<html> <head> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 02/09/2015 12:13 PM, Chris Mohler wrote: </div> <blockquote cite="mid:54D906E7.2080003@oberlin.edu" type="cite"> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> <div class="moz-cite-prefix">On 02/09/2015 11:19 AM, Rich Megginson wrote: </div> <blockquote cite="mid:54D8DE08.2010002@redhat.com" type="cite"> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> <div class="moz-cite-prefix">On 02/09/2015 08:26 AM, Chris Mohler wrote: </div> <blockquote cite="mid:54D8D19E.1080703@oberlin.edu" type="cite"> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> <div class="moz-cite-prefix">On 02/09/2015 09:48 AM, Rich Megginson wrote: </div> <blockquote cite="mid:54D8C8B5.2080102@redhat.com" type="cite"> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> <div class="moz-cite-prefix">On 02/08/2015 08:23 PM, Chris Mohler wrote: </div> <blockquote cite="mid:CAOBT0Fkj+96YbQk=y2T0bxGE1Fd5Jtkrk55rh9qK0LTLRSAkoQ@mail.gmail.com" type="cite"> <div dir="ltr"> <div> <div>Thanks for the reply and the link Rich! </div> <div>dbmon.sh is a handy tool indeed. </div> <div> </div> I read the instructions and upped my entry cache size to 2gb because I have enough ram. </div> Everything went well until <pre><code>service dirsrv restart </code></pre> <pre><code>I Got the following errors: [06/Feb/2015:10:07:35 -0500] - slapd stopped. [06/Feb/2015:10:07:37 -0500] attr_syntax_create - Error: the EQUALITY matching rule [caseIgnoreIA5Match] is not compatible with the syntax [1.3.6.1.4.1.1466.115.121.1.15] for the attribute [dc] [06/Feb/2015:10:07:37 -0500] attr_syntax_create - Error: the SUBSTR matching rule [caseIgnoreIA5SubstringsMatch] is not compatible with the syntax [1.3.6.1.4.1.1466.115.121.1.15] for the attribute [dc] [06/Feb/2015:10:07:37 -0500] - 389-Directory/<a moz-do-not-send="true" href="http://1.2.11.15">1.2.11.15</a> B2014.314.1342 starting up [06/Feb/2015:10:07:37 -0500] - slapd started. Listening on All Interfaces port 7389 for LDAP requests [06/Feb/2015:10:07:37 -0500] - Listening on All Interfaces port 7390 for LDAPS requests </code></pre> <pre><code>Oddly enough everything appears to be working. Are these messages safe to ignore? </code></pre> </div> </blockquote> This is definitely not related to the cache size. <code>Not sure what the problem is - looks like something has done an override of the standard schema definition of dc. <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://tools.ietf.org/html/rfc4519">http://tools.ietf.org/html/rfc4519</a> defines it with syntax 1.3.6.1.4.1.1466.115.121.1.26. rpm -q 389-ds-base find /etc/dirsrv -name \*.ldif -exec grep 0.9.2342.19200300.100.1.25 {} /dev/null \; </code> <blockquote cite="mid:CAOBT0Fkj+96YbQk=y2T0bxGE1Fd5Jtkrk55rh9qK0LTLRSAkoQ@mail.gmail.com" type="cite"> <div dir="ltr"> <pre><code>Another run of dbmon.sh shows that my entry cache was increased. </code><code></code></pre> <pre><code>Thanks, </code></pre> <pre><code>-Chris </code></pre> <pre><code> </code></pre> </div> <div class="gmail_extra"> <div class="gmail_quote">On Sun, Feb 8, 2015 at 5:58 PM, Rich Megginson <<a moz-do-not-send="true" href="mailto:rmeggins@redhat.com" target="_blank">rmeggins@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div bgcolor="#FFFFFF" text="#000000"> <div> <div class="h5"> <div>On 02/07/2015 11:25 AM, Chris Mohler wrote: </div> <blockquote type="cite"> <div dir="ltr"> <pre>Hi Everyone. I'm trying to troubleshoot some issues I'm having. I want to increase the entry cache size </pre> <pre>I'm trying to follow the directions here </pre> <pre>/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 dn: cn=<code>database_name</code>, cn=ldbm database, cn=plugins, cn=config changetype: modify replace: nsslapd-cachememsize nsslapd-cachememsize: 20971520 </pre> <pre>Is this the correct way to do this? How do I find out what the " cn=<code>database_name" is