December 2024 - FreeIPA-users - Fedora mailing-lists

Errors in dirsrv log
by Ranbir 14 Mar '25

14 Mar '25

I'm seeing errors like the ones below on my ipa servers (excuse the wrapping): [11/Aug/2023:22:07:37.684144411 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5d558000400130000 [11/Aug/2023:22:07:37.686865097 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5d8d00004003e0000 [11/Aug/2023:22:07:37.689902756 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5dc51000700190000 [11/Aug/2023:22:07:37.693576614 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5ff800005002d0000 [11/Aug/2023:22:07:37.696088129 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d60301000400380000 [11/Aug/2023:22:07:37.698351038 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d606800007000d0000 I can't find anything about what they mean. What do these errors mean? How do I resolve the problem? -- Ranbir

3 5

Cannot create users on platform migration: sambaSID failure
by Melissa Ferreira da Silva Boiko 07 Mar '25

07 Mar '25

Hi, I'm trying to upgrade an ancient master replica (the CA master) running FreeIPA 4.5 on CentOS 7.4. Upgrading the freeipa packages in-place (in a cloned VM) caused numerous problems so I'm trying to create a new master replica on a fresh Fedora 39, using the "Migrating to different platform or OS" procedure described on https://www.freeipa.org/page/Howto/Migration At first sight the new replica appears to work, but user creation fails, both on the web and command-line, with: ipa user-add --first=Testy --last=McTestface teste123 ipa: ERROR: missing attribute "sambaSID" required by object class "sambaSamAccount" Web searches seem to suggest this is due to a missing DNA plugin that should autogenerate the sambaSIDs, but I failed to find a guide on how to enable that plugin with current IPA (4.11). Should it be enabled automatically? Unless it's used for something internal to IPA I don't think we actually are even using AD integration or SMB shares, so removing Samba support altogether would also be an option, but I don't know what's the safe way of doing that to the schema either. Thanks for your help!

3 8

can't enroll ubuntu 24
by Dmitry Krasov 23 Feb '25

23 Feb '25

Hello. Trying to enroll Ubuntu 24.04 to domain, but it says "certificate verify failed: Hostname mismatch, certificate is not valid for 'ipa2.dom.loc'. (_ssl.c :1000)" But when I trying ipa web adress via browser it's seems fine. It's selfsigned like always, but date and name are fine. And just recently I have successfully added another one host How can I fix it? Maybe I can disable certificate checking somehow, just for start? sudo ipa-client-install --hostname dit-ntb-spc39-1797875.dom.loc --server=ipa2.dom.loc --enable-dns-updates --domain dom.loc --mkhomedir -p admin -w Password --force-join This program will set up IPA client. Version 4.11.1 WARNING: conflicting time&date synchronization service 'ntp' will be disabled in favor of chronyd Using existing certificate '/etc/ipa/ca.crt'. Autodiscovery of servers for failover cannot work with this configuration. If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure. Proceed with fixed values and no DNS discovery? [no]: y Do you want to configure chrony with NTP server or pool address? [no]: Client hostname: dit-ntb-spc39-1797875.dom.loc Realm: dom.loc DNS Domain: dom.loc IPA Server: ipa2.dom.loc BaseDN: dc=l3874,dc=ru Continue to configure the system with these values? [no]: y Removed old keys for realm dom.loc from /etc/krb5.keytab Synchronizing time Configuration of chrony was changed by installer. Attempting to sync time with chronyc. Time synchronization was successful. Enrolled in IPA realm dom.loc Created /etc/ipa/default.conf Domain dom.loc is already configured in existing SSSD config, creating a new one. The old /etc/sssd/sssd.conf is backed up and will be restored during uninstall. Configured /etc/sssd/sssd.conf Connection to https://ipa2.dom.loc/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'ipa2.dom.loc'. (_ssl.c :1000) Connection to https://ipa.dom.loc/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'ipa.dom.loc'. (_ssl.c:1000) cannot connect to 'любой из настроенных серверов': https://ipa2.dom.loc/ipa/json, https://ipa.dom.loc/ipa/json The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

