Announcing 389 Directory Server 1.4.2.7
by Mark Reynolds
389 Directory Server 1.4.2.7
The 389 Directory Server team is proud to announce 389-ds-base version
1.4.2.7
Fedora packages are available on Fedora 31.
https://koji.fedoraproject.org/koji/taskinfo?taskID=40930612
<https://koji.fedoraproject.org/koji/taskinfo?taskID=40930612> - Fedora 31
Bodhi
https://bodhi.fedoraproject.org/updates/FEDORA-2020-1afba1a0c2
<https://bodhi.fedoraproject.org/updates/FEDORA-2020-1afba1a0c2>
The new packages and versions are:
* 389-ds-base-1.4.2.7-1
Source tarballs are available for download at Download
389-ds-base Source
<https://releases.pagure.org/389-ds-base/389-ds-base-1.4.2.7.tar.bz2>
Highlights in 1.4.2.7
* Bug fixes
Installation and Upgrade
See Download <https://www.port389.org/docs/389ds/download.html> for
information about setting up your yum repositories.
To install the server use *dnf install 389-ds-base*
To install the Cockpit UI plugin use *dnf install cockpit-389-ds*
After rpm install completes, run *dscreate interactive*
For upgrades, simply install the package. There are no further
steps required.
There are no upgrade steps besides installing the new rpms
See Install_Guide
<https://www.port389.org/docs/389ds/howto/howto-install-389.html> for
more information about the initial installation and setup
See Source <https://www.port389.org/docs/389ds/development/source.html>
for information about source tarballs and SCM (git) access.
New UI Progress (Cockpit plugin)
The new UI is fully functional. There are still parts that need to be
converted to ReactJS, but every feature is available.
Configuration Tab
Functional
Written in ReactJS
Server Tab Yes No (coming soon)
Security Tab Yes Yes
Database Tab Yes Yes
Replication Tab Yes Yes
Schema Tab Yes Yes
Plugin Tab Yes Yes
Monitor Tab Yes Yes
Feedback
We are very interested in your feedback!
Please provide feedback and comments to the 389-users mailing list:
https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...
If you find a bug, or would like to see a new feature, file it in our
Pagure project: https://pagure.io/389-ds-base
* Bump version to 1.4.2.7
* Issue 49254 - Fix compiler failures and warnings
* Issue 50741 - cont bdb_start - Detected Disorderly Shutdown
* Issue 50836 - Port Schema UI tab to React
* Issue 50842 - Decrease 389-console Cockpit component size
* Issue 50790 - Add result text when filter is invalid
* Issue 50834 - Incorrectly setting the NSS default SSL version max
* Issue 50829 - Disk monitoring rotated log cleanup
causes heap-use-after-free
* Issue 50709 - (cont) Several memory leaks reported by Valgrind for
389-ds 1.3.9.1-10
* Issue 50599 - Fix memory leak when removing db region files
* Issue 49395 - Set the default TLS version min to TLS1.2
* Issue 50818 - dsconf pwdpolicy get error
* Issue 50824 - dsctl remove fails with “name ‘ensure_str’ is not defined”
* Issue 50599 - Remove db region files prior to db recovery
* Issue 50812 - dscontainer executable should be placed
under /usr/libexec/dirsrv/
* Issue 50816 - dsconf allows the root password to be set to nothing
* Issue 50798 - incorrect bytes in format string(fix import issue)
--
389 Directory Server Development Team
4 years, 2 months
Announcing 389 Directory Server 1.4.3.2
by Mark Reynolds
389 Directory Server 1.4.3.2
The 389 Directory Server team is proud to announce 389-ds-base version
1.4.3.2
Fedora packages are available on rawhide.
https://koji.fedoraproject.org/koji/taskinfo?taskID=40928882
<https://koji.fedoraproject.org/koji/taskinfo?taskID=40928882> - Rawhide
The new packages and versions are:
* 389-ds-base-1.4.3.2-1
Source tarballs are available for download at Download
389-ds-base Source
<https://releases.pagure.org/389-ds-base/389-ds-base-1.4.3.2.tar.bz2>
Highlights in 1.4.3.2
* Bug fixes
Installation and Upgrade
See Download <https://www.port389.org/docs/389ds/download.html> for
information about setting up your yum repositories.