supposed to be? </code></pre> </div> </blockquote> </div> </div> <code>see </code><a moz-do-not-send="true" href="https://github.com/richm/scripts/wiki/dbmon.sh" target="_blank">https://github.com/richm/scripts/wiki/dbmon.sh</a> - the script will tell you what the names of your databases are. <blockquote type="cite"> <div dir="ltr"> <pre><code> </code></pre> <pre><code>Thanks, </code></pre> <pre><code>-Chris </code></pre> </div> <fieldset></fieldset> </blockquote> </div> -- Manage your subscription for the Freeipa-users mailing list: <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> Go To <a moz-do-not-send="true" href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project </blockquote> </div> </div> </blockquote> <fieldset class="mimeAttachmentHeader"></fieldset> </blockquote> Thanks again Rich, I have been having an abundance of issues with my FreeIPA server lately. I'm not surprised that error is not related. I was not sure as It has not surfaced in my logs before I changed the entry cache size. Possibly this will be the clue to get me on the road to recovery. <blockquote type="cite"><code>Not sure what the problem is - looks like something has done an override of the standard schema definition of dc. <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://tools.ietf.org/html/rfc4519">http://tools.ietf.org/html/rfc4519</a> defines it with syntax 1.3.6.1.4.1.1466.115.121.1.26.</code></blockquote> I migrated from OpenLdap about a year ago. So my install is a migration. I also recently tried to add a replica. Which prompted me to update the schema on the master before it would replicate. </blockquote> What exactly did you do? You should not have migrated the standard schema from openldap. Did you have to override the definition of 'dc' for some reason? <blockquote cite="mid:54D8D19E.1080703@oberlin.edu" type="cite"> <blockquote type="cite"><code>rpm -q 389-ds-base</code></blockquote> <code>389-ds-base-1.2.11.15-48.el6_6.x86_64 </code> <blockquote type="cite"><code>find /etc/dirsrv -name \*.ldif -exec grep 0.9.2342.19200300.100.1.25 {} /dev/null \;</code> </blockquote> <code> </code>/etc/dirsrv/slapd-PKI-IPA/schema.bak/00core.ldif:attributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' ) /etc/dirsrv/slapd-PKI-IPA/schema/00core.ldif:attributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' ) /etc/dirsrv/slapd-PKI-IPA/schema/05rfc2247.ldif:attributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' ) DESC 'Standard LDAP attribute type' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 2247' ) </blockquote> This definition is wrong. Both RFC 2247 and RFC 4519 define 'dc' as syntax 1.3.6.1.4.1.1466.115.121.1.26 - that is, 7-bit ASCII only. Do you have some application that requires 8-bit or unicode characters (syntax 1.3.6.1.4.1.1466.115.121.1.15) in domain component names? If it is absolutely required that dc accepts unicode, then you'll have to change the matching rules as well, to be unicode compatible: EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch - that is, just get rid of the IA5. <blockquote cite="mid:54D8D19E.1080703@oberlin.edu" type="cite"> /etc/dirsrv/schema/00core.ldif:attributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' ) /etc/dirsrv/slapd-CS-OBERLIN-EDU/schema.bak/00core.ldif:attributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' ) /etc/dirsrv/slapd-CS-OBERLIN-EDU/schema/00core.ldif:attributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' ) Thanks again, -Chris <fieldset class="mimeAttachmentHeader"></fieldset> </blockquote> <fieldset class="mimeAttachmentHeader"></fieldset> </blockquote> <blockquote type="cite">What exactly did you do? You should not have migrated the standard schema from openldap. Did you have to override the definition of 'dc' for some reason?