Soup To Nuts Sun DSEE - Revision history

Hutch: /* The incorrect way */

Hutch — Wed, 06 Aug 2008 17:02:23 GMT

The incorrect way

←Older revision		Revision as of 17:02, 6 August 2008
Line 759:		Line 759:
	[06/Aug/2008:10:39:53 -0500] - INFORMATION - gle - conn=58046937 op=0 msgId=1 - Password policy migration: The entry "dn:cn=proxyagent,ou=profile,dc=subdomain,dc=example,dc=com" contains "passwordExpirationTime:20380119031407Z". While a passwordExpirationTime far in the future implies "never expires" in previous versions of Directory Server, this DSA supports multiple password policies, and this feature should be used instead.		[06/Aug/2008:10:39:53 -0500] - INFORMATION - gle - conn=58046937 op=0 msgId=1 - Password policy migration: The entry "dn:cn=proxyagent,ou=profile,dc=subdomain,dc=example,dc=com" contains "passwordExpirationTime:20380119031407Z". While a passwordExpirationTime far in the future implies "never expires" in previous versions of Directory Server, this DSA supports multiple password policies, and this feature should be used instead.

-	See [~~Common Warnings Codes~~ http://docs.sun.com/app/docs/doc/820-2768/common-warning-codes?a=view] in the [http://docs.sun.com/app/docs/doc/820-2768 Sun DSEE 6.3 Troubleshooting Guide] for more information.	+	See [http://docs.sun.com/app/docs/doc/820-2768/common-warning-codes?a=view Common Warning Codes] in the [http://docs.sun.com/app/docs/doc/820-2768 Sun DSEE 6.3 Troubleshooting Guide] for more information.

	=== Create user home directories ===		=== Create user home directories ===

Hutch: /* Prevent the ''proxyagent'' user's password from expiring */

Hutch — Wed, 06 Aug 2008 17:01:38 GMT

Prevent the ''proxyagent'' user's password from expiring

←Older revision		Revision as of 17:01, 6 August 2008
Line 696:		Line 696:
	== Final Steps ==		== Final Steps ==

-	=== Prevent the ''proxyagent'' ~~user~~'~~s password~~ from expiring ===	+	=== Prevent the passwords for ''proxyagent'' and ''replication manager'' from expiring ===

-	If you are using the proxy credential level on LDAP clients, the ''proxyagent'' user's password should never expire]. If it does, LDAP clients will not be able to retrieve name service information from the LDAP server(s).	+	If you are using the proxy credential level on LDAP clients, the ''proxyagent'' user's password should never expire. If it does, LDAP clients will not be able to retrieve name service information from the LDAP server(s).
		+
		+	Likewise, if you are using replication, you do not want this password to expire.

	==== The correct way ====		==== The correct way ====

-	With DSEE 6.x, the correct way to prevent a password from expiring is to add specialized password policy (i.e., a password policy subentry), and modify service accounts (e.g., '''proxyagent''') to use the specialized password policy.	+	With DSEE 6.x, the correct way to prevent a password from expiring is to add a specialized password policy (i.e., a password policy subentry), and modify service accounts (e.g., ''proxyagent'' and ''replication manager'') to use the specialized password policy.

	[http://forums.sun.com/thread.jspa?forumID=761&threadID=5056424 This thread], specifically the post by '''gtholbert''', shows how to implement this.		[http://forums.sun.com/thread.jspa?forumID=761&threadID=5056424 This thread], specifically the post by '''gtholbert''', shows how to implement this.
Line 738:		Line 740:

	dn: cn=proxyagent,ou=profile,dc=subdomain,dc=example,dc=com		dn: cn=proxyagent,ou=profile,dc=subdomain,dc=example,dc=com
		+	changetype: modify
		+	replace: passwordPolicySubentry
		+	passwordPolicySubentry: cn=Service Password Policy,cn=config
		+
		+	dn: cn=replication manager,cn=replication,cn=config
	changetype: modify		changetype: modify
	replace: passwordPolicySubentry		replace: passwordPolicySubentry

Hutch: /* Prevent the ''proxyagent'' user's password from expiring */

Hutch — Wed, 06 Aug 2008 16:51:30 GMT

Prevent the ''proxyagent'' user's password from expiring

←Older revision		Revision as of 16:51, 6 August 2008
Line 698:		Line 698:
	=== Prevent the ''proxyagent'' user's password from expiring ===		=== Prevent the ''proxyagent'' user's password from expiring ===

-	If you are using the proxy credential level on LDAP clients, the ''proxyagent'' user's password ~~[http://docs.sun.com/app/docs/doc/816-4556/6maort2td?a=view~~ should never expire]. If it does, LDAP clients will not be able to retrieve name service information from the LDAP server(s).	+	If you are using the proxy credential level on LDAP clients, the ''proxyagent'' user's password should never expire]. If it does, LDAP clients will not be able to retrieve name service information from the LDAP server(s).

