[Fedora-directory-users] Console issue
by Anand Vaddarapu
Hi,
when i turn on SSL i use url as a https.
(You still see that same error, but the console works anyway?)
yes, console works fine when SSL engine turn off.
Thanks
15 years, 6 months
[Fedora-directory-users] temporary resource unavailable problem with fedora directory server
by M Vallapan
Dear all,
I have installed fedora directory server version :
fedora-ds-1.0.4-1.RHEL4. This ldap server integrates with postfix and
our radius server. My problem is when I check the access log I see
this error
.[18/Feb/2008:11:04:51 +0800] conn=72887 op=-1 fd=593 closed error 11
(Resource temporarily unavailable) - T1
[18/Feb/2008:11:04:54 +0800] conn=72898 op=-1 fd=666 closed error 11
(Resource temporarily unavailable) - T1
[18/Feb/2008:11:05:22 +0800] conn=72895 op=-1 fd=605 closed error 11
(Resource temporarily unavailable) - T1
occuring again and again very frequently. I have already tuned the
server according to the tuning guide on fedora directory server site.
This is my sysctl.conf :
# Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and
# sysctl.conf(5) for more details.
# Controls IP packet forwarding
net.ipv4.ip_forward = 0
# Controls source route verification
net.ipv4.conf.default.rp_filter = 1
# Do not accept source routing
net.ipv4.conf.default.accept_source_route = 0
# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0
# Controls whether core dumps will append the PID to the core filename.
# Useful for debugging multi-threaded applications.
kernel.core_uses_pid = 1
net.ipv4.ip_local_port_range = 1024 65000
fs.file-max = 128000
net.ipv4.tcp_keepalive_time = 300
Am I missing something that I haven't done ?
15 years, 6 months
[Fedora-directory-users] notes on building fds in etch and a failed build question
by Ryan Braun
I've been working a little bit towards setting up a build environment for fds
in debian. I've never actually built anything this complex, and in general
my compiling experience is somewhat lacking. I'm trying to follow the write
up at http://directory.fedoraproject.org/wiki/Building . Which states you
have to build the mozilla components first. Here's where it gets
interesting.
nspr and nss are already installed on the systems by default.
ii libnspr4-0d 1.8.0.15~pre080131b-0etch1
NetScape Portable Runtime Library
ii libnspr4-dev 1.8.0.15~pre080131b-0etch1
Development files for the NetScape Portable
ii libnss3-0d 1.8.0.15~pre080131b-0etch1
Network Security Service libraries
ii libnss3-0d-dbg 1.8.0.15~pre080131b-0etch1
Development files for the Network Security S
ii libnss3-dev 1.8.0.15~pre080131b-0etch1
Development files for the Network Security S
ii libnss3-tools 1.8.0.15~pre080131b-0etch1
Network Security Service tools
But they have a goofy version number dictated by the xulrunner package.
http://packages.debian.org/source/etch/xulrunner
ywgbuild:/usr/src/dsbuild/meta/ds# pkg-config --modversion xulrunner-nss
1.8.0.13pre
ywgbuild:/usr/src/dsbuild/meta/ds# pkg-config --modversion xulrunner-nspr
4.6.7
Now, I'm not sure why nspr is reporting it's true version number, while nss
is reporting the 1.8.0 version when it should be something like 3.10 or 3.11.
And, I've been digging on the debian packages listings trying to figure out
just which version nss is. Any idea how to pull the version number right out
of the shared lib? Anyhow I moved on to try and build the next component,
svrcore.
I had to do some fudging with pkg-config (ln -s xulrunner-nspr.pc nspr.pc and
ln -s xulrunner-nss.pc nss.pc) in order for svrcore's configure to work
(prolly a RH vs debian package naming issue).
So I ./configure --prefix=/opt/svrcore and it makes and make install's ok.
