Help with understanding 389-ds, multiple server setup and TLS/SSL
by Tom Fallon
Hi folks
I've inherited a 389-ds server (let's call that Server1) running version
389-Management-Console/1.1.7 B2011.172.2016 on which I've been tasked with
getting replication working on a second server (Server2). I am not new to
Linux but am new to System Administration having made the jump from
Helpdesk recently so please bear with me if these seem like stupid
questions....
I've struck one hurdle already whereby I can no longer log in on the
Console to Server1 and am getting error:
Error:
Cannot logon because of an incorrect User ID
Incorrect password or Directory problem.
java.io interruptedIOException: HTTP response timeout
I think this has occurred while I tried to get SSL certs copied/exported to
a Server2 as log files show the following.
[06/Oct/2015:23:46:46 +0100] attrcrypt - attrcrypt_cipher_init: symmetric
key failed to unwrap with the private key; Cert might have been renewed
since the key is wrapped. To recover the encrypted contents, keep the
wrapped symmetric key value.
[06/Oct/2015:23:46:46 +0100] attrcrypt - All prepared ciphers are not
available. Please disable attribute encryption.
[06/Oct/2015:23:46:46 +0100] attrcrypt - attrcrypt_unwrap_key: failed to
unwrap key for cipher AES
[06/Oct/2015:23:46:46 +0100] attrcrypt - attrcrypt_cipher_init: symmetric
key failed to unwrap with the private key; Cert might have been renewed
since the key is wrapped. To recover the encrypted contents, keep the
wrapped symmetric key value.
[06/Oct/2015:23:46:46 +0100] attrcrypt - attrcrypt_unwrap_key: failed to
unwrap key for cipher 3DES
[06/Oct/2015:23:46:46 +0100] attrcrypt - attrcrypt_cipher_init: symmetric
key failed to unwrap with the private key; Cert might have been renewed
since the key is wrapped. To recover the encrypted contents, keep the
wrapped symmetric key value.
[06/Oct/2015:23:46:46 +0100] attrcrypt - All prepared ciphers are not
available. Please disable attribute encryption.
[06/Oct/2015:23:46:47 +0100] - Skipping CoS Definition
cn=nsAccountInactivation_cos,dc=example,dc=com--no CoS Templates found,
which should be added before the CoS Definition.
[06/Oct/2015:23:46:47 +0100] - slapd started. Listening on All Interfaces
port 389 for LDAP requests
[06/Oct/2015:23:46:47 +0100] - Listening on All Interfaces port 636 for
LDAPS requests
So in theory I recreate the SSL certs on Server1 export to Server2 and
continue on.
I'd appreciate if someone could help in my understanding of how this is
supposed to work in a multi server environment as despite reading the
documentation here:
https://access.redhat.com/documentation/en/red-hat-directory-server/ I'm
struggling to get my head around things.
My understanding is there are these main components (I'm ignoring SNMP bit
for now):
- Directory Server located at /etc/dirsrv/slapd-instance and containing all
the LDAP server pieces and command line tools
- Admin Server located at /etc/dirsrv/admin-serv - docs refer to the
controlling portals which access LDAP server and refers to "Using the Admin
server" guide - I'm presuming this is the Administration Guide now
- Directory Server console - various docs I've read refer to this as the
Directory Server Console or the Admin Console which then bamboozles me as
to whether its incorporated in Directory Server or Admin Server.
I've been trying to follow this guide to multi-master SSL setup -
http://directory.fedoraproject.org/docs/389ds/howto/howto-walkthroughmult...
and
tweaking for my version of OS (Centos 6.7) and 389-ds but not getting very
far.
Can anyone point me to a more up to date guide or provide some form of
idiot-proof guide to get this working? I've been banging my head on this
for a couple weeks now and despite reading the docs and a load of googling
I'm not getting very far.
I have the install part down ok including disktuning, file descriptors,
keepalive, port ranges etc and 389-ds itself of course. And on Server2 I
can log in to the console using http and a basic LDAP test works fine using:
ldapsearch -x -b "dc=example,dc=com"
I think whoever setup the existing Directory Server used a self-signed cert
as there are pwdfile and noise.txt files in the slapd-instance directory so
looks like something like this was used to generate the CA Cert and Server
Cert
certutil -S -n "CA certificate" -s "cn=CAcert" -x -t "CT,," -m 1000 -v 120 -d
*.* -z noise.txt -f pwdfile.txt
certutil -S -n "Server-Cert" -s "cn=server.example.com
,cn=Directory Server" -c "CA certificate" -t "u,u,u" -m 1001 -v 120 -d *.*
-z noise.txt -f pwdfile.txt
What I don't have a note of is the unique numbers entered with the -m
switch. Is there a way to tell what these are after the fact as I believe
they need to be unique across servers, correct?