</blockquote> "what did you do?" Made me smile. I dug up my notes from the install and migrate from openldap. After ipa-server-install was successful I had a messy migration. I did the following #Disable the compat plugin $ipa-compat-manage disable #Restart the dirservice $service dirsrv restart #Enable Migration $ipa config-mod --enable-migration=TRUE </blockquote> Are you supposed to do --enable-migration=FALSE or --disable-migration after migration is complete? Perhaps during migration the schema is relaxed Can any IPA or DogTag developer comment about this schema issue? <blockquote cite="mid:54D906E7.2080003@oberlin.edu" type="cite"> #Run the migration script $ipa migrate-ds --bind-dn="cn=linux,ou=LDAPauth,dc=cs,dc=oberlin,dc=edu" --base-dn="dc=cs,dc=oberlin,dc=edu" --group-container=ou=Group --user-container=ou=People --user-objectclass=\* --user-ignore-objectclass=inetLocalMailRecipient --user-ignore-attribute="mailHost" --user-ignore-attribute="mailRoutingAddress" --user-ignore-objectclass=organizationalPerson --user-ignore-objectclass=inetOrgPerson --user-ignore-attribute="givenName" --user-ignore-attribute="roomNumber" --user-ignore-attribute="displayName" --user-ignore-attribute="mail" --user-ignore-attribute="homePhone" <a moz-do-not-send="true" class="moz-txt-link-freetext" href="ldap://cs.oberlin.edu:389">ldap://cs.oberlin.edu:389</a> #You may find that the script exits after a while with an error stating that the LDAP server is down. This seems #to be an OpenLdap side thing. To work around this, do the following. <code class="bash plain">$getent </code><code class="bash functions">passwd</code> <code class="bash plain">| </code><code class="bash functions">cut</code> <code class="bash plain">-d : -f 1 > </code><code class="bash functions">passwd</code> #And copy this passwd file, which now contains a list of every user, to the IdM. #Then, run the following on the IdM to copy until compl$ cp passwd missing $ touch present $ ipa migrate-ds --bind-dn="cn=linux,ou=LDAPauth,dc=cs,dc=oberlin,dc=edu" --base-dn="dc=cs,dc=oberlin,dc=edu" --group-container=ou=Group --user-container=ou=People --user-objectclass=\* --exclude-users=`cat present | tr '\n' ','` --user-ignore-objectclass=inetLocalMailRecipient --user-ignore-attribute="mailHost" --user-ignore-attribute="mailRoutingAddress" --user-ignore-objectclass=organizationalPerson --user-ignore-objectclass=inetOrgPerson --user-ignore-attribute="givenName" --user-ignore-attribute="roomNumber" --user-ignore-attribute="displayName" --user-ignore-attribute="mail" <a moz-do-not-send="true" class="moz-txt-link-freetext" href="ldap://cs.oberlin.edu:389">ldap://cs.oberlin.edu:389</a> $ E=1; while [ $E -gt "0" ]; do for i in `cat missing`; do ipa user-find --login=$i; if [ $? = "0" ]; then echo $i >> present; else echo $i >> missing1; fi; done; mv missing1 missing; ipa migrate-ds --bind-dn="cn=linux,ou=LDAPauth,dc=cs,dc=oberlin,dc=edu" --base-dn="dc=cs,dc=oberlin,dc=edu" --group-container=ou=Group --user-container=ou=People --user-objectclass=\* --exclude-users=`cat present | tr '\n' ','` --user-ignore-objectclass=inetLocalMailRecipient --user-ignore-attribute="mailHost" --user-ignore-attribute="mailRoutingAddress" --user-ignore-objectclass=organizationalPerson --user-ignore-objectclass=inetOrgPerson --user-ignore-attribute="homePhone" --user-ignore-attribute="givenName" --user-ignore-attribute="roomNumber" --user-ignore-attribute="displayName" --user-ignore-attribute="mail" <a moz-do-not-send="true" class="moz-txt-link-freetext" href="ldap://cs.oberlin.edu:389">ldap://cs.oberlin.edu:389</a>; E=$?; doneete: <code class="bash plain">Groups were processed a similar way. getent group > </code><code class="bash functions">groups </code><code class="bash keyword">while</code> <code class="bash functions">read</code> <code class="bash plain">line; </code><code class="bash keyword">do</code> <code class="bash plain">ipa group-add-member `</code><code class="bash functions">echo</code> <code class="bash plain">$line | </code><code class="bash