Crash with SEGV after compacting
by Niklas Schmatloch
Hi
My organisation is using a replicated 389-dirsrv. Lately, it has been crashing
each time after compacting.
It is replicable on our instances by lowering the compactdb-interval to
trigger the compacting:
dsconf -D "cn=Directory Manager" ldap://127.0.0.1 -w 'PASSWORD_HERE' backend config set --compactdb-interval 300
This is the log:
[03/Aug/2022:16:06:38.552781605 +0200] - NOTICE - checkpoint_threadmain - Compacting DB start: userRoot
[03/Aug/2022:16:06:38.752592692 +0200] - NOTICE - bdb_db_compact_one_db - compactdb: compact userRoot - 8 pages freed
[03/Aug/2022:16:06:44.172233009 +0200] - NOTICE - bdb_db_compact_one_db - compactdb: compact userRoot - 888 pages freed
[03/Aug/2022:16:06:44.179315345 +0200] - NOTICE - checkpoint_threadmain - Compacting DB start: changelog
[03/Aug/2022:16:13:18.020881527 +0200] - NOTICE - bdb_db_compact_one_db - compactdb: compact changelog - 458 pages freed
dirsrv(a)auth-alpha.service: Main process exited, code=killed, status=11/SEGV
dirsrv(a)auth-alpha.service: Failed with result 'signal'.
dirsrv(a)auth-alpha.service: Consumed 2d 6h 22min 1.122s CPU time.
The first steps are done very quickly, but the step before the 458 pages of the
retro-changelog are freed, takes several minutes. In this time the dirsrv writes
more than 10 G and reads more than 7 G (according to iotop).
After this line is printed the dirsrv crashes within seconds.
What I also noticed is, that even though it said it freed a lot of pages the
retro-changelog does not seem to change in size.
The file `/var/lib/dirsrv/slapd-auth-alpha/db/changelog/id2entry.db` is 7.2 G
before and after the compacting.
Debian 11.4
389-ds-base/stable,now 1.4.4.11-2 amd64
Does someone have an idea how to debug / fix this?
Thanks
1 month, 2 weeks
389 DS sync issue with Active Directory
by Darshan B
Hello Team
I have a question on sync between 389 DS and windows active Directoty.
I have followed this link to https://documentation.suse.com/sles/15-SP3/html/SLES-all/cha-security-lda... for Synchronizing with Microsoft Active Directory(6.11) with 389 DS , I'm able to create the repl-winsync-agmt but while checking its status using sudo dsconf ldap1 repl-winsync-agmt init-status i'm getting below error .
Error:
[16/Sep/2022:16:25:45.129760205 +051800] - ERR - slapi_ldap_bind - Could not send bind request for id [CN=darshan,CN=Users,DC=training,DC=itadmin,DC=com] authentication mechanism [SIMPLE]: error -1 (Can't contact LDAP server), system error -5950 (File not found.), network error 107 (Transport endpoint is not connected, host "192.168.56.106:389")
I'm able to do ldapsearch on Active directory but repl-winsync-agmt init-status command is giving the network error.
ldapseach command:
ldapsearch -x -h 192.168.56.106 -p 389 -b "CN=Users,dc=training,dc=itadmin,dc=com" -D "CN=darshan,CN=Users,DC=training,DC=itadmin,DC=com" -w "Test@123" dn
repl-winsync-agmt create command used:
sudo dsconf -D "cn=ldap1-infra1" -w "#CEEadmin123" ldap1 repl-winsync-agmt create --suffix "dc=openstack,dc=org" --host 192.168.56.106 --port 389 --conn-protocol LDAPS --bind-dn "CN=darshan,CN=Users,DC=training,DC=itadmin,DC=com" --bind-passwd "Test@123" --win-subtree "CN=Users,DC=training,DC=itadmin,DC=com" --ds-subtree "dc=openstack,dc=org" --one-way-sync fromWindows --sync-users=on --sync-groups=on --move-action delete --win-domain "trainingitadmin.com" adsync_agreement
Let me know what should be done to resolve this network error
8 months, 3 weeks
Procedure to change the AD used to sync users
by Mihai Carabas
Hello,
We are planning to decommision our current PDC AD (Windows 2012R2). This AD
is also used to sync users from our 389ds instance to this AD. What would
be the correct procedure to update the WinSync agreement? Just update the
hostname and run a full sync?
Thank you,
Mihai Carabas
8 months, 3 weeks
Automated replication management
by tdarby＠arizona.edu
I've been working with the official docker container and have succeeded in scripting a complete install and configuration of our LDAP instance(s). Now, I'd like to go further and automate the addition and removal of a multi-master instance. Has anyone already succeeded in doing this?
Currently, we have two EC2 instances in AWS that have a multi-master replication agreement. I'd like to be able to run a script that:
1. Brings up a new EC2/389ds container instance
2. Adds this to the existing multi-master replication agreements
3. When this is finished replicating, remove one of the current instances from the replication agreements
I can do part 1, but I'm concerned about making parts 2 and 3 bullet-proof.
