389-users February 2008

389-users@lists.fedoraproject.org

59 participants
100 discussions

[Fedora-directory-users] Console issue
by Anand Vaddarapu 27 Mar '08

27 Mar '08

Hi, when i turn on SSL i use url as a https. (You still see that same error, but the console works anyway?) yes, console works fine when SSL engine turn off. Thanks

3 6

[Fedora-directory-users] temporary resource unavailable problem with fedora directory server
by M Vallapan 11 Mar '08

11 Mar '08

Dear all, I have installed fedora directory server version : fedora-ds-1.0.4-1.RHEL4. This ldap server integrates with postfix and our radius server. My problem is when I check the access log I see this error .[18/Feb/2008:11:04:51 +0800] conn=72887 op=-1 fd=593 closed error 11 (Resource temporarily unavailable) - T1 [18/Feb/2008:11:04:54 +0800] conn=72898 op=-1 fd=666 closed error 11 (Resource temporarily unavailable) - T1 [18/Feb/2008:11:05:22 +0800] conn=72895 op=-1 fd=605 closed error 11 (Resource temporarily unavailable) - T1 occuring again and again very frequently. I have already tuned the server according to the tuning guide on fedora directory server site. This is my sysctl.conf : # Kernel sysctl configuration file for Red Hat Linux # # For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and # sysctl.conf(5) for more details. # Controls IP packet forwarding net.ipv4.ip_forward = 0 # Controls source route verification net.ipv4.conf.default.rp_filter = 1 # Do not accept source routing net.ipv4.conf.default.accept_source_route = 0 # Controls the System Request debugging functionality of the kernel kernel.sysrq = 0 # Controls whether core dumps will append the PID to the core filename. # Useful for debugging multi-threaded applications. kernel.core_uses_pid = 1 net.ipv4.ip_local_port_range = 1024 65000 fs.file-max = 128000 net.ipv4.tcp_keepalive_time = 300 Am I missing something that I haven't done ?

3 14

[Fedora-directory-users] notes on building fds in etch and a failed build question
by Ryan Braun 10 Mar '08

