Syntax error with DNA plugin in 1.2.6
by Mark Plaksin
We have the DNA plugin working fine in 1.2.5. In 1.2.6 we get a syntax
error when we try to create users with uidNumber set to 'magic'. We
configure and use the DNA plugin as described here:
http://www.redhat.com/docs/manuals/dir-server/8.1/admin/dna.html
If I turn on all the debugging it ends up complaining that uidNumber has
a syntax error. As if DNA failed to replace 'magic' with a number.
We've reproduced this by installing both 1.2.5 and 1.2.6 from scratch
and configuring DNA using the same LDIF. 1.2.5 works, 1.2.6 gives the
syntax error.
Do we need to do something extra in 1.2.6?
Thanks!
13 years, 7 months
Syntax validation rejecting DirectoryStrings
by Edward Z. Yang
Hello all,
We are having some difficulties with the new syntax validation built in
to LDAP. Consider the following schema (formatted for
readability):
dn: cn=schema
attributeTypes: ( 1.2.840.113554.4.2.1.1
NAME 'scriptsVhostName'
DESC 'Canonical server name'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE
X-ORIGIN 'scripts.mit.edu' )
attributeTypes: ( 1.2.840.113554.4.2.1.2
NAME 'scriptsVhostAlias'
DESC 'Other server names'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
X-ORIGIN 'scripts.mit.edu' )
attributeTypes: ( 1.2.840.113554.4.2.1.3
NAME 'scriptsVhostDirectory'
DESC 'Directory under $HOME/Scripts/$service for the root of this service'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE
X-ORIGIN 'scripts.mit.edu' )
attributeTypes: ( 1.2.840.113554.4.2.1.4
NAME 'scriptsVhostAccount'
DESC 'User account for finding home direcory and suexec uid/gid'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
SINGLE-VALUE
X-ORIGIN 'scripts.mit.edu' )
objectClasses: ( 1.2.840.113554.4.2.2.1
NAME 'scriptsVhost'
DESC 'Configuration for a scripts virtual host'
SUP top
AUXILIARY
MUST ( scriptsVhostName $ scriptsVhostDirectory $ scriptsVhostAccount )
MAY ( scriptsVhostAlias )
X-ORIGIN 'scripts.mit.edu' )
The syntax validation then rejects a directory entry of the following
form.
0 scriptsVhostName=ezyang.scripts.mit.edu,ou=VirtualHosts,dc=scripts,dc=mit,dc=edu
objectClass: scriptsVhost
objectClass: top
scriptsVhostName: ezyang.scripts.mit.edu
scriptsVhostAlias: ezyang.scripts
scriptsVhostAccount: uid=ezyang,ou=People,dc=scripts,dc=mit,dc=edu
scriptsVhostDirectory:
With the following error:
[16/Sep/2010:14:19:39 -0400] syntax-plugin - Syntax validate task starting (base: "scriptsVhostName=ezyang.scripts.mit.edu,ou=VirtualHosts,dc=scripts,dc=mit,dc=edu", filter: "(objectclass=*)") ...
[16/Sep/2010:14:19:40 -0400] syntax-plugin - Entry "scriptsVhostName=ezyang.scripts.mit.edu,ou=VirtualHosts,dc=scripts,dc=mit,dc=edu" violates syntax.
scriptsVhostDirectory: value #0 invalid per syntax
[16/Sep/2010:14:19:41 -0400] syntax-plugin - Syntax validate task complete. Found 1 invalid entries.
It is difficult for me to tell what value #0 is referring to, but if it
is scriptsVhostName, as far as I can tell it is a perfectly fine DirectoryString.
Is our schema wrong or is there a bug in the syntax validation?
Cheers,
Edward
13 years, 7 months
Using ldclt
by Gerrard Geldenhuis
Hi
I have not been able to get ldclt working. I suspect I am not using it correctly and would appreciate anyone just giving my options a sanity check.
Running the following:
ldclt -h testserver.example.com -p 389 -e bindeach,bindonly -Z /etc/dirsrv/slapd-testserver -e cltcertname=certname,keydbfile=key3.db,keydbpin=password -V
Running that give me an error:
ldclt version 4.23
/usr/bin/ldclt: line 47: 2352 Segmentation fault ${dir}/${COMMAND} "$@"
I have tried both the server and the CA cert names as options n the cltcertname. Some of the CA certs have spaces in so I enclose it in single quotes which then still gives me an segmentation fault
Best Regards
________________________________________________________________________
In order to protect our email recipients, Betfair Group use SkyScan from
MessageLabs to scan all Incoming and Outgoing mail for viruses.
________________________________________________________________________
13 years, 7 months
Re: [389-users] Restoring a completely broken machine that is using a shared netscapedb
by Prashanth Sundaram
Gerrad,
Here is some documentation on Disaster recovery.
http://www.redhat.com/docs/manuals/dir-server/8.2/admin/html/disaster-rec...
Basically the steps are correct, but when I was in that situation I
pointed the ldap to our then stand-by server. The reason was, I could
not completely recover from the backup as I had replication setup for
admin-server(netscaperoot) and when I tried to restore I got weird
messages. This was just my experience, but I am sure the recovery must
be simple.