To install the server use *dnf install 389-ds-base*
To install the Cockpit UI plugin use *dnf install cockpit-389-ds*
After rpm install completes, run *dscreate interactive*
For upgrades, simply install the package. There are no further
steps required.
There are no upgrade steps besides installing the new rpms
See Install_Guide
<https://www.port389.org/docs/389ds/howto/howto-install-389.html> for
more information about the initial installation and setup
See Source <https://www.port389.org/docs/389ds/development/source.html>
for information about source tarballs and SCM (git) access.
New UI Progress (Cockpit plugin)
The new UI is fully functional. There are still parts that need to be
converted to ReactJS, but every feature is available.
Configuration Tab
Functional
Written in ReactJS
Server Tab Yes No (coming soon)
Security Tab Yes Yes
Database Tab Yes Yes
Replication Tab Yes Yes
Schema Tab Yes Yes
Plugin Tab Yes Yes
Monitor Tab Yes Yes
Feedback
We are very interested in your feedback!
Please provide feedback and comments to the 389-users mailing list:
https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...
If you find a bug, or would like to see a new feature, file it in our
Pagure project: https://pagure.io/389-ds-base
* Bump version to 1.4.3.2
* Issue 49254 - Fix compiler failures and warnings
* Issue 50741 - cont bdb_start - Detected Disorderly Shutdown
* Issue 50836 - Port Schema UI tab to React
* Issue 50842 - Decrease 389-console Cockpit component size
* Issue 50790 - Add result text when filter is invalid
* Issue 50627 - Add ASAN logs to HTML report
* Issue 50834 - Incorrectly setting the NSS default SSL version max
* Issue 50829 - Disk monitoring rotated log cleanup
causes heap-use-after-free
* Issue 50709 - (cont) Several memory leaks reported by Valgrind for
389-ds 1.3.9.1-10
* Issue 50784 - performance testing scripts
* Issue 50599 - Fix memory leak when removing db region files
* Issue 49395 - Set the default TLS version min to TLS1.2
* Issue 50818 - dsconf pwdpolicy get error
* Issue 50824 - dsctl remove fails with “name ‘ensure_str’ is not defined”
* Issue 50599 - Remove db region files prior to db recovery
* Issue 50812 - dscontainer executable should be placed
under /usr/libexec/dirsrv/
* Issue 50816 - dsconf allows the root password to be set to nothing
* Issue 50798 - incorrect bytes in format string(fix import issue)
--
389 Directory Server Development Team
4 years, 2 months
cockpit ui problem
by Alberto Viana
1. UI never shows password administrator field (always blank), even if is
set:
~# dsconf instace_name config get passwordAdminDN
passwordAdminDN: cn=GRP_SRV_PREHASHED_PASSWORD,ou=test,dc=my,dc=domain
Also tried to setup via UI, but it's blank again after clink on save button.
Should I file a ticket?
Thanks
Alberto Viana
4 years, 2 months
DB problems
by Alberto Viana
Hi Guys,
389-Directory/1.4.3.1.20200116git4f9aafca9
Start to get this error:
[17/Jan/2020:11:49:56.436658541 -0300] - NOTICE - bdb_start - Detected
Disorderly Shutdown last time Directory Server was running, recovering
database.
And 389 do not start anymore.
