389-users February 2024

389-users@lists.fedoraproject.org

8 participants
5 discussions

Determining max CSN of running server
by William Faulk 01 Mar '24

01 Mar '24

I'm having another replication problem where changes made on a particular server are not being replicated outward at all. Right now, I'm trying to determine what's going on during the replication process. (Caveat: I'm still running an old version of 389ds: v1.3.10. In particular, the dsconf utility does not exist.) My understanding is that when a server receives a change from a client, it wraps it up as a CSN and starts a replication session with its peers, during which it sends a message that states the greatest CSN that it originated. First off, is that a correct understanding? If so, how can I determine what CSN a particular server is telling its replication peers during those sessions? I have a feeling that this server is, for some reason, sending an inaccurate number. In the cn=replica,cn=...,cn=mapping tree,cn=config tree, there are entries for each of the servers topology peers, and they contain nsds50ruv attributes that seem to be the RUVs that that server has received from those peers, right? But the nsds50ruv attribute also exists directly in the cn=replica if you explicitly ask for it. Is it possible that this is the server's own RUV? Can I rely on the nsds50ruv attributes on this server's peers' cn=replica nsds50ruv attribute values to be an accurate reflection of what this server is sending as its CSN in replication sessions? Any other way to see what's going on in a replication session? (I'm even trying to decrypt a network capture, but I'm not having any luck with that yet.) In particular, I see the max CSN for this server in all of these RUVs less than CSNs recorded in the server's own log files. -- William Faulk

5 12

Can't delete groups / users
by Phill Harvey-Smith 26 Feb '24

26 Feb '24

Hi all, I've been following the SuSE guide to setting up 389-ds available at : https://doc.opensuse.org/documentation/leap/security/html/book-security/cha… I've been able to setup a default instance with dscreate dscreate from-file traken-test-template.txt This shows up ok, and I can create users/groups ldap-test:~ # dsidm traken-test group list demo_group test But when I try and delete a group I get : ldap-test:~ # dsidm traken-test group delete Enter dn to delete : test Deleting Group test : Type 'Yes I am sure' to continue: Yes I am sure Error: The entry does not exist What could be wrong? Also is there a flag I can pass to dsidm to not have to type 'Yes I am sure' every time, this will make automating stuff a pain..... I'll include below my create script (with comments stripped) and my ~/.dsrc Cheers. Phill. [general] full_machine_name = ldap-test.ftt start = True [slapd] db_lib = mdb instance_name = traken-test ldapi = /run/slapd-{instance_name}.socket mdb_max_size = 21138142003.2 port = 389 root_password = redacted secure_port = 636 self_sign_cert = True elf_sign_cert_valid_months = 24 [backend-userroot] changelog_max_age = 7d changelog_max_entries = -1 create_suffix_entry = False enable_replication = False replica_binddn = cn=replication manager,cn=config replica_bindgroup = replica_bindpw = replica_id = 1 replica_role = supplier require_index = False hangelog_max_entries = -1 create_suffix_entry = False enable_replication = False replica_binddn = cn=replication manager,cn=config replica_bindgroup = replica_bindpw = replica_id = 1 replica_role = supplier require_index = False sample_entries = yes suffix = dc=traken-test,dc=ftt and my ~/.dsrc[traken-test] uri = ldapi://%%2fvar%%2frun%%2fslapd-traken-test.socket basedn = dc=traken-test,dc=ftt binddn = cn=Directory Manager

1 0

Re: Fwd: dscontainer as non root
by Viktor Ashirov 12 Feb '24

12 Feb '24

On Mon, Feb 12, 2024 at 5:37 PM Antony Jose <anto346(a)gmail.com> wrote: > Thanks Viktor for the response. Appreciate it. > I have provided an attachment with the details. Dockerfile, kubectl error > log and security context construct has been provided. > > I am using sles15 bci as base os. Do we need add 389 user in Dockerfile? > Please let me know if you want any further information. > The error: KeyError: 'getpwuid(): uid not found: 389' indicates that there is no 389 uid found inside the container. When the 389-ds package is installed, dirsrv user is created by using systemd-sysusers configuration. In Fedora/RHEL it has a preference for 389 uid/gid: https://src.fedoraproject.org/rpms/389-ds-base/blob/rawhide/f/389-ds-base.s… But in SUSE it has no preference and takes the first available uid/gid: https://build.opensuse.org/package/view_file/network:ldap/389-ds/dirsrv-use… a28855ee79c7:/ # cat /etc/passwd root:x:0:0:root:/root:/bin/bash dirsrv:x:499:486:User for 389 directory server:/var/lib/dirsrv:/sbin/nologin So in your case dirsrv user has 499 as the uid and 486 as gid. I don't know how stable these mappings are. And securityContext accepts these values as int64 only, so it's not possible to specify 'dirsrv' user: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-… You can add dirsrv user and group with 389 uid/gid before installing 389-ds. And then use 389 as runAsUser and fsGroup values. HTH > > > > On Mon, Feb 12, 2024 at 9:38 PM Viktor Ashirov <vashirov(a)redhat.com> > wrote: > >> Hi Antony, >> >> On Mon, Feb 12, 2024 at 3:37 PM Mark Reynolds <mareynol(a)redhat.com> >> wrote: >> >>> Forwarding to the correct list.... >>> >>> >>> -------- Forwarded Message -------- >>> Subject: dscontainer as non root >>> Date: Mon, 12 Feb 2024 20:01:09 +0530 >>> From: Antony Jose <anto346(a)gmail.com> <anto346(a)gmail.com> >>> To: 389-users-owner(a)lists.fedoraproject.org >>> >>> Hi, >>> Can we run dscontainer as non root process. I have deployed >>> dscontainer on k8s cluster as root user. However running as root user is >>> not the best security practice. Is there a tested way we can reliably run >>> ds389 as non root user. I tried tweaking security policies to use a non >>> root user. However, I get errors during dscontainer start up. >>> >> dscontainer certainly can run as non-root user, in the doc that you >> linked there is a securityContext section with runAsUser and fsGroup values >> that are set to 389, which is dirsrv user. >> >> Can you share errors that you get? >> Thanks. >> >> >>> >>> Took inspiration from this doc >>> https://www.port389.org/docs/389ds/howto/howto-deploy-389ds-on-openshift.ht… >>> >>> >>> Regards >>> Antony >>> -- >>> _______________________________________________ >>> 389-users mailing list -- 389-users(a)lists.fedoraproject.org >>> To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org >>> Fedora Code of Conduct: >>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: >>> https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject… >>> Do not reply to spam, report it: >>> https://pagure.io/fedora-infrastructure/new_issue >>> >> >> >> -- >> Viktor >> > -- Viktor