4 39

FreeIPA servers falling out of sync?
by Martin Jackson 10 Feb '25

10 Feb '25

I'm experiencing this pretty regularly. srv-ds-2 will show messages of the following type: ``` [14/Dec/2024:15:29:58.343703946 -0600] - ERR - NSMMReplicationPlugin - changelog program - repl_plugin_name_cl - agmt="cn=meTosrv-ds-1.imladris.lan" (srv-ds-1:389): CSN 675de299000600140000 not found, we aren't as up to date, or we purged [14/Dec/2024:15:29:58.354587507 -0600] - ERR - NSMMReplicationPlugin - send_updates - agmt="cn=meTosrv-ds-1.imladris.lan" (srv-ds-1:389): Data required to update replica has been purged from the changelog. If the error persists the replica must be reinitialized. [14/Dec/2024:15:30:01.404036067 -0600] - ERR - agmt="cn=meTosrv-ds-1.imladris.lan" (srv-ds-1:389) - clcache_load_buffer - Can't locate CSN 675de299000600140000 in the changelog (DB rc=-12797). If replication stops, the consumer may need to be reinitialized. ``` Both are on current Fedora 41 (specifically 389-ds-base 3.1.1-3 and freeipa-server 4.12.2-6) using lmdb databases (I just finished migrating this domain to lmdb, by deleting the previous ipa servers one at a time and rebuilding new ones in their place.) Is there a way to configure how long to keep the changelog? I can (and have) re-initialized ds-2 a couple of times at this point, but after the third time in as many days, it seems like I should look for other solutions than re-initialization. Thanks!

3 2

Re: Create IPA user via LDAP
by Ronald Wimmer 21 Jan '25

21 Jan '25

On 08.01.24 17:58, Alexander Bokovoy wrote: > On Пан, 08 сту 2024, Ronald Wimmer wrote: >> On 02.01.24 17:57, Ronald Wimmer via FreeIPA-users wrote: >>> On 02.01.24 16:27, Rob Crittenden wrote: >>>> Ronald Wimmer via FreeIPA-users wrote: >>>>> >>>>> >>>>> On 14.12.23 14:42, Alexander Bokovoy wrote: >>>>>> On Чцв, 14 сне 2023, Ronald Wimmer via FreeIPA-users wrote: >>>>>>> In our company we do have an IAM tool for user management. We >>>>>>> need to >>>>>>> create IPA users via this particular tool. I am aware of all IPA >>>>>>> commands or API calls to create/modify or delete a user. >>>>>>> >>>>>>> As the tool does not support FreeIPA yet they asked if there is a >>>>>>> way >>>>>>> to manage users by using LDAP only. Could that work? What about >>>>>>> attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber? >>>>>> >>>>>> Learn about lifecycle management. This is your way of integrating >>>>>> with >>>>>> such tools bvy creating staged users: >>>>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/ht… >>>>>> >>>>> >>>>> I followed the instructions from the documentation. >>>>> >>>>> How could I possibly overcome >>>>> >>>>> Dec 19 09:18:39 tipa01.ipatest.mydomain.at ipa-activate-all[836863]: >>>>> ipa: ERROR: Constraint violation: pre-hashed passwords are not valid >>>>> >>>>> I need to set passwords from the external system. >>>> >>>> You need to enable migration mode (ipa config-mod --enable-migration >>>> true). >>>> >>>> By default a pre-hashed password can only be set once: during the user >>>> add operation. >>> >>> Ok. So this would not work for a password change. So if we need to >>> set an initial password and change that particular password in some >>> point in time the only feasible way is the IPA API, right? >>> >>> Can the immediate password expiration be overridden? >> >> As we have an upcoming please allow me to ask if I got the point here. >> >> I appreciate your support in this matter! >> > > I was looking over the code. The only way to accept pre-hashed passwords > is when they also have Kerberos keys set. This means you cannot use > external LDAP modify/add for that as you cannot create the Kerberos key > without knowing a Kerberos master key. > > So the only other option is to submit a clear-text password: > > userPassword: {CLEAR}text-password > > That will be accepted and if bind DN that performed this change is > either a cn=Directory Manager or a one from the passsync managers, it > would also not be marked for expiration immediately. If I try to set the userPassword attribute to some value with an LDAP browser and chose "plaintext" the value gets hashed immediately. I do see {PBKDF2_SHA256}. As a consequence the user cannot be activated. What am I doing wrong? I tried to enable migration mode and wanted to try it again but now I cannot connect to IPA's LDAP directory at all anymore... [root@tipa01 ~]# ipa config-mod --enable-migration=true Maximum username length: 32 Maximum hostname length: 64 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain: ipatest.mydomain.at Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: True Certificate Subject base: O=IPATEST.MYDOMAIN.AT Password Expiration Notification (days): 4 Password plugin features: AllowNThash, KDC:Disable Last Success SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$sysadm_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC, nfs:NONE IPA masters: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at IPA master capable of PKINIT: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at IPA CA servers: tipa01.ipatest.mydomain.at IPA CA renewal master: tipa01.ipatest.mydomain.at Domain resolution order: org.mydomain.at:ipatest.mydomain.at [root@tipa01 ~]# ipa config-mod --enable-migration=false ipa: ERROR: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529638972): KDC returned error string: PROCESS_TGS