9 months
Re: How to have more than 1 directory manager account?
by Pierre Rogier
Hi Pierre,
One solution is to add an user then add an aci in dn=example,dn=com to
allow this user to add entries. Something like:
aci: (targetattr = "*")(version 3.0; aci "user access for xxx script; allow(
all) userdn="ldap:///uid=someone,ou=people,dc=exmaple,dc=people";)
For more details, see the aci documentation:
https://access.redhat.com/documentation/en-us/red_hat_directory_server/11...
.
Regards,
Pierre Rogier
On Fri, Sep 9, 2022 at 3:52 PM Pierre Girard <pierre.girard(a)gerad.ca> wrote:
> Hello,
>
> I looked around and so far I didn’t find information on
> how to add an additional directory manager account.
>
>
>
> Or maybe there’s a way to create an account that can add
> entries to dn=example,dn=com, since that would be more limited.
>
> The goal is to have an account that will be different for scripts that
> we’ll be writing to add information in the server.
>
>
>
> Any guide on how to do that?
>
>
>
> Thanks.
>
>
>
>
>
>
> _______________________________________________
> 389-users mailing list -- 389-users(a)lists.fedoraproject.org
> To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>
--
--
389 Directory Server Development Team
9 months
How to have more than 1 directory manager account?
by Pierre Girard
Hello,
I looked around and so far I didn't find information on how to add an additional directory manager account.
Or maybe there's a way to create an account that can add entries to dn=example,dn=com, since that would be more limited.
The goal is to have an account that will be different for scripts that we'll be writing to add information in the server.
Any guide on how to do that?
Thanks.
9 months
Limiting Direcory Manager access
by Alberto Crescente
Hello, the compromision of the direcory manager user gives full access
over directory server.
Is it possible to limit Directory Manager user acccess from localhost only?
Best regards,
Alberto Crescente.
9 months
Announcing 389 Directory Server 2.2.3
by Mark Reynolds
389 Directory Server 2.2.3
The 389 Directory Server team is proud to announce 389-ds-base version 2.2.3
Fedora packages are available on Fedora 37
https://koji.fedoraproject.org/koji/taskinfo?taskID=91505211
<https://koji.fedoraproject.org/koji/taskinfo?taskID=91505211>
https://bodhi.fedoraproject.org/updates/FEDORA-2022-2269bbf393
<https://bodhi.fedoraproject.org/updates/FEDORA-2022-2269bbf393> - Bohdi
The new packages and versions are:
* 389-ds-base-2.2.3-1
Source tarballs are available for download at Download
389-ds-base Source
<https://github.com/389ds/389-ds-base/archive/389-ds-base-2.2.3.tar.gz>
Highlights in 2.2.3
* Enhancements, Security and Bug fixes
Installation and Upgrade
See Download <https://www.port389.org/docs/389ds/download.html> for
information about setting up your yum repositories.
To install the server use *dnf install 389-ds-base*
To install the Cockpit UI plugin use *dnf install cockpit-389-ds*
After rpm install completes, run *dscreate interactive*
For upgrades, simply install the package. There are no further
steps required.
There are no upgrade steps besides installing the new rpms
See Install_Guide
<https://www.port389.org/docs/389ds/howto/howto-install-389.html> for
more information about the initial installation and setup
See Source <https://www.port389.org/docs/389ds/development/source.html>
for information about source tarballs and SCM (git) access.
Feedback
We are very interested in your feedback!
Please provide feedback and comments to the 389-users mailing list:
https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...
If you find a bug, or would like to see a new feature, file it in our
GitHub project: https://github.com/389ds/389-ds-base
* Bump verrsion to 2.2.3
* Issue 5012 - Migrate pcre to pcre2 - remove match limit
* Update CI tests
* Issue 5356 - Make Rust non-optional and update default password
storage scheme
* Issue 5012 - Migrate pcre to pcre2
* Issue 5428 - Fix regression with nscpEntryWsi computation
* Fix missing ‘not’ in description (closes #5423) (#5424)
* Issue 5421 - CI - makes
replication/acceptance_test.py::test_modify_entry more robust (#5422)
* Issue 3903 - fix repl keep alive event interval
* Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
* Issue 5415 - Hostname when set to localhost causing failures in
other tests
* Issue 5412 - lib389 - do not set backend name to lowercase
* Issue 5407 - sync_repl crashes if enabled while dynamic plugin is
enabled (#5411)
* Issue 5385 - LMDB - import crash in rdncache_add_elem (#5406)
* Issue 5403 - Memory leak in conntection table mulit list (#5404)
* Issue 3903 - keep alive update event starts too soon
* Issue 5397 - Fix various memory leaks
* Issue 5399 - UI - LDAP Editor is not updated when we switch
instances (#5400)
* Issue 3903 - Supplier should do periodic updates
* Issue 5377 - Code cleanup: Fix Covscan invalid reference (#5393)
* Issue 5394 - configure doesn’t check for lmdb and json-c