I add /opt/svrcore/lib to ld.so.conf, and run ldconfig.
ywgbuild:/opt/svrcore# strings /etc/ld.so.cache |grep svrcore
libsvrcore.so.0
/opt/svrcore/lib/libsvrcore.so.0
libsvrcore.so
/opt/svrcore/lib/libsvrcore.so
ywgbuild:/opt/svrcore# pkg-config --modversion svrcore
4.0.4
Next on the list is the mozldap library
ywgbuild:/usr/src/mozldap-6.0.5/mozilla/directory/c-sdk# ./configure --enable-clu --with-sasl --with-svrcore --enable-optimize --disable-debug --prefix=/opt/mozldap
works ok.
But then make throws this
gcc -o
ntuserpin.o -c -pipe -ansi -Wall -pthread -O2 -fPIC -UDEBUG -DNDEBUG=1 -DXP_UNIX=1 -D_POSIX_SOURCE=1 -D_BSD_SOURCE=1 -D_SVID_SOURCE=1 -D_LARGEFILE64_SOURCE=1 -DHAVE_FCNTL_FILE_LOCKING=1 -DLINUX=1 -Dlinux=1 -Di386=1 -DHAVE_LCHOWN=1 -DHAVE_STRERROR=1 -DHAVE_GETADDRINFO=1 -DHAVE_GETNAMEINFO=1 -DHAVE_SASL=1 -DHAVE_SASL_OPTIONS=1 -DLDAP_SASLIO_HOOKS=1 -D_REENTRANT=1 -DNET_SSL -DNO_LIBLCACHE -DLDAP_REFERRALS -DNS_DOMESTIC -DLINUX2_0 -DLINUX1_2 -DLINUX2_1 -DLDAP_TOOL_ARGPIN -DLDAP_TOOL_PKCS11 -DFORCE_PR_LOG -D_PR_PTHREADS -UHAVE_CVAR_BUILT_ON_SEM -I/usr/include/nss -I/usr/include/nspr -I/usr/include/nspr -I/usr/include/sasl -I../../../../../dist/public/ldap -I../../../ldap/include -I/opt/svrcore/include -I/usr/include/nspr -I/usr/include/nss
ntuserpin.c
c++ -o bin/ldapdelete ldapdelete.o common.o convutf8.o fileurl.o
ldaptool-sasl.o argpin.o
ntuserpin.o -L../../../../../dist/./lib -lssldap60 -lprldap60 -lldap60 -lldif60 -L../../../../../dist/lib -lsvrcore -lssl3 -lnss3 -lsoftokn3 -L/usr/lib -lplds4 -lplc4 -lnspr4 -lpthread -ldl -lplc4 -lplds4 -lnspr4 -lsasl2 -ldl -lresolv -lpthread
/usr/bin/ld: cannot find -lsvrcore
collect2: ld returned 1 exit status
make[2]: *** [bin/ldapdelete] Error 1
ywgbuild:/tmp# strace -o out ld -l svrcore
ld: cannot find -lsvrcore
ywgbuild:/tmp# grep open out
open("/etc/ld.so.cache", O_RDONLY) = 3
open("/usr/lib/libbfd-2.17.so", O_RDONLY) = 3
open("/lib/tls/i686/cmov/libc.so.6", O_RDONLY) = 3
open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3
open("a.out", O_RDWR|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 3
open("/usr/bin/../lib/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No
such file or directory)
open("/usr/bin/../lib/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No
such file or directory)
open("/usr/i486-linux-gnu/lib32/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1
ENOENT (No such file or directory)
open("/usr/i486-linux-gnu/lib32/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1
ENOENT (No such file or directory)
open("/usr/local/lib32/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No
such file or directory)
open("/usr/local/lib32/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No
such file or directory)
open("/lib32/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file
or directory)
open("/lib32/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or
directory)
open("/usr/lib32/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such
file or directory)
open("/usr/lib32/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such
file or directory)
open("/usr/i486-linux-gnu/lib/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1
ENOENT (No such file or directory)
open("/usr/i486-linux-gnu/lib/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT
(No such file or directory)
open("/usr/local/lib/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No
such file or directory)
open("/usr/local/lib/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such
file or directory)
open("/lib/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or
directory)
open("/lib/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or
directory)
open("/usr/lib/libsvrcore.so", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file
or directory)
open("/usr/lib/libsvrcore.a", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file
or directory)
open("/usr/share/locale/locale.alias", O_RDONLY) = 4
open("/usr/share/locale/en_CA/LC_MESSAGES/ld.mo", O_RDONLY) = -1 ENOENT (No
such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/ld.mo", O_RDONLY) = -1 ENOENT (No such
file or directory)
So I'm not sure why ld doesn't want to look in /opt/svrcore/lib for the
libsvrcore shared libs. it just looks in the default spots according to
strace. Did I mess up somewhere?