4 47

2FA not working with OpenVPN Free IPA Integration
by Tinku Goyal 20 Jan '25

20 Jan '25

My setup includes a set of FreeIPA servers running on 4.9.2 version and a OpenVPN configured for the users to connect to VPN. Previously I was using IPA version 4.6.8 on CentOS7 and now installed IPA replica on 4.9.2 on OL8 and decommissioned the old one. I am using openvpn-plugin-auth-pam.so with login pam file to authenticate the IPA users logging in to OpenVPN. when I am resetting the password of users now, then users are not able to login to OpenVPN with 2FA (password+otp) whereas, with otp disabled it is working for old users for whom password is not resetted recently after change in IPA cluster, their authentication is working through OpenVPN with/without OTP both. All users(old + users whose password is resetted recently) are able to login to linux servers using password and OTP both combination, its just not authenticating in OpenVPN. I have tried multiple things but still couldn't able to get it work. Hoping if someone can help with this!!

3 7

Multi-Arch support of freeipa-container images
by Ronald Wimmer 17 Jan '25

17 Jan '25

I've read https://github.com/freeipa/freeipa-container/issues/596#issuecomment-198865… for example. I am wondering if there is any progress here? We are experimenting with K3s clusters on Raspberry Pis (5). It would be great if FreeIPA could run inside a pod on that hardware...

3 3

Migrate freeipa enrolled host to new host
by Ranbir 06 Jan '25

06 Jan '25

Hello Everyone, Can I migrate a freeipa enrolled host, host.domain.tld, to a brand new host with the same name without disrupting services that depend on keytabs on the old host? The keytab files from the old host should just work on the new one as long as the hostnames are exactly the same, right? What I'm unsure about is how to get the new host enrolled without overwriting the old host's kerberos "stuff" in freeipa. Thanks, -- Ranbir