	==== The correct way ====		==== The correct way ====

Hutch: /* The wrong way */

Hutch — Wed, 06 Aug 2008 16:49:43 GMT

The wrong way

←Older revision		Revision as of 16:49, 6 August 2008
Line 742:		Line 742:
	passwordPolicySubentry: cn=Service Password Policy,cn=config		passwordPolicySubentry: cn=Service Password Policy,cn=config

-	==== The ~~wrong~~ way ====	+	==== The incorrect way ====

	To prevent the ''proxyagent'' user's password from expiring:		To prevent the ''proxyagent'' user's password from expiring:

Hutch: /* Final Steps */

Hutch — Wed, 06 Aug 2008 16:48:56 GMT

Final Steps

←Older revision		Revision as of 16:48, 6 August 2008
Line 699:		Line 699:

	If you are using the proxy credential level on LDAP clients, the ''proxyagent'' user's password [http://docs.sun.com/app/docs/doc/816-4556/6maort2td?a=view should never expire]. If it does, LDAP clients will not be able to retrieve name service information from the LDAP server(s).		If you are using the proxy credential level on LDAP clients, the ''proxyagent'' user's password [http://docs.sun.com/app/docs/doc/816-4556/6maort2td?a=view should never expire]. If it does, LDAP clients will not be able to retrieve name service information from the LDAP server(s).
		+
		+	==== The correct way ====
		+
		+	With DSEE 6.x, the correct way to prevent a password from expiring is to add specialized password policy (i.e., a password policy subentry), and modify service accounts (e.g., '''proxyagent''') to use the specialized password policy.
		+
		+	[http://forums.sun.com/thread.jspa?forumID=761&threadID=5056424 This thread], specifically the post by '''gtholbert''', shows how to implement this.
		+
		+	Example LDIF:
		+
		+	dn: cn=Service Password Policy,cn=config
		+	changetype: add
		+	objectClass: top
		+	objectClass: passwordPolicy
		+	cn: Service Password Policy
		+	description: A password policy intended for proxy or service accounts.
		+	passwordMustChange: off
		+	passwordChange: off
		+	passwordMinAge: 0
		+	passwordInHistory: 0
		+	passwordExp: off
		+	passwordMaxAge: 2142720000
		+	passwordWarning: 0
		+	passwordExpireWithoutWarning: off
		+	passwordCheckSyntax: off
		+	passwordMinLength: 6
		+	passwordRootdnMayBypassModsChecks: off
		+	passwordStorageScheme: SSHA
		+	passwordLockout: off
		+	passwordMaxFailure: 32700
		+	passwordUnlock: on
		+
		+	* Add the above LDIF to both directory servers.
		+	# '''ldapmodify -a -f /tmp/service_password_policy.ldif -D 'cn=Directory Manager''''
		+	...
		+	adding new entry cn=Service Password Policy,cn=config
		+
		+	* Configure the service account ('''proxyagent''' in this example) to use the password policy subentry. This entry will replicate and will only have to be added on one of the directory servers.
		+
		+	dn: cn=proxyagent,ou=profile,dc=subdomain,dc=example,dc=com
		+	changetype: modify
		+	replace: passwordPolicySubentry
		+	passwordPolicySubentry: cn=Service Password Policy,cn=config
		+
		+	==== The wrong way ====

