Your message dated Wed, 09 Dec 2015 09:50:58 +0000 with message-id <[email protected]> and subject line Bug#806778: fixed in bind-dyndb-ldap 8.0-1 has caused the Debian Bug report #806778, regarding bind9-dyndb-ldap: Bind fails to get zones from 389 directory server (IPA) to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 806778: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806778 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: bind9-dyndb-ldap Version: 6.0-4 Severity: important Dear Maintainer, I have bind in freeipa setup with 389 directory server as backend. Everything worked fine until yesterday's restart of whole server, after which bind can't see LDAP zones contents any more. Configuration haven't changed so I suspect some of the updates that came in after last restart (must have happend before 11-1). The bind log contains these entries: named[18922]: LDAP instance 'ipa' is being synchronized, please ignore message 'all zones loaded' reloading configuration succeeded any newly configured zones are now loaded LDAP error: Server is unwilling to perform: Too many active synchronization sessions: unable to start SyncRepl session ldap_syncrepl will reconnect in 60 seconds received control channel command 'reconfig' ldap_sync_prepare() failed, retrying in 1 second: shutting down ... LDAP server error log is empty, but access log shows there is some problem with search operation: conn=39352 fd=110 slot=110 connection from local to /var/run/slapd-REALM.socket conn=39352 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI conn=39352 op=0 RESULT err=14 tag=97 nentries=0 etime=0, SASL bind in progress conn=39352 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI conn=39352 op=1 RESULT err=14 tag=97 nentries=0 etime=0, SASL bind in progress conn=39352 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI conn=39352 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="krbprincipalname=dns/hostname@domain,cn=services,cn=accounts,dc=domain,dc=xx" conn=39351 op=3 SRCH base="cn=dns,dc=domain,dc=xx" scope=2 filter="(|(objectClass=idnsConfigObject)(objectClass=idnsZone)(objectClass=idnsForwardZone)(objectClass=idnsRecord))" attrs=AL conn=39351 op=4 UNBIND conn=39351 op=4 fd=108 closed - U1 conn=39351 op=3 RESULT err=53 tag=101 nentries=0 etime=0 If I try to use ldapsearch with same parameters (kinit -k -t /etc/bind/named.keytab DNS/hostname and than ldapsearch -Y GSSAPI) I get the correct result and LDAP log contains: conn=39404 op=3 RESULT err=0 tag=101 nentries=85 etime=0 So it seems bind sets some connection or search parameters that cause the problem when querying LDAP. I've tried to increase bind log verbosity. but it didn't help as it seems it doesn't affect this plugin. Bind config is set as: dynamic-db "ipa" { library "ldap.so"; arg "uri ldapi://%2fvar%2frun%2fslapd-REALM.socket"; arg "base cn=dns, dc=domain,dc=xx"; arg "fake_mname hostname.; arg "auth_method sasl"; arg "sasl_mech GSSAPI"; arg "sasl_user DNS/hostname"; arg "serial_autoincrement yes"; }; If there is a way I could help debugging the problem, I can add more information here. -- System Information: Debian Release: stretch/sid APT prefers unstable APT policy: (650, 'unstable') Architecture: amd64 (x86_64) Kernel: Linux 4.2.0-1-amd64 (SMP w/4 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=cs_CZ.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages bind9-dyndb-ldap depends on: ii bind9 1:9.9.5.dfsg-12+b1 ii libc6 2.19-22 ii libdns100 1:9.9.5.dfsg-12+b1 ii libkrb5-3 1.13.2+dfsg-4 ii libldap-2.4-2 2.4.42+dfsg-2 bind9-dyndb-ldap recommends no packages. bind9-dyndb-ldap suggests no packages. -- no debconf information