Also can someone explain how I export the CA Cert from server 1 to server 2
- the docs don't cover that part as far as I can tell other than this
command which as far as I can see exports the CA Cert on the server you run
that command on to ascii format.
certutil -L -d . -n "CA certificate" -a > cacert.asc
Is it just a matter of copying the cacert.asc file to 2nd server in the
slapd-instance directory and running another certutil command of some sort
to import there?
Secondly do I need to setup SSL on the Admin Server as well or for simple
replication can we just get by with SSL on the Directory Server? If we need
to do the Admin Server as well (I'm unsure of what functionality the Admin
Server actually provides) is it a matter of same steps as for the Directory
Server, same commands etc?
Lastly is there a recommended way to redo the certificates on the existing
(live) server other than just removing the files and starting again?
Server1 is in production so I'm hesitant to play around with it too much
until i know what I'm doing.
Many thanks to anyone who takes the time to read this and provide any
pointers.
Cheers. Kiweegie.
7 years, 5 months
fractional replication and consumers Q
by ghiureai
Hi LIst,
I have cfg a multimaster rep env with fractional rep, all agreements
are already in placed between suppliers and consumers , all consumers
had been cfg with Multi Master Replica option, reading trough RHES
389-ds there is some mentioning about "dedicated consumer" option in
replica.
We need to have a cfg which at anytime any of the DS can act as master
( write+read), would "Multi Master " replica option need to be replaced
with "dedicated consumer"?
Thank you
Isabella
7 years, 5 months
WinSync agreement deletes directoryt server users
by Mizrahi, Yair
Hi,
I have setup a sync agreement between directory server and active directory 2012R2 and I'm getting a very strange behavior, if I am doing 2 way sync (the default) the sync completes successfully but not all the users are created in AD, not only that , they are also gets deleted from directory server (around 200 users from 550).
I'm syncing to Blank OU in AD
My DS version is 1.2.2-1
Thanks,
[cid:image001.gif@01D1099A.FE66D260][cid:image002.png@01D1099A.FE66D260]
Yair Mizrahi
Sr Lab IT engineer
Office: + 972 722563243
Mobile: + 972 54 2327687
Email: Yair.Mizrahi(a)emc.com<mailto:Yair.Mizrahi@emc.com>
EMC² - XtremIO
Glil Yam 46905,
Herzliya,
Israel
www.emc.com<http://www.emc.com/>
7 years, 5 months
seeing errors in MM Rep fractional replication
by ghiureai
Hi list,
we completed the MMRep Fractional rep excluded (memberOf pluging) and
on supplier seeing this error:
repl5_inc_wait for_async_results timed out waiting for responses: 15 17
and consumer seeing this :
slapi_ldap_bind - Error: timeout after [0.0] seconds reading bind
response for [uid=rep_user,cn=config] mech [SIMPLE]
[16/Oct/2015:13:46:35 -0700] NSMMReplicationPlugin - agmt="cn=2 to 01"
1:389): Replication bind with SIMPLE auth failed: LDAP error -5 (Timed
out) ((null))
[16/Oct/2015:13:46:59 -0700] slapi_ldap_bind - Error: timeout after
[0.0] seconds reading bind response for [uid=rep_user,cn=config] mech
[SIMPLE]
[16/Oct/2015:13:47:19 -0700] slapi_ldap_bind - Error: timeout after
[0.0] seconds reading bind response for [uid=rep_user,cn=config] mech
[SIMPLE]
[16/Oct/2015:13:47:39 -0700] slapi_ldap_bind - Error: timeout after
[0.0] seconds reading bind response for [uid=rep_user,cn=config] mech
[SIMPLE]
[16/Oct/2015:13:47:59 -0700] slapi_ldap_bind - Error: timeout after
[0.0] seconds reading bind response for [uid=rep_user,cn=config] mech
[SIMPLE]
[16/Oct/2015:13:48:29 -0700] slapi_ldap_bind - Error: timeout after
[0.0] seconds reading bind response for [uid=rep_user,cn=config] mech
[SIMPLE]
[16/Oct/2015:13:50:05 -0700] slapi_ldap_bind - Error: timeout after
[0.0] seconds reading bind response for [uid=rep_user,cn=config] mech
[SIMPLE]
any help much appreciate it
Thank you
Isabella
7 years, 5 months
using ipa_pwd_extop (freeIPA plugin) to update kerberos
by Winstanley, Anthony
Hello,
We want regular 389-ds password changes to also update our MIT kerberos realm principals.
