389-users March 2007

389-users@lists.fedoraproject.org

59 participants
64 discussions

[Fedora-directory-users] db_verify
by Ville Silventoinen 17 Apr '07

17 Apr '07

After I import about 1400 accounts to a new database (ebiRoot, People subtree), I get lot of errors when I run verify-db.pl (slapd has been stopped): Verify log files in db ... Good Verify db/ebiRoot/uid.db4 ... Good Verify db/ebiRoot/mail.db4 ... DB ERROR: db_verify: Page 37: out-of-order key at entry 247 DB ERROR: db_verify: Page 37: out-of-order key at entry 503 ... Same error for ancestorid.db4, objectclass.db4, parentid.db4, cn.db4, givenName.db4 and sn.db4. I have run db2index and re-run verify-db.pl but I don't see any difference. Here is what db2index says about ebiRoot: [29/Mar/2007:12:04:26 +0100] upgrade DB - ebiRoot: Start upgradedb. [29/Mar/2007:12:04:26 +0100] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database [29/Mar/2007:12:04:26 +0100] - import ebiRoot: Index buffering enabled with bucket size 100 [29/Mar/2007:12:04:27 +0100] - import ebiRoot: Workers finished; cleaning up... [29/Mar/2007:12:04:28 +0100] - import ebiRoot: Workers cleaned up. [29/Mar/2007:12:04:28 +0100] - import ebiRoot: Cleaning up producer thread... [29/Mar/2007:12:04:28 +0100] - import ebiRoot: Indexing complete. Post-processing... [29/Mar/2007:12:04:28 +0100] - import ebiRoot: Flushing caches... [29/Mar/2007:12:04:28 +0100] - import ebiRoot: Closing files... [29/Mar/2007:12:04:29 +0100] - import ebiRoot: Import complete. Processed 1424 entries in 3 seconds. (474.67 entries/sec) Does that WARNING "No other process is alloed to access the database" mean something is wrong? How can I locate those "out-of order keys" the db_verify lists? I tried with dbscan but I don't think I'm giving the right entry id: $ ./dbscan -K 247 -f db/ebiRoot/mail.db4 Can't set cursor to returned item: DB_NOTFOUND: No matching key/data pair found Is there a way to find out which entries are causing the problem? Can there be illegal characters in the entries? If I import a considerably smaller set of entries (120), I get no errors. I noticed there was a similar thread here but no conclusion: http://www.mail-archive.com/fedora-directory-users@redhat.com/msg04461.html Sorry for so many questions, I've spent couple of days trying to solve the problem. If I delete a database with the Console, it leaves behind couple of index files: -rw------- 1 w3secure systems 16384 Mar 28 17:05 ancestorid.db4 -rw------- 1 w3secure systems 18 Mar 28 17:03 DBVERSION -rw------- 1 w3secure systems 32768 Mar 28 17:05 id2entry.db4 These index files don't seem to shrink when new entries are imported. dbscan still shows the deleted entries in id2entry. I noticed a problem when I import a small set of entries, delete the database, import large set of entries and if I query the entries, I get the entries from the first set (they don't exist in the second set). I can reproduce the problem. If I delete ancestorid.db4 and id2entry.db4 manually when I delete the database, I don't have this problem. Is there a reason why those two files are not deleted? Or can this whole thing be caused by corrupted data? Ville

3 8

[Fedora-directory-users] CA certificate format
by Yoram Kahana 04 Apr '07

04 Apr '07

Hi Does anyone has an idea on which format should i save the ca certificate in the clients (for SSL communication) ? Is it PEM, DER, BER Thanks in advance Yoram

3 7

[Fedora-directory-users] Create Browsing Index gets stuck
by Ville Silventoinen 03 Apr '07

03 Apr '07

I'm sorry if this has already been discussed or reported as a bug. I tried to find the bug report, but couldn't find it so here goes: Quite often when I have removed all entries and put them back and tried to create a Browsing Index with the Console, the Console gets stuck. I have few times left it for hours but nothing happens. In this case I deleted the previous browsing index from the GUI and tried to create it again for People with 1400 entries. The GUI tells me it has done "Adding browsing index entries to server" (ticked) but it is still "Creating browsing index in server" (not ticked). It stays in this window forever. The "Server status for creating browsing index" window is empty. I cannot see any error messages in slapd-HOSTNAME/logs/errors or admin-serv/logs/error log. The startconsole terminal doesn't show any Java exceptions. Is there anywhere else I could look for clues? If I force the window to close, the database goes to read-only mode. I close the Console, shutdown the slapd, change the database back to read-write mode and restart everything. The Console shows the index has been created, but if I look at slapd-HOSTNAME/db/ebiRoot/ directory, I cannot see a vlv#bymccoupeopledcebidcacdcuk.db4 file, so I guess the index doesn't really exist? With just 1400 entries it's difficult to tell. Sometimes I do get the index created, but quite often not. I'm using Fedora DS 1.0.4 on CentOS 4.4 with following JRE: Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_09-b01) Java HotSpot(TM) Server VM (build 1.5.0_09-b01, mixed mode) Thanks for any help! Ville

