You are viewing [info]richmegginson's journal

Rich Megginson's Journal
 
[Most Recent Entries] [Calendar View] [Friends]

Below are the 20 most recent journal entries recorded in Rich Megginson's LiveJournal:

    [ << Previous 20 ]
    Thursday, March 29th, 2012
    9:50 am
    Announcing 389 Directory Server 1.2.10.4 - Stable
    1.2.10.4 was released to the Stable repos in Fedora and EPEL. .4 fixes a hang when using the compare operation with virtual attributes.

    We've also stopped using Red Hat Bugzilla for our 389 issue tracking, and are now using https://fedorahosted.org/389 Trac. You'll need a Fedora account in order to file new tickets.

    Release Notes - http://port389.org/wiki/Release_Notes
    Tuesday, March 13th, 2012
    3:32 pm
    Announcing 389 Directory Server 1.2.10.4 - Testing
    1.2.10.4 was released to the Testing repos in Fedora and EPEL. .4 fixes a hang when using the compare operation with virtual attributes.

    We've also stopped using Red Hat Bugzilla for our 389 issue tracking, and are now using https://fedorahosted.org/389 Trac. You'll need a Fedora account in order to file new tickets.

    Release Notes - http://port389.org/wiki/Release_Notes
    Thursday, March 8th, 2012
    10:57 am
    Announcing 389 Directory Server 1.2.10.3 - Testing
    1.2.10.3 was released to the Testing repos in Fedora and EPEL. .3 fixes a crash when using password policies, and a few other bugs found with valgrind.

    We've also stopped using Red Hat Bugzilla for our 389 issue tracking, and are now using https://fedorahosted.org/389 Trac. You'll need a Fedora account in order to file new tickets.

    Release Notes - http://port389.org/wiki/Release_Notes
    Monday, February 6th, 2012
    6:52 pm
    Announcing 389 Directory Server 1.2.10 Release Candidate 1 - Testing
    1.2.10 Release Candidate 1 was released to the Testing repos in Fedora and EPEL. RC1 has no new features since alpha 8, but many, many bug fixes.

    We've also stopped using Red Hat Bugzilla for our 389 issue tracking, and are now using https://fedorahosted.org/389 Trac. You'll need a Fedora account in order to file new tickets.

    Release Notes - http://port389.org/wiki/Release_Notes
    Friday, January 27th, 2012
    9:50 am
    Announcing 389 Directory Server 1.2.10 Alpha 8 - Testing
    1.2.10 Alpha 8 was released to the Testing repos in Fedora and EPEL. 1.2.10 has some new features and many bug fixes.

    We've also stopped using Red Hat Bugzilla for our 389 issue tracking, and are now using https://fedorahosted.org/389 Trac. You'll need a Fedora account in order to file new tickets.

    Release Notes - http://port389.org/wiki/Release_Notes
    Thursday, September 8th, 2011
    8:33 am
    Announcing 389 Directory Server 1.2.9.9 - Stable
    1.2.9.9 was released today to Stable in Fedora and EPEL 5 and EPEL 6 (for EL6.1 and later). This is primarily a bug fix release to fix several bugs found in 1.2.9.x testing.

    Release Notes - http://port389.org/wiki/Release_Notes
    Tuesday, August 16th, 2011
    1:11 pm
    Announcing 389 Directory Server 1.2.9.6 - Testing
    389-ds-base 1.2.9.6 is now available from the Testing repositories. We now have EL6 support. Due to the fact that, beginning with RHEL6.1, 389-ds-base is now in the base OS, and the replication/winsync functionality is in a separate, add-on package ds-replication, we are using repos.fedorapeople.org to make full 389-ds-base binary packages available. See http://directory.fedoraproject.org/wiki/Download for more infomation.