Few things I find hard in the backup and recovery is SSL certs,
Replication and the order in which you should recover, automated backups
and indexing and backup do not go well together when running at same
time.
>Hi
>I was wandering if anyone can share some tips on how to restore a
>machine that is using a shared/replicated netscapedb.
>
>If I loose the server and need to rebuild the hardware how would I
>"plug" the server back in?
>
>The steps as I think they should be done without having tested it yet
>is:
>Install 389 dir server rpms ( same version as other servers )
>Make backup of netscapedb on any other server.
>Restore it on the server
>Copy backed-up dse.ldif
>Re-initialize userdb
>
>I am still reading about all the backup commands so the above is
>conceptually what I believe needs doing.
>
>Any comments would be appreciated.
>
>Best Regards
13 years, 7 months
Debug PTA and PAM-PTA stack for ldap timeout
by Prashanth Sundaram
Hello,
We are having some ldap timeout issues in out MMR-SLAVE ldap setup. A
user is unable to ssh to random hosts at random times.
Terminal Error: Permission denied (publickey,gssapi-with-mic,password)
secure logs: pam_ldap: ldap_result Timed out
Failed password for psundaram from 10.1.0.120 port 22039
ssh2
Sifting thru logs tell the user's password was successfully
authenticated upstream by looking at dirsrv access log with err=0. The
clients connecting to slave incur regular timeouts and the login fails
but it is not case with clients connecting to Master directly.
Setup: Two Masters with MMR, Two Slaves with MMR. The authentication for
clients connecting to the slave ldap server goes to the master via PTA
plugin and then from Master it goes to Windows AD via PAM-PTA.
Client----->Slave--(PTA)-->Master--(PAM-PTA)-->AD(This is where all
passwords are)
I understand we have might have a long traversal for the authentication,
but we have set considerably high timeout limits.
/etc/ldap.conf
timelimit 120
bind_timelimit 5
bind_policy hard
idle_timelimit 3600
slave ldap server
nsslapd-idletimeout: 86400
nsbindtimeout: 15
nsslapd-timelimit: 3600
Master ldap server
nsslapd-idletimeout: 7200
nsbindtimeout: 15
nsslapd-timelimit: 3600
Anybody had similar issue or can share some debugging tips?
-Prashanth
13 years, 7 months
Restoring a completely broken machine that is using a shared netscapedb
by Gerrard Geldenhuis
Hi
I was wandering if anyone can share some tips on how to restore a machine that is using a shared/replicated netscapedb.
If I loose the server and need to rebuild the hardware how would I "plug" the server back in?
The steps as I think they should be done without having tested it yet is:
Install 389 dir server rpms ( same version as other servers )
Make backup of netscapedb on any other server.
Restore it on the server
Copy backed-up dse.ldif
Re-initialize userdb
I am still reading about all the backup commands so the above is conceptually what I believe needs doing.
Any comments would be appreciated.
Best Regards
________________________________________________________________________
In order to protect our email recipients, Betfair Group use SkyScan from
MessageLabs to scan all Incoming and Outgoing mail for viruses.
________________________________________________________________________
13 years, 7 months
GOSA as a frontend for the 389 Directory Server?
by Stefan-Michael Guenther
Hello,
one of our clients wants to use GOSA (https://oss.gonicus.de/labs/gosa/)
as a frontend for the 389 DS.
I found a number of postings that configuring GOSA to work with the 398
DS isn't easy.
Therefore my question is whether anyone has a working combination and
might publish a howto on it?
Otherwise I would have to find my way through it and write the docu on it.
Thanks for any hints & suggestions,
Stefan
13 years, 7 months
389 as authentication server on Fedora 13 #389 #ldap @Skolan
by Lars Gunther
Hi all
I am new to this list and need help setting up an authentication server
for an all Linux network. I previously used OpenLDAP, but think it is
very complicated to set up and use, so I am giving 389 a try.
However, things are not going great...
I am running a network where users should have access both through SSH
to the servrer and be able to log in on a local machine to a roaming
profile. /home is shared via NFS.
Both the server and all clients are running Fedora 13.
389 is installed and running. I can query the server and using the admin
tools I was able to import an old account saved as LDIF.
However, the following does not work:
1. The user I imported can not authenticate. I think that I need to set
up 389 to use encryption with ldaps (Fedora 13 does not allow
unencrypted passwords, which I used earlier since this net was
experimental, isolated and contains no sensitive information).
2. I can not import old posixGroups, nor can I create new ones. Trying
to import using LDIF, I get errors. Trying to create manually, I do not
see the option appear in the admin tool.
I wish there was a guide that did provide exactly the steps I need to
set up my server and network. The manual is good, but frankly I do not
understand it well enough and lots of information is redundant to my needs.
When I've gotten this to work, I intend to write such a guide! But
perhaps someone on this list could point me in the right direction...)
BTW, please CC my Evernote account when you reply to this thread.
--
Lars Gunther
http://keryx.se/
http://twitter.com/itpastorn/
http://itpastorn.blogspot.com/
13 years, 7 months