As a quick fix I just symlinked /opt/svrcore/lib/libsvrcore.(a|so) to /usr/lib
and it built.
mozldap doesn't make install apparently, but creates a dist directory
symlinking all the built apps and libs. So I just
copied /usr/src/mozldap-6.0.5/mozilla/dist to /opt/mozldap copying the files
rather then preserving the symlinks.
add /opt/mozldap/lib to ld.so.conf && ldconfig
ywgbuild:/opt/mozldap/bin# strings /etc/ld.so.cache |grep mozldap
/opt/mozldap/lib/libssldap60.so
/opt/mozldap/lib/libprldap60.so
/opt/mozldap/lib/libldif60.so
/opt/mozldap/lib/libldap60.so
So those libs look to be installed ok.
I then hacked up a fedora mozldap.pc (the make process didn't generate one,
but the mozldap.pc.in file is there..)
ywgbuild:/tmp/usr/lib/pkgconfig# cat mozldap.pc
prefix=/opt/mozldap
exec_prefix=${prefix}
libdir=${prefix}/lib
includedir=${prefix}/include
bindir=${prefix}/bin
major=6
minor=0
submin=5
libsuffix=60
Name: mozldap
Description: Mozilla LDAP C SDK
Version: 6.0.5
Requires: nspr >= 4.6 , nss >= 1.8.0.13pre
Libs: -lssldap60 -lprldap60 -lldap60
Cflags: -I${includedir}
But again I end up in a spot where ld can't find the libs I just installed.
So I symlynk'd everything in /opt/mozldap/lib to /usr/lib/
Then ld -lssldap60 -lprldap60 -lldap60 wouldn't complain about not being able
to find the libs anymore.
Now for perl-ldap
export LDAPSDKINCDIR="/opt/mozldap/include"
export LDAPSDKDIR="/opt/mozldap"
export LDAPSDKLIBDIR="/opt/mozldap/lib"
export NSPRINCDIR="/usr/include/nspr"
export NSPRLIBDIR="/usr/lib"
export NSSLIBDIR="/usr/lib"
make would puke complaining about missing ldap-standard.h
ln -s /opt/mozldap/public/ldap/ldap-standard.h /opt/mozldap/include/ldap-standard.h
ywgbuild:/usr/src/perl-mozldap-1.5.2# make
cc -c -I/opt/mozldap/include -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -DVERSION=\"1.5\" -DXS_VERSION=\"1.5\" -fPIC "-I/usr/lib/perl/5.8/CORE" -DUSE_SSL
API.c
Running Mkbootstrap for Mozilla::LDAP::API ()
chmod 644 API.bs
rm -f blib/arch/auto/Mozilla/LDAP/API/API.so
LD_RUN_PATH="/opt/mozldap/lib" LD_RUN_PATH=/opt/mozldap/lib
cc -shared -L/usr/local/lib API.o -o blib/arch/auto/Mozilla/LDAP/API/API.so
\
-L/opt/mozldap/lib -lssldap60 -lprldap60 -lldap60 -L/usr/lib -lssl3 -lnss3 -L/usr/lib -lplc4 -lnspr4
\
chmod 755 blib/arch/auto/Mozilla/LDAP/API/API.so
cp API.bs blib/arch/auto/Mozilla/LDAP/API/API.bs
chmod 644 blib/arch/auto/Mozilla/LDAP/API/API.bs
Manifying blib/man3/Mozilla::LDAP::Conn.3pm
Manifying blib/man3/Mozilla::LDAP::Utils.3pm
Manifying blib/man3/Mozilla::LDAP::Entry.3pm
Manifying blib/man3/Mozilla::LDAP::LDIF.3pm
Manifying blib/man3/Mozilla::LDAP::API.3pm
So where I'm at now, using sysyem nspr and nss, built mozldap and installed
to /opt/mozldap, built svrcore and installed to /opt/svrcore and built
perl-ldap, not installing it anywhere.
