SSL Question
by Cawley, Chris
Hello -
We are in the process of setting up SSL on 389 ds; however,
it appears that the CA cert db is empty. The builtin tokens
are not even loaded. Any ideas why?
- Thanks
Chris Cawley
System Administrator
Washington Research Library Consortium
301-390-2049
cawley(a)wrlc.org
11 years, 5 months
Replication issue
by Reinhard Nappert
Hi,
I encountered the following logs in the errors:
[06/Oct/2011:10:11:57 +0000] NSMMReplicationPlugin - changelog program - agmt="cn=srvAtosrvB" (srvB:389): CSN 4e8d804a0000000c0000 not found, we aren't as up to date, or we purged
[06/Oct/2011:10:11:57 +0000] NSMMReplicationPlugin - agmt="cn=srvAtosrvB" (srvB:389): Data required to update replica has been purged. The replica must be reinitialized.
[06/Oct/2011:10:11:57 +0000] NSMMReplicationPlugin - agmt="cn=srvAtosrvB" (srvB:389): Incremental update failed and requires administrator action
Does anyone have an idea, what could have caused this and more importantly, how to fix this?
Thanks
-Reinhard
11 years, 5 months
GUI console fails to show up after upgrade
by harry.devine@faa.gov
We are running a 64-bit CentOS that used to be on 5.4, but a few days ago
we put patches on it which brought it up to 5.7. It also updated our
389-ds to the following versions:
rpm -qa 389*
389-dsgw-1.1.7-2.el5
389-ds-base-1.2.9.9-1.el5
389-ds-console-1.2.6-1.el5
389-admin-console-1.1.8-1.el5
389-admin-1.1.23-1.el5
389-ds-console-doc-1.2.6-1.el5
389-ds-base-libs-1.2.9.9-1.el5
389-console-1.1.7-3.el5
389-admin-console-doc-1.1.8-1.el5
389-adminutil-1.1.14-1.el5
389-ds-1.2.1-1.el5
When I try to run the 389-console application now (a user needs his
password reset), I get the following errors:
389-console
Exception in thread "main" java.lang.ClassFormatError:
com.netscape.management.client.console.Console (unrecognized class file
version)
at java.lang.VMClassLoader.defineClass(libgcj.so.7rh)
at java.lang.ClassLoader.defineClass(libgcj.so.7rh)
at java.security.SecureClassLoader.defineClass(libgcj.so.7rh)
at java.net.URLClassLoader.findClass(libgcj.so.7rh)
at java.lang.ClassLoader.loadClass(libgcj.so.7rh)
at java.lang.ClassLoader.loadClass(libgcj.so.7rh)
at gnu.java.lang.MainThread.run(libgcj.so.7rh)
Any ideas on how to fix this?
Harry Devine
Common ARTS Software Development
AJT-144
(609)485-4218
Harry.Devine(a)faa.gov
11 years, 5 months
Configure access log
by Moisés Barba Pérez
*HI,
I'm doing a backup for mi access logs in several ldap servers and I have
found that some of this logs have been deleted because of rotation info. The
thing is, I want to save all the access log generated in a day in files of
100MB. I have searched the way to do it and now I have to set the maximum
size of the combined archived logs to -1, but I don't know if I can set -1
to the **maximum number of logs for the directory to keep. Is this possible?
Regards,
Moses
*
11 years, 5 months
389 pauses every 5 minutes under load
by Justin Gronfur
Hello all,
I need your expertise... please help me! (Disclaimer: I am a relative
newcomer to 389ds)
I'm running a Java application that keeps user authentication,
permissions, and preferences in ldap. And I'm currently load testing
this application (using Jmeter, 15 concurrent threads, no think time)
and I'm getting really good performance most of the time. However every
5 minutes (from the time I started ldap), 389's CPU usage will spike to
375% (400% = all 4 processors at 100%, 389 normally sits around
15-20%). These pauses last for between 20 - 30 seconds (proportionate
to the load I'm throwing at it) during which our application will just
sit. Since I'm just running the same set of requests at it constantly,
there isn't anything different in terms of our application during those
times, which points to 389 as the culprit (or possibly some glassfish
ldap pool problem).
Some info:
Glassfish 3.1 final on Java 1.6.0_26 (64 bit server VM)
389-Directory/1.2.9.10 B2011.250.1455
Fedora 15 64-bit (also observed on Centos 5.4 64-bit)
Have any of you run into this problem? Do you have any possible config
changes I could try? Any possible leads at all?