It's my understanding that FreeIPA does this already via their ipa_pwd_extop 389-ds plugin.
Does anybody have any comment on the feasibility of implementing this plugin in a vanilla 389-ds install without bringing much of FreeIPA along with it?
Anybody have any better ideas? :)
Thanks,
Anthony Winstanley
UBC Enterprise LDAP project
7 years, 5 months
ldap export/db2ldif Q's
by ghiureai
Hi List,
I have 2 questions related to export/ db2ldif for a domain:
-anything I need to be aware when using a export /db2ldif from a
multimaster rep cfg ldap file to be imported/ldif2db in a non
replication server cfg ldap ? or into another multimaster rep cf ldap
( are any rep internal counters to be reset etc?)
-see the following message/warning when running export/db2ldif, the
slapd errorlog level is set to 64 , can this be ignored?
[07/Oct/2015:13:58:45 -0700] - All database threads now stopped
Exported ldif file: /staging/proc/ldap_backup/xxxdump.20151007-135842
reading config file /etc/dirsrv/slapd-ldap/slapd-collations.conf
[07/Oct/2015:13:58:45 -0700] - line 45: collation "" "" "" 1 3
2.16.840.1.113730.3.3.2.0.1 default
[07/Oct/2015:13:58:45 -0700] - line 46: collation ar "" "" 1 3
2.16.840.1.113730.3.3.2.1.1 ar
[07/Oct/2015:13:58:45 -0700] - line 47: collation be "" "" 1 3
2.16.840.1.113730.3.3.2.2.1 be
[07/Oct/2015:13:58:45 -0700] - line 48: collation bg "" "" 1 3
2.16.840.1.113730.3.3.2.3.1 bg
[07/Oct/2015:13:58:45 -0700] - line 49: collation ca "" "" 1 3
2.16.840.1.113730.3.3.2.4.1 ca
[07/Oct/2015:13:58:45 -0700] - line 50: collation cs "" "" 1 3
2.16.840.1.113730.3.3.2.5.1 cs
[07/Oct/2015:13:58:45 -0700] - line 51: collation da "" "" 1 3
2.16.840.1.113730.3.3.2.6.1 da
[07/Oct/2015:13:58:45 -0700] - line 52: collation de "" "" 1 3
2.16.840.1.113730.3.3.2.7.1 de
[07/Oct/2015:13:58:45 -0700] - line 53: collation de AT "" 1 3
2.16.840.1.113730.3.3.2.8.1 de-AT
[07/Oct/2015:13:58:45 -0700] - line 54: collation de CH "" 1 3
2.16.840.1.113730.3.3.2.9.1 de-CH
[07/Oct/2015:13:58:45 -0700] - line 55: collation el "" "" 1 3
2.16.840.1.113730.3.3.2.10.1 el
[07/Oct/2015:13:58:45 -0700] - line 56: collation en "" "" 1 3
2.16.840.1.113730.3.3.2.11.1 en en-US
[07/Oct/2015:13:58:45 -0700] - line 57: collation en CA "" 1 3
2.16.840.1.113730.3.3.2.12.1 en-CA
[07/Oct/2015:13:58:45 -0700] - line 58: collation en GB "" 1 3
2.16.840.1.113730.3.3.2.13.1 en-GB
[07/Oct/2015:13:58:45 -0700] - line 59: collation en IE "" 1 3
2.16.840.1.113730.3.3.2.14.1 en-IE
[07/Oct/2015:13:58:45 -0700] - line 60: collation es "" "" 1 3
2.16.840.1.113730.3.3.2.15.1 es es-ES
[07/Oct/2015:13:58:45 -0700] - line 61: collation et "" "" 1 3
2.16.840.1.113730.3.3.2.16.1 et
[07/Oct/2015:13:58:45 -0700] - line 62: collation fi "" "" 1 3
2.16.840.1.113730.3.3.2.17.1 fi
[07/Oct/2015:13:58:45 -0700] - line 63: collation fr "" "" 1 3
2.16.840.1.113730.3.3.2.18.1 fr fr-FR
[07/Oct/2015:13:58:45 -0700] - line 64: collation fr BE "" 1 3
2.16.840.1.113730.3.3.2.19.1 fr-BE
[07/Oct/2015:13:58:45 -0700] - line 65: collation fr CA "" 1 3
2.16.840.1.113730.3.3.2.20.1 fr-CA
[07/Oct/2015:13:58:45 -0700] - line 66: collation fr CH "" 1 3
