Windows Sync
by Phil Daws
Hi,
We have a Windows replication agreement in place which works great; plus we are using the PassSync on the Windows server itself. The issue we have is that when somebody changed their password on the Windows server it has got stuck due to a Constraint Violation on previous passwords and this is stopping any further password changes from that user. Is there anyway to remove that entry from a database somewhere ? I am guessing it may be secmod.db on the Windows server ?
--
Thanks, Phil
12 years, 10 months
How to let users change their passwords?
by Steven Truong
Dear, all. I have been searched low and high for a tool that can let
users to change their passwords in 389 DS or OpenLDAP? I think there
is a real need for such a tool and I hope that people already wrote
such a tool...
Please share your ways of how you allow your users to change their
passwords or other setup/architecture that allow this function.
Beside that, I also recommend Apache Studio as a great tool to work
with LDAP servers.....
Thank you in advance.
12 years, 10 months
new 00core.ldif break other ldif
by Roberto Polli
Hi all,
it seems that the new 00core.ldif doesn't contain the NAME alias for the
fields (eg. "cn" "commonName")
it cause other old ldif not to work under new releases of fds.
Why are the aliases have been removed?
Thx+Peace,
R.
--
Roberto Polli
Babel S.r.l. - http://www.babel.it
Tel. +39.06.91801075 - fax +39.06.91612446
Tel. cel +39.340.6522736
P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma)
"Il seguente messaggio contiene informazioni riservate. Qualora questo
messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene
notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio
erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto
della legge in materia di protezione dei dati personali."
12 years, 10 months
'mail' attribute is now case-sensitive?
by Dael Maselli
Hi,
I installed a new 389 (389-ds-base-1.2.5-1.el5.x86_64) to replace the
old FDS (fedora-ds-base-1.1.3-2.fc6.x86_64) and migrated the content.
Now I realize that search behavior on 'mail' has changed, the old was
case-insensitive and now is case-SENSITIVE.
Schema definition on FDS was in 01common.ldif:
attributeTypes: ( 0.9.2342.19200300.100.1.3 NAME ( 'mail'
'rfc822mailbox' ) DESC 'Standard LDAP attribute type' SYNTAX
1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 1274' )
on 389 is in 05rfc4524.ldif:
attributeTypes: ( 0.9.2342.19200300.100.1.3 NAME 'mail'
EQUALITY caseIgnoreIA5Match
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
X-ORIGIN 'RFC 4524' )
Is the case-sensitive the right behavior?
What's the meaning of caseIgnoreIA5Match then?
^^^^^^
Is there any method to get back the old (useful) case-insensitive behavior?
Thank you.
Regards,
Dael.
--
___________________________________________________________________
Dael Maselli --- INFN-LNF Computing Service -- +39.06.9403.2214
___________________________________________________________________
* Il Buco Nero * http://www.buconero.eu *
___________________________________________________________________
Democracy is two wolves and a lamb voting on what to have for lunch
___________________________________________________________________
12 years, 10 months
Preventing ssh keys from granting a user access when LDAP account is disabled.
by Gerrard Geldenhuis
Hi
There is a bugzilla raised concerns users still being able to login if they have ssh keys even if there ldap account is disabled.
https://bugzilla.redhat.com/show_bug.cgi?id=455350
I have experimented a bit in PAM with ordering to try and find a solution but so far I have not been very successful. The solution/bugfix in the bugzilla is to store authorized keys centrally in LDAP. I was wondering that apart from that solution is there any other suggested solution or way of configuring PAM to disallow a person login when his/her account is disabled?
Regards
________________________________________________________________________
In order to protect our email recipients, Betfair Group use SkyScan from
MessageLabs to scan all Incoming and Outgoing mail for viruses.
________________________________________________________________________
12 years, 10 months
Large amount of users in Directory causes timeouts on client login.
by Gerrard Geldenhuis
Hi
I have just created 20 000 users each with a private group on two masters 10 000 on each master, with the purpose of testing replication between two masters.
