NSMMReplicationPlugin - replica_update_state - Failed to update state of csn generator for replica dc=example,dc=com: LDAP error - 32
Received result code 50 (00002098: SecErr: DSID-03150E49, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0 ) for modify operation
openssl req -x509 -newkey rsa:2048 -keyout 389.key -out 389.crt
openssl pkcs12 -export -out 389.p12 -inkey 389.key -in 389.crt -name Server-Cert
pk12util -i 389.p12 -d /etc/dirsrv/slapd-ryo/
# certutil -L -d /etc/dirsrv/slapd-ryo
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Windows Server AD CA cert P,,
Server-Cert u,u,u
# certutil -K -d /etc/dirsrv/slapd-ryo
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"
Enter Password or Pin for "NSS Certificate DB":
< 0> rsa 1xxxxxxxxxxxxxxxaff5b7826ec1dxxxxxxxxxx Server-Cert
dn: cn=encryption,cn=config
changetype: modify
replace: nsSSL3
nsSSL3: off
-
replace: nsSSLClientAuth
nsSSLClientAuth: allowed
-
add: nsSSL3Ciphers
nsSSL3Ciphers: +all
dn: cn=config
changetype: modify
add: nsslapd-security
nsslapd-security: on
-
replace: nsslapd-ssl-check-hostname
nsslapd-ssl-check-hostname: off
dn: cn=RSA,cn=encryption,cn=config
changetype: add
objectclass: top
objectclass: nsEncryptionModule
cn: RSA
nsSSLPersonalitySSL: Server-Cert
nsSSLToken: internal (software)
nsSSLActivation: on
internal (software):secret
# chown dirsrv:dirsrv /etc/dirsrv/slapd-ryo/pin.txt
# chmod 400 /etc/dirsrv/slapd-ryo/pin.txt
systemctl restart dirsrv@ryo
cd "C:\Program Files\389 Directory Password Synchronization"
certutil.exe -d . -A -n "DS CA cert" -t "P,," -a -i \path\to\389.crt
dn: ou=people,dc=example,dc=com
changetype: modify
add: aci
aci: (targetattr="userPassword")(version 3.0;acl "password sync";allow (write,compare) userdn="ldap:///cn=sync user,cn=config";)
# yum install 389-ds-base
# setup-ds.pl
# cd /etc/dirsrv/slapd-ryo/
# certutil -d . -A -n "Windows Server AD CA cert" -t P,, -a -i /path/to/my.crt
dn: dc=example,dc=com
changetype: add
objectClass: top
objectClass: domain
dc: example.com
aci: (targetattr!="userPassword || aci")(version 3.0; acl "Enable anonymous ac
cess"; allow (read, search, compare) userdn="ldap:///anyone";)
aci: (targetattr="carLicense || description || displayName || facsimileTelepho
neNumber || homePhone || homePostalAddress || initials || jpegPhoto || labele
dURI || mail || mobile || pager || photo || postOfficeBox || postalAddress ||
postalCode || preferredDeliveryMethod || preferredLanguage || registeredAddr
ess || roomNumber || secretary || seeAlso || st || street || telephoneNumber
|| telexNumber || title || userCertificate || userPassword || userSMIMECertif
icate || x500UniqueIdentifier")(version 3.0; acl "Enable self write for commo
n attributes"; allow (write) userdn="ldap:///self";)
aci: (targetattr ="*")(version 3.0;acl "Directory Administrators Group";allow
(all) (groupdn = "ldap:///cn=Directory Administrators, dc=example,dc=com");)
dn: ou=people,dc=example,dc=com
changeType: add
objectclass: top
objectclass: organizationalUnit
ou: people
dn: cn=changelog5,cn=config
changetype: add
objectclass: top
objectclass: extensibleObject
cn: changelog5
nsslapd-changelogdir: /var/lib/dirsrv/slapd-ryo/changelogdb
nsslapd-changelogmaxage: 7d
dn: cn=sync user,cn=config
changetype: add
objectClass: inetorgperson
objectClass: person
objectClass: top
cn: sync user
sn: SU