3 2

GetKeytabControl extended operation
by Yuriy Halytskyy 02 Jan '25

02 Jan '25

Hi, and Happy New Year! I am trying to request service and host keytabs programmatically. The idea is to create terraform data source with Go, but I am also experimenting with python because it has good ASN1 support. There are already several terraform providers for IPA but they all use RPC only and there does not appear to be an RPC call to get a keytab. This looks like straightforward extended operation in ldap: https://github.com/freeipa/freeipa/blob/3a5ce9cb2af362d97d598f2198cbc20c4c3… The reply I am supposed to receive is: GKReply ::= SEQUENCE { newkvno Int32, keys SEQUENCE OF KrbKey } So I send GKCurrentKeys message, but the reply is interpreted as LDAP controls both by python and Go ldap libraries? Which doesn't make any sense to me because controls are supposedly part of ldap request, not ldap response, but I don't know much about ldap. This is what I get in python after sending a request for host/ipa.example.test(a)IPA.EXAMPLE.TEST Request message is: >>LDAPMessage: >> messageID=30 >> protocolOp=ProtocolOp: >> extendedReq=ExtendedRequest: >> requestName=2.16.840.1.113730.3.8.10.5 >> requestValue=0xa11b3019a0170415686f73742f6970612e6578616d706c652e74657374 Result message: <<{'controls': [(0, << True, << 16, << [(0, False, 4, b'2.16.840.1.113730.3.8.10.5'), << (0, << False, << 4, << b'\xa2\x81\xf30\x81\xf0\x02\x01\x020\x81\xea0-\xa0+0)\xa0\x03' << b'\x02\x01\x12\xa1"\x04 R%\xb2\xec\x13=g\xc9J\xad\x07\xbf\x14' << b'\x83\xac\xccg\xa4w\xfcV\xd8\x90#\x1a%s\xe7\xd8\xb0G\x9c0' << b'\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x11\xa1\x12\x04\x10\xf7k' << b'\x90\x84-\xf0\xa9\x02\xbf\xa5H\xdb\xfe\xa0\x94y0\x1d' << b'\xa0\x1b0\x19\xa0\x03\x02\x01\x13\xa1\x12\x04\x10MOX' << b'\x0e\xae\xed\x95_\xba\xe7\xaa\xcd?C7\x050-\xa0+0)\xa0' << b'\x03\x02\x01\x14\xa1"\x04 \xd5]6\xe4\xf6D\x96#i\xa6\x9fX' << b"\x93\xd7\xf3\x03\xc9f\xb5'\x022z\x93WZ\xb2\x8c\xe5rW\x0f" << b'0\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x19\xa1\x12\x04\x10<' << b'|\x84\xdd"\x9cl\xed\x01\xdb\xc7\xbe\xd2\xbfg\xbe0-\xa0+0' << b')\xa0\x03\x02\x01\x1a\xa1"\x04 \xf6.\xd9/\xae\xf8\xc3j4\x03' << b'\n\x12?\xb4%!