389-users June 2019

389-users@lists.fedoraproject.org

17 participants
13 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

MemberOf group restrictions to a client system (server and client running CentOS 7)
by Janet Houser 06 Aug '20

06 Aug '20

Hi, I'm new to 389-ds and last week downloaded and installed the software. I have a running instance of the server, and I've added TLS/SSL. I've configured a CentOS 7 client to be able to query the server using TLS/SSL, and all appears working. I've created users and groups on the 389-ds server successfully. For each user and group, I've enabled posix attributes and my client can see the unix users and groups using the "getent password" or "getent group" commands. Now, here's where I'm getting tripped up.......... I need to limit which users have access to which systems. I've been trying to do this via memberOf group limitations. I found the following online resource (https://thornelabs.net/2013/01/28/aix-restrict-server-login-via-ldap-groups…) which is close enough to CentOS that the initial commands worked. I enabled the MemberOf plugin and changed the attributes per the link, and restarted the system. I created a test group (that I didn't enable a posix GID) and tried to add a single user via: Right click on group -- > click Properties --> then Members --> click Add --> Search for user --> click Add. When I try to go this route (which worked before enabling the memberOf plugin) it worked. Now it seems I get the error: "Cannot save to directory server. netscape.ldap.LDAPException: error resiult(65): Object class violation" And the messages file throws the error (/var/log/dirsrv/slapd-<instancename>/errors: "Entry "uid=test,ou=People,dc=int,dc=com" -- attribute "memberOf" not allowed [17/Feb/2016:11:22:58 -0700] memberof-plugin - memberof_postop_modify: failed to add dn (cn=testgroup,ou=Groups,dc=int,dc=com) to target. Error (65)" So it seems my server isn't quite using the memberOf plugin properly, but I'm not sure what else to enable. I'll have to solve this issue before I even try to filter login access via groups on my client system. I should mention that if I go under the advanced tab for one of the groups I created, I can add the the attribute "uniquemember", but I'm not sure what I should set the "value" to be. I've tried creating new users to see if I could set their "uniquemember" attributes, but no luck. It seems that I don't have the ability to set this attribute on individual users, only groups. This might not be the right road to head down when trying to restrict access to servers via groups, so I'm open to any suggestions. Any suggestions would be appreciated.

6 19

Windows Sync Agreement not copying all objects
by Abhisheyk Deb 03 Jul '19

03 Jul '19

Hi, We have the following setup. Active Directory Server in US. 389 DS Server in Italy. We are able to access the Active Directory Server from 389 DS. We installed the sync agreement. No body is touching the AD, the number of objects that should copied is 21. But every time we are running the replication agreement, the number of objects being copied is always different. How can that be if there is no change happening at the AD Server. Is the replication done over UDP or TCP. Also is it because of distance and delay that is causing the synchronization issues. If some can elaborate in this issue, it would be really helpful. Thank you Abhishek Deb

3 5

Announcing 389 Directory Server 1.4.0.24
by Mark Reynolds 25 Jun '19

25 Jun '19

389 Directory Server 1.4.0.24 The 389 Directory Server team is proud to announce 389-ds-base version 1.4.0.24 Fedora packages are available on Fedora 29 Fedora 29 https://koji.fedoraproject.org/koji/taskinfo?taskID=35826090 <https://koji.fedoraproject.org/koji/taskinfo?taskID=35826090> Bodhi F29 https://bodhi.fedoraproject.org/updates/FEDORA-2019-688ce6cf00 <https://bodhi.fedoraproject.org/updates/FEDORA-2019-688ce6cf00> The new packages and versions are: * 389-ds-base-1.4.0.24-1 Source tarballs are available for download at Download 389-ds-base Source <https://releases.pagure.org/389-ds-base/389-ds-base-1.4.0.24.tar.bz2> Highlights in 1.4.0.24 Bug fixes Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install, use *dnf install 389-ds-base*, then run *dscreate*. To install the Cockput UI plugin use *dnf install cockpit-389-ds* See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation, setup, and upgrade See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. New UI Progress (Cockpit plugin) The new UI is broken up into a series of configuration tabs. Here is a table showing the current progress Configuration Tab Finished Written in ReachJS Server Tab Yes No Security Tab No No Database Tab Yes Yes Replication Tab Yes No Schema Tab Yes No Plugin Tab Yes Yes Monitor Tab Yes Yes Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our Pagure project: https://pagure.io/389-ds-base * Bump version to 1.4.0.24 * Issue 50052 - Fix rpm.mk according to audit-ci change * Issue 50276 - 389-ds-console is not built on RHEL8 if cockpit_dist is already present * Issue 50041 - Add the rest UI Plugin tabs - Part 1 * Issue 50217 - Implement dsconf security section * Issue 49602 - Revise replication status messages * Issue 50431 - Fix regression from coverity fix * Issue 50431 - Fix covscan warnings * Issue 50426 - nsSSL3Ciphers is limited to 1024 characters * Issue 50428 - Log the actual base DN when the search fails with “invalid attribute request” * Issue 50329 - (2nd) Possible Security Issue: DOS due to ioblocktimeout not applying to TLS * Issue 50413 - ds-replcheck - Always display the Result Summary * Issue 50355 - NSS can change the requested SSL min and max versions