Thanks
4 years, 2 months
dsconf and dsctl bugs
by Alberto Viana
Hi Guys,
389-Directory/1.4.3.1.20200116git4f9aafca9 B2020.016.1843
python3-lib389-1.4.3.1-20200116gita08202a5b.el8.noarch
*dsconf*:
If I try to create an instance got this error:
DEBUG: name 'ensure_list_str' is not defined
Traceback (most recent call last):
File "/usr/sbin/dscreate", line 75, in <module>
result = args.func(inst, log, args)
File "/usr/lib/python3.6/site-packages/lib389/cli_ctl/instance.py", line
71, in instance_create
if sd.create_from_inf(args.file):
File "/usr/lib/python3.6/site-packages/lib389/instance/setup.py", line
527, in create_from_inf
self.create_from_args(general, slapd, backends, self.extra)
File "/usr/lib/python3.6/site-packages/lib389/instance/setup.py", line
654, in create_from_args
self._install_ds(general, slapd, backends)
File "/usr/lib/python3.6/site-packages/lib389/instance/setup.py", line
786, in _install_ds
args = ' '.join(ensure_list_str(result.args))
NameError: name 'ensure_list_str' is not defined
ERROR: Error: name 'ensure_list_str' is not defined
The workaround was
edit /usr/lib/python3.6/site-packages/lib389/instance/setup.py file and add
to import ensure_list_str.
After that, everything works fine.
*dsctl*:
I was facing the "name 'ensure_str' is not defined" problem, even after the
fix (
https://pagure.io/389-ds-base/c/4f9aafca9a9927812da5e37ce71d79d1fd23b25a?...),
the debug shows me no error, but the dsctl tells me that the instance
removal failed (but in fact it deletes the instance).
I tested with selinux disabled too.
DEBUG: Removing instance test
DEBUG: Checking for instance marker at /etc/dirsrv/slapd-test/dse.ldif
DEBUG: Found instance marker at /etc/dirsrv/slapd-test/dse.ldif! Proceeding
to remove ...
DEBUG: Stopping instance test
DEBUG: systemd status -> True
DEBUG: Found instance marker at /etc/dirsrv/slapd-test/dse.ldif! Proceeding
to remove ...
DEBUG: Stopping instance test
DEBUG: systemd status -> True
DEBUG: Removing /var/lib/dirsrv/slapd-test/bak
DEBUG: Removing /etc/dirsrv/slapd-test
DEBUG: Removing /etc/dirsrv/slapd-test
DEBUG: Removing /var/lib/dirsrv/slapd-test/db
DEBUG: Removing /var/lib/dirsrv/slapd-test/db/../
DEBUG: Removing /var/lib/dirsrv/slapd-test/changelogdb
DEBUG: Removing /var/lib/dirsrv/slapd-test/ldif
DEBUG: Removing /var/lock/dirsrv/slapd-test
DEBUG: Removing /var/log/dirsrv/slapd-test
DEBUG: Removing /usr/lib64/dirsrv/slapd-test
DEBUG: Removing /etc/sysconfig/dirsrv-test
DEBUG: Removing the systemd symlink
CRITICAL: Instance removal failed
4 years, 2 months
Attribute encryption issue
by Iain Morgan
Hi,
,
Yesterday, I ran up against an attribute encryption issue, and I'm
looking for advice on how to debug and resolve the issue.
For background, I have a pair of RHEL 7 servers in an MMR configuration.
Let's call them host_A and host_B. Both are running the RedHat-provided
1.3.9 RPMs of 389-ds. There is also an RHEL 6 system, host_Z, that was
set up in an MMR configuration with host_B. This setup was used to test
the transition from one generation of servers to the next one.
All had dbeen working fine, and I next tried severing the connection
between host_Z and host_B. The replication agreements were removed and a
cleanAllRUV task was initiated on host_B. All seemed to go well -- until
I restarted host_A.
After restarting host_A, I got the following in the errors log:
[09/Jan/2020:17:00:36.191870707 -0800] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES
[09/Jan/2020:17:00:36.192310924 -0800] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.
[09/Jan/2020:17:00:36.206041190 -0800] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES
[09/Jan/2020:17:00:36.206478885 -0800] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.
[09/Jan/2020:17:00:36.206905949 -0800] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption.
