389-users May 2024

389-users@lists.fedoraproject.org

5 participants
4 discussions

dsconf idempotency
by Marco Favero 07 Dec '25

07 Dec '25

Hello, I like to use [dsconf](https://directory.fedoraproject.org/docs/389ds/design/dsadm-dsconf.… to manage my 389ds instances. I like also Ansible to manage the configuration. From Ansible, if I run dsconf command I see some problems of idempotency. For example, if I run the first time in a new fresh installation ``` dsconf -D cn=Directory Manager -w **** ldap://localhost:389 plugin attr-uniq set attribute uniqueness --subtree=c=en --enabled=on --attr-name=uid --across-all-subtrees=off ``` it returns 0 and the output *Successfully changed the cn=attribute uniqueness,cn=plugins,cn=config*. If I re run the same command I will see: *There is nothing to set in the cn=attribute uniqueness,cn=plugins,cn=config plugin entry* and the exit status is 1. Of course I can manage the output in Ansible in order to reclassify as well the task result. But I have to do that in a lot of cases (best effort). Of course I can use some idempotent ldapmodify module, but I like to trust `dsconf`. So I wonder if you could consider the benefit to make `dsconf` more idempotent. For instance, in the above case the exit status could be 0. The same behavior could be adopted in all results of "already exists" output messages when the value to set is equal to the value already present (ie: `dsconf -D cn=Directory Manager -w *** ldap://localhost:389 backend index add ...` returns "already exists" and the exit status 1 if the idex is already defined) If you have any other hints to address this problem could let me know. Thank you very much Kind Regards Marco

4 4

Password Hashes in Audit Log
by Trevor Fong 31 May '24

31 May '24

Hi All, I noticed the audit logs capture all details about any change in the directory, including password hashes when an account's password is updated. This strikes me as a security risk and I'd like to stop password hashes from being logged, or at least have them masked. In reading https://www.port389.org/docs/389ds/design/audit-log-entry-attrs-design.html I see it might be possible to configure attributes to omit from the audit log by setting: cn=config nsslapd-auditlog-display-attrs: [ATTR ATTR ATTR] | * My reading of that is that you need to either allow all ("*"), or enumerate each and every attribute you want in the audit log; you can't say "all, except userPassword". Would that be correct? The problem with this is that every time we update the schema to add a new attribute type, we'll need to remember to update this list on every machine we capture audit logs on. Is there perhaps some other way that I may have missed in my research? Thanks everyone, Trevor

2 1

Automatically delete "linked" objects
by Julian Kippels 27 May '24

27 May '24

Hi, I am looking for a way to automatically delete certain objects when I delete a user object. For example: * I have a user uid=user1,ou=users,dc=test,dc=tld * I have a role cn=xyz,ou=roles,dc=test,dc=tld * This role has the following atribute: roleOccupant: uid=user1,ou=users,dc=test,dc=tld I would like to delete the cn=xyz-object automatically when the uid=user1-object is deleted. Is there a way to do this server side, or do I have to implement it client side? Thanks Julian

2 1

[389-announce] Announcing 389 Directory Server 3.1.0
by James Chapman 15 May '24

15 May '24

389 Directory Server 3.1.0 The 389 Directory Server team is proud to announce 389-ds-base version 3.1.0 Fedora packages are available on Rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=117712920 - Koji https://bodhi.fedoraproject.org/updates/FEDORA-2024-1ca60183aa - Bodhi The new package and version is: - 389-ds-base-3.1.0 Source tarballs are available for download at GitHub Releases page <https://github.com/389ds/389-ds-base/releases>: - https://github.com/389ds/389-ds-base/releases/tag/389-ds-base-3.1.0 Highlights in 3.1.0 - LMDB updates - Enhancements and Bug fixes Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base - Bump version to 3.1.0 - Issue 6142 - Fix CI tests (#6161) - Issue 6157 - Cockipt crashes when getting replication status if topology contains an old 389ds version (#6158) - Issue 5105 - lmdb - Cannot create entries with long rdn - fix covscan (#6131) - Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user - Issue 6094 - Add coverity scan workflow - Issue 5962 - Rearrange includes for 32-bit support logic - Issue 6046 - Make dscreate to work during kickstart installations - Issue 6073 - Improve error log when running out of memory (#6084) - Issue 6071 - Instance creation/removal is slow - Issue 6010 - 389 ds ignores nsslapd-maxdescriptors (#6027) - Issue 6075 - Ignore build artifacts (#6076) - Issue 6068 - Add dscontainer stop function _______________________________________________ 389-announce mailing list -- 389-announce(a)lists.fedoraproject.org To unsubscribe send an email to 389-announce-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-announce@lists.fedoraproj… Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users May 2024