	To prevent the ''proxyagent'' user's password from expiring:		To prevent the ''proxyagent'' user's password from expiring:
Line 704:		Line 748:
	'''modify\nreplace: PasswordExpirationTime\nPasswordExpirationTime: 20380119031407Z\n" \| \'''		'''modify\nreplace: PasswordExpirationTime\nPasswordExpirationTime: 20380119031407Z\n" \| \'''
	'''ldapmodify -h hostname1 -D "cn=Directory Manager"'''		'''ldapmodify -h hostname1 -D "cn=Directory Manager"'''
		+
		+	If you use this method, your DSEE logs will be riddled with messages similar to:
		+	[06/Aug/2008:10:39:53 -0500] - INFORMATION - gle - conn=58046937 op=0 msgId=1 - Password policy migration: The entry "dn:cn=proxyagent,ou=profile,dc=subdomain,dc=example,dc=com" contains "passwordExpirationTime:20380119031407Z". While a passwordExpirationTime far in the future implies "never expires" in previous versions of Directory Server, this DSA supports multiple password policies, and this feature should be used instead.
		+
		+	See [Common Warnings Codes http://docs.sun.com/app/docs/doc/820-2768/common-warning-codes?a=view] in the [http://docs.sun.com/app/docs/doc/820-2768 Sun DSEE 6.3 Troubleshooting Guide] for more information.

	=== Create user home directories ===		=== Create user home directories ===

Hutch: /* Upgrading to DS 6.3 */

Hutch — Tue, 27 May 2008 15:56:16 GMT

Upgrading to DS 6.3

←Older revision		Revision as of 15:56, 27 May 2008
Line 787:		Line 787:
	I used this basic procedure to upgrade from DS 6.2 to DS 6.3 on our two LDAP servers.		I used this basic procedure to upgrade from DS 6.2 to DS 6.3 on our two LDAP servers.

-	* Delete the replication agreements between the two LDAP servers. (I'm not sure if this step is needed, but I'm doing it just in case).
	* Stop the Directory Server instance on ''hostname2''.		* Stop the Directory Server instance on ''hostname2''.
	* Uncompress and install Directory Server 6.3, overwriting the previous installation.		* Uncompress and install Directory Server 6.3, overwriting the previous installation.
Line 794:		Line 793:
	* Confirm that any pending replication changes from ''hostname1'' have transferred.		* Confirm that any pending replication changes from ''hostname1'' have transferred.
	* Repeat the process on ''hostname1''.		* Repeat the process on ''hostname1''.
-	* Establish the replication agreements between the two LDAP servers.
-
-	(hostname1) # '''dsconf delete-repl-agmt-status dc=subdomain,dc=example,dc=com hostname2:636
-	(hostname2) # '''dsconf delete-repl-agmt-status dc=subdomain,dc=example,dc=com hostname1:636

	On ''hostname2'':		On ''hostname2'':

Hutch: /* Upgrading to DS 6.3 */

Hutch — Tue, 27 May 2008 15:54:07 GMT

Upgrading to DS 6.3

←Older revision		Revision as of 15:54, 27 May 2008
Line 800:		Line 800:

	On ''hostname2'':		On ''hostname2'':
-	# '''~~/opt/SUNWdsee/ds6/bin/~~dsadm stop /var/ds'''	+	# '''dsadm stop /var/ds'''
	$ '''gzip -cd DSEE.6.3.Solaris-Sparc-full.tar.gz \| tar xf -'''		$ '''gzip -cd DSEE.6.3.Solaris-Sparc-full.tar.gz \| tar xf -'''
	$ '''cd DSEE_ZIP_Distribution'''		$ '''cd DSEE_ZIP_Distribution'''
	# '''./dsee_deploy install --no-inter --install-path /opt/SUNWdsee'''		# '''./dsee_deploy install --no-inter --install-path /opt/SUNWdsee'''
-	# '''~~/opt/SUNWdsee/ds6/bin/~~dsadm export /var/ds dc=subdomain,dc=example,dc=com /tmp/suffix.ldif'''	+	# '''dsadm export /var/ds dc=subdomain,dc=example,dc=com /tmp/suffix.ldif'''
-	# '''~~/opt/SUNWdsee/ds6/bin/~~dsadm import /var/ds /tmp/suffix.ldif dc=dev,dc=aps,dc=unix,dc=navitaire,dc=com'''	+	# '''dsadm import /var/ds /tmp/suffix.ldif dc=dev,dc=aps,dc=unix,dc=navitaire,dc=com'''
-	# '''~~/opt/SUNWdsee/ds6/bin/~~dsadm start /var/ds'''	+	# '''dsadm start /var/ds'''