So I figured I would give the newer dsbuild a shot at building the directory
server. And it cranks away for a while then comes back with a message
complaining about ldap agent and snmp. I initiated dsbuild with just a make
command with no options.
Here are the snmp packages installed
ywgbuild:/usr/src/dsbuild/meta/ds# dpkg -l|grep snmp
ii libsnmp-base 5.2.3-7etch2
NET SNMP (Simple Network Management Protocol
ii libsnmp-perl 5.2.3-7etch2
NET SNMP (Simple Network Management Protocol
ii libsnmp9 5.2.3-7etch2
NET SNMP (Simple Network Management Protocol
ii libsnmp9-dev 5.2.3-7etch2
NET SNMP (Simple Network Management Protocol
I've sent the last portion of the build process to pastebin if you want to
have a look at
http://www.pastebin.org/20301
but the guts of the issue is this
3]: Entering directory
`/usr/src/dsbuild/ds/ldapserver/work/fedora-ds-base-1.1.0'
/bin/sh ./libtool --tag=CC --mode=link gcc -g -o ldap-agent-bin
ldap/servers/snmp/ldap_agent_bin-main.o
ldap/servers/snmp/ldap_agent_bin-ldap-agent.o
ldap/servers/slapd/ldap_agent_bin-agtmmap.o -lssldap60 -lprldap60 -lldap60 -lldif60 -lsasl2 -lssl3 -lnss3 -lsoftokn3 -lplc4 -lplds4 -lnspr4 -L/usr/lib -lnetsnmpmibs -lnetsnmpagent -lnetsnmphelpers -lnetsnmp -lm -ldl -lsensors -lwrap -lwrap
gcc -g -o ldap-agent-bin ldap/servers/snmp/ldap_agent_bin-main.o
ldap/servers/snmp/ldap_agent_bin-ldap-agent.o
ldap/servers/slapd/ldap_agent_bin-agtmmap.o -lssldap60 -lprldap60 -lldap60 -lldif60 /usr/lib/libsasl2.so -lresolv -lssl3 -lnss3 -lsoftokn3 -lplc4 -lplds4 -lnspr4 -L/usr/lib /usr/lib/libnetsnmpmibs.so /usr/lib/libnetsnmpagent.so /usr/lib/libnetsnmphelpers.so /usr/lib/libnetsnmp.so -lcrypto -lm -ldl -lsensors -lwrap
ldap/servers/snmp/ldap_agent_bin-ldap-agent.o: In function `init_ldap_agent':
ldap/servers/snmp/ldap-agent.c:98: undefined reference to `CONTAINER_INSERT'
collect2: ld returned 1 exit status
make[3]: *** [ldap-agent-bin] Error 1
make[3]: Leaving directory
`/usr/src/dsbuild/ds/ldapserver/work/fedora-ds-base-1.1.0'
make[2]: *** [all] Error 2
make[2]: Leaving directory
`/usr/src/dsbuild/ds/ldapserver/work/fedora-ds-base-1.1.0'
make[1]: *** [build-work/fedora-ds-base-1.1.0/Makefile] Error 2
make[1]: Leaving directory `/usr/src/dsbuild/ds/ldapserver'
make: *** [dep-../../ds/ldapserver] Error 2
make[
Any ideas?