    Release Notes: http://port389.org/wiki/Release_Notes
    Tuesday, April 26th, 2011
    2:27 pm
    Announcing 389 Directory Server 1.2.8.2 - Stable
    1.2.8.2 was released today to Stable in Fedora and EPEL 5. There are a couple of new features, and many bug fixes since the last stable release (1.2.7.5).

    http://port389.org/wiki/Release_Notes
    Monday, April 18th, 2011
    5:14 pm
    Announcing 389 Directory Server 1.2.8.2 - Testing
    1.2.8.2 was released today to Testing in Fedora and EPEL 5. It was released to Stable in Fedora 15 in order to solve some issues related to the move to systemd (tmpfiles.d). This is a bug fix release.

    http://port389.org/wiki/Release_Notes
    Monday, April 11th, 2011
    8:26 am
    Announcing 389 Directory Server 1.2.8.1 - Testing
    1.2.8.1 was released today to Testing in Fedora and EPEL 5. This release contains many bug fixes.

    http://port389.org/wiki/Release_Notes
    Friday, March 25th, 2011
    2:13 pm
    Announcing 389 Directory Server 1.2.8 Release Candidate 2
    1.2.8 Release Candidate 2 was released today to Testing in Fedora and EPEL 5. This release contains many bug fixes.

    http://port389.org/wiki/Release_Notes
    Thursday, March 3rd, 2011
    10:46 am
    Announcing 389 Directory Server 1.2.8 Release Candidate 1
    1.2.8 Release Candidate 1 was released today to Testing in Fedora and EPEL 5. This release contains many bug fixes.

    http://port389.org/wiki/Release_Notes
    Wednesday, January 26th, 2011
    8:23 am
    Announcing 389 Directory Server 1.2.8 Alpha 1
    1.2.8 Alpha 1 was released today to Testing in Fedora and EPEL 5. This release contains many bug fixes, with many more to come in subsequent 1.2.8 alpha and rc releases.

    http://port389.org/wiki/Release_Notes
    Friday, December 17th, 2010
    11:34 am
    Announcing 389 Directory Server 1.2.7.5
    389 Directory Server 1.2.7.5 was released today. This is to fix a few problems found in testing 1.2.7.2, .3, and .4.

    * Bug 663597 - Memory leaks in normalization code
    * Bug 661792 - Valid managed entry config rejected
    * Bug 658312 - Invalid free in Managed Entry plug-in
    * Bug 641944 - Don't normalize non-DN RDN values

    Details here - http://port389.org/wiki/Release_Notes
    Wednesday, December 15th, 2010
    3:09 pm
    Setting up a Kerberos server on RHEL6 for SASL/GSSAPI testing
    Steps to configure Kerberos and add principals for Replication using GSSAPI on RHEL6

    Notes:
    * can be used on a machine already configured with another realm - add a realm to /etc/krb5.conf
    * does not use LDAP for Kerberos DB

    http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/Configuring_a_Kerberos_5_Server.html

    My /etc/krb5.conf is already set up for using Kerberos internally. I added another realm for testing:
    ...
    [realms]
    ...
     TESTDOMAIN.COM = {
      kdc = vmhost.testdomain.com:88
      admin_server = vmhost.testdomain.com:749
      default_domain = testdomain.com
     }
    
    [domain_realm]
    ...
     .testdomain.com = TESTDOMAIN.COM
     testdomain.com = TESTDOMAIN.COM
    ...
    

    I mostly just have to remember to specify my realm TESTDOMAIN.COM to all of the Kerberos commands.
    /usr/sbin/kdb5_util create -s -r TESTDOMAIN.COM
    vi /var/kerberos/krb5kdc/kdc.conf - change EXAMPLE.COM to TESTDOMAIN.COM
    vi /var/kerberos/krb5kdc/kadm5.acl - change EXAMPLE.COM to TESTDOMAIN.COM
    kadmin.local -r TESTDOMAIN.COM -q "addprinc scarter/admin@TESTDOMAIN.COM"
    vi /etc/sysconfig/krb5kdc - KRB5REALM=TESTDOMAIN.COM
    vi /etc/sysconfig/kadmin - KRB5REALM=TESTDOMAIN.COM
    service krb5kdc start
    service kadmin start
    kadmin.local -r TESTDOMAIN.COM
    > addprinc scarter # use sprain as the password
    > addprinc -randkey ldap/vmhost.testdomain.com
    > ktadd -k /path/to/ldap.keytab ldap/vmhost.testdomain.com
    

    Adding the principal for scarter is not strictly necessary, but it allows you to have a user principal for testing ldapsearch -Y GSSAPI and sasl mapping.
    KRB5CCNAME=/tmp/scarter.krb kinit scarter@TESTDOMAIN.COM
    KRB5CCNAME=/tmp/scarter.krb klist
    KRB5CCNAME=/tmp/scarter.krb ldapsearch -h vmhost.testdomain.com -p port -Y GSSAPI -s base -b ""
    