userPassword: secret
passwordExpirationTime: 20380119031407Z
dn: cn=syncreplica,cn=dc\=example\,dc\=com,cn=mapping tree,cn=config
changetype: add
objectclass: top
objectclass: nsds5replica
objectclass: extensibleObject
cn: syncreplica
nsds5replicaroot: dc=example,dc=com
nsds5replicaid: 7
nsds5replicatype: 3
nsds5flags: 1
nsds5ReplicaPurgeDelay: 604800
nsds5ReplicaBindDN: cn=sync user,cn=config
ERR - NSMMReplicationPlugin - agmtlist_add_callback - Can't start agreement
dn: cn=adagreement3,cn=syncreplica,cn=dc\=example\,dc\=com,cn=mapping tree,cn=config
changetype: add
objectclass: top
objectclass: nsDSWindowsReplicationAgreement
cn: adagreement3
nsds7WindowsReplicaSubtree: cn=Users,DC=example,DC=local
nsds7DirectoryReplicaSubtree: ou=people,dc=example,dc=com
nsds7NewWinUserSyncEnabled: on
nsds7NewWinGroupSyncEnabled: on
nsds7WindowsDomain: SIOS
nsDS5ReplicaRoot: dc=example,dc=com
nsDS5ReplicaHost: ad-389.example.local
nsDS5ReplicaPort: 636
nsDS5ReplicaBindDN: cn=replication,cn=Users,dc=example,dc=local
nsDS5ReplicaCredentials: MySecret-123
nsDS5ReplicaTransportInfo: SSL
nsds5replicabindmethod: SIMPLE
winSyncInterval: 30
winSyncMoveAction: delete
nsds5BeginReplicaRefresh: start
# db2bak.pl -Z testinst -D "cn=Directory Manager" -w password
Back up directory: /var/lib/dirsrv/slapd-testinst/bak/rhds1-2017_10_18_2_15_12
Successfully added task entry "cn=backup_2017_10_18_2_15_12, cn=backup, cn=tasks, cn=config"
dn: cn=backup_2017_10_18_2_20_7,cn=backup,cn=tasks,cn=config
objectClass: top
objectClass: extensibleObject
cn: backup_2017_10_18_2_20_7
nsarchivedir: /var/lib/dirsrv/slapd-testinst/bak/hoge
nsdatabasetype: ldbm database
nstaskcurrentitem: 0
nstasktotalitems: 1
nstasklog:: xxxxxx
:
nstaskstatus: Backup finished.
nstaskexitcode: 0
Once a task has finished (good or bad), the entry will stay visible for 2 minutes. By viewing the nstaskstatus and nstaskexitcode attributes you can find out how far it has gone and if the task has finished successfully or with an error. Here is an example using a persistent search filtering on nstaskexitcode so you only get a response back once the job has completed:これをぐるぐる回して同期なスクリプトを作るか。終了後 2 分で消えるということは、
ERR - ldbm_back_archive2ldbm - No back up "/home/ryo/rhds1-2017_10_7_3_20_46" exists.
ERR - task_restore_thread - Restore failed (error -1)
48 return_value = dbversion_read(li, directory, &dbversion, &dataversion);
49 if (return_value) {
50 if (ENOENT == return_value) {
51 slapi_log_err(SLAPI_LOG_ERR, "ldbm_back_archive2ldbm", "No back up \"%s\" exists.\n",
52 directory);
53 return -1;
54 }
# ls -Z
-rw-------. dirsrv dirsrv unconfined_u:object_r:user_home_t:s0 DBVERSION
-rw-------. dirsrv dirsrv unconfined_u:object_r:user_home_t:s0 dse_index.ldif
-rw-------. dirsrv dirsrv unconfined_u:object_r:user_home_t:s0 dse_instance.ldif
-rw-------. dirsrv dirsrv unconfined_u:object_r:user_home_t:s0 dse.ldif
:
# chcon -R system_u:object_r:dirsrv_var_lib_t:s0 rhds1-2017_10_7_3_20_46/
Exception in thread "main" java.awt.HeadlessException
at java.awt.GraphicsEnvironment.checkHeadless(GraphicsEnvironment.java:204)
at java.awt.Window.(Window.java:536)
at java.awt.Frame.(Frame.java:420)
at java.awt.Frame.(Frame.java:385)
at javax.swing.JFrame.(JFrame.java:189)
at com.netscape.management.client.console.Console.(Unknown Source)
at com.netscape.management.client.console.Console.main(Unknown Source)
