Bug related to file descriptors
by Jazcek Braden
I am having an issue with running 398 server on fedora core 14 using
the default packages (389 1.2.7.5-1).
What is happening is that every once and a while a client gets
disconnected with a T2 error, after that happens no new connections
can be made to the server until the server is restart, all existing
connections continue to work as expected. Reading only the access log
messages it looks like it might have something to do with the fd
handle. I only say this because once the first disconnect occurs, the
conn number is incremented by the fd number isn't and any connection
that tries to use the fd increment has an error. I was wondering if
any body can suggest the logging options on how to diagnose this
better or if this is a known bug in this version of 389 server. Below
is an exceprt from the access logs.
[06/Jan/2011:21:29:11 -0700] conn=473 op=-1 fd=81 closed - T2
[06/Jan/2011:21:38:36 -0700] conn=490 fd=81 slot=81 connection from 10.128.0.142
to 10.128.0.129
[06/Jan/2011:21:38:37 -0700] conn=490 op=-1 fd=81 closed - T2
[06/Jan/2011:21:38:38 -0700] conn=491 fd=81 slot=81 connection from 10.128.0.142
to 10.128.0.129
[06/Jan/2011:21:38:38 -0700] conn=491 op=-1 fd=81 closed - T2
...repeats until server is restarted...
--
Jazcek Braden
12 years, 2 months
Resetting user passwords
by harry.devine@faa.gov
In my 389-ds setup, I have a password policy in place where the user must
change their password after a reset, they are allowed to change their
password, and it expires after 90 days. However, I cannot find where the
Directory Manager can actually RESET a user's password. The docs are very
vague in this area IMO, so I'm sure I overlooked it.
Where do I go in the console to reset a particular user's password so they
will be prompted to change it when they log in again?
Thanks,
Harry
Harry Devine
Common ARTS Software Development
AJT-144
(609)485-4218
Harry.Devine(a)faa.gov
12 years, 2 months
Simple AD password sync?
by Gary Algier
I am looking for simple AD password sync solution.
I think there was once one as part of this project. It was to be installed on
all DCs and would send password updates to any LDAP server. Now this project
seems to use one that requires a replication agreement and it only supports
this server.
While I may be interested in switching to the 389 server at some point, we are
currently using the Sun directory server (5.2) and I need more time to
evaluate what that will entail. In the mean time I need to get password
syncing working as we want to pull the plug on Oracle's Identity Management
Suite (OIM) which is currently doing this function along with lots of other
unnecessary things.
Can anyone point me to where to find the old password sync tool? Or is there
a way to use the current one without replication, etc?
Thanks,
Gary
--
Gary Algier, WB2FWZ gaa at ulticom.com +1 856 787 2758
Ulticom Inc., 1020 Briggs Rd, Mt. Laurel, NJ 08054 Fax:+1 856 866 2033
Nielsen's First Law of Computer Manuals:
People don't read documentation voluntarily.
12 years, 2 months
Questions about groups and group IDs
by harry.devine@faa.gov
We are planning out how we are going to move from Active Directory to
389-ds. We can add users to our test environment successfully, and give
the accounts the proper information (uid, shell, etc.). However, 1 area
that we are getting stumped at is groups. In our Active Directory
currently, we have several groups that we put our users into based on
their function.
Those groups have unique group IDs. However, when I make a group on
389-ds, I don't have any way of specifying a group ID. I can make a new
user and give it a group ID by default, but that group ID doesn't exist
anywhere and I can't find where to assign it or create it. Any ideas on
this?
Thanks,
Harry
Harry Devine
Common ARTS Software Development
AJT-144
(609)485-4218
Harry.Devine(a)faa.gov
12 years, 2 months
Re: [389-users] Questions about groups and group IDs
by Tim Warren
Or just create your own schema extension to cover what you need. Its very easy to accomplish as long as you plan it right. Coming from AD land you're probably convinced to stay in the "box" that ms constrains you into but its very doable. If your converting just use the same or near the same data type for group ID and naming. it makes it that much easier to port your app over to the new environment. There are differences in the way 389 and AD behave but its not that big and can be overcome easily to ease app migration.
From: Angel Bosch Mora <angbosch(a)conselldemallorca.net>
To: General discussion list for the 389 Directory server project. <389-users(a)lists.fedoraproject.org>
Cc:
Sent: Friday, January 7, 2011 7:57:00 PM
Subject: Re: [389-users] Questions about groups and group IDs
----- Missatge original -----
> We are planning out how we are going to move from Active Directory to
> 389-ds. We can add users to our test environment successfully, and
> give the accounts the proper information (uid, shell, etc.). However,
> 1 area that we are getting stumped at is groups. In our Active
> Directory currently, we have several groups that we put our users into
> based on their function.