10 Mar '08

I've been working a little bit towards setting up a build environment for fds in debian. I've never actually built anything this complex, and in general my compiling experience is somewhat lacking. I'm trying to follow the write up at http://directory.fedoraproject.org/wiki/Building . Which states you have to build the mozilla components first. Here's where it gets interesting. nspr and nss are already installed on the systems by default. ii libnspr4-0d 1.8.0.15~pre080131b-0etch1 NetScape Portable Runtime Library ii libnspr4-dev 1.8.0.15~pre080131b-0etch1 Development files for the NetScape Portable ii libnss3-0d 1.8.0.15~pre080131b-0etch1 Network Security Service libraries ii libnss3-0d-dbg 1.8.0.15~pre080131b-0etch1 Development files for the Network Security S ii libnss3-dev 1.8.0.15~pre080131b-0etch1 Development files for the Network Security S ii libnss3-tools 1.8.0.15~pre080131b-0etch1 Network Security Service tools But they have a goofy version number dictated by the xulrunner package. http://packages.debian.org/source/etch/xulrunner ywgbuild:/usr/src/dsbuild/meta/ds# pkg-config --modversion xulrunner-nss 1.8.0.13pre ywgbuild:/usr/src/dsbuild/meta/ds# pkg-config --modversion xulrunner-nspr 4.6.7 Now, I'm not sure why nspr is reporting it's true version number, while nss is reporting the 1.8.0 version when it should be something like 3.10 or 3.11. And, I've been digging on the debian packages listings trying to figure out just which version nss is. Any idea how to pull the version number right out of the shared lib? Anyhow I moved on to try and build the next component, svrcore. I had to do some fudging with pkg-config (ln -s xulrunner-nspr.pc nspr.pc and ln -s xulrunner-nss.pc nss.pc) in order for svrcore's configure to work (prolly a RH vs debian package naming issue). So I ./configure --prefix=/opt/svrcore and it makes and make install's ok. I add /opt/svrcore/lib to ld.so.conf, and run ldconfig. ywgbuild:/opt/svrcore# strings /etc/ld.so.cache |grep svrcore libsvrcore.so.0 /opt/svrcore/lib/libsvrcore.so.0 libsvrcore.so /opt/svrcore/lib/libsvrcore.so ywgbuild:/opt/svrcore# pkg-config --modversion svrcore 4.0.4 Next on the list is the mozldap library ywgbuild:/usr/src/mozldap-6.0.5/mozilla/directory/c-sdk# ./configure --enable-clu --with-sasl --with-svrcore --enable-optimize --disable-debug --prefix=/opt/mozldap works ok. But then make throws this gcc -o ntuserpin.o -c -pipe -ansi -Wall -pthread -O2 -fPIC -UDEBUG -DNDEBUG=1 -DXP_UNIX=1 -D_POSIX_SOURCE=1 -D_BSD_SOURCE=1 -D_SVID_SOURCE=1 -D_LARGEFILE64_SOURCE=1 -DHAVE_FCNTL_FILE_LOCKING=1 -DLINUX=1 -Dlinux=1 -Di386=1 -DHAVE_LCHOWN=1 -DHAVE_STRERROR=1 -DHAVE_GETADDRINFO=1 -DHAVE_GETNAMEINFO=1 -DHAVE_SASL=1 -DHAVE_SASL_OPTIONS=1 -DLDAP_SASLIO_HOOKS=1 -D_REENTRANT=1 -DNET_SSL -DNO_LIBLCACHE -DLDAP_REFERRALS -DNS_DOMESTIC -DLINUX2_0 -DLINUX1_2 -DLINUX2_1 -DLDAP_TOOL_ARGPIN -DLDAP_TOOL_PKCS11 -DFORCE_PR_LOG -D_PR_PTHREADS -UHAVE_CVAR_BUILT_ON_SEM -I/usr/include/nss -I/usr/include/nspr -I/usr/include/nspr -I/usr/include/sasl -I../../../../../dist/public/ldap -I../../../ldap/include -I/opt/svrcore/include -I/usr/include/nspr -I/usr/include/nss ntuserpin.c c++ -o bin/ldapdelete ldapdelete.o common.o convutf8.o fileurl.o ldaptool-sasl.o argpin.o ntuserpin.o -L../../../../../dist/./lib -lssldap60 -lprldap60 -lldap60 -lldif60 -L../../../../../dist/lib -lsvrcore -lssl3 -lnss3 -lsoftokn3 -L/usr/lib -lplds4 -lplc4 -lnspr4 -lpthread -ldl -lplc4 -lplds4 -lnspr4 -lsasl2 -ldl -lresolv -lpthread /usr/bin/ld: cannot find -lsvrcore collect2: ld returned 1 exit status make[2]: *** [bin/ldapdelete] Error 1 ywgbuild:/tmp# strace -o out ld -l svrcore ld: cannot find -lsvrcore ywgbuild:/tmp# grep open out open("/etc/ld.so.cache", O_RDONLY) = 3 open("/usr/lib/libbfd-2.17.so", O_RDONLY) = 3 open("/lib/tls/i686/cmov/libc.so.6", O_RDONLY) = 3 open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3 open("a.out", O_RDWR|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 3 open("/usr/bin/../lib/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/usr/bin/../lib/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/usr/i486-linux-gnu/lib32/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/usr/i486-linux-gnu/lib32/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/usr/local/lib32/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/usr/local/lib32/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/lib32/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/lib32/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/usr/lib32/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/usr/lib32/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/usr/i486-linux-gnu/lib/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/usr/i486-linux-gnu/lib/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/usr/local/lib/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/usr/local/lib/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/lib/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/lib/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/usr/lib/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/usr/lib/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/usr/share/locale/locale.alias", O_RDONLY) = 4 open("/usr/share/locale/en_CA/LC_MESSAGES/ld.mo", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/share/locale/en/LC_MESSAGES/ld.mo", O_RDONLY) = -1 ENOENT (No such file or directory) So I'm not sure why ld doesn't want to look in /opt/svrcore/lib for the libsvrcore shared libs. it just looks in the default spots according to strace. Did I mess up somewhere? As a quick fix I just symlinked /opt/svrcore/lib/libsvrcore.(a|so) to /usr/lib and it built. mozldap doesn't make install apparently, but creates a dist directory symlinking all the built apps and libs. So I just copied /usr/src/mozldap-6.0.5/mozilla/dist to /opt/mozldap copying the files rather then preserving the symlinks. add /opt/mozldap/lib to ld.so.conf && ldconfig ywgbuild:/opt/mozldap/bin# strings /etc/ld.so.cache |grep mozldap /opt/mozldap/lib/libssldap60.so /opt/mozldap/lib/libprldap60.so /opt/mozldap/lib/libldif60.so /opt/mozldap/lib/libldap60.so So those libs look to be installed ok. I then hacked up a fedora mozldap.pc (the make process didn't generate one, but the mozldap.pc.in file is there..) ywgbuild:/tmp/usr/lib/pkgconfig# cat mozldap.pc prefix=/opt/mozldap exec_prefix=${prefix} libdir=${prefix}/lib includedir=${prefix}/include bindir=${prefix}/bin major=6 minor=0 submin=5 libsuffix=60 Name: mozldap Description: Mozilla LDAP C SDK Version: 6.0.5 Requires: nspr >= 4.6 , nss >= 1.8.0.13pre Libs: -lssldap60 -lprldap60 -lldap60 Cflags: -I${includedir} But again I end up in a spot where ld can't find the libs I just installed. So I symlynk'd everything in /opt/mozldap/lib to /usr/lib/ Then ld -lssldap60 -lprldap60 -lldap60 wouldn't complain about not being able to find the libs anymore. Now for perl-ldap export LDAPSDKINCDIR="/opt/mozldap/include" export LDAPSDKDIR="/opt/mozldap" export LDAPSDKLIBDIR="/opt/mozldap/lib" export NSPRINCDIR="/usr/include/nspr" export NSPRLIBDIR="/usr/lib" export NSSLIBDIR="/usr/lib" make would puke complaining about missing ldap-standard.h ln -s /opt/mozldap/public/ldap/ldap-standard.h /opt/mozldap/include/ldap-standard.h