Ryan Braun
Informatics Operations
Aviation and Defence Services Division
Chief Information Officer Branch, Environment Canada
CIV: (204) 833-2500x2824 CSN: 257-2824 FAX: (204) 833-2524
E-Mail: Ryan.Braun(a)ec.gc.ca
15 years, 6 months
[Fedora-directory-users] Apple OS X 10.5 question
by John Call
Aloha list,
My university has been authenticating Mac OS X 10.4 clients to FDS
1.04 for about a year now. Things have been working great, as long as
we keep an eye on the external SASL mechanisms. However, now that our
staff is deploying the new OS X 10.5 things aren't working. To the
best of our knowledge we have maintained the same client LDAP
configuration from 10.4 to 10.5, but the Apple clients refuse to
authenticate. Has anybody else experienced this?
Mahalo (thanks),
John Call
15 years, 6 months
[Fedora-directory-users] groups
by solarflow99
I was interested to create groups to use for authenticated access. Say for
instance I configure samba to use FDS, can it actually use those groups to
control permissions? What about the gidnumber? This all the docs had to
say about it:
5.4. Using Groups
Groups are a mechanism for associating entries for ease of administration.
This mechanism was provided with previous versions of Directory Server and
should be used primarily for compatibility with older versions of the
server.
15 years, 6 months
[Fedora-directory-users] Individual Passwordpolicies
by Sujay D'Souza
Hello,
I was wondering if anyone could shed some light on passwordpolicies within FDS
1.0.4.
It is possible to setup individual passwordpolicies within Sun Directory 5.2 and
then assign the specific policy to either a single entry as the value of
passwordPolicySubentry or managing the policy via CoS and roles.
From the FDS documentation, it is possible to apply an individual policy either
globally, user or subtree, but no mention of applying the policy via roles....
Any input would be appreciated.
tia
Sujay
15 years, 7 months
[Fedora-directory-users] Could not register the directory server with the configuration directory server
by Nick P
I am trying to install and configure my first FDS, and first LDAP
server. I have spent many hours with little fruit so far. Currently,
I am receiving an error at the end of the setup-ds-admin script:
[08/02/29:02:37:41] - [Setup] Fatal Could not register the directory
server with the configuration directory server.
The error is similar to what is described in this bug:
https://bugzilla.redhat.com/show_bug.cgi?id=431103. However, my
configuration directory is _not_ on another host. I answered 'no' to
the question of whether I would be registering with a current
configuration server. I don't know if the solution presented there
would work - I am forwarding a port to the server, and do not have a
hostname.domain.org to use there. I have had trouble adding entries,
so if I added them and it didn't fix the problem, I would not know if
the solution failed or if I failed to add the entries properly. The
server is NAT'ed and receiving a forwarded port. so I have been using
mydomain.org for the servername and identifying the port that gets
forwarded.
If you can help me make some sense of this, I would very much
appreciate it. If the workaround in the bug above is the answer,
could you address my specific situation of not having a FQDN with a
host and everything - how will this effect the entries? After failing
to add entries with success many times I have started to use a windows
client, Ldapadmin - could I use this, if the work around is the
solution? Should the entries go in o=netscaperoot or dc=domain,dc=org
?
I am also including a portion of the log file that was created during
the installation. Is there anything here that shows what the root of
the problem is?
Thanks,
Nick
--------------------
+Entry cn=topologyplugin, ou=1.1, ou=Admin, ou=Global Preferences,
ou=admin, o=NetscapeRoot is added
+++check_and_add_entry: Entry not found cn=defaultplugin,
cn=topologyplugin, ou=1.1, ou=Admin, ou=Global Preferences, ou=admin,
o=NetscapeRoot error No such object
+Entry cn=defaultplugin, cn=topologyplugin, ou=1.1, ou=Admin,
ou=Global Preferences, ou=admin, o=NetscapeRoot is added
+++check_and_add_entry: Entry not found cn=UI,ou=1.1, ou=Admin,
ou=Global Preferences, ou=admin, o=NetscapeRoot error No such object
+Entry cn=UI,ou=1.1, ou=Admin, ou=Global Preferences, ou=admin,
o=NetscapeRoot is added
+Processing /usr/share/dirsrv/data/12dsconfig.mod.tmpl ...