$ diff -u /etc/java/redhat-389-console.conf.dist /etc/java/redhat-389-console.conf
--- /etc/java/redhat-389-console.conf.dist 2016-10-10 01:45:11.000000000 +0000
+++ /etc/java/redhat-389-console.conf 2017-10-04 01:44:55.026633680 +0000
@@ -1,3 +1,3 @@
mylang=${mylang:-en}
ADDITIONAL_JARS=${ADDITIONAL_JARS:-redhat-idm-console_$mylang.jar}
-ADDITIONAL_OPTIONS=${ADDITIONAL_OPTIONS:-"-Dprogram.name=redhat-idm-console -Djava.util.prefs.systemRoot=$HOME/.redhat-idm-console -Djava.util.prefs.userRoot=$HOME/.redhat-idm-console"}
+ADDITIONAL_OPTIONS=${ADDITIONAL_OPTIONS:-"-Dprogram.name=redhat-idm-console -Djava.util.prefs.systemRoot=$HOME/.redhat-idm-console -Djava.util.prefs.userRoot=$HOME/.redhat-idm-console -Djava.awt.headless=false"}
Defaults secure_path =
Defaults env_keep += "PATH"
%mygroup ALL = (myuser) /path/to/target*
Defaults secure_path = /path/to/target:/sbin:/bin:/usr/sbin:/usr/bin
Defaults env_keep += "PATH"
%mygroup ALL = (myuser) /path/to/target*
Defaults secure_path -= /sbin
Defaults secure_path -= /bin
Defaults secure_path -=/usr/sbin/
grep 'temporary password' /var/log/mysqld.log
/usr/bin/mysql_secure_installation
nmcli connection add type ethernet con-name "connection-name" ifname "*" mac 00:00:5E:00:53:00
$ gcloud compute http-health-checks create mygce-site1-health-check \
--request-path "/site1/index.txt"$ gcloud compute http-health-checks create mygce-site2-health-check \
--request-path "/site2/index.txt"$ gcloud compute firewall-rules create mygce-firewall-healthcheck \
--source-ranges '130.211.0.0/22' \
--allow tcp:80$ gcloud compute backend-services create mygce-site1-bs \
--session-affinity generated_cookie \
--http-health-checks mygce-site1-health-check \
--global$ gcloud compute backend-services add-backend mygce-site1-bs \
--instance-group mygce-site1-ig-asia \
--instance-group-zone asia-east1-b \
--global
$ gcloud compute backend-services add-backend mygce-site1-bs \
--instance-group mygce-site1-ig-us \
--instance-group-zone us-east1-b \
--global$ gcloud compute backend-services create mygce-site2-bs \
--session-affinity generated_cookie \
--http-health-checks mygce-site2-health-check \
--global$ gcloud compute backend-services add-backend mygce-site2-bs \
--instance-group mygce-site2-ig-asia \
--instance-group-zone asia-east1-b \
--global
$ gcloud compute backend-services add-backend mygce-site2-bs \
--instance-group mygce-site2-ig-us \
--instance-group-zone us-east1-b \
--global$ gcloud compute url-maps create mygce-url-map \
--default-service mygce-site1-bs$ gcloud compute url-maps add-path-matcher mygce-url-map \
--default-service mygce-site1-bs \
--path-matcher-name mygce-path-matcher \
--path-rules /site1=mygce-site1-bs,/site1/*=mygce-site1-bs,/site2=mygce-site2-bs,/site2/*=mygce-site2-bs \
--new-hosts mygce.fastriver.net$ openssl req -x509 -newkey rsa:2048 -keyout mygce.key -out mygce.crt
$ openssl rsa -in mygce.key -out mygce-nopass.key # ← 秘密鍵のパスフレーズを解きます$ gcloud compute ssl-certificates create mygce-cert \
--certificate mygce.crt \
--private-key mygce-nopass.key$ gcloud compute target-https-proxies create mygce-target-proxy \
--ssl-certificate mygce-cert \
--url-map mygce-url-map$ gcloud compute forwarding-rules create mygce-forwarding-rule \
--target-https-proxy mygce-target-proxy \
--global-address \
--global \
--ports 443 |
| よくある Web サーバシステムの図 |