    Monday, November 15th, 2010
    1:28 pm
    Installing RHEL6 using a USB thumb drive
    My cd/dvd drive conked out, and I wanted to install RHEL6 on a machine. The machine is able to boot from a USB drive. There is no Live RHEL6 DVD/CD/USB, so it is a manual procedure. This is what I did:

    1) format an 8GB USB drive
    2) From RHN, go to the channel you want to use - in my case RHEL6 Workstation, and choose your arch
    3) Download both the minimal/network install ISO, and the full package DVD ISO - you will need both
    4) Using the Fedora Live USB Creator, make the USB drive bootable using the minimal/network install ISO - be sure to leave plenty of space for the full package DVD ISO
    5) once the USB drive is complete, copy the DVD ISO to the USB thumb drive - then eject the thumb drive
    6) Plug the USB drive into your computer and reboot
    7) You may have to hit F-12 or some other function key to get to the BIOS boot menu - select the USB device
    8) You should then see the RHEL install screen - select your install option
    9) Go through the install screens - you will eventually get to a screen that says something like
    Install from:
    CD
    Hard Drive
    Network
    HTTP/FTP
    Choose "Hard Drive" - if it prompts you for the path, just hit Enter or "/" if you must enter something - this is the location of the DVD ISO

    Q: Why is this necessary? Why can't I just create the live usb from the DVD ISO, boot from that, and install from that?

    A: If you select to install from a Hard Drive, the RHEL installer program must have an ISO file to install from - it doesn't understand that you are booting from the Hard Drive that has the packages too.

    I suppose you could use the DVD ISO to create the live usb, but you would also need to have the entire ISO as well.
    Friday, October 1st, 2010
    11:27 am
    Re-Announcing 389 Directory Server 1.2.6.1 -2
    The original release of 1.2.6.1 was messed up. I submitted the wrong patches to the Fedora build system. As a result, 1.2.6.1 did not have the correct patches to fix the crash bugs. 389-ds-base-1.2.6.1-2 was released to Testing in order to fix these problems. Please help us test so we can get these crash bugs fixed and released in Stable ASAP.

    Details here - http://port389.org/wiki/Release_Notes
    Tuesday, September 28th, 2010
    2:41 pm
    Announcing 389 Directory Server 1.2.6.1
    389 Directory Server 1.2.6.1 was released today. This is to fix a few problems found in 1.2.6.1, including two crashing problems - one in winsync, and one which usually occurs with deletion.

    * Bug 635987 - Incorrect sub scope search result with ACL containing ldap:///self
    * Bug 612264 - ACI issue with (targetattr='userPassword')
    * Bug 606920 - anonymous resource limit- nstimelimit - also applied to "cn=directory manager"
    * Bug 631862 - crash - delete entries not in cache + referint
    * Bug 634561 - Server crushes when using Windows Sync Agreement

    Details here - http://port389.org/wiki/Release_Notes
    Monday, September 13th, 2010
    4:28 pm
    Announcing 389 Directory Server 1.2.6
    389 Directory Server 1.2.6 was released today. This is essentially the same as 1.2.6 RC7.

    This release contains a few new features (including big ones such as Subtree Rename and SELinux policy) and many, many bug fixes.

    Details here - http://port389.org/wiki/Release_Notes
    Wednesday, August 11th, 2010
    9:45 am
    Using sed to unwrap ldif lines
    LDIF is the ASCII format used to represent LDAP data. Tools such as ldapsearch produce LDIF output. LDIF wraps long lines.  Continuation lines begin with a space.  For example:
    ...
    description: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
     bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
     ccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
    someotherattribute: ....
    

    Programs that read LDIF must be able to concatenate the lines into a single value without the newline+space. This is problematic for a large number of use cases where you may want to use standard *nix tools such as grep to parse the output e.g.
    ldapsearch .... "attr=something" | grep pattern
    

    This is a problem if the attribute value is very long - the pattern may or may not match depending on how the value is wrapped. There is a very simple perl one-liner which can do this:
    perl -p0e 's/\n //g' file.ldif
    

    but sometimes perl is not the right tool for the job. Since sed is part of the standard *nix toolkit, and is very powerful, it would be nice to be able to use sed for this.