No change was made to the TLS certificate, and I would not have expected
the tear-down of the replication agreements between host_Z and host_b to
be relevant here. host_B is still able to replicate to host_A, but
host_A is unable to go in the other direction.
I haven't identified anything that would account for this problem. The
system had been up from early December and had not exhibited any issues.
So, any suggestions as to how I can troubleshoot and fix this issue? The
log messages don't seem to be very helpful.
thanks,
--
Iain Morgan
4 years, 2 months
Announcing 389 Directory Server 1.4.2.6
by Mark Reynolds
389 Directory Server 1.4.2.6
The 389 Directory Server team is proud to announce 389-ds-base version
1.4.2.6
Fedora packages are available on Fedora 31.
https://koji.fedoraproject.org/koji/taskinfo?taskID=40494075
<https://koji.fedoraproject.org/koji/taskinfo?taskID=40494075> - Fedora 31
Bodhi
https://bodhi.fedoraproject.org/updates/FEDORA-2020-5f27470985
<https://bodhi.fedoraproject.org/updates/FEDORA-2020-5f27470985>
The new packages and versions are:
* 389-ds-base-1.4.2.6-1
Source tarballs are available for download at Download
389-ds-base Source
<https://releases.pagure.org/389-ds-base/389-ds-base-1.4.2.6.tar.bz2>
Highlights in 1.4.2.6
* Bug fixes
Installation and Upgrade
See Download <https://www.port389.org/docs/389ds/download.html> for
information about setting up your yum repositories.
To install the server use *dnf install 389-ds-base*
To install the Cockpit UI plugin use *dnf install cockpit-389-ds*
After rpm install completes, run *dscreate interactive*
For upgrades, simply install the package. There are no further
steps required.
There are no upgrade steps besides installing the new rpms
See Install_Guide
<https://www.port389.org/docs/389ds/howto/howto-install-389.html> for
more information about the initial installation and setup
See Source <https://www.port389.org/docs/389ds/development/source.html>
for information about source tarballs and SCM (git) access.
New UI Progress (Cockpit plugin)
The new UI is fully functional. There are still parts that need to be
converted to ReactJS, but every feature is available.
Configuration Tab
Functional
Written in ReactJS
Server Tab Yes No
Security Tab Yes Yes
Database Tab Yes Yes
Replication Tab Yes Yes
Schema Tab Yes No (coming soon)
Plugin Tab Yes Yes
Monitor Tab Yes Yes
Feedback
We are very interested in your feedback!
Please provide feedback and comments to the 389-users mailing list:
https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...
If you find a bug, or would like to see a new feature, file it in our
Pagure project: https://pagure.io/389-ds-base
* Bump version to 1.4.2.6
* Issue 50798 - incorrect bytes in format string
* Issue 50545 - Add the new replication monitor functionality to UI
* Issue 50806 - Fix minor issues in lib389 health checks
* Issue 50754 - Add Restore Change Log option to CLI
* Issue 50727 - change syntax validate by default in 1.4.2
* Issue 50667 - dsctl -l did not respect PREFIX
* Issue 50780 - More CLI fixes
* Issue 50780 - Fix UI issues
* Issue 50727 - correct mistaken options in filter validation patch
* Issue 50779 - lib389 - conflict compare fails for DN’s with spaces
* Issue 49761 - Fix CI test suite issues
* Issue 50499 - Fix npm audit issues
* Issue 50774 - Account.enroll_certificate() should not check for
DS version
* Issue 50771 - 1.4.2.5 doesn’t compile due to error
ModuleNotFoundError: No module named ‘pkg_resources.extern’
* Issue 50758 - Need to enable CLI arg completion
* Issue 50710 |Ticket 50709: Several memory leaks reported by Valgrind
for 389-ds 1.3.9.1-10|
* Issue 50709 - Several memory leaks reported by Valgrind for 389-ds
1.3.9.1-10
* Issue 50690 - Port Password Storage test cases from TET to
python3(create required types in password_plugins)
* Issue 48851 - Investigate and port TET matching rules filter
tests(last test cases for match index)
* Issue 50761 - Parametrized tests are missing ‘:parametrized’ value
--
389 Directory Server Development Team
4 years, 2 months
Announcing 389 Directory Server 1.4.3
by Mark Reynolds
389 Directory Server 1.4.3.1
The 389 Directory Server team is proud to announce 389-ds-base version
1.4.3.1
Fedora packages are available on rawhide.