1 0

Replacing a default schema for only one instance?
by Paul Engle 20 Jun '19

20 Jun '19

All, Specifically, I'm referring to the two incompatible schemas for rfc2307 vs rfc2307bis. In the past, it was possible to just delete 10rfc2307.ldif from /etc/dirsrv/<instance>/schema and replace it with the file supplied from /usr/share/dirsrv/data/10rfc2307bis.ldif. Now, with the new directory layout in 1.3.8.4, there is nothing to delete in /etc/dirsrv/<instance>/schema. And since the two schemas are incompatible, I can't load the other one by dropping it in there. It seems the only thing I'm able to do is remove /usr/share/dirsrv/schema/10rfc2307.ldif to get the other file to load. That's global for all instances on the server, though. Is there any way to make this change for just one instance? paul -- Paul Engle Office of Information Technology pengle(a)rice.edu 713-348-4702

3 4

Docker official image
by Olivier JUDITH 19 Jun '19

19 Jun '19

Hi all, Do you provide an official docker image for 389 ? I plan to deploy MMR on Kubernetes . Any advice/link ?

4 17

Announcing 389 Directory Server 1.4.1.4
by Mark Reynolds 19 Jun '19

19 Jun '19

389 Directory Server 1.4.1.4 The 389 Directory Server team is proud to announce 389-ds-base version 1.4.1.4 Fedora packages are available on Fedora 30 and rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=35621238 <https://koji.fedoraproject.org/koji/taskinfo?taskID=35621238> - Rawhide https://koji.fedoraproject.org/koji/taskinfo?taskID=35620824 <https://koji.fedoraproject.org/koji/taskinfo?taskID=35620824> - Fedora 30 Bodhi https://bodhi.fedoraproject.org/updates/FEDORA-2019-ed262351ae <https://bodhi.fedoraproject.org/updates/FEDORA-2019-ed262351ae> The new packages and versions are: * 389-ds-base-1.4.1.4-1 Source tarballs are available for download at Download 389-ds-base Source <https://releases.pagure.org/389-ds-base/389-ds-base-1.4.1.4.tar.bz2> Highlights in 1.4.1.4 * Bug fixes Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. New UI Progress (Cockpit plugin) The new UI is broken up into a series of configuration tabs. Here is a table showing the current progress Configuration Tab Finished Written in ReactJS Server Tab Yes No Security Tab No No Database Tab Yes Yes Replication Tab Yes No Schema Tab Yes No Plugin Tab Yes Yes Monitor Tab Yes Yes Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our Pagure project: https://pagure.io/389-ds-base * Bump version to 1.4.1.4 * Issue 49361 - Use IPv6 friendly network functions * Issue 48851 - Investigate and port TET matching rules filter tests(bug772777) * Issue 50446 - NameError: name ‘ds_is_older’ is not defined * Issue 49602 - Revise replication status messages * Issue 50439 - Update docker integration to work out of source directory * Issue 50037 - revert path changes as it breaks prefix/rpm builds * Issue 50431 - Fix regression from coverity fix * Issue 50370 - CleanAllRUV task crashing during server shutdown * Issue 48851 - investigate and port TET matching rules filter tests(match) * Issue 50417 - Fix missing quote in some legacy tools * Issue 50431 - Fix covscan warnings * Revert “Issue 49960 - Core schema contains strings instead of numer oids” * Issue 50426 - nsSSL3Ciphers is limited to 1024 characters * Issue 50052 - Fix rpm.mk according to audit-ci change * Issue 50365 - PIDFile= references path below legacy directory /var/run/ * Issue 50428 - Log the actual base DN when the search fails with “invalid attribute request” * Issue 50329 - (2nd) Possible Security Issue: DOS due to ioblocktimeout not applying to TLS * Issue 50417 - Revise legacy tool scripts to work with new systemd changes * Issue 48851 - Add more search filters to vfilter_simple test suite * Issue 49761 - Fix CI test suite issues * Issue 49875 - Move SystemD service config to a drop-in file * Issue 50413 - ds-replcheck - Always display the Result Summary * Issue 50052 - Add package-lock.json and use “npm ci” * Issue 48851 - investigate and port TET matching rules filter tests(vfilter simple) * Issue 50355 - NSS can change the requested SSL min and max versions * Issue 48851 - investigate and port TET matching rules filter tests(vfilter_ld) * Issue 50390 - Add Managed Entries Plug-in Config Entry schema * Issue 49730 - Remove unused Mozilla ldapsdk variables

1 0

NSX/F5 Load Balancing Health Checks
by Mailvaganam, Hari 18 Jun '19

18 Jun '19

Hi: At the moment we perform TCP health check via F5 on ports 389/636 (historical inheritance) – which isn’t sufficient for HA. We are moving to an env where NSX and F5 may co-exist – and have an opportunity to re-work the LB health check for HA (on existing F5 and upcoming NSX). If running NSX and/or F5 (or other load balancers) – how do you determine health on ldap node? We have 2 read/write (1 active at given time) – replicating to N read-only nodes.