\x10+&]\xae\xad\xb5\x07\xf7f\xc6\x93\xb1\xcb' << b'L\x96')])], << 'messageID': 30, << 'payload': [(0, False, 10, 0), (0, False, 4, b''), (0, False, 4, b'')], << 'protocolOp': 24} The payload is just 4 bytes... That bit blob in controls is valid keytab list and I can decode it using asn1 definitions from >>> c.result['controls']['2.16.840.1.113730.3.8.10.5'].values().mapping['value'] b'\xa2\x81\xf30\x81\xf0\x02\x01\x020\x81\xea0-\xa0+0)\xa0\x03\x02\x01\x12\xa1"\x04 R%\xb2\xec\x13=g\xc9J\xad\x07\xbf\x14\x83\xac\xccg\xa4w\xfcV\xd8\x90#\x1a%s\xe7\xd8\xb0G\x9c0\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x11\xa1\x12\x04\x10\xf7k\x90\x84-\xf0\xa9\x02\xbf\xa5H\xdb\xfe\xa0\x94y0\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x13\xa1\x12\x04\x10MOX\x0e\xae\xed\x95_\xba\xe7\xaa\xcd?C7\x050-\xa0+0)\xa0\x03\x02\x01\x14\xa1"\x04 \xd5]6\xe4\xf6D\x96#i\xa6\x9fX\x93\xd7\xf3\x03\xc9f\xb5\'\x022z\x93WZ\xb2\x8c\xe5rW\x0f0\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x19\xa1\x12\x04\x10<|\x84\xdd"\x9cl\xed\x01\xdb\xc7\xbe\xd2\xbfg\xbe0-\xa0+0)\xa0\x03\x02\x01\x1a\xa1"\x04 \xf6.\xd9/\xae\xf8\xc3j4\x03\n\x12?\xb4%!\x10+&]\xae\xad\xb5\x07\xf7f\xc6\x93\xb1\xcbL\x96' Go produces similar result. This is what the response looks like: LDAP Response: (Universal, Constructed, Sequence and Sequence of) Len=297 "<nil>" Message ID: (Universal, Primitive, Integer) Len=1 "2" Extended Response: (Application, Constructed, 0x18) Len=7 "<nil>" (Universal, Primitive, Enumerated) Len=1 "0" (Universal, Primitive, Octet String) Len=0 "" (Universal, Primitive, Octet String) Len=0 "" (Context, Constructed, 0x00) Len=281 "<nil>" (Universal, Constructed, Sequence and Sequence of) Len=277 "<nil>" (Universal, Primitive, Octet String) Len=26 "2.16.840.1.113730.3.8.10.5" (Universal, Primitive, Octet String) Len=246 "\xa2\x81\xf30\x81\xf0\x02\x01\x020\x81\xea0-\xa0+0)\xa0\x03\x02\x01\x12\xa1\"\x04 R%\xb2\xec\x13=g\xc9J\xad\a\xbf\x14\x83\xac\xccg\xa4w\xfcVؐ#\x1a%s\xe7ذG\x9c0\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x11\xa1\x12\x04\x10\xf7k\x90\x84-\xf0\xa9\x02\xbf\xa5H\xdb\xfe\xa0\x94y0\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x13\xa1\x12\x04\x10MOX\x0e\xae\xed\x95_\xba\xe7\xaa\xcd?C7\x050-\xa0+0)\xa0\x03\x02\x01\x14\xa1\"\x04 \xd5]6\xe4\xf6D\x96#i\xa6\x9fX\x93\xd7\xf3\x03\xc9f\xb5'\x022z\x93WZ\xb2\x8c\xe5rW\x0f0\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x19\xa1\x12\x04\x10<|\x84\xdd\"\x9cl\xed\x01\xdbǾҿg\xbe0-\xa0+0)\xa0\x03\x02\x01\x1a\xa1\"\x04 \xf6.\xd9/\xae\xf8\xc3j4\x03\n\x12?\xb4%!\x10+&]\xae\xad\xb5\a\xf7fƓ\xb1\xcbL\x96" Again, the extended response is just 4 bytes of nothing, and the actual result is provided after that and Go is confused (and so am I). [root@ipa /]# ipa --version VERSION: 4.11.0, API_VERSION: 2.253 Is there a bug here, or does this work as intended? Cheers, Yuriy