ywgbuild:/usr/src/perl-mozldap-1.5.2# make cc -c -I/opt/mozldap/include -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -DVERSION=\"1.5\" -DXS_VERSION=\"1.5\" -fPIC "-I/usr/lib/perl/5.8/CORE" -DUSE_SSL API.c Running Mkbootstrap for Mozilla::LDAP::API () chmod 644 API.bs rm -f blib/arch/auto/Mozilla/LDAP/API/API.so LD_RUN_PATH="/opt/mozldap/lib" LD_RUN_PATH=/opt/mozldap/lib cc -shared -L/usr/local/lib API.o -o blib/arch/auto/Mozilla/LDAP/API/API.so \ -L/opt/mozldap/lib -lssldap60 -lprldap60 -lldap60 -L/usr/lib -lssl3 -lnss3 -L/usr/lib -lplc4 -lnspr4 \ chmod 755 blib/arch/auto/Mozilla/LDAP/API/API.so cp API.bs blib/arch/auto/Mozilla/LDAP/API/API.bs chmod 644 blib/arch/auto/Mozilla/LDAP/API/API.bs Manifying blib/man3/Mozilla::LDAP::Conn.3pm Manifying blib/man3/Mozilla::LDAP::Utils.3pm Manifying blib/man3/Mozilla::LDAP::Entry.3pm Manifying blib/man3/Mozilla::LDAP::LDIF.3pm Manifying blib/man3/Mozilla::LDAP::API.3pm So where I'm at now, using sysyem nspr and nss, built mozldap and installed to /opt/mozldap, built svrcore and installed to /opt/svrcore and built perl-ldap, not installing it anywhere. So I figured I would give the newer dsbuild a shot at building the directory server. And it cranks away for a while then comes back with a message complaining about ldap agent and snmp. I initiated dsbuild with just a make command with no options. Here are the snmp packages installed ywgbuild:/usr/src/dsbuild/meta/ds# dpkg -l|grep snmp ii libsnmp-base 5.2.3-7etch2 NET SNMP (Simple Network Management Protocol ii libsnmp-perl 5.2.3-7etch2 NET SNMP (Simple Network Management Protocol ii libsnmp9 5.2.3-7etch2 NET SNMP (Simple Network Management Protocol ii libsnmp9-dev 5.2.3-7etch2 NET SNMP (Simple Network Management Protocol I've sent the last portion of the build process to pastebin if you want to have a look at http://www.pastebin.org/20301 but the guts of the issue is this 3]: Entering directory `/usr/src/dsbuild/ds/ldapserver/work/fedora-ds-base-1.1.0' /bin/sh ./libtool --tag=CC --mode=link gcc -g -o ldap-agent-bin ldap/servers/snmp/ldap_agent_bin-main.o ldap/servers/snmp/ldap_agent_bin-ldap-agent.o ldap/servers/slapd/ldap_agent_bin-agtmmap.o -lssldap60 -lprldap60 -lldap60 -lldif60 -lsasl2 -lssl3 -lnss3 -lsoftokn3 -lplc4 -lplds4 -lnspr4 -L/usr/lib -lnetsnmpmibs -lnetsnmpagent -lnetsnmphelpers -lnetsnmp -lm -ldl -lsensors -lwrap -lwrap gcc -g -o ldap-agent-bin ldap/servers/snmp/ldap_agent_bin-main.o ldap/servers/snmp/ldap_agent_bin-ldap-agent.o ldap/servers/slapd/ldap_agent_bin-agtmmap.o -lssldap60 -lprldap60 -lldap60 -lldif60 /usr/lib/libsasl2.so -lresolv -lssl3 -lnss3 -lsoftokn3 -lplc4 -lplds4 -lnspr4 -L/usr/lib /usr/lib/libnetsnmpmibs.so /usr/lib/libnetsnmpagent.so /usr/lib/libnetsnmphelpers.so /usr/lib/libnetsnmp.so -lcrypto -lm -ldl -lsensors -lwrap ldap/servers/snmp/ldap_agent_bin-ldap-agent.o: In function `init_ldap_agent': ldap/servers/snmp/ldap-agent.c:98: undefined reference to `CONTAINER_INSERT' collect2: ld returned 1 exit status make[3]: *** [ldap-agent-bin] Error 1 make[3]: Leaving directory `/usr/src/dsbuild/ds/ldapserver/work/fedora-ds-base-1.1.0' make[2]: *** [all] Error 2 make[2]: Leaving directory `/usr/src/dsbuild/ds/ldapserver/work/fedora-ds-base-1.1.0' make[1]: *** [build-work/fedora-ds-base-1.1.0/Makefile] Error 2 make[1]: Leaving directory `/usr/src/dsbuild/ds/ldapserver' make: *** [dep-../../ds/ldapserver] Error 2 make[ Any ideas? Ryan Braun Informatics Operations Aviation and Defence Services Division Chief Information Officer Branch, Environment Canada CIV: (204) 833-2500x2824 CSN: 257-2824 FAX: (204) 833-2524 E-Mail: Ryan.Braun(a)ec.gc.ca