I did not observe any errors in access log and there is no errors logged in the error log for either of the servers.
I am seeing strange behavior though.... firstly a getent only returns 2028 rows according the wc. That is not a problem as I am aware that there is a setting somewhere that limits search size.
What is strange though is that trying to login as any user just times out on me.
if I do su - testuser39043 on a client machine
pam creates the home directory but then nothing happens ( I have configured pam to create a home dir when it does not exist)
I have the following errors in /var/log/messages
Jul 21 16:19:32 client01 -bash: nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)...
Jul 21 16:19:37 client01 -bash: nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)...
Jul 21 16:19:45 client01 -bash: nss_ldap: reconnecting to LDAP server (sleeping 16 seconds)...
Eventually after a while I get the following login:
[I have no name!@client01 ~]$
with this error message before hand:
id: cannot find name for user ID 7280
When I try to su - randomname I get an immediate response back to say that the user does not exist which is true.
The console is also behaving in a strange way. I can see a number of users ( i have not increase the default limit of returned users in the console ) and when I double click on a user I get the relevant information back. However if I do a search for the same user by right clicking on people and typing in the username I don't get any results returned. When I retested the behavior for writing the email the behaviour has changed so I can now find a user when searching for it in the console but I still can't login to a box.
The two masters have almost no CPU load and is not swapping. They are virtualboxes with only 500mb ram so maybe that is the source of the problem...
I can see the request in the log file on the master server when I do a su - username on the client server but the information never gets returned back to pam.
Any thoughts or steering in the right direction would be appreciated.
The documentation states a few default indexes that gets created and I would have thought that these would be adequate for effectively finding a user in a larger database.
Regards
________________________________________________________________________
In order to protect our email recipients, Betfair Group use SkyScan from
MessageLabs to scan all Incoming and Outgoing mail for viruses.
________________________________________________________________________
12 years, 10 months
389 DS 1.2.5 on RHEL VM
by Barry Sitompul
Hi All,
Has anyone had the experience of running the DS on a VM?
I've got one set up running on a RHEL VM and it looks like the virtual
memory usage keeps going up and stays up with every LDAP query (I just
use top).
I'm not sure if this is caused by the application problem or this is
expected RHEL behaviour?
Any help is much appreciated!
Thanks!
Bazza
12 years, 10 months
Error initializing server
by Juan Asensio Sánchez
Hi
I am having trouble initializaing a server. That server has some replicas in
r/o mode, as hub, and one as multimaster. When I try to initialize the
multimaster database of this server from another server that has also that
database in multimaster mode, I get these errors:
[12/Jul/2010:13:08:52 +0200] NSMMReplicationPlugin -
multimaster_be_state_change: replica o=XXX,dc=XXXX,dc=es is going offline;
disabling replication
[12/Jul/2010:13:09:20 +0200] - WARNING: Import is running with
nsslapd-db-private-import-mem on; No other process is allowed to access the
database
[12/Jul/2010:13:09:26 +0200] - ERROR bulk import abandoned
[12/Jul/2010:13:09:26 +0200] - import o_XXXX_dc_XXXX_dc_es: Aborting all
import threads...
[12/Jul/2010:13:09:32 +0200] - import o_XXXX_dc_XXXX_dc_es: Import threads
aborted.
[12/Jul/2010:13:09:32 +0200] - import o_XXXX_dc_XXXX_dc_es: Closing files...
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/nscpEntryDN.db4:
unable to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/mail.db4: unable
to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/givenName.db4:
unable to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/nsuniqueid.db4:
unable to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/memberOf.db4:
unable to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/ntUniqueId.db4:
unable to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/member.db4:
unable to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb:
o_XXXX_dc_XXXX_dc_es/ntUserDomainId.db4: unable to flush: No such file or
directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/objectclass.db4:
unable to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/cn.db4: unable to
flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/aci.db4: unable
to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/seeAlso.db4:
unable to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/sn.db4: unable to
flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb:
o_XXXX_dc_XXXX_dc_es/telephoneNumber.db4: unable to flush: No such file or
directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/uid.db4: unable
to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/uniquemember.db4:
unable to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/parentid.db4:
unable to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/entrydn.db4:
unable to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - libdb: o_XXXX_dc_XXXX_dc_es/id2entry.db4:
unable to flush: No such file or directory
[12/Jul/2010:13:09:32 +0200] - import o_XXXX_dc_XXXX_dc_es: Import failed.