* Issue 5392 - dscreate fails when using alternative ports in the
SELinux hi_reserved_port_t label range
* Issue 5386 - BUG - Update sudoers schema to correctly support
UTF-8 (#5387)
* Issue 5388 - fix use-after-free and deadcode
* Issue 5383 - UI - Various fixes and RFE’s for UI
* Issue 4656 - Remove problematic language from source code
* Issue 5380 - Separate cleanAllRUV code into new file
* Issue 5322 - optime & wtime on rejected connections is not properly set
* Issue 5335 - RFE - Add Security Audit Log
* Issue 5375 - CI - disable TLS hostname checking
* Issue 981 - Managed Entries betxnpreoperation - transaction not
aborted on managed entry failure (#5369)
* Issue 5373 - dsidm user get_dn fails with search_ext() argument 1
must be str, not function
* Issue 5371 - Update npm and cargo packages
* Issue 3069 - Support ECDSA private keys for TLS (#5365)
* Issue 5290 - Importing certificate chain files via
“import-server-key-cert” no longer works (#5293)
--
Directory Server Development Team
9 months, 1 week
Announcing 389 Directory Server 2.3.0
by Mark Reynolds
389 Directory Server 2.3.0
The 389 Directory Server team is proud to announce 389-ds-base version 2.3.0
Fedora packages are available on Rawhide (f38)
Rawhide:
https://koji.fedoraproject.org/koji/taskinfo?taskID=91503550
<https://koji.fedoraproject.org/koji/taskinfo?taskID=91503550>
The new packages and versions are:
* 389-ds-base-2.3.0-1
Source tarballs are available for download at Download
389-ds-base Source
<https://github.com/389ds/389-ds-base/archive/389-ds-base-2.3.0.tar.gz>
Highlights in 2.3.0
* Enhancements, Security and Bug fixes
Installation and Upgrade
See Download <https://www.port389.org/docs/389ds/download.html> for
information about setting up your yum repositories.
To install the server use *dnf install 389-ds-base*
To install the Cockpit UI plugin use *dnf install cockpit-389-ds*
After rpm install completes, run *dscreate interactive*
For upgrades, simply install the package. There are no further
steps required.
There are no upgrade steps besides installing the new rpms
See Install_Guide
<https://www.port389.org/docs/389ds/howto/howto-install-389.html> for
more information about the initial installation and setup
See Source <https://www.port389.org/docs/389ds/development/source.html>
for information about source tarballs and SCM (git) access.
Feedback
We are very interested in your feedback!
Please provide feedback and comments to the 389-users mailing list:
https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...
If you find a bug, or would like to see a new feature, file it in our
GitHub project: https://github.com/389ds/389-ds-base
* Bump version to 2.3.0
* Issue 5012 - Migrate pcre to pcre2 - remove match limit
* Update CI tests
* Issue 5356 - Make Rust non-optional and update default password
storage scheme
* Issue 5012 - Migrate pcre to pcre2
* Issue 5428 - Fix regression with nscpEntryWsi computation
* Fix missing ‘not’ in description (closes #5423) (#5424)
* Issue 5421 - CI - makes
replication/acceptance_test.py::test_modify_entry more robust (#5422)
* Issue 3903 - fix repl keep alive event interval
* Issue 5418 - Sync_repl may crash while managing invalid cookie
(#5420) (Security fix)
* Issue 5415 - Hostname when set to localhost causing failures in
other tests
* Issue 5412 - lib389 - do not set backend name to lowercase
* Issue 5407 - sync_repl crashes if enabled while dynamic plugin is
enabled (#5411)
* Issue 5385 - LMDB - import crash in rdncache_add_elem (#5406)
* Issue 5403 - Memory leak in conntection table mulit list (#5404)
* Issue 3903 - keep alive update event starts too soon
* Issue 5397 - Fix various memory leaks
* Issue 5399 - UI - LDAP Editor is not updated when we switch
instances (#5400)
* Issue 3903 - Supplier should do periodic updates
* Issue 5377 - Code cleanup: Fix Covscan invalid reference (#5393)
* Issue 5394 - configure doesn’t check for lmdb and json-c
* Issue 5392 - dscreate fails when using alternative ports in the
SELinux hi_reserved_port_t label range
* Issue 5386 - BUG - Update sudoers schema to correctly support
UTF-8 (#5387)
* Issue 5388 - fix use-after-free and deadcode
* Issue 5383 - UI - Various fixes and RFE’s for UI
* Issue 4656 - Remove problematic language from source code
* Issue 5380 - Separate cleanAllRUV code into new file
* Issue 5322 - optime & wtime on rejected connections is not properly set
* Issue 5335 - RFE - Add Security Audit Log
* Issue 5375 - CI - disable TLS hostname checking
* Issue 981 - Managed Entries betxnpreoperation - transaction not
aborted on managed entry failure (#5369)
* Issue 5373 - dsidm user get_dn fails with search_ext() argument 1
must be str, not function
* Issue 5371 - Update npm and cargo packages
* Issue 3069 - Support ECDSA private keys for TLS (#5365)
* Issue 5290 - Importing certificate chain files via
“import-server-key-cert” no longer works (#5293)
--
Directory Server Development Team
9 months, 1 week
