389-users June 2021

389-users@lists.fedoraproject.org

3 participants
5 discussions

ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0
by Graham Leggett 11 Dec '23

11 Dec '23

Hi all, We have a long standing 389ds master LDAP server that was found to be unable to contact it’s slaves. Most specifically, the slaves show nothing in their logs about any kind of connection, while the master is logging this: [12/Nov/2019:21:39:47.212715697 +0000] - ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0 (Unknown error, host “ldap01:636”) Key is "system error 0 (no error)”, which leaves us stumped. The error is obviously “success”. Has anyone seen this kind of thing before? This is 389ds running on CentOS7 as follows: 389-ds-base-1.3.9.1-10.el7.x86_64 Regards, Graham —

3 9

Plugin development licensing
by DUVERT Vincent 09 May '23

09 May '23

Hello, I have a question regarding the licensing of developed 389-ds plugins. The FAQ (https://directory.fedoraproject.org/docs/389ds/FAQ/licensing.html#directory…) indicates that the Directory Server core code is licensed under a GPL + Exception license that allows non-GPL 389-ds plugins to link to 389-ds and to use specific header files. However, the LICENSE file in the current 389-ds-base source does not contain this exception. It was apparently removed by the following commit, when the license was changed to GPLv3+: https://pagure.io/389-ds-base/c/88cae401aee39a19ac6b07c3c36ee8daa07192e7 Does that means that the license exception does not apply to the current version of 389-ds? Regards, Vincent Duvert

2 2

Announcing 389 Directory Server 2.0.6
by Thierry Bordaz 24 Jun '21

24 Jun '21

389 Directory Server 2.0.6 The 389 Directory Server team is proud to announce 389-ds-base version 2.0.6 Fedora packages are available on Fedora 34 and Rawhide Fedora 34: https://koji.fedoraproject.org/koji/taskinfo?taskID=70696310 <https://koji.fedoraproject.org/koji/taskinfo?taskID=70696310> - Koji https://bodhi.fedoraproject.org/updates/FEDORA-2021-6cec1584ab <https://bodhi.fedoraproject.org/updates/FEDORA-2021-6cec1584ab> - Bodhi Rawhide: https://koji.fedoraproject.org/koji/taskinfo?taskID=70730267 <https://koji.fedoraproject.org/koji/taskinfo?taskID=70730267> - Koji The new packages and versions are: * 389-ds-base-2.0.6-1 Source tarballs are available for download at Download 389-ds-base Source <https://github.com/389ds/389-ds-base/archive/389-ds-base-2.0.6.tar.gz> Highlights in 2.0.6 * Bug & security fixes Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… <https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o…> If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base <https://github.com/389ds/389-ds-base> * Bump version to 2.0.6 * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810) * Issue 4169 - UI - Migrate Typeaheads to PF4 (#4808) * Issue 4414 - disk monitoring - prevent division by zero crash * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793) * Issue 4656 - Fix replication plugin rename dependency issues * Issue 4656 - replication name change upgrade code causes crash with dynamic plugins * Issue 4506 - Improve SASL logging * Issue 4709 - Fix double free in dbscan * Issue 4093 - Fix MEP test case * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809) * Issue 4791 - Missing dependency for RetroCL RFE (#4792) * Issue 4794 - BUG - don’t capture container output (#4798) * Issue 4593 - Log an additional message if the server certificate nickname doesn’t match nsSSLPersonalitySSL value * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799) * Issue 4169 - UI Migrate checkbox to PF4 (#4769) * Issue 4447 - Crash when the Referential Integrity log is manually edited * Issue 4773 - Add CI test for DNA interval assignment * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790) * Issue 4379 - fixing regression in test_info_disclosure * Issue 4379 - Allow more than 1 empty AttributeDescription for ldapsearch, without the risk of denial of service * Issue 4379 - Allow more than 1 empty AttributeDescription for ldapsearch, without the risk of denial of service * Issue 4575 Update test docstrings metadata * Issue 4753 - Adjust our tests to 389-ds-base-snmp missing in RHEL 9 Appstream * removed the snmp_present() from utils.py as we have get_rpm_version() in conftest.py * Issue 4753 - Adjust our tests to 389-ds-base-snmp missing in RHEL 9 Appstream