2.16.840.1.113730.3.3.2.21.1 fr-CH
[07/Oct/2015:13:58:45 -0700] - line 67: collation hr "" "" 1 3
2.16.840.1.113730.3.3.2.22.1 hr
[07/Oct/2015:13:58:45 -0700] - line 68: collation hu "" "" 1 3
2.16.840.1.113730.3.3.2.23.1 hu
[07/Oct/2015:13:58:45 -0700] - line 69: collation is "" "" 1 3
2.16.840.1.113730.3.3.2.24.1 is
[07/Oct/2015:13:58:45 -0700] - line 70: collation it "" "" 1 3
2.16.840.1.113730.3.3.2.25.1 it
[07/Oct/2015:13:58:45 -0700] - line 71: collation it CH "" 1 3
2.16.840.1.113730.3.3.2.26.1 it-CH
[07/Oct/2015:13:58:45 -0700] - line 72: collation iw "" "" 1 3
2.16.840.1.113730.3.3.2.27.1 iw
[07/Oct/2015:13:58:45 -0700] - line 73: collation ja "" "" 1 3
2.16.840.1.113730.3.3.2.28.1 ja
[07/Oct/2015:13:58:45 -0700] - line 74: collation ko "" "" 1 3
2.16.840.1.113730.3.3.2.29.1 ko
[07/Oct/2015:13:58:45 -0700] - line 75: collation lt "" "" 1 3
2.16.840.1.113730.3.3.2.30.1 lt
[07/Oct/2015:13:58:45 -0700] - line 76: collation lv "" "" 1 3
2.16.840.1.113730.3.3.2.31.1 lv
[07/Oct/2015:13:58:45 -0700] - line 77: collation mk "" "" 1 3
2.16.840.1.113730.3.3.2.32.1 mk
[07/Oct/2015:13:58:45 -0700] - line 78: collation nl "" "" 1 3
2.16.840.1.113730.3.3.2.33.1 nl
[07/Oct/2015:13:58:45 -0700] - line 79: collation nl BE "" 1 3
2.16.840.1.113730.3.3.2.34.1 nl-BE
[07/Oct/2015:13:58:45 -0700] - line 80: collation no "" "" 1 3
2.16.840.1.113730.3.3.2.35.1 no
[07/Oct/2015:13:58:45 -0700] - line 81: collation no NO B 1 3
2.16.840.1.113730.3.3.2.36.1 no-NO-B
[07/Oct/2015:13:58:45 -0700] - line 82: collation no NO NY 1 3
2.16.840.1.113730.3.3.2.37.1 no-NO-NY
[07/Oct/2015:13:58:45 -0700] - line 83: collation pl "" "" 1 3
2.16.840.1.113730.3.3.2.38.1 pl
[07/Oct/2015:13:58:45 -0700] - line 84: collation ro "" "" 1 3
2.16.840.1.113730.3.3.2.39.1 ro
[07/Oct/2015:13:58:45 -0700] - line 85: collation ru "" "" 1 3
2.16.840.1.113730.3.3.2.40.1 ru
[07/Oct/2015:13:58:45 -0700] - line 86: collation sh "" "" 1 3
2.16.840.1.113730.3.3.2.41.1 sh
[07/Oct/2015:13:58:45 -0700] - line 87: collation sk "" "" 1 3
2.16.840.1.113730.3.3.2.42.1 sk
[07/Oct/2015:13:58:45 -0700] - line 88: collation sl "" "" 1 3
2.16.840.1.113730.3.3.2.43.1 sl
[07/Oct/2015:13:58:45 -0700] - line 89: collation sq "" "" 1 3
2.16.840.1.113730.3.3.2.44.1 sq
[07/Oct/2015:13:58:45 -0700] - line 90: collation sr "" "" 1 3
2.16.840.1.113730.3.3.2.45.1 sr
[07/Oct/2015:13:58:45 -0700] - line 91: collation sv "" "" 1 3
2.16.840.1.113730.3.3.2.46.1 sv
[07/Oct/2015:13:58:45 -0700] - line 92: collation tr "" "" 1 3
2.16.840.1.113730.3.3.2.47.1 tr
[07/Oct/2015:13:58:45 -0700] - line 93: collation uk "" "" 1 3
2.16.840.1.113730.3.3.2.48.1 uk
[07/Oct/2015:13:58:45 -0700] - line 94: collation zh "" "" 1 3
2.16.840.1.113730.3.3.2.49.1 zh
[07/Oct/2015:13:58:45 -0700] - line 95: collation zh TW "" 1 3
2.16.840.1.113730.3.3.2.50.1 zh-TW
[07/Oct/2015:13:58:45 -0700] - line 97: collation "" "" "" 3 3
2.16.840.1.113730.3.3.2.0.3
[07/Oct/2015:13:58:45 -0700] - line 98: collation en "" "" 3 3
2.16.840.1.113730.3.3.2.11.3
[07/Oct/2015:13:58:45 -0700] plugin_mr_find - Error: matching rule
plugin for [caseIgnoreOrderingMatch-default] not found