+++check_and_add_entry: Found entry cn=config
+++Adding attr=aci value=(targetattr="*")(version 3.0; acl
"Configuration Administrators Group"; allow (all)
groupdn="ldap:///cn=Configuration Administrators, ou=Groups,
ou=TopologyManagement, o=NetscapeRoot";) to entry cn=config
+++Adding attr=aci value=(targetattr="*")(version 3.0; acl
"Configuration Administrator"; allow (all) userdn="ldap:///uid=admin,
ou=Administrators, ou=TopologyManagement, o=NetscapeRoot";) to entry
cn=config
+++Adding attr=aci value=(targetattr = "*")(version 3.0; acl "SIE
Group"; allow (all) groupdn = "ldap:///cn=slapd-server, cn=Fedora
Directory Server, cn=Server Group, cn=server, ou=admin,
o=NetscapeRoot";) to entry cn=config
+++check_and_add_entry: Found entry cn=SNMP,cn=config
+++Adding attr=aci
value=(target="ldap:///cn=SNMP,cn=config")(targetattr !="aci")(version
3.0;acl "snmp";allow (read, search, compare)(userdn =
"ldap:///anyone");) to entry cn=SNMP,cn=config
+++check_and_add_entry: Found entry
oid=2.16.840.1.113730.3.4.9,cn=features,cn=config
+++Adding attr=aci value=(targetattr != "aci")(version 3.0; acl "VLV
Request Control"; allow( read, search, compare, proxy ) userdn =
"ldap:///all";) to entry
oid=2.16.840.1.113730.3.4.9,cn=features,cn=config
+Processing /usr/share/dirsrv/data/13dsschema.mod.tmpl ...
+++check_and_add_entry: Found entry cn=schema
+++Adding attr=aci value=(target="ldap:///cn=schema")(targetattr
!="aci")(version 3.0;acl "anonymous, no acis"; allow (read, search,
compare) userdn = "ldap:///anyone";) to entry cn=schema
+++Adding attr=aci value=(targetattr="*")(version 3.0; acl
"Configuration Administrators Group"; allow (all)
groupdn="ldap:///cn=Configuration Administrators, ou=Groups,
ou=TopologyManagement, o=NetscapeRoot";) to entry cn=schema
+++Adding attr=aci value=(targetattr="*")(version 3.0; acl
"Configuration Administrator"; allow (all)
userdn="ldap:///uid=admin,ou=Administrators, ou=TopologyManagement,
o=NetscapeRoot";) to entry cn=schema
+++Adding attr=aci value=(targetattr = "*")(version 3.0; acl "SIE
Group"; allow (all) groupdn = "ldap:///cn=slapd-server, cn=Fedora
Directory Server, cn=Server Group, cn=server, ou=admin,
o=NetscapeRoot";) to entry cn=schema
+Processing /usr/share/dirsrv/data/14dsmonitor.mod.tmpl ...
+++check_and_add_entry: Found entry cn=monitor
+++Adding attr=aci value=(target ="ldap:///cn=monitor*")(targetattr !=
"aci || connection")(version 3.0; acl "monitor"; allow( read, search,
compare ) userdn = "ldap:///anyone";) to entry cn=monitor
+Processing /usr/share/dirsrv/data/16dssuffixadmin.mod.tmpl ...
+++check_and_add_entry: Entry not found dc=hpconnect,dc=org error No such object
Could not authenticate as user 'uid=admin, ou=Administrators,
ou=TopologyManagement, o=NetscapeRoot' to server
'ldap://server:46645/o=NetscapeRoot'. Error: Invalid credentials
Could not register the directory server with the configuration directory server.