5 36

[Fedora-directory-users] Apple OS X 10.5 question
by John Call 05 Mar '08

05 Mar '08

Aloha list, My university has been authenticating Mac OS X 10.4 clients to FDS 1.04 for about a year now. Things have been working great, as long as we keep an eye on the external SASL mechanisms. However, now that our staff is deploying the new OS X 10.5 things aren't working. To the best of our knowledge we have maintained the same client LDAP configuration from 10.4 to 10.5, but the Apple clients refuse to authenticate. Has anybody else experienced this? Mahalo (thanks), John Call

3 4

[Fedora-directory-users] groups
by solarflow99 05 Mar '08

05 Mar '08

I was interested to create groups to use for authenticated access. Say for instance I configure samba to use FDS, can it actually use those groups to control permissions? What about the gidnumber? This all the docs had to say about it: 5.4. Using Groups Groups are a mechanism for associating entries for ease of administration. This mechanism was provided with previous versions of Directory Server and should be used primarily for compatibility with older versions of the server.

3 6

[Fedora-directory-users] Individual Passwordpolicies
by Sujay D'Souza 29 Feb '08

29 Feb '08

Hello, I was wondering if anyone could shed some light on passwordpolicies within FDS 1.0.4. It is possible to setup individual passwordpolicies within Sun Directory 5.2 and then assign the specific policy to either a single entry as the value of passwordPolicySubentry or managing the policy via CoS and roles. From the FDS documentation, it is possible to apply an individual policy either globally, user or subtree, but no mention of applying the policy via roles.... Any input would be appreciated. tia Sujay

2 1

[Fedora-directory-users] FedoraDs and saslauthd
by Giovanni Mancuso 29 Feb '08

29 Feb '08

Hi to all, can i configure my FedoraDS to authenticate with saslauthd ??? Thanks

1 0

[Fedora-directory-users] Could not register the directory server with the configuration directory server
by Nick P 29 Feb '08