Thanks,
Justin
11 years, 5 months
Certificate based authentication
by Gerhardus Geldenhuis
Hi
I am looking at doing certifcate based authentication using 389. The company
where I am working currently issues a certificate for every new starter and
these certs are well managed with regards to sensible expiry dates etc. This
cert is your key to the whole environment and a lot of the applications like
jira/confluence authenticate you based on your certificate.
I have read through the documentation:
http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html/Admin...
and it seems to suggest that it is nessesary to convert the user certificate
and upload it into 389 db. This seems a bit of a duplication. Is there
anyway to "talk" to the certificate provider to ascertain the validity or
not of a certificate and obtain any other required information, rather than
having a copy of the certificate in the database. The documentation also
does not say whether this is the public or private part of
the certificate that needs to be uploaded. I am assuming it is the public
part.
The second part of the question is how would this work with regards to ssh
authentication. Somehow via pam and ssh the certificate must be passed on to
389 when the authentication happens. I am not sure this is currently
possible with pam but would be interested in any suggestions to achieve
something like this.
Regards
--
Gerhardus Geldenhuis
11 years, 5 months
sendmail LDAP routing
by Orion Poplawski
Looks like 389 doesn't by default have the LDAP Schema for Intranet Mail
Routing schema defined which uses objectClass inetLocalMailRecipient. Any
particular reason for this? Is there a more useful schema?
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA/CoRA Division FAX: 303-415-9702
3380 Mitchell Lane orion(a)cora.nwra.com
Boulder, CO 80301 http://www.cora.nwra.com
11 years, 5 months
389 Console & setup SSL with MMR
by Pieter Baele
Hi,
I used 389 Directory Server in the past.... but it has been a long time...
Problem 1:
---------------
When I start 389-console on top of an ssh session with X, I can't use
the input boxes...
(solved by a local installation of 389-ds but...)
Problem 2:
---------------
I see for an easy setup of multimaster replication with SSL, I can
still use setupssl2.sh and mmr.pl
scripts :-)
But what's the right order?
After setup-ds-admin.pl I first ran setupssl2.sh and then I tried to setup mmr.
I've this fault when I choose --with-ssl.... (replication without ssl works)
[11/Oct/2011:13:15:51 +0200] slapi_ldap_bind - Error: could not send
bind request for id [cn=repman,cn=config] mech [SIMPLE]: error -1
(Can't contact LDAP server) -8054 (You are attempting to import a cert
with the same issuer/serial as an existing cert, but that is not the
same cert.) 107 (Transport endpoint is not connected)
(with the normal replication I also see netscapeRoot, not userRoot)
Sincerely,
PieterB
11 years, 5 months
setting up ACLs
by Karoly Czovek
Hi there,
i ran into a problem with the ACLs.
I set up an account, what needed to acquire only certain attributes, i set the following ACL:
(targetattr = "uid || mail || mailHost || accountType || accountStatus || mailAlternateAddress || mailForwardingAddress || mailUserPassword")
(target = "ldap:///dc=moveone,dc=info")
(targetfilter = ou=People)
(version 3.0;
acl "Email server can lookup some data";
allow (read,compare,search)
(userdn = "ldap:///cn=emailServerLookup,ou=People,dc=moveone,dc=info")
;)
but the search is gives back all the attributes, not only the allowed ones.
What i am miss?
the lookup:
ldapsearch -x -LLL -h ds -b ou=People,dc=moveone,dc=info -D "cn=emailServerLookup,ou=People,dc=moveone,dc=info" -w TheSecretPassword uid=karoly.czovek
dn: uid=karoly.czovek,ou=People,dc=moveone,dc=info
--
Karoly CZOVEK
Global Systems Administrator
MoveOne IT Department
Eastern Europe - Balkans - CIS& Central Asia - Middle East& Africa -
Asia Pacific
phone: +36 1 266 0181 - ext.6710
mobile: +36 70 708 9953
skype: mo_karoly.czovek
email: karoly.czovek(a)moveoneinc.com
web: http://www.moveoneinc.com
11 years, 5 months
Best way to sync ldap and samba passwords
by David Hoskinson
I am trying to find out the best way to change my password using ldappaswd... and have it also update my samba passwd. From what I am understanding the ldap sync option in samba will do that, but we don't use samba as a domain controller, only as a file server. We change our passwords from command line in linux. Everything I am reading seems to point the opposite direction of what we want to do.
Thanks.
David Hoskinson | DATATRAK International
Systems Engineer
Mayfield Heights, Ohio, USA
+1.440.443.0082 x 124 (p) | +1.216.280.5457 (m)
david.hoskinson(a)datatrak.net<mailto:david.hoskinson@datatrak.net> | www.datatrak.net<http://www.datatrak.net/>
11 years, 5 months