functions">cut</code> <code class="bash plain">-d : -f 1` --</code><code class="bash functions">users</code><code class="bash plain">=`</code><code class="bash functions">echo</code> <code class="bash plain">$line | </code><code class="bash functions">cut</code> <code class="bash plain">-d : -f 4`; </code><code class="bash keyword">done</code> <code class="bash plain">< </code><code class="bash functions">groups Of course I am not the sys adm that did the migration I am working off some old notes. </code>Recently I tried to add a replica and the replica install asked me to run the following on the master. Which I did. copy-schema-to-ca.py #! /usr/bin/python2 """Copy the IPA schema to the CA directory server instance You need to run this script to prepare a 2.2 or 3.0 IPA master for installation of a 3.1 replica. Once a 3.1 replica is in the domain, every older CA master will emit schema replication errors until this script is run on it. """ import os import sys import pwd import shutil from ipapython import ipautil, dogtag from ipapython.ipa_log_manager import root_logger, standard_logging_setup from ipaserver.install.dsinstance import DS_USER, schema_dirname from ipaserver.install.cainstance import PKI_USER from ipalib import api try: from ipaplatform import services except ImportError: from ipapython import services # pylint: disable=no-name-in-module SERVERID = "PKI-IPA" SCHEMA_FILENAMES = ( "60kerberos.ldif", "60samba.ldif", "60ipaconfig.ldif", "60basev2.ldif", "60basev3.ldif", "60ipadns.ldif", "61kerberos-ipav3.ldif", "65ipacertstore.ldif", "65ipasudo.ldif", "70ipaotp.ldif", "05rfc2247.ldif", </blockquote> This is the file. I guess DogTag needs the relaxed schema definition for some reason? <blockquote cite="mid:54D906E7.2080003@oberlin.edu" type="cite"> ) def add_ca_schema(): """Copy IPA schema files into the CA DS instance """ pki_pent = pwd.getpwnam(PKI_USER) ds_pent = pwd.getpwnam(DS_USER) for schema_fname in SCHEMA_FILENAMES: source_fname = os.path.join(ipautil.SHARE_DIR, schema_fname) target_fname = os.path.join(schema_dirname(SERVERID), schema_fname) if not os.path.exists(source_fname): root_logger.debug('File does not exist: %s', source_fname) continue if os.path.exists(target_fname): root_logger.info( 'Target exists, not overwriting: %s', target_fname) continue try: shutil.copyfile(source_fname, target_fname) except IOError, e: root_logger.warning('Could not install %s: %s', target_fname, e) else: root_logger.info('Installed %s', target_fname) os.chmod(target_fname, 0440) # read access for dirsrv user/group os.chown(target_fname, pki_pent.pw_uid, ds_pent.pw_gid) def restart_pki_ds(): """Restart the CA DS instance to pick up schema changes """ root_logger.info('Restarting CA DS') services.service('dirsrv').restart(SERVERID) def main(): if os.getegid() != 0: sys.exit("Must be root to run this script") standard_logging_setup(verbose=True) # In 3.0, restarting needs access to api.env (options, argv) = api.bootstrap_with_global_options(context='server') add_ca_schema() restart_pki_ds() root_logger.info('Schema updated successfully') main() <blockquote type="cite">This definition is wrong. Both RFC 2247 and RFC 4519 define 'dc' as syntax 1.3.6.1.4.1.1466.115.121.1.26 - that is, 7-bit ASCII only. Do you have some application that requires 8-bit or unicode characters (syntax 1.3.6.1.4.1.1466.115.121.1.15) in domain component names? If it is absolutely required that dc accepts unicode, then you'll have to change the matching rules as well, to be unicode compatible: EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch - that is, just get rid of the IA5. </blockquote> I am only using FreeIPA to authenticate linux clients for user login via SSSD. Using Pam. I don't have any applications that would require 8-bit or Unicode characters. Is it possible to return to a standard definition? -Chris <fieldset class="mimeAttachmentHeader"></fieldset> </blockquote> </body> </html>