1 0

Fwd: dscontainer as non root
by Mark Reynolds 12 Feb '24

12 Feb '24

Forwarding to the correct list.... -------- Forwarded Message -------- Subject: dscontainer as non root Date: Mon, 12 Feb 2024 20:01:09 +0530 From: Antony Jose <anto346(a)gmail.com> To: 389-users-owner(a)lists.fedoraproject.org Hi, Can we run dscontainer as non root process. I have deployed dscontainer on k8s cluster as root user. However running as root user is not the best security practice. Is there a tested way we can reliably run ds389 as non root user. I tried tweaking security policies to use a non root user. However, I get errors during dscontainer start up. Took inspiration from this doc https://www.port389.org/docs/389ds/howto/howto-deploy-389ds-on-openshift.ht… Regards Antony

2 1

Announcing 389 Directory Server 3.0.1
by Simon Pichugin 02 Feb '24

02 Feb '24

389 Directory Server 3.0.1 The 389 Directory Server team is proud to announce 389-ds-base version 3.0.1 Fedora packages are available on RawHide. (For Fedora 40) Rawhide: https://koji.fedoraproject.org/koji/taskinfo?taskID=112619489 - Koji https://bodhi.fedoraproject.org/updates/FEDORA-2024-88f958bb2c - Bodhi The new packages and versions are: - 389-ds-base-3.0.1 Source tarballs are available for download at GitHub Releases page <https://github.com/389ds/389-ds-base/releases/tag/389-ds-base-3.0.1> - https://github.com/389ds/389-ds-base/releases/download/389-ds-base-3.0.1/38… <https://github.com/389ds/389ds.github.io/blob/main/docs/389ds/releases/rele…>Highlights in 3.0.1 - Lightning Memory-Mapped Database Manager (LMDB) is now used by default when creating new instances instead of Berkeley Database that is deprecated (but still usable) For more informations, see: FAQ about BerkeleyDB backend deprecation and using LMDB backend <https://github.com/389ds/389ds.github.io/blob/main/docs/389ds/FAQ/Berkeley-…> - The fact of using lmdb instead of Berkeley DB may greatly change the server dynamic so we decided to change the major version but in practice for instances that are still using Berkeley database, it is only a minor update. - Enhancements and Bug fixes <https://github.com/389ds/389ds.github.io/blob/main/docs/389ds/releases/rele…>Installation and Upgrade See Download <https://github.com/389ds/389ds.github.io/blob/main/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://github.com/389ds/389ds.github.io/blob/main/docs/389ds/howto/howto-i…> for more information about the initial installation and setup See Source <https://github.com/389ds/389ds.github.io/blob/main/docs/389ds/development/s…> for information about source tarballs and SCM (git) access. <https://github.com/389ds/389ds.github.io/blob/main/docs/389ds/releases/rele…> Feedback We are very interested in your feedback! Please provide feedback and comments to the - 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… - 389ds discussion channel: https://github.com/389ds/389-ds-base/discussions If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base - Bump version to 3.0.1 - Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045) - Issue 3555 - Remove audit-ci from dependencies (#6056) - Issue 6052 - Paged results test sets hostname to localhost on test collection - Issue 6051 - Drop unused pytest markers - Issue 6049 - lmdb - changelog is wrongly recreated by reindex task (#6050) - Issue 6047 - Add a check for tagged commits - Issue 6041 - dscreate ds-root - accepts relative path (#6042) - Switch default backend to lmdb and bump version to 3.0 (#6013) - Issue 6032 - Replication broken after backup restore (#6035) - Issue 6037 - Server crash at startup in vlvIndex_delete (#6038) - Issue 6034 - Change replica_id from str to int - Issue 6028 - vlv index keys inconsistencies (#6031) - Issue 5989 - RFE support of inChain Matching Rule (#5990) - Issue 6022 - lmdb inconsistency between vlv index and vlv cache names (#6026) - Issue 6015 - Fix typo remeber (#6014) - Issue 6016 - Pin upload/download artifacts action to v3 - Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007) - Issue 4673 - Update Rust crates - Issue 6004 - idletimeout may be ignored (#6005) - Issue 5954 - Disable Transparent Huge Pages - Issue 5997 - test_inactivty_and_expiration CI testcase is wrong (#5999) - Issue 5993 - Fix several race condition around CI tests (#5996) - Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994) - Bump openssl from 0.10.55 to 0.10.60 in /src (#5995) - Issue 5980 - Improve instance startup failure handling (#5991) - Issue 5976 - Fix freeipa install regression with lmdb (#5977) - Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987) - Issue 5984 - Crash when paged result search are abandoned (#5985) - Issue 5947 - CI test_vlv_recreation_reindex fails on LMDB (#5979)

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users February 2024