https://koji.fedoraproject.org/koji/taskinfo?taskID=40493136
<https://koji.fedoraproject.org/koji/taskinfo?taskID=40493136> - Rawhide
The new packages and versions are:
* 389-ds-base-1.4.3.1-1
Source tarballs are available for download at Download
389-ds-base Source
<https://releases.pagure.org/389-ds-base/389-ds-base-1.4.3.1.tar.bz2>
Highlights in 1.4.3.1
* Bug fixes
Installation and Upgrade
See Download <https://www.port389.org/docs/389ds/download.html> for
information about setting up your yum repositories.
To install the server use *dnf install 389-ds-base*
To install the Cockpit UI plugin use *dnf install cockpit-389-ds*
After rpm install completes, run *dscreate interactive*
For upgrades, simply install the package. There are no further
steps required.
There are no upgrade steps besides installing the new rpms
See Install_Guide
<https://www.port389.org/docs/389ds/howto/howto-install-389.html> for
more information about the initial installation and setup
See Source <https://www.port389.org/docs/389ds/development/source.html>
for information about source tarballs and SCM (git) access.
New UI Progress (Cockpit plugin)
The new UI is fully functional. There are still parts that need to be
converted to ReactJS, but every feature is available.
Configuration Tab
Functional
Written in ReactJS
Server Tab Yes No
Security Tab Yes Yes
Database Tab Yes Yes
Replication Tab Yes Yes
Schema Tab Yes No (coming soon)
Plugin Tab Yes Yes
Monitor Tab Yes Yes
Feedback
We are very interested in your feedback!
Please provide feedback and comments to the 389-users mailing list:
https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...
If you find a bug, or would like to see a new feature, file it in our
Pagure project: https://pagure.io/389-ds-base
* Bump version to 1.4.3.1
* Issue 50798 - incorrect bytes in format string
* Issue 50545 - Add the new replication monitor functionality to UI
* Issue 50806 - Fix minor issues in lib389 health checks
* Issue 50690 - Port Password Storage test cases from TET to python3
part 1
* Issue 49761 - Fix CI test suite issues
* Issue 49761 - Fix CI test suite issues
* Issue 50754 - Add Restore Change Log option to CLI
* Issue 48055 - CI test - automember_plugin(part2)
* Issue 50667 - dsctl -l did not respect PREFIX
* Issue 50780 - More CLI fixes
* Issue 50649 - lib389 without defaults.inf
* Issue 50780 - Fix UI issues
* Issue 50727 - correct mistaken options in filter validation patch
* Issue 50779 - lib389 - conflict compare fails for DN’s with spaces
* Set branch version to 1.4.3.0 (previously 1.4.2.5)
--
389 Directory Server Development Team
4 years, 2 months
389 centOS8 selinux issues
by Alberto Viana
Hi Guys,
389-Directory/1.4.2.5.20200106gitd52700340 B2020.06.1337
CentOS8
I'm getting these alarms due to selinux:
SELinux is preventing ns-slapd from getattr access on the directory
/sys/fs/pstore.
SELinux is preventing /usr/sbin/ns-slapd from getattr access on the
directory /sys/fs/bpf.
SELinux is preventing /usr/sbin/ns-slapd from getattr access on the
directory /sys/kernel/config.
SELinux is preventing /usr/sbin/ns-slapd from read access on the lnk_file
lock.
SELinux is preventing /usr/sbin/ns-slapd from using the ptrace access on a
process.
What is the best approach to deal with this?
Thanks
Alberto Viana
4 years, 2 months