    I started with http://www.shell-fu.org/lister.php?id=234 :
    /^ / {; H; d; }; /^ /! {; x; s/\n //; };
    

    Which is a good place to start, but has a few problems:
    * prints a blank line as the first line
    * does not handle more than one continuation line
    * chops off the last line

    Here is my solution, which works with sed -n (to suppress printing - the sed program does the printing):
    1 {h; $ !d}; $ {x; s/\n //g; p}; /^ / {H; d}; /^ /! {x; s/\n //g; p}
    

    For those unfamiliar with sed, here is a good introduction: http://www.grymoire.com/Unix/Sed.html


    Notes: { and } are used for command grouping - ; is the command delimiter. The sed command above is really 4 separate address/command pairs.
    1 {h; $ !d};
    

    On the first line, store the line in the hold buffer. If this is not the last line, delete it, and go to the next line. If it is the last line, it will fall through to the next statement $ .... This (with sed -n) supresses printing the first line.
    $ {x; s/\n //g; p};
    

    On the last line, swap the hold buffer into the current pattern buffer. Delete all (/g) occurances of newline+space in the current pattern buffer. Print the current pattern buffer. This solves the problem that the original had with printing the last line.
    /^ / {H; d};
    

    If the line is a continuation line, just add it to the hold space, delete it, and go to the next line.
    /^ /! {x; s/\n //g; p}
    

    If the line is not a continuation line, swap the hold buffer with the current pattern buffer. Delete all (/g) occurances of newline+space in the current pattern buffer. Print the current pattern buffer.


    To use this in a shell command:
    $ ldapsearch .... '(something=otherthing)' | sed -n '1 {h; $ !d}; $ {x; s/\n //g; p}; /^ / {H; d}; /^ /! {x; s/\n //g; p}' | grep somepattern
    

    Another common task is getting the value of a single-valued attribute. This is similar to the above, but slightly more complicated. This assumes you have a shell variable called attrname which you have set to the name of the attribute you are interested in. The sed looks like this and is quoted for the shell:
    '/^'$attrname':/,/^$/ { /^'$attrname':/ { s/^'$attrname': *// ; h ; $ !d}; /^ / { H; $ !d}; /^ /! { x; s/\n //g; p; q}; $ { x; s/\n //g; p; q} }'
    

    The blow-by-blow description:
    /^'$attrname':/,/^$/ {
    

    Only perform the following actions between lines that begin with attrname: to the end of the entry. In LDIF entries end with an empty line or EOF.
    /^'$attrname':/ { s/^'$attrname': *// ; h ; $ !d};
    

    If the line begins with attrname:, delete the attrname, the colon, and any white space after the colon, so that we have just the attribute value without the attribute name. Save the result to the hold buffer. If this is not EOF, delete the pattern buffer, and go to the next line. If this is EOF, fall through to the EOF statement ($ ...). The rest is similar to the previous, except that the last one ends with q - this assumes the attribute is single valued.
    /^ / { H; $ !d};
    

    If this is a continuation line, add it to the hold buffer. If not EOF, delete it, and go to the next line. If EOF, fall through to the EOF case.
    /^ /! { x; s/\n //g; p; q};
    

    If the line is not a continuation line, swap the hold buffer with the current pattern buffer. Delete all (/g) occurances of newline+space in the current pattern buffer. Print the current pattern buffer. Quit the sed program.
    $ { x; s/\n //g; p; q} }
    

    If we are at EOF, swap the hold buffer with the current pattern buffer. Delete all (/g) occurances of newline+space in the current pattern buffer. Print the current pattern buffer. Quit the sed program. Note that this only works with the first occurance of the attribute, and only works with single-valued attributes.

    Here is an example:
    $ attrname=svattrname
    $ attrval=`ldapsearch ... '(somefilter)' $attrname | sed -n '/^'$attrname':/,/^$/ { /^'$attrname':/ { s/^'$attrname': *// ; h ; $ !d}; /^ / { H; $ !d}; /^ /! { x; s/\n //g; p; q}; $ { x; s/\n //g; p; q} }'`
    

    Assuming (somefilter) is a valid LDAP search filter which returns a single entry, and svattrname is the name of a single-valued attribute in that entry, attrval will contain the value of that attribute, with the continuation lines unwrapped.
[ << Previous 20 ]
About LiveJournal.com