[12/Jul/2010:13:09:33 +0200] - process_bulk_import_op: NULL backend
[12/Jul/2010:13:09:34 +0200] NSMMReplicationPlugin -
replica_replace_ruv_tombstone: failed to update replication update vector
for replica o=XXXX,dc=XXXX,dc=es: LDAP error - 1
[12/Jul/2010:13:09:38 +0200] NSMMReplicationPlugin -
replica_replace_ruv_tombstone: failed to update replication update vector
for replica o=XXXX,dc=XXXX,dc=es: LDAP error - 1
[12/Jul/2010:13:09:41 +0200] NSMMReplicationPlugin -
replica_replace_ruv_tombstone: failed to update replication update vector
for replica o=XXXX,dc=XXXX,dc=es: LDAP error - 1
And the last message is repeating continiously. Also, the folder for that
database in /var/lib/dirsrv/db/o_XXXX_dc_XXXX_dc_es, is removed, although is
recreated when the server is restarted. So I can not initialize that
database (the other hub replicas work fine).
It looks the same as
http://www.redhat.com/archives/fedora-directory-users/2007-March/msg00100...,
which has not any definitive solution.
Using CentOS 5.4 and 389 DS 1.2.5.
Regards.
12 years, 10 months
Announcing 389 Directory Server 1.2.6 Release Candidate 1
by Rich Megginson
The 389 team is pleased to announce the availability of Release
Candidate 1 of version 1.2.6. This release a couple of bug fixes.
***We need your help! Please help us test this software.*** It is a
release candidate, so it may have a few glitches, but it has been tested
for regressions and for new feature bugs. The Fedora system
strongly encourages packages to be in Testing until verified and pushed
to Stable. If we don't get any feedback while the packages are in
Testing, the packages will remain in limbo, or get pushed to Stable.
The more testing we get, the faster we can release these packages to
Stable. See the Release Notes for information about how to provide
testing feedback (or just send an email to
389-users(a)lists.fedoraproject.org).
The packages that need testing are:
* 389-ds-base-1.2.6.rc1 - 389-ds-base
* 389-admin-1.1.11.rc1 - 389-admin
There are some new console/java packages too, and there is a new version
of the 389-ds "meta" package - 1.2.1
* Release Notes - http://port389.org/wiki/Release_Notes
* Install_Guide - http://port389.org/wiki/Install_Guide
* Download - http://port389.org/wiki/Download
=== Bugs Fixed ===
This release contains a couple of bug fixes. The complete list of bugs
fixed is found at the link below. Note that bugs marked as MODIFIED
have been fixed but are still in testing.
* Tracking bug for 1.2.6 release -
https://bugzilla.redhat.com/showdependencytree.cgi?id=543590&hide_resolved=0
12 years, 10 months
problem with re-installation of 389-ds
by Martial TADJO
Hi,
I got some problems with my 389-ds and I decided to re-install it by deleting some directories (/etc/dirsrv, /var/lib/dirsrv, /var/run/dirsrv, etc..), removing the package with "yum remove 389-ds" and installing a new one "yum install 389-ds.
When i start the configuration with the following script : setup-ds-admin.pl, i have the following error at the end of configuration:
Are you ready to set up your servers? [yes]:
Creating directory server . . .
Could not copy file '/etc/dirsrv/config/certmap.conf' to '/etc/dirsrv/slapd-kangourous/certmap.conf'. Error: No such file or directory
Error: Could not create directory server instance 'kangourous'.
Exiting . . .
Log file is '/tmp/setup0m9X6x.log'
Could anyone help me ?
Thanks in advance.
---------------
Elie MABO
12 years, 10 months