>
> Those groups have unique group IDs. However, when I make a group on
> 389-ds, I don't have any way of specifying a group ID. I can make a
> new user and give it a group ID by default, but that group ID doesn't
> exist anywhere and I can't find where to assign it or create it. Any
> ideas on this?
>
you need to use objectClass: posixGroup in your group template. in theory posixGroup and groupOfNames are structural object classes and cannot be combined, but in practice there's a variation of the RFC that allows to use posixGroup as auxiliar.
http://osdir.com/ml/ldap.umich/2006-07/msg00015.html
regards,
abosch
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
12 years, 2 months
Admin server won't start after upgrade from 1.1.10-1 to 1.1.13-1
by Jason Solan
We've recently run yum upgrade to update the 389 packages from EPEL.
Using Centos 5.5 i386.
Previous package versions were:
389-ds-console-1.2.0-5.el5
389-ds-base-1.2.5-1.el5
389-admin-console-doc-1.1.4-3.el5
389-admin-console-1.1.4-3.el5
389-ds-1.1.3-6.el5
389-admin-1.1.10-1.el5
389-dsgw-1.1.4-1.el5
389-console-1.1.3-6.el5
389-ds-console-doc-1.2.0-5.el5
The new package versions are:
389-dsgw-1.1.6-1.el5
389-ds-console-doc-1.2.3-1.el5
389-ds-base-1.2.7.5-1.el5
389-ds-console-1.2.3-1.el5
389-adminutil-1.1.13-1.el5
389-console-1.1.4-1.el5
389-admin-console-1.1.5-1.el5
389-ds-1.2.1-1.el5
389-admin-console-doc-1.1.5-1.el5
389-admin-1.1.13-1.el5
After upgrading packages we ran
setup-ds-admin.pl -u
After trying to restart the services, the admin server times out and
will not start.
The directory server itself seems to be working ok. Connecting to it
using an ldap browser shows that the data is there as we expected.
The only errors we seem to be getting in the admin logs are:
[Fri Jan 07 12:24:43 2011] [notice] Access Host filter is: *.domain.com
[Fri Jan 07 12:24:43 2011] [notice] Access Address filter is: *
[Fri Jan 07 12:24:43 2011] [notice] Unable to shutdown NSS - still busy
- assume mod_nss is holding references - continuing
[Fri Jan 07 12:24:43 2011] [error] NSS_Shutdown failed: -8038
[Fri Jan 07 12:24:44 2011] [error] NSS initialization failed.
Certificate database: /etc/dirsrv/admin-serv.
[Fri Jan 07 12:24:44 2011] [error] SSL Library Error: -8038 Unknown
Any help would be appreciated.
12 years, 2 months
Can't access auto.master directory entries in console
by Orion Poplawski
In 389-console, my auto.master folder entry does not appear on the left pane
so I can't edit the entries in it. It does appear as a folder icon on the
right. Any ideas why this would be? File a bug?
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA/CoRA Division FAX: 303-415-9702
3380 Mitchell Lane orion(a)cora.nwra.com
Boulder, CO 80301 http://www.cora.nwra.com
12 years, 2 months
Cannot login as cn=Directory Manager
by harry.devine@faa.gov
I've been away from my 389-ds admin for a few months (I'm just starting to
get familiar with it), and I can't login using the user ID "cn=Directory
Manager". A few months ago I could using the GUI 389-console application.
But today I can't. It keeps saying:
"Can't login because of an incorrect User ID, Incorrect password, or
Directory problem."
The error log shows: "[error] [client 127.0.0.1] user cn=Directory Manager
not found: /admin-serv/authenticate"
I am able to get data back when I enter: "ldapsearch -x -b o=netscaperoot
-D "cn=Directory Manager" -w <password> "objectclass=nsAdminConfig"" from
the command line, so I know that the password is correct.
Any thoughts on what to do to fix this?
Thanks!
Harry
Harry Devine
Common ARTS Software Development
AJT-144
(609)485-4218
Harry.Devine(a)faa.gov
12 years, 2 months
Re: [389-users] memory allocator - calloc of 4098 elems of 4 bytes failed; OS error 12 (Cannot allocate memory)
by Rich Megginson
On 01/04/2011 11:27 PM, mahao wrote:
>
> Hi,
>
> Thanks for your letter.
>
> This fedora-ds version is :
>
> nsslapd-versionstring: Fedora-Directory/1.0.4.