2 1

[Fedora-directory-users] Complicated ACI Definitions
by Bjorn Oglefjorn 02 Apr '07

02 Apr '07

Or maybe it's not so complicated and I don't know how. ;) This is what I'm trying to accomplish: Users who are a member of the group 'cn=support' can perform ALL operations on 'userPassword', except on targets which are a member of group 'cn=admins' or 'cn=bosses'. Is this possible? I can't figure out how. Thanks in advance! --BO

2 5

[Fedora-directory-users] ip in ACI bind rules
by George Holbert 02 Apr '07

02 Apr '07

I've noticed that the 'ip' keyword in ACI bind rules seems to have no effect on its own. For example, This does not deny access to IP 1.2.3.4: aci: (version 3.0; acl "Deny 1.2.3.4"; deny(all) (ip = "1.2.3.4");) But when combined with a userdn clause like this, it works: aci: (version 3.0; acl "Deny 1.2.3.4"; deny(all) (userdn = "ldap:///anyone") and (ip = "1.2.3.4");) Is this known/expected behavior? Just want to make sure I'm interpreting this right. Thanks a lot, -- George

2 1

[Fedora-directory-users] "Bad Ber Tag Encountered" in log analysis
by Philip Kime 02 Apr '07

02 Apr '07

I was looking through the logconv.pl output and I see that the majority of connection codes are B1 Bad Ber Tag Encountered Should I be worried about this? LDAP seems to be working fine and has been for months. PK -- Philip Kime NOPS Systems Architect 310 401 0407

2 1

[Fedora-directory-users] PSET failure
by Glenn 02 Apr '07

02 Apr '07

Hello, again! I'm trying to install Fedora DS 1.0.4 on Red Hat EL4. Everything goes smoothly until I try to enable SSL in the admin server console. When I try to save new settings on the Encryption tab and the User DS tab, I get a message, "PSET failure. PSET attribute creation or local cache update failed!" After that, I back out of the admin console without saving changes. When I go back into the admin console, the certificate has disappeared from the drop-down list. It sounds like a problem with file permissions, but I don't know what files might be involved. Hoping you can help. Thanks. -G.

2 1

Re: [Fedora-directory-users] Error : Critical extension unavailable
by Victor Rodriguez 02 Apr '07

02 Apr '07

>Richard Megginson wrote: >The Fedora DS chaining database (database link) uses the Proxy Auth >control. I think you can disable this. Check the docs for the chaining >database configuration. It may be that the console does not allow you >to set this, but you can set it manually. http://www.redhat.com/docs/manuals/dir-server/pdf/ds71cli.pdf - search >for nsProxiedAuthorization >If there are other controls being sent by Fedora DS, you can disable >those too - search for nsTransmittedControls in the above document. Hi Richard: I have disabled these control but the problem still continue, this error only happen with openldap because when I connect to Novell eDirectory ldap server I have a different error: I dont have permisions to read the database link. Any idea? Regards, Victor Rodriguez IT Technical Support Officer System & Database Administrator Attention: The information contained in this message and or attachments is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any system and destroy any copies. Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of The Gribbles Group. Thank You. Whilst every effort has been made to ensure that this e-mail message and any attachments are free from viruses, you should scan this message and any attachments. Under no circumstances do we accept liability for any loss or damage which may result from your receipt of this message or any attachment.

2 1

[Fedora-directory-users] virtual attributes in targetfilter
by George Holbert 30 Mar '07

30 Mar '07

Under recent versions of FDS, is it OK to use virtual attributes (i.e., nsRole or CoS-generated) in ACI targetfilters? In earlier versions of Netscape DS, this was not recommended, and this is still mentioned in the RHDS 7.1 docs: http://www.redhat.com/docs/manuals/dir-server/ag/7.1/acl.html#1013769 However, in testing I haven't seen any problems so far doing this, and have noticed examples of it elsewhere, e.g.: http://www.redhat.com/archives/fedora-directory-users/2005-June/msg00188.ht… Are the docs just a little dated on this, or is it still not a good idea? Thank you! -- George

2 1

[Fedora-directory-users] Connect Active Directory to my LDAP
by Michiel van Heukelom - Van Boxtel Software BV 30 Mar '07

30 Mar '07

I've got the Fedora LDAP service running, connecting from other Linux server is no problem. the next step is to sunchronize the database to Active Directory. Is there a way to keep my Fedora LDAP as a master database and the AD server (W2003) as a member. So that i should only configure my users on my LDAP server and not on my AD server Met vriendelijke groet, Michiel van Heukelom Van Boxtel Software B.V. Telefoon: +31 (0) 492 - 327 357 Fax: +31 (0) 492 - 324 326 E-mail: mvheukelom(a)van-boxtel-software.nl Website: www.van-boxtel-software.nl

4 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users March 2007