	On ''hostname1'':		On ''hostname1'':
-	# '''~~/opt/SUNWdsee/ds6/bin/~~dsadm stop /var/ds'''	+	# '''dsadm stop /var/ds'''
	$ '''gzip -cd DSEE.6.3.Solaris-Sparc-full.tar.gz \| tar xf -'''		$ '''gzip -cd DSEE.6.3.Solaris-Sparc-full.tar.gz \| tar xf -'''
	$ '''cd DSEE_ZIP_Distribution'''		$ '''cd DSEE_ZIP_Distribution'''
	# '''./dsee_deploy install --no-inter --install-path /opt/SUNWdsee'''		# '''./dsee_deploy install --no-inter --install-path /opt/SUNWdsee'''
-	# '''~~/opt/SUNWdsee/ds6/bin/~~dsadm export /var/ds dc=subdomain,dc=example,dc=com /tmp/suffix.ldif'''	+	# '''dsadm export /var/ds dc=subdomain,dc=example,dc=com /tmp/suffix.ldif'''
-	# '''~~/opt/SUNWdsee/ds6/bin/~~dsadm import /var/ds /tmp/suffix.ldif dc=dev,dc=aps,dc=unix,dc=navitaire,dc=com'''	+	# '''dsadm import /var/ds /tmp/suffix.ldif dc=dev,dc=aps,dc=unix,dc=navitaire,dc=com'''
-	# '''~~/opt/SUNWdsee/ds6/bin/~~dsadm start /var/ds'''	+	# '''dsadm start /var/ds'''

	== Creating an additional Directory Server instance ==		== Creating an additional Directory Server instance ==

Hutch: /* Upgrading to DS 6.2 */

Hutch — Tue, 27 May 2008 15:52:33 GMT

Upgrading to DS 6.2

←Older revision		Revision as of 15:52, 27 May 2008
Line 766:		Line 766:

	On ''hostname2'':		On ''hostname2'':
-	# '''~~/opt/SUNWdsee/ds6/bin/~~dsadm stop /var/ds'''	+	# '''dsadm stop /var/ds'''
	$ '''gzip -cd DSEE.6.2.Solaris-Sparc-full.tar.gz \| tar xf -'''		$ '''gzip -cd DSEE.6.2.Solaris-Sparc-full.tar.gz \| tar xf -'''
	$ '''cd DSEE_ZIP_Distribution'''		$ '''cd DSEE_ZIP_Distribution'''
	# '''./dsee_deploy install --no-inter --install-path /opt/SUNWdsee'''		# '''./dsee_deploy install --no-inter --install-path /opt/SUNWdsee'''
-	# '''~~/opt/SUNWdsee/ds6/bin/~~dsadm start /var/ds'''	+	# '''dsadm start /var/ds'''
	(hostname1) # '''dsconf show-repl-agmt-status dc=subdomain,dc=example,dc=com hostname2:636'''		(hostname1) # '''dsconf show-repl-agmt-status dc=subdomain,dc=example,dc=com hostname2:636'''

	On ''hostname1'':		On ''hostname1'':
-	# '''~~/opt/SUNWdsee/ds6/bin/~~dsadm stop /var/ds'''	+	# '''dsadm stop /var/ds'''
	$ '''gzip -cd DSEE.6.2.Solaris-Sparc-full.tar.gz \| tar xf -'''		$ '''gzip -cd DSEE.6.2.Solaris-Sparc-full.tar.gz \| tar xf -'''
	$ '''cd DSEE_ZIP_Distribution'''		$ '''cd DSEE_ZIP_Distribution'''
	# '''./dsee_deploy install --no-inter --install-path /opt/SUNWdsee'''		# '''./dsee_deploy install --no-inter --install-path /opt/SUNWdsee'''
-	# '''~~/opt/SUNWdsee/ds6/bin/~~dsadm start /var/ds'''	+	# '''dsadm start /var/ds'''
	(hostname2) # '''dsconf show-repl-agmt-status dc=subdomain,dc=example,dc=com hostname1:636'''		(hostname2) # '''dsconf show-repl-agmt-status dc=subdomain,dc=example,dc=com hostname1:636'''

Hutch: /* Confirm replication is working */

Hutch — Tue, 27 May 2008 15:49:18 GMT

Confirm replication is working

←Older revision		Revision as of 15:49, 27 May 2008
Line 675:		Line 675:

	On ''hostname1'':		On ''hostname1'':
-	# dsconf show-repl-agmt-status dc=subdomain,dc=example,dc=com hostname2:636	+	# '''dsconf show-repl-agmt-status dc=subdomain,dc=example,dc=com hostname2:636'''
	Enter "cn=Directory Manager" password:		Enter "cn=Directory Manager" password:
	Configuration Status : OK		Configuration Status : OK
Line 685:		Line 685:

	On ''hostname2'':		On ''hostname2'':
-	# dsconf show-repl-agmt-status dc=subdomain,dc=example,dc=com hostname1:636	+	# '''dsconf show-repl-agmt-status dc=subdomain,dc=example,dc=com hostname1:636'''
	Enter "cn=Directory Manager" password:		Enter "cn=Directory Manager" password:
	Configuration Status : OK		Configuration Status : OK

Hutch: /* Upgrading to DS 6.2 */

Hutch — Tue, 27 May 2008 15:43:38 GMT

Upgrading to DS 6.2

←Older revision		Revision as of 15:43, 27 May 2008
Line 780:		Line 780:
	# '''/opt/SUNWdsee/ds6/bin/dsadm start /var/ds'''		# '''/opt/SUNWdsee/ds6/bin/dsadm start /var/ds'''
	(hostname2) # '''dsconf show-repl-agmt-status dc=subdomain,dc=example,dc=com hostname1:636'''		(hostname2) # '''dsconf show-repl-agmt-status dc=subdomain,dc=example,dc=com hostname1:636'''
		+
		+	== Upgrading to DS 6.3 ==
		+
		+	Sun DSEE 6.2 contains a race condition that may cause database integrity issues[http://blogs.sun.com/dsee/entry/dsee_6_2_sun_alert].
		+
		+	I used this basic procedure to upgrade from DS 6.2 to DS 6.3 on our two LDAP servers.
		+
		+	* Delete the replication agreements between the two LDAP servers. (I'm not sure if this step is needed, but I'm doing it just in case).
		+	* Stop the Directory Server instance on ''hostname2''.
		+	* Uncompress and install Directory Server 6.3, overwriting the previous installation.
		+	* Rebuild the database by exporting to LDIF and importing from LDIF (needed because of DSEE 6.2 bug).
		+	* Start the Directory Server on ''hostname2''.
		+	* Confirm that any pending replication changes from ''hostname1'' have transferred.
		+	* Repeat the process on ''hostname1''.
		+	* Establish the replication agreements between the two LDAP servers.
		+
		+	(hostname1) # '''dsconf delete-repl-agmt-status dc=subdomain,dc=example,dc=com hostname2:636
		+	(hostname2) # '''dsconf delete-repl-agmt-status dc=subdomain,dc=example,dc=com hostname1:636
		+
		+	On ''hostname2'':
		+	# '''/opt/SUNWdsee/ds6/bin/dsadm stop /var/ds'''
		+	$ '''gzip -cd DSEE.6.3.Solaris-Sparc-full.tar.gz \| tar xf -'''
		+	$ '''cd DSEE_ZIP_Distribution'''
		+	# '''./dsee_deploy install --no-inter --install-path /opt/SUNWdsee'''
		+	# '''/opt/SUNWdsee/ds6/bin/dsadm export /var/ds dc=subdomain,dc=example,dc=com /tmp/suffix.ldif'''
		+	# '''/opt/SUNWdsee/ds6/bin/dsadm import /var/ds /tmp/suffix.ldif dc=dev,dc=aps,dc=unix,dc=navitaire,dc=com'''
		+	# '''/opt/SUNWdsee/ds6/bin/dsadm start /var/ds'''
		+
		+	On ''hostname1'':
		+	# '''/opt/SUNWdsee/ds6/bin/dsadm stop /var/ds'''
		+	$ '''gzip -cd DSEE.6.3.Solaris-Sparc-full.tar.gz \| tar xf -'''
		+	$ '''cd DSEE_ZIP_Distribution'''
		+	# '''./dsee_deploy install --no-inter --install-path /opt/SUNWdsee'''
		+	# '''/opt/SUNWdsee/ds6/bin/dsadm export /var/ds dc=subdomain,dc=example,dc=com /tmp/suffix.ldif'''
		+	# '''/opt/SUNWdsee/ds6/bin/dsadm import /var/ds /tmp/suffix.ldif dc=dev,dc=aps,dc=unix,dc=navitaire,dc=com'''
		+	# '''/opt/SUNWdsee/ds6/bin/dsadm start /var/ds'''

	== Creating an additional Directory Server instance ==		== Creating an additional Directory Server instance ==