>
> And platform :
>
> LSB Version:
> :core-3.1-amd64:core-3.1-ia32:core-3.1-noarch:graphics-3.1-amd64:graphics-3.1-ia32:graphics-3.1-noarch
>
> Distributor ID: RedHatEnterpriseServer
>
> Description: Red Hat Enterprise Linux Server release 5.5 (Tikanga)
>
> Release: 5.5
>
> Codename: Tikanga
>
> Linux esjirp64.emea.nsn-net.net 2.6.18-164.6.1.el5 #1 SMP Tue Oct 27
> 11:28:30 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
>
> I have pasted config.ldif of my fedora-ds server in attachment.
>
> You said its ran out of memory, but the next day morning after
> fedora-ds was crashed, I checked cacti monitor of memory, memory and
> cpu usage rate was on a normal level , far from exhausted.
>
> And after I restart fedora-ds server 2 hours without changing any
> configuration, there was no response from ldap server but the process
> was running and 389 port was listened. And this time no errors were
> written into error log. I had to restart it again and it have been
> working fine from then on.
>
> Do you have any idea of this?
>
> Thank you for your advice.
>
Not sure. Looks like all of your cache settings are the default values.
I suppose it could be a memory leak.
I suggest upgrading to 389 1.2.7.5 available from EPEL. Even if that
does not solve your problem, it will be much easier to support.
>
> Best Regards
>
> Ma Hao
>
> *From:*Rich Megginson [mailto:rmeggins@redhat.com]
> *Sent:* 2011年1月5日1:07
> *To:* mahao
> *Cc:* 389-users(a)lists.fedoraproject.org
> *Subject:* Re: memory allocator - calloc of 4098 elems of 4 bytes
> failed; OS error 12 (Cannot allocate memory)
>
> On 12/24/2010 12:15 AM, mahao wrote:
>
> Hi all,
>
> Fedora-ds was down for some reason,
>
> And I got these logs:
>
> [23/Dec/2010:18:59:32 +0200] - libdb: User-specified malloc function
> returned NULL
>
> [23/Dec/2010:18:59:32 +0200] - id2entry error 12
>
> [23/Dec/2010:18:59:32 +0200] - id2entry get error 12
>
> [23/Dec/2010:18:59:32 +0200] - next_search_entry db err 12
>
> [23/Dec/2010:18:59:32 +0200] memory allocator - calloc of 4098 elems
> of 4 bytes failed; OS error 12 (Cannot allocate memory)
>
> The server has probably allocated all available virtual memory. To solve
>
> this problem, make more virtual memory available to your server, or reduce
>
> one or more of the following server configuration settings:
>
> nsslapd-cachesize (Database Settings - Maximum entries in cache)
>
> nsslapd-cachememsize (Database Settings - Memory available for cache)
>
> nsslapd-dbcachesize (LDBM Plug-in Settings - Maximum cache size)
>
> nsslapd-import-cachesize (LDBM Plug-in Settings - Import cache size).
>
> Can't recover; calling exit(1).
>
> It looks like no more available virtual memory to use, so should I set
> a lager nsslapd-dbcachesize?
>
> I don't know if it will down again, and please give me some advice .
> its important to me. Thanks a lot
>
> What version of fedora-ds or 389-ds-base?
> What platform?
>
> This usually means you have run out of memory. The usual thing is to
> reduce your cache sizes (as specified above). Start with
> nsslapd-dbcachesize as the minimum. Set nsslapd-cachememsize to be
> large enough to cache all of your entries, but no larger.
>
> BS
>
> Ma Hao
>
12 years, 2 months
Multiple suffixes in 1 database
by Juan Asensio Sánchez
Hi
I am trying to setup a test environment where each database should
contain multiple suffixes. I have 6 organizations:
- o=a1,dc=org,dc=net
- o=a2,dc=org,dc=net
- o=b1,dc=org,dc=net
- o=b2,dc=org,dc=net
- o=c1,dc=org,dc=net
- o=c2,dc=org,dc=net
a1 and a2, should belong to userRoot, which is "mastered" in server1,
b1 and b2 should belog to database px02, which is mastered in server2,
and so with c1 and c2. Is this possible to do? I am trying to do it,
creating a new sub-suffix b1, allowing the console to autocreate
database px02. Then I create a new sub-suffix b2, without creating any
database. Then, i try to assing the database px02 previously created,
but i get an error in the console, and in the logs: "ERROR: backend
px_02 is already pointed to by a mapping tree node. Only one mapping
tree node can point to a backend", so I think this is not possible.
Any ideas?
CentOS 5.5 + 389-ds-base-1.2.6.1-2.el5
Regards.
12 years, 2 months