3 2

precreation nss databases
by Angel Bosch 18 Jun '19

18 Jun '19

hi, I'm still evaluating some options to securize dynamic nodes and I have some questions regarding certutil and nss databases: Can I create NSS databases on any directory/server and then move files to "/etc/dirsrv/slapd-instance_name" ? If cert8.db and key3.db files are found in that directory are they used automatically by slapd process on reboot? If both answers are affirmative I'll try to script it and hook it within my node creation flow. is there any other detail I should take care of with this approach? thanks, abosch --

4 6

What Do I Need?
by Eugene Poole 18 Jun '19

18 Jun '19

I'm trying to upgrade my environment and I've reinstalled my CentOS machines to CentOS 7 except for one. I've got my DNS for my LAN working just fine. So now it's time for Directory Server. What is a GOOD tutorial to follow? My environment includes 26 physical and KVM virtual machines; 4 Windows 7 machines and 1 ArcaOS (OS/2) machine. What is a DS configuration to go for? TIA -- Eugene Poole Woodstock, Georgia

3 9

Server listening only on tcp6
by wodel youchi 12 Jun '19

12 Jun '19

Hi, I am using a new installation on Cento 7 updated. I am using these packages for 389DS 389-adminutil-1.1.21-2.el7.x86_64 389-ds-base-1.3.8.4-15.el7.x86_64 389-admin-console-doc-1.1.12-1.el7.noarch 389-ds-base-libs-1.3.8.4-15.el7.x86_64 389-console-1.1.19-4.el7.noarch 389-admin-1.1.46-1.el7.x86_64 389-admin-console-1.1.12-1.el7.noarch 389-ds-console-doc-1.2.16-1.el7.noarch 389-ds-1.2.2-6.el7.noarch 389-ds-console-1.2.16-1.el7.noarch 389-dsgw-1.1.11-5.el7.x86_64 The netstat on both ports 389 and 636 show that the daemon is listening on tcp6 only. as a workaround i modified nsslapd-listenhost and nsslapd-securelistenhost to 0.0.0.0 it's the first time I ma getting this behavior. Regards. <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

3 2

Proper upgrade procedure using Redhat repo and yum
by Patrick Landry 07 Jun '19

07 Jun '19

I have two servers running with multi master replication. The servers are running RHEL 7.4 with 389-ds installed via yum using the rhel-7-server-rpms repository. The hosts are behind a load balancer and all client access is through the load balancer. I would like to upgrade to the latest release available in rhel-7-server-rpms. I have the following packages installed related to 389ds: 389-admin-1.1.46-1.el7.x86_64 389-admin-console-1.1.12-1.el7.noarch 389-admin-console-doc-1.1.12-1.el7.noarch 389-adminutil-1.1.21-2.el7.x86_64 389-console-1.1.18-1.el7.noarch 389-ds-1.2.2-6.el7.noarch 389-ds-base-1.3.7.5-21.el7_5.x86_64 389-ds-base-libs-1.3.7.5-21.el7_5.x86_64 389-ds-console-1.2.16-1.el7.noarch 389-ds-console-doc-1.2.16-1.el7.noarch 389-dsgw-1.1.11-5.el7.x86_64 Only two of those packages appear to have updates available; 389-ds-base and 389-ds-base-libs. Is this the correct procedure? 1. remove server1 from the load balancer config to halt client requests 2. stop the dirsrv and dirsrv-admin services on server1 3. run "yum upgrade 389-ds-base 389-ds-base-libs" on server1 4. run "setup-ds-admin.pl -u" on server1 5. restart dirsrv and dirsrv-admin on server1 6. verify replication is still working 7. add server1 back to load balancer config 8. repeat steps 1-7 on server2 I presume that replication will continue to work after upgrading server1 but before upgrading server2. I believe that at step 4, I don't *also* have to run "setup-ds.pl". Is that correct? Thanks. -- Patrick Landry Director, UCSS University of Louisiana at Lafayette patrick.landry(a)louisiana.edu

3 5

directory manager bypassing password policies, alternatives?
by Eric Freeman 07 Jun '19

07 Jun '19

After upgrading from 389 version 1.2.11.15-33.el6_5.x86_64 to 1.2.11.15-97.el6_10.x86_64, we're finding that the Directory Manager account can bypass configured password policies and set user passwords to anything. I believe this is now by design, but is there a configuration file flag to revert to the previous behavior where Directory Manager needed to conform to the password policy? If not, how do we create a user account in 389 ldap server with rights to check and update user password hashes, and still enforce configured password policies? Please advise

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users June 2019