1 0

Can't locate CSN - replica issue
by Marco Favero 17 Jun '21

17 Jun '21

Hello, I'm dealing with the update from 389-ds 1.3.9.1 to 1.4.3.22 in three multimaster servers: - srv1 - srv2 - srv3 srv1 replicates to srv2 and srv3. srv2 replicates to srv1 and srv3. srv3 replicates to srv1 and srv2. Let suppose I reinstall srv3 with 389ds 1.4.3.22, and I initialize it from srv1. This happens with success as expected. The replica is fine. Then, I reinstall srv2, and I initialize it from srv3. This happens with success as expected, but just at the initialization end, the agreement from srv3 to srv1 stops to works. In the console appears "Error (18) Can't acquire replica (Incremental update transient warning. Backing off, will retry update later.)" in the status of the agreements from srv3 to srv1. In the logs I see errors like repl_plugin_name_cl - agmt="srv3 to srv1" (srv1:389): CSN 596c6868000075320000 not found, we aren't as up to date, or we purged clcache_load_buffer - Can't locate CSN 596c6868000075320000 in the changelog (DB rc=-30988). If replication stops, the consumer may need to be reinitialized. The changelogdb Maximun Age is "7d", equals to the default nsDS5ReplicaPurgeDelay for the suffix. This happens always, for every suffix. To resolve the issue I have to re-initialize from srv3 to srv1 again and after the end of initialization from srv3 to srv2. Resuming: 1) install srv2 OK 2) initialize srv1 to srv3 OK 3) initialize srv2 to srv3: the agreement srv1 to srv3 stops to work 4) initialize srv1 to srv3 again I would like to know how to configure the Directory Server in order to avoid the above scenario. The problem is very similar to https://access.redhat.com/solutions/2690611 but that document says that the problem was already fixed in 389-ds-base-1.3.5.10-15.el7_3 or later. Could you help me? Thank you very much Marco

3 11

Re: [Freeipa-users] Re: Consumer failed to replay change Operations error (1)
by Thierry Bordaz 17 Jun '21

17 Jun '21

Hello Alfred, If it is IPA deployment I doubt that you hit [1] because it only applies on read-only replica (hub/consumer). Also this bug is fixed in the version you are running. The consumer (redactedauth0003.redacted.com <http://redactedauth0001.redacted.com-to-redactedauth0003.redacted.com>) fails to apply a replicated MOD targeting the admin group. It is not clear if the failure occurs at changelog update or RUV update. It is looking it is a permanent failure so you may enable replication debug log in case it gives more details why it is failing. regards thierry [1] https://bugzilla.redhat.com/show_bug.cgi?id=1574602 <https://bugzilla.redhat.com/show_bug.cgi?id=1574602> On 6/17/21 11:12 AM, Florence Renaud via FreeIPA-users wrote: > Forwarding to 389-users(a)lists.fedoraproject.org > <https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o…> > as they may have more inputs. > > On Wed, Jun 16, 2021 at 11:31 PM Alfred Victor via FreeIPA-users > <freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> wrote: > > Hi FreeIPA, > > We have some replication messages in our slapd errors log which > look very like the ones discussed here: > > https://bugzilla.redhat.com/show_bug.cgi?id=1574602 > <https://bugzilla.redhat.com/show_bug.cgi?id=1574602> > > I took a look and we do have the MemberOf plugin, but our version > of 389-ds newer: > > *389-ds-base-1.3.10.2-10.el7_9.x86_64* > > * > * > > * > * > > Hoping someone might have a suggestion for what we might do to get > rid of these log messages, or what the root cause may be/impact? > They've been going since at least a couple of weeks ago: > * > * > > [15/Jun/2021:18:57:26.362094959 -0500] - WARN - > NSMMReplicationPlugin - repl5_inc_update_from_op_result - > agmt="cn=redactedauth0001.redacted.com-to-redactedauth0003.redacted.com > <http://redactedauth0001.redacted.com-to-redactedauth0003.redacted.com>" > (redactedauth0003:389): Consumer failed to replay change > (uniqueid d5896001-39a111eb-8868efc8-91dc0b98, CSN > 60c93bc2000400250000): Operations error (1). Will retry later. > > > > > I looked for this same uniqueid (they are ALL the same uniqueID) and found this which is interesting and references a specific cn and "optype": > > > [03/Jun/2021:15:45:43.332068775 -0500] - ERR - > NSMMReplicationPlugin - write_changelog_and_ruv - Can't add a > change for cn=admin,cn=groups,cn=accounts,dc=redacted,dc=com > (uniqid: d5896001-39a111eb-8868efc8-91dc0b98, optype: 8) to > changelog csn 60b93f93005200230000 > > > > Alfred > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > <https://docs.fedoraproject.org/en-US/project/code-of-conduct/> > List Guidelines: > https://fedoraproject.org/wiki/Mailing_list_guidelines > <https://fedoraproject.org/wiki/Mailing_list_guidelines> > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > <https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…> > Do not reply to spam on the list, report it: > https://pagure.io/fedora-infrastructure > <https://pagure.io/fedora-infrastructure> > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users June 2021