[07/Oct/2015:13:58:45 -0700] plugin_mr_find - Error: matching rule
plugin for [caseIgnoreSubstringMatch-default] not found
[07/Oct/2015:13:58:45 -0700] plugin_mr_find - Error: matching rule
plugin for [caseIgnoreOrderingMatch-default] not found
[07/Oct/2015:13:58:45 -0700] plugin_mr_find - Error: matching rule
plugin for [caseIgnoreSubstringMatch-default] not found
[07/Oct/2015:13:58:45 -0700] plugin_mr_find - Error: matching rule
plugin for [caseIgnoreSubstringMatch-default] not found
7 years, 5 months
replica from DS to AD: Replica has no update vector. It has never been initialized
by Mihai Carabas
Hello,
After a power blackout we have some trouble with synchronization
between 389ds and AD.
Here are some debugging messages:
[13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - windows sync -
agmt="cn=ad.curs.pub.ro" (ad:636): State: start_backoff -> backoff
[13/Oct/2015:09:34:39 +0300] - acquire_replica, supplier RUV:
[13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - supplier:
{replicageneration} 547f9354000000010000
[13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - supplier:
{replica 1 ldap://ldap.curs.pub.ro:389} 547f9663000000010000
561ca5b8000000010000 561ca5b8
[13/Oct/2015:09:34:39 +0300] - acquire_replica, consumer RUV:
[13/Oct/2015:09:34:39 +0300] - acquire_replica, consumer RUV = null
[13/Oct/2015:09:34:39 +0300] - acquire_replica, supplier RUV is newer
[13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - windows sync -
agmt="cn=ad.curs.pub.ro" (ad:636): Cancelling linger on the connection
[13/Oct/2015:09:34:39 +0300] - _csngen_adjust_local_time: gen state
before 561ca5fb0001:1444718075:0:0
[13/Oct/2015:09:34:39 +0300] - _csngen_adjust_local_time: gen state
after 561ca5ff0000:1444718079:0:0
[13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - windows sync -
agmt="cn=ad.curs.pub.ro" (ad:636): State: backoff -> sending_updates
[13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - windows sync -
agmt="cn=ad.curs.pub.ro" (ad:636): Replica has no update vector. It
has never been initialized.
[13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - windows sync -
agmt="cn=ad.curs.pub.ro" (ad:636): Beginning linger on the connection
[13/Oct/2015:09:34:39 +0300] NSMMReplicationPlugin - windows sync -
agmt="cn=ad.curs.pub.ro" (ad:636): State: sending_updates ->
start_backoff
^C
What action should we take to solve this issue?
Thank you,
Mihai Carabas
7 years, 5 months
Random dirsrv freezes and high CLOSE_WAITs
by Prashant Bapat
Hi,
We have been using 389-ds as part of FreeIPA. In one of our environments,
we have 2 389-ds installations with replication.
Randomly, the 389-ds on either of them completely freezes and there are
high number of CLOSE_WAITs on tcp/389 port.
Only way to recover from this situation is to either reboot or "kill -9"
the ns-slapd process. Graceful restarts get stuck indefinitely.
One curious thing when this happens, a search using "ldapsearch" command
seems to work but a search using a python-ldap client does not. FreeIPA
does not work either.
Any pointers on troubleshooting this would be appreciated.
Thanks.
--Prashant
7 years, 5 months