29 Feb '08

I am trying to install and configure my first FDS, and first LDAP server. I have spent many hours with little fruit so far. Currently, I am receiving an error at the end of the setup-ds-admin script: [08/02/29:02:37:41] - [Setup] Fatal Could not register the directory server with the configuration directory server. The error is similar to what is described in this bug: https://bugzilla.redhat.com/show_bug.cgi?id=431103. However, my configuration directory is _not_ on another host. I answered 'no' to the question of whether I would be registering with a current configuration server. I don't know if the solution presented there would work - I am forwarding a port to the server, and do not have a hostname.domain.org to use there. I have had trouble adding entries, so if I added them and it didn't fix the problem, I would not know if the solution failed or if I failed to add the entries properly. The server is NAT'ed and receiving a forwarded port. so I have been using mydomain.org for the servername and identifying the port that gets forwarded. If you can help me make some sense of this, I would very much appreciate it. If the workaround in the bug above is the answer, could you address my specific situation of not having a FQDN with a host and everything - how will this effect the entries? After failing to add entries with success many times I have started to use a windows client, Ldapadmin - could I use this, if the work around is the solution? Should the entries go in o=netscaperoot or dc=domain,dc=org ? I am also including a portion of the log file that was created during the installation. Is there anything here that shows what the root of the problem is? Thanks, Nick -------------------- +Entry cn=topologyplugin, ou=1.1, ou=Admin, ou=Global Preferences, ou=admin, o=NetscapeRoot is added +++check_and_add_entry: Entry not found cn=defaultplugin, cn=topologyplugin, ou=1.1, ou=Admin, ou=Global Preferences, ou=admin, o=NetscapeRoot error No such object +Entry cn=defaultplugin, cn=topologyplugin, ou=1.1, ou=Admin, ou=Global Preferences, ou=admin, o=NetscapeRoot is added +++check_and_add_entry: Entry not found cn=UI,ou=1.1, ou=Admin, ou=Global Preferences, ou=admin, o=NetscapeRoot error No such object +Entry cn=UI,ou=1.1, ou=Admin, ou=Global Preferences, ou=admin, o=NetscapeRoot is added +Processing /usr/share/dirsrv/data/12dsconfig.mod.tmpl ... +++check_and_add_entry: Found entry cn=config +++Adding attr=aci value=(targetattr="*")(version 3.0; acl "Configuration Administrators Group"; allow (all) groupdn="ldap:///cn=Configuration Administrators, ou=Groups, ou=TopologyManagement, o=NetscapeRoot";) to entry cn=config +++Adding attr=aci value=(targetattr="*")(version 3.0; acl "Configuration Administrator"; allow (all) userdn="ldap:///uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot";) to entry cn=config +++Adding attr=aci value=(targetattr = "*")(version 3.0; acl "SIE Group"; allow (all) groupdn = "ldap:///cn=slapd-server, cn=Fedora Directory Server, cn=Server Group, cn=server, ou=admin, o=NetscapeRoot";) to entry cn=config +++check_and_add_entry: Found entry cn=SNMP,cn=config +++Adding attr=aci value=(target="ldap:///cn=SNMP,cn=config")(targetattr !="aci")(version 3.0;acl "snmp";allow (read, search, compare)(userdn = "ldap:///anyone");) to entry cn=SNMP,cn=config +++check_and_add_entry: Found entry oid=2.16.840.1.113730.3.4.9,cn=features,cn=config +++Adding attr=aci value=(targetattr != "aci")(version 3.0; acl "VLV Request Control"; allow( read, search, compare, proxy ) userdn = "ldap:///all";) to entry oid=2.16.840.1.113730.3.4.9,cn=features,cn=config +Processing /usr/share/dirsrv/data/13dsschema.mod.tmpl ... +++check_and_add_entry: Found entry cn=schema +++Adding attr=aci value=(target="ldap:///cn=schema")(targetattr !="aci")(version 3.0;acl "anonymous, no acis"; allow (read, search, compare) userdn = "ldap:///anyone";) to entry cn=schema +++Adding attr=aci value=(targetattr="*")(version 3.0; acl "Configuration Administrators Group"; allow (all) groupdn="ldap:///cn=Configuration Administrators, ou=Groups, ou=TopologyManagement, o=NetscapeRoot";) to entry cn=schema +++Adding attr=aci value=(targetattr="*")(version 3.0; acl "Configuration Administrator"; allow (all) userdn="ldap:///uid=admin,ou=Administrators, ou=TopologyManagement, o=NetscapeRoot";) to entry cn=schema +++Adding attr=aci value=(targetattr = "*")(version 3.0; acl "SIE Group"; allow (all) groupdn = "ldap:///cn=slapd-server, cn=Fedora Directory Server, cn=Server Group, cn=server, ou=admin, o=NetscapeRoot";) to entry cn=schema +Processing /usr/share/dirsrv/data/14dsmonitor.mod.tmpl ... +++check_and_add_entry: Found entry cn=monitor +++Adding attr=aci value=(target ="ldap:///cn=monitor*")(targetattr != "aci || connection")(version 3.0; acl "monitor"; allow( read, search, compare ) userdn = "ldap:///anyone";) to entry cn=monitor +Processing /usr/share/dirsrv/data/16dssuffixadmin.mod.tmpl ... +++check_and_add_entry: Entry not found dc=hpconnect,dc=org error No such object Could not authenticate as user 'uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot' to server 'ldap://server:46645/o=NetscapeRoot'. Error: Invalid credentials Could not register the directory server with the configuration directory server. -----------------------------------------------

2 3

[Fedora-directory-users] Setting up fault tolerant mesh of FDS servers - just checking I have got it right!
by Howard Wilkinson 29 Feb '08