2 6

Directory server disk being hammered with writes and constantly growing database
by Brian J. Murrell 31 Dec '24

31 Dec '24

Hi. I am running FreeIPA on (fully up-to-date) EL8 and am experiencing really heavy constant writes to the (/var/lib/)dirsrv database disk: 12:00:01 AM tps rkB/s wkB/s dkB/s areq-sz aqu-sz await %util DEV 01:00:01 AM 774.16 401.09 7371.63 0.00 10.04 0.78 1.01 39.59 var_lib_dirsrv 02:00:00 AM 511.07 0.14 4896.57 0.00 9.58 0.51 1.00 26.06 var_lib_dirsrv 03:00:00 AM 501.74 0.50 4807.00 0.00 9.58 0.50 1.00 25.54 var_lib_dirsrv 04:00:00 AM 497.64 0.07 4771.83 0.00 9.59 0.50 1.00 25.43 var_lib_dirsrv 05:00:00 AM 442.64 0.14 4241.13 0.00 9.58 0.44 0.98 22.34 var_lib_dirsrv 06:00:00 AM 487.64 0.96 4676.10 0.00 9.59 0.48 0.99 24.92 var_lib_dirsrv 07:00:00 AM 474.65 0.14 4558.98 0.00 9.61 0.48 1.00 24.32 var_lib_dirsrv 08:00:00 AM 534.18 0.81 5137.36 0.00 9.62 0.54 1.01 27.59 var_lib_dirsrv 09:00:00 AM 574.34 0.43 5537.93 0.00 9.64 0.58 1.00 29.52 var_lib_dirsrv 10:00:00 AM 672.95 0.43 6501.68 0.00 9.66 0.67 0.99 34.12 var_lib_dirsrv 11:00:00 AM 749.18 0.82 7250.97 0.00 9.68 0.75 1.00 38.38 var_lib_dirsrv 12:00:00 PM 958.57 1.05 9296.95 0.00 9.70 0.95 0.99 48.60 var_lib_dirsrv 01:00:00 PM 1003.80 0.80 9743.29 0.00 9.71 0.99 0.99 51.09 var_lib_dirsrv 02:00:01 PM 567.52 1.34 5508.37 0.00 9.71 0.57 1.01 29.40 var_lib_dirsrv 03:00:01 PM 514.13 0.16 5006.66 0.00 9.74 0.52 1.01 26.71 var_lib_dirsrv 04:00:00 PM 515.12 0.34 5025.29 0.00 9.76 0.51 1.00 26.49 var_lib_dirsrv 05:00:01 PM 514.74 0.03 5034.02 0.00 9.78 0.52 1.00 26.56 var_lib_dirsrv 06:00:01 PM 490.61 0.04 4809.68 0.00 9.80 0.49 1.00 25.29 var_lib_dirsrv 07:00:00 PM 513.17 0.02 5034.52 0.00 9.81 0.52 1.00 26.81 var_lib_dirsrv 08:00:00 PM 506.14 0.00 4964.79 0.00 9.81 0.50 1.00 25.99 var_lib_dirsrv 09:00:01 PM 503.88 0.05 4943.89 0.00 9.81 0.50 1.00 25.89 var_lib_dirsrv 10:00:01 PM 509.54 0.02 5004.35 0.00 9.82 0.51 1.00 26.35 var_lib_dirsrv 11:00:01 PM 498.23 0.02 4893.29 0.00 9.82 0.50 1.00 25.78 var_lib_dirsrv Average: 578.94 17.80 5609.40 0.00 9.72 0.58 1.00 29.68 var_lib_dirsrv As you can see it's a pretty constant 5MB/s write bandwidth. That disk is just the database, no log files, etc. The files most frequently being written to are: -rw-------. 1 dirsrv dirsrv 37347328 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/id2entry.db -rw-------. 1 dirsrv dirsrv 2744320 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/entryusn.db -rw-------. 1 dirsrv dirsrv 2646016 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/ipaca/id2entry.db -rw-------. 1 dirsrv dirsrv 16384 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/ipaca/entryusn.db -rw-------. 1 dirsrv dirsrv 1109262336 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 14745600 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/__db.001 -rw-------. 1 dirsrv dirsrv 104949064 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/__db.003 -rw-------. 1 dirsrv dirsrv 10485760 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/log.0000005162 -rw-------. 1 dirsrv dirsrv 57999360 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/__db.002 And the main database files themselves have just continually grown over time: -rw-------. 1 dirsrv dirsrv 121634816 Aug 27 2022 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 144097280 Nov 3 2022 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 166150144 Dec 3 2022 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 174202880 Dec 17 2022 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 187965440 Jan 20 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 202571776 Feb 17 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 247570432 May 12 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 262955008 Jun 10 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 279224320 Jul 8 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 293167104 Aug 5 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 304029696 Aug 26 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 318144512 Sep 30 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 337469440 Nov 4 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 364732416 Dec 8 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 396328960 Jan 12 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 410517504 Feb 8 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 418586624 Feb 22 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 456179712 Mar 15 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 485425152 Apr 7 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 562569216 May 28 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 612147200 Aug 18 02:42 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 639762432 Aug 31 01:53 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 662282240 Sep 6 01:51 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 695541760 Sep 14 04:18 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 715882496 Sep 21 02:33 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 731496448 Sep 28 02:10 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 761552896 Oct 13 02:18 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 778076160 Oct 20 01:18 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 794820608 Oct 27 01:46 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 809304064 Nov 2 03:36 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 822583296 Nov 7 08:36 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 844079104 Nov 10 01:21 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 848076800 Nov 11 01:40 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 857710592 Nov 12 01:53 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 867352576 Nov 13 01:58 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 876568576 Nov 14 01:11 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 888070144 Nov 15 03:31 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 898465792 Nov 16 04:08 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 907616256 Nov 17 02:07 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 916480000 Nov 18 01:46 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 926220288 Nov 19 01:50 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 935952384 Nov 20 01:38 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 945872896 Nov 21 01:44 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 955441152 Nov 22 01:31 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 963747840 Nov 23 01:59 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 972324864 Nov 24 01:27 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 980189184 Nov 25 00:57 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 988086272 Nov 26 00:58 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 995680256 Nov 27 01:26 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1003315200 Nov 28 01:25 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1010884608 Nov 29 01:53 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1021444096 Nov 30 01:47 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1027997696 Dec 1 01:58 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1036558336 Dec 2 02:10 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1068269568 Dec 6 03:23 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1073307648 Dec 7 01:33 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1082449920 Dec 8 11:02 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1088061440 Dec 9 09:06 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1092091904 Dec 10 01:01 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1098244096 Dec 11 00:50 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1105944576 Dec 12 00:44 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db Should the directory server really need to sustain 5MB/s of write 24/7? Should the database file(s) have this kind of constant growth model or is there some pruning that should be getting done? Could these two issues be related? Cheers, b.

4 13

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2024