389-users April 2021

389-users@lists.fedoraproject.org

16 participants
15 discussions

Preserving create & modifyTimestamp during import
by Jan Tomasek 13 Apr '21

13 Apr '21

Hi, I need to import sub-suffix into the existing suffix on a running server. When I use: dsconf -D "cn=Directory Manager" -w "$pswd" ldap://localhost backend import userRoot sub-suffix.ldif than userRoot is truncated and later import fails with error: [13/Apr/2021:15:08:41.180921374 +0200] - WARN - import_foreman - import userRoot: Skipping entry "o=sub,o=suffix" which has no parent, ending at line 36 of file "/root/sub-suffix.ldif" One way is to dump existing userRoot and later re-import complete backend: dsconf -D "cn=Directory Manager" -w "$pswd" ldap://localhost backend import userRoot suffix.ldif sub-suffix.ldif But that means downtime I'm trying to avoid. Other import way is use ldapadd but that means that server replaces operational attributes: creatorsName modifiersName createTimestamp modifyTimestamp Is there a way how to import sub-suffix into existing and running server and preserve those operational attributes at the same time? Thanks -- ----------------------- Jan Tomasek aka Semik http://www.tomasek.cz/

2 1

dsconf duplicate replica id
by Gary Waters 12 Apr '21

12 Apr '21

Hey Everyone, I love the new dsconf python tool. Its great, and big upgrade over the perl scripts that I think I have been using for decades. However I am having a problem using it when making new replication agreements between multiple masters. How do I find the duplicates and how do i run dsconf to avoid that duplicate? Error after agreements are made: Error (11) Replication error acquiring replica: Unable to acquire replica: the replica has the same Replica ID as this one. Replication is aborting. (duplicate replica ID detected) Error (11) Replication error acquiring replica: duplicate replica ID detected I know how to delete the newly made agreements no problem, but how do I recreate them to avoid the duplicates? when creating the agreements I didnt see a way to set an id. command for the individual agreement.. maybe I am doing something wrong. This is how I setup the agreement: dsconf -D "cn=Directory Manager" -w $pass ldap://$supplier- repl-agmt \ create --suffix="ou=$suffix,o=school,c=us" --host=$consumer --port=389 \ --conn-protocol=StartTLS --bind-dn="cn=replication manager,cn=config" \ --bind-passwd="x" --bind-method=SIMPLE --init \ $agreement_name And this is how I setup the id and replication for the for the suffix: dsconf -D "cn=Directory Manager" -w $pass ldap://$consumer replication \ enable --suffix="ou=$suffix,o=school,c=us" --role="master" --replica-id=$repid \ --bind-dn="cn=replication manager,cn=config" --bind-passwd=XXX In my case I have 3 masters that I need to setup MMR between, and this error happens when I added the third. It says replication is already set for the suffix as mmr, which is correct, but I cant set a new repid for each aggreement via the first command. Thank you everyone, Gary Other info: rhel8.3 389-ds-base-libs-1.4.3.17-1.module_el8+10764+2b5f8656.x86_64 389-ds-base-1.4.3.17-1.module_el8+10764+2b5f8656.x86_64