29 Feb '08

Fedora-ds-1.1.1 on Fedora 7 + (the + is back ports from 8/9, all of the updates applied, and additional packages I have cross ported) I have succeeded in getting a fault tolerant mesh configured that consists of 2 or more Multi-Master servers, a number of Hub (0+) and a number of consumers (0+). I have done this by modifying mmr.pl to accept --host1_role and --host2_role parameters which can be set to supplier, hub, or consumer. For all of the usual DCROOTs i.e. not o=NetscapeRoot I set the relationships up as implied i.e. supplier<->supplier for the Multi-Master Hosts, supplier<->hub, hub<->consumer. Where the site is too small for hub servers I have gone supplier<->consumer direct. Inter-site topology and hub grouping within sites is left as an exercise for the reader (me when it comes back to bite me...) For the o=Netscape I have chosen to use supplier<->supplier relationships but to apply the same topology. Sequence of events are: * On first Master 1. Install clean environment - erase rpm's delete residual files, install rpms, patch dirsrv-admin startup to work! 2. Run setup-ds-admin.pl in silent mode, this adds schema files. The inf file has SlapdConfigMC=1, UseExistingMC=0 and points ConfigDirectoryLdapURL to this host. 3. Set up SSL certs using certutil commands and openssl supplied certificates from our CA. 4. Restart dirsrv and dirsrv-admin 5. Create 2nd and subsequent DCROOTS with default aci's and "standard" container entries 6. Preload data into DCROOTS for users and other objects being migrated. * On other servers - doing other masters first, followed by hubs and then consumers - carry out steps 1-5 above creating the o=NetscapeRoot DCROOT as well. o The inf file has SlapdConfigMC=1, UseExistingMC=1 and points ConfigDirectoryLdapUrl to the first Master * Then run the mmr.pl script on each connection for each DCROOT starting with replicating the first master to all other masters, then to hubs, then other masters to hubs and finally hubs to consumers. 1. For o=NetscapeRoot run mmr.pl as supplier<->supplier, otherwise honor the role played by each server. 2. Replace entries in cn=UserDirectory, ou=Global Preferences, ou=<localdomain>, o=NetscapeRoot for nsDirectoryFailoverList with one for each server other than the first master which is mentioned in the nsDirectoryURL entry in the same object. *Is this the right sort of thing to do?* 3. On every host alter the cn=Pass Through Authentication,cn=plugins,cn=config object to have nssslapd-pluginarg0 to reference that host rather than the first master. *Is this correct on the consumers (or hubs)? *I am assuming that this is for authentication not for password modification purposes! Which brings up the question of where in the consumers and hubs do I put referrals to the Master(s)? 4. Edit adm.conf on each host to change the ldapurl to point to the local host. Now assuming that this was the right thing to do I now need to set up referrals for writing to the system from the consumers and hubs back to the "site" masters. Where do I put this information? I am also getting these errors logged on the first master! Feb 28 22:00:35 bastion ns-slapd: auxpropfunc error invalid parameter supplied Feb 28 22:00:35 bastion ns-slapd: sql_select option missing Feb 28 22:00:35 bastion ns-slapd: auxpropfunc error no mechanism available These are appearing about every 15 minutes. Anybody any idea where these are coming from? Finally the shutdown time for the dirsrv servers on the suppliers is extremely long - orders of minutes, what could be causing this? -- Howard Wilkinson Phone: +44(20)76907075 Coherent Technology Limited Fax: 23 Northampton Square, Mobile: +44(7980)639379 United Kingdom, EC1V 0HL Email: howard(a)cohtech.com

2 1

[Fedora-directory-users] Looking for copy of new mmr.pl
by Chris St. Pierre 28 Feb '08

28 Feb '08

The link to the new version of mmr.pl at http://directory.fedoraproject.org/wiki/Howto:MultiMasterReplication is broken, and I was wondering if anyone had a copy of the mmr.pl script for Fedora DS 1.1. Thanks! Chris St. Pierre Unix Systems Administrator Nebraska Wesleyan University

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users February 2008