--- End Message ---
--- Begin Message ---Source: bind-dyndb-ldap Source-Version: 8.0-1 We believe that the bug you reported is fixed in the latest version of bind-dyndb-ldap, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Timo Aaltonen <[email protected]> (supplier of updated bind-dyndb-ldap package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.8 Date: Wed, 09 Dec 2015 10:25:18 +0200 Source: bind-dyndb-ldap Binary: bind9-dyndb-ldap Architecture: source amd64 Version: 8.0-1 Distribution: unstable Urgency: medium Maintainer: Debian FreeIPA Team <[email protected]> Changed-By: Timo Aaltonen <[email protected]> Description: bind9-dyndb-ldap - LDAP back-end plug-in for BIND Closes: 790227 806778 Changes: bind-dyndb-ldap (8.0-1) unstable; urgency=medium . * New upstream release. (Closes: #790227, #806778) * control: Mark FreeIPA team as maintainer. * control: Add uuid-dev to build-depends. * workaround-missing-headers.patch: Update to not check for isc/errno2result.h during configure. * rules, postinst, dirs: Modify cache directory permissions on postinst. Checksums-Sha1: e94d374ae61b37409726ea45c3f7650b1aa3fd44 2064 bind-dyndb-ldap_8.0-1.dsc 437b6cc45e4d4cced35e4ef7822bf337e61f41d0 325158 bind-dyndb-ldap_8.0.orig.tar.bz2 e3bc12ecd03ea14f448be479b5fa65c549b1caaf 4760 bind-dyndb-ldap_8.0-1.debian.tar.xz 664b72aa476164aa6bca87c8c6c3663864ef7061 88418 bind9-dyndb-ldap_8.0-1_amd64.deb Checksums-Sha256: f20ac44d29aa73ebcb093380013887a9c57e9b7087d6614cadd8aade441ad813 2064 bind-dyndb-ldap_8.0-1.dsc deab1eda720ff5425f0e67157451756df1f73d461368093da74156d0163b2c6f 325158 bind-dyndb-ldap_8.0.orig.tar.bz2 9bb5063aa7d9ff49e58553f9d5709ab22f0825282e30ff9c0f493f8e65111ae8 4760 bind-dyndb-ldap_8.0-1.debian.tar.xz 80ced4006706eec65fe742a6970e3e3df76d4c3aaf22e82be3ac94ad961e860f 88418 bind9-dyndb-ldap_8.0-1_amd64.deb Files: 609642a2442a41e165affc00982af6fe 2064 net optional bind-dyndb-ldap_8.0-1.dsc 93f6c2870aae5293a7aba96357cc9061 325158 net optional bind-dyndb-ldap_8.0.orig.tar.bz2 35b819eedaff47b3fe4e30e964b12775 4760 net optional bind-dyndb-ldap_8.0-1.debian.tar.xz 8efe9841ad9dadb5f7179f8b803b2cdc 88418 net optional bind9-dyndb-ldap_8.0-1_amd64.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJWZ+enAAoJEMtwMWWoiYTcweEP/3V+qfjbt7TmqTUFDbG6imcf XC4OVU0Jsgamcvdi5BTZhQF56+08HHOf8NbPPywA7Kh3dxaEPRlqrjD7dZw/MHAz hIy84BUxMsrIymnJW0C8nEF/nh6oKWrp2lduWlCbmF2q9l5A7omGju0zmxSGntBU 4yi1GZeA8BhuJU1JuGqGB8qntcYu1k+sTSs7Yz6bJLOk1MnX1UHlZ0oNkaGwRT45 Nfkjm155ybNOwAKxs0uUe7ZljJLc83hnG3qyZAFypKfUYZzIdVqkUcjaPTSsRfkO ifbxSepe9QjDvIxjK5iZVdpBWyegRZTyY3IGz23U4rBPYQeD5uv9hw32ZjyR0Zyb 0DwWypJhrIWFLOhS6JFxPbd1q9AAuBUwVBxy3RKt+umQhBItNB/OhdSiRMeME8Bs OzdHTWw574HGIdAm2+IkTfWdnsWuBxqH0Tfo0uHkCYCTt6x7s9/qFBAfE4kHUxwp ixKkGEVb/x76+Q2CznuzopHAfi8mLF4uZYvRhYdWgr6OOIrx9T18QyyBhk65CAnN d/k5OwO2innJLqhfbp3AX2GR916De3hELRgAagY8GSQ2nmfjoMryhl7