 |
| GCE ではこんな感じの図 |
$ gcloud compute disks create mygce-site1-disk \
--image-family=centos-7 \
--image-project=centos-cloud \
--zone asia-east1-b$ gcloud compute instances create mygce-site1-tmp-instance \
--disk name=mygce-site1-disk,boot=yes \
--metadata "ssh-keys=ryo:$(cat ~/.ssh/id_rsa.pub)" \
--zone asia-east1-b$ ssh ryo@xxx.xxx.xxx.xxx[ryo@mygce-site1-tmp-instance]$ sudo yum install httpd -y
[ryo@mygce-site1-tmp-instance]$ sudo mkdir /var/www/html/site1
[ryo@mygce-site1-tmp-instance]$ echo "site1" | sudo tee /var/www/html/site1/index.txt
[ryo@mygce-site1-tmp-instance]$ sudo systemctl enable httpd
[ryo@mygce-site1-tmp-instance]$ exit$ gcloud compute instances delete mygce-site1-tmp-instance --zone asia-east1-b -q$ gcloud compute images create mygce-site1-image \
--source-disk-zone=asia-east1-b \
--source-disk mygce-site1-disk \
--family mygce-site1-image-family$ gcloud compute disks create mygce-site2-disk \
--image-family=mygce-site1-image-family \
--zone=asia-east1-b$ gcloud compute instances create mygce-site2-tmp-instance \
--disk name=mygce-site2-disk,boot=yes \
--metadata "ssh-keys=ryo:$(cat ~/.ssh/id_rsa.pub)" \
--zone asia-east1-b$ ssh ryo@xxx.xxx.xxx.xxx[ryo@mygce-site2-tmp-instance]$ sudo mkdir /var/www/html/site2
[ryo@mygce-site2-tmp-instance]$ echo "site2" | sudo tee /var/www/html/site2/index.txt
[ryo@mygce-site2-tmp-instance]$ sudo systemctl enable httpd
[ryo@mygce-site2-tmp-instance]$ exit$ gcloud compute instances delete mygce-site2-tmp-instance --zone asia-east1-b -q$ gcloud compute images create mygce-site2-image \
--source-disk-zone=asia-east1-b \
--source-disk mygce-site2-disk \
--family mygce-site2-image-family$ gcloud compute instance-templates create mygce-site1-template \
--machine-type g1-small \
--image-family mygce-site1-image-family \
--metadata "ssh-keys=ryo:$(cat ~/.ssh/id_rsa.pub)"$ gcloud compute instance-groups managed create mygce-site1-ig-asia \
--size 1 \
--template mygce-site1-template \
--zone asia-east1-b$ gcloud compute instance-groups managed set-autoscaling mygce-site1-ig-asia \
--max-num-replicas 3 \
--min-num-replicas 1 \
--target-cpu-utilization 0.8 \
--scale-based-on-cpu \
--zone asia-east1-b$ gcloud compute instance-groups managed create mygce-site1-ig-us \
--size 1 \
--template mygce-site1-template \
--zone us-east1-b$ gcloud compute instance-groups managed set-autoscaling mygce-site1-ig-us \
--max-num-replicas 3 \
--min-num-replicas 1 \
--target-cpu-utilization 0.8 \
--scale-based-on-cpu \
--zone us-east1-b$ gcloud compute instance-templates create mygce-site2-template \
--machine-type g1-small \
--image-family mygce-site2-image-family \
--metadata "ssh-keys=ryo:$(cat ~/.ssh/id_rsa.pub)"$ gcloud compute instance-groups managed create mygce-site2-ig-asia \
--size 1 \
--template mygce-site2-template \
--zone asia-east1-b$ gcloud compute instance-groups managed set-autoscaling mygce-site2-ig-asia \
--max-num-replicas 3 \
--min-num-replicas 1 \
--target-cpu-utilization 0.8 \
--scale-based-on-cpu \
--zone asia-east1-b$ gcloud compute instance-groups managed create mygce-site2-ig-us \
--size 1 \
--template mygce-site2-template \
--zone us-east1-b$ gcloud compute instance-groups managed set-autoscaling mygce-site2-ig-us \
--max-num-replicas 3 \
--min-num-replicas 1 \
--target-cpu-utilization 0.8 \
--scale-based-on-cpu \
--zone us-east1-b