3 4

Announcing 389 Directory Server 2.0.4
by thierry bordaz 07 Apr '21

07 Apr '21

389 Directory Server 2.0.4 The 389 Directory Server team is proud to announce 389-ds-base version 2.0.4 Fedora packages are available on Fedora 34 and Rawhide Fedora 34: https://koji.fedoraproject.org/koji/taskinfo?taskID=65380611 <https://koji.fedoraproject.org/koji/taskinfo?taskID=65380611> - Koji https://bodhi.fedoraproject.org/updates/FEDORA-2021-123ca32c27 <https://bodhi.fedoraproject.org/updates/FEDORA-2021-123ca32c27> - Bohdi The new packages and versions are: * 389-ds-base-2.0.4-1 Source tarballs are available for download at Download 389-ds-base Source <https://github.com/389ds/389-ds-base/archive/389-ds-base-2.0.4.tar.gz> Highlights in 2.0.4 * Bug & security fixes Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base * Bump version to 2.0.4 * Issue 4680 - 389ds coredump (@389ds/389-ds-base-nightly) in replica install with CA (#4715) * Issue 3965 - RFE - Implement the Password Policy attribute “pwdReset” (#4713) * Issue 4700 - Regression in winsync replication agreement (#4712) * Issue 3965 - RFE - Implement the Password Policy attribute “pwdReset” (#4710) * Issue 4169 - UI - migrate monitor tables to PF4 * issue 4585 - backend redesign phase 3c - dbregion test removal (#4665) * Issue 2736 - remove remaining perl references * Issue 2736 - https://github.com/389ds/389-ds-base/issues/2736 * Issue 4706 - negative wtime in access log for CMP operations * Issue 3585 - LDAP server returning controltype in different sequence * Issue 4127 - With Accounts/Account module delete fuction is not working (#4697) * Issue 4666 - BUG - cb_ping_farm can fail with anonymous binds disabled (#4669) * Issue 4671 - UI - Fix browser crashes * Issue 4169 - UI - Add PF4 charts for server stats * Issue 4648 - Fix some issues and improvement around CI tests (#4651) * Issue 4654 Updates to tickets/ticket48234_test.py (#4654) * Issue 4229 - Fix Rust linking * Issue 4673 - Update Rust crates * Issue 4658 - monitor - connection start date is incorrect * Issue 4169 - UI - migrate modals to PF4 * Issue 4656 - remove problematic language from ds-replcheck * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down * Issue 4656 - Remove problematic language from UI/CLI/lib389 * Issue 4661 - RFE - allow importing openldap schemas (#4662) * Issue 4659 - restart after openldap migration to enable plugins (#4660) * Merge pull request #4664 from mreynolds389/issue4663 * issue 4552 - Backup Redesign phase 3b - use dbimpl in replicatin plugin (#4622) * Issue 4643 - Add a tool that generates Rust dependencies for a specfile (#4645) * Issue 4646 - CLI/UI - revise DNA plugin management * Issue 4644 - Large updates can reset the CLcache to the beginning of the changelog (#4647) * Issue 4649 - crash in sync_repl when a MODRDN create a cenotaph (#4652) * Issue 4169 - UI - Migrate alerts to PF4 * Issue 4169 - UI - Migrate Accordians to PF4 ExpandableSection * Issue 4595 - Paged search lookthroughlimit bug (#4602) * Issue 4169 - UI - port charts to PF4 * Issue 2820 - Fix CI test suite issues * Issue 4513 - CI - make acl ip address tests more robust

1 0

Cert Problems with dsidm
by Bryan K. Walton 06 Apr '21

06 Apr '21

We have/had a working 389 directory server running on Centos 8. It was working fine, and for the most part, it still is. We can sucessfully manage it through the cockpit service. We can successfully manage the directory with ApacheDirectoryStudio. ldapsearch/ldapmodify works fine. But it appears that sometime in the last month or two, when we use the command dsidm, we have started getting a cert error. Again, it is only with dsidm. The error we get is: Error: Can't contact LDAP server - error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed (self signed certificate in certificate chain) I can't figure out where it is seeing this self-signed cert. When I run dsidm commands with "-v", I see the following: DEBUG: Using dirsrv ca certificate /etc/dirsrv/slapd-{instance_name} DEBUG: Using external ca certificate /etc/dirsrv/slapd-{instance_name} DEBUG: Using external ca certificate /etc/dirsrv/slapd-{instance_name} But we have our certs in that directory. And there are no self-signed certs in our cert or its intermediate and root certs. The cert is a GoDaddy cert. How can I find out what cert dsidm is reading, so as to resolve this issue? Thanks, Bryan

3 10

Announcing 389 Directory Server 1.4.4.15
by thierry bordaz 06 Apr '21

06 Apr '21

389 Directory Server 1.4.4.15 The 389 Directory Server team is proud to announce 389-ds-base version 1.4.4.15 Fedora packages are available on Fedora 33. Fedora 33: https://koji.fedoraproject.org/koji/taskinfo?taskID=65298461 <https://koji.fedoraproject.org/koji/taskinfo?taskID=65298461> - Koji https://bodhi.fedoraproject.org/updates/FEDORA-2021-57ef97888c <https://bodhi.fedoraproject.org/updates/FEDORA-2021-57ef97888c> - Bohdi The new packages and versions are: * 389-ds-base-1.4.4.15-1 Source tarballs are available for download at Download 389-ds-base Source <https://github.com/389ds/389-ds-base/archive/389-ds-base-1.4.4.15.tar.gz> Highlights in 1.4.4.15 * Bug and Security fixes Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base * Bump version to 1.4.4.15 * Issue 4700 - Regression in winsync replication agreement (#4712) * Issue 2736 - https://github.com/389ds/389-ds-base/issues/2736 * Issue 4706 - negative wtime in access log for CMP operations

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users April 2021