same 3 user specified idletimeout, time and size limits to avoid tuning up the general setting of the size limit. M. On Tue, Oct 19, 2021 at 10:44 AM Michael Starling <mlstarling31(a)hotmail.com> wrote: > Good afternoon. > > I have a few questions about anon binds. > > In theory if you have 3000 user objects in the directory and anonymous > binds have a limit returning 2000 entries can you still use anonymous binds > in LDAP client configurations without issues? Or does something else take > place when a user logs in that only requires the LDAP clients (sssd or > nscld) to parse that specific user dn and attributes? > > Typically, with OpenLDAP I have created a "bind" user that can read all > user/group objects with limited attributes and turned off anon binds so I > don't fully understand the behavior of anonymous binds. > > Mike > _______________________________________________ > 389-users mailing list -- 389-users(a)lists.fedoraproject.org > To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject… > Do not reply to spam on the list, report it: > https://pagure.io/fedora-infrastructure >

1 0

anonymous binds
by Michael Starling 19 Oct '21

19 Oct '21

Good afternoon. I have a few questions about anon binds. In theory if you have 3000 user objects in the directory and anonymous binds have a limit returning 2000 entries can you still use anonymous binds in LDAP client configurations without issues? Or does something else take place when a user logs in that only requires the LDAP clients (sssd or nscld) to parse that specific user dn and attributes? Typically, with OpenLDAP I have created a "bind" user that can read all user/group objects with limited attributes and turned off anon binds so I don't fully understand the behavior of anonymous binds. Mike

1 0

changelog program - _cl5AddThread - Invalid changelog state - 2
by Kees Bakker 19 Oct '21

19 Oct '21

Hi, Today I tried 389-base 1.4.4.17 for a fix of retro cl trimming [1] Unfortunately the ns-slapd got into some sort of deadlock, I think. Anyway, I reverted 389-base back to 1.4.3.23. But now I have a replication problem. Could this have been caused by the update to 1.4.4.17 ? And, if yes, how can I fix this? [18/Oct/2021:12:17:41.750334062 +0200] - ERR - NSMMReplicationPlugin - changelog program - _cl5AddThread - Invalid changelog state - 2 [18/Oct/2021:12:17:41.782505596 +0200] - ERR - NSMMReplicationPlugin - send_updates - agmt="cn=iparep4.example.com-to-rotte.example.com" (rotte:389): Changelog database was in an incorrect state [18/Oct/2021:12:17:41.827732779 +0200] - ERR - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=iparep4.example.com-to-rotte.example.com" (rotte:389): Incremental update failed and requires administrator action [1] https://github.com/389ds/389-ds-base/pull/4895 -- Kees

2 8

Lock table is out of available lock entries
by Kees Bakker 18 Oct '21

18 Oct '21

Hi, When my dirsrv was trying to compact the databases I was getting this error [07/Aug/2021:23:59:02.715984489 +0200] - NOTICE - bdb_compact - Compacting databases ... [07/Aug/2021:23:59:02.765932397 +0200] - NOTICE - bdb_compact - Compacting DB start: userRoot [07/Aug/2021:23:59:03.518175414 +0200] - NOTICE - bdb_compact - compactdb: compact userRoot - 417 pages freed [07/Aug/2021:23:59:03.576427786 +0200] - NOTICE - bdb_compact - Compacting DB start: ipaca [07/Aug/2021:23:59:03.659941533 +0200] - NOTICE - bdb_compact - compactdb: compact ipaca - 419 pages freed [07/Aug/2021:23:59:03.718445310 +0200] - NOTICE - bdb_compact - Compacting DB start: changelog [08/Aug/2021:00:00:40.807571334 +0200] - NOTICE - NSMMReplicationPlugin - changelog program - cl5CompactDBs - compacting replication changelogs... [08/Aug/2021:00:00:54.309357211 +0200] - ERR - libdb - BDB2055 Lock table is out of available lock entries [08/Aug/2021:00:00:54.726504736 +0200] - ERR - bdb_compact - compactdb: failed to compact changelog; db error - 12 Cannot allocate memory [08/Aug/2021:00:00:54.801571421 +0200] - ERR - libdb - BDB2055 Lock table is out of available lock entries [08/Aug/2021:00:00:54.876618702 +0200] - ERR - NSMMReplicationPlugin - changelog program - cl5CompactDBs - Failed to compact a797bb0b-be1d11eb-88c0b677-613aa2ad; db error - 12 Cannot allocate memory [08/Aug/2021:00:00:57.253006449 +0200] - NOTICE - bdb_compact - Compacting databases finished. There are about 402k entries in cn=changelog. I have a few questions 1) is it normal to have so many entries in cn=changelog? On another replica I have almost 3M entries Isn't this cleaned up? 2) the number of locks is 50000 (there are two config items). Should I increase that number? If so, increase to what? 3) is there maybe something else going on, causing the exhaustion of the locks? -- Kees Bakker

4 21

389 1.4.x Change Log Config
by Sean Weldon 13 Oct '21

13 Oct '21

Hello, Can someone tell me where the change log config has moved in 1.4.x+? Looking at https://directory.fedoraproject.org/docs/389ds/design/integrate-changelog-d… , I understand it's now part of the back end and can be configured in the 'replica object', but where exactly is that? Is that somewhere in the cn=config tree or is that in the root suffix (example: C=US)? Thanks Sean

2 1

syntax passwd policy trivial words restrictions issues
by Ghiurea, Isabella 12 Oct '21

12 Oct '21

Hi List, We are testing a new passwd syntax policy in ldap we have only cfg password length to 8 char and according to this RH Doc bellow there are some exceptions( aka "trivial words" and uid, cn, givenName which can not be used ) when a user tries to update his passwd , for example if the new passwd contains more than 3 char from his uid the ldapasswd cmd will fail . Exemple : Uid=6712 For new Passwd :cheese671cheese >> will fail But for passwd: cheese67cheese will work . I need to understand if we need other passwd attributes to cfg or why this char min limitation and how to solve this issue? Our uid can be from 4 char lenhgt to 14 char length. Here is in ldap ldif: nsslapd-pwpolicy-inherit-global: on nsslapd-pwpolicy-local: off passwordTrackUpdateTime: on passwordCheckSyntax: on passwordminlenghth: 8 passwordMinCategories: 1 And RH DS doc : https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/h… 9.6.2.7. Password Syntax Checking Password syntax checking enforces rules for password strings, so that any password has to meet or exceed certain criteria. All password syntax checking can be applied globally, per subtree, or per user. Password syntax checking is set in the passwordCheckSyntax attribute. The default password syntax requires a minimum password length of eight characters and that no trivial words are used in the password. A trivial word is any value stored in the uid, cn, sn, givenName, ou, or mailattributes of the user's entry. Thank you Isabella

2 1

ldapsearch filters
by Ghiurea, Isabella 06 Oct '21

06 Oct '21

Dear List, What ldapsearch options/ filters I need to use to find all the multiple uid /cn's entries associated to one single email address in my DS with > 5k entries? ( I do not know the email address or uids values) Thank you

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users October 2021