-----------------------------------------------
15 years, 7 months
[Fedora-directory-users] Setting up fault tolerant mesh of FDS servers - just checking I have got it right!
by Howard Wilkinson
Fedora-ds-1.1.1 on Fedora 7 + (the + is back ports from 8/9, all of the
updates applied, and additional packages I have cross ported)
I have succeeded in getting a fault tolerant mesh configured that
consists of 2 or more Multi-Master servers, a number of Hub (0+) and a
number of consumers (0+).
I have done this by modifying mmr.pl to accept --host1_role and
--host2_role parameters which can be set to supplier, hub, or consumer.
For all of the usual DCROOTs i.e. not o=NetscapeRoot I set the
relationships up as implied i.e. supplier<->supplier for the
Multi-Master Hosts, supplier<->hub, hub<->consumer.
Where the site is too small for hub servers I have gone
supplier<->consumer direct. Inter-site topology and hub grouping within
sites is left as an exercise for the reader (me when it comes back to
bite me...)
For the o=Netscape I have chosen to use supplier<->supplier
relationships but to apply the same topology.
Sequence of events are:
* On first Master
1. Install clean environment - erase rpm's delete residual
files, install rpms, patch dirsrv-admin startup to work!
2. Run setup-ds-admin.pl in silent mode, this adds schema
files. The inf file has SlapdConfigMC=1, UseExistingMC=0 and
points ConfigDirectoryLdapURL to this host.
3. Set up SSL certs using certutil commands and openssl
supplied certificates from our CA.
4. Restart dirsrv and dirsrv-admin
5. Create 2nd and subsequent DCROOTS with default aci's and
"standard" container entries
6. Preload data into DCROOTS for users and other objects being
migrated.
* On other servers - doing other masters first, followed by hubs and
then consumers - carry out steps 1-5 above creating the
o=NetscapeRoot DCROOT as well.
o The inf file has SlapdConfigMC=1, UseExistingMC=1 and points
ConfigDirectoryLdapUrl to the first Master
* Then run the mmr.pl script on each connection for each DCROOT
starting with replicating the first master to all other masters,
then to hubs, then other masters to hubs and finally hubs to
consumers.
1. For o=NetscapeRoot run mmr.pl as supplier<->supplier,
otherwise honor the role played by each server.
2. Replace entries in cn=UserDirectory, ou=Global Preferences,
ou=<localdomain>, o=NetscapeRoot for nsDirectoryFailoverList
with one for each server other than the first master which
is mentioned in the nsDirectoryURL entry in the same object.
*Is this the right sort of thing to do?*
3. On every host alter the cn=Pass Through
Authentication,cn=plugins,cn=config object to have
nssslapd-pluginarg0 to reference that host rather than the
first master. *Is this correct on the consumers (or hubs)?
*I am assuming that this is for authentication not for
password modification purposes! Which brings up the question
of where in the consumers and hubs do I put referrals to the
Master(s)?
4. Edit adm.conf on each host to change the ldapurl to point to
the local host.
Now assuming that this was the right thing to do I now need to set up
referrals for writing to the system from the consumers and hubs back to
the "site" masters. Where do I put this information?
I am also getting these errors logged on the first master!
Feb 28 22:00:35 bastion ns-slapd: auxpropfunc error invalid parameter
supplied
Feb 28 22:00:35 bastion ns-slapd: sql_select option missing
Feb 28 22:00:35 bastion ns-slapd: auxpropfunc error no mechanism available
These are appearing about every 15 minutes. Anybody any idea where these
are coming from?
Finally the shutdown time for the dirsrv servers on the suppliers is
extremely long - orders of minutes, what could be causing this?
--
Howard Wilkinson
Phone:
+44(20)76907075
Coherent Technology Limited
Fax:
23 Northampton Square,
Mobile:
+44(7980)639379
United Kingdom, EC1V 0HL
Email:
howard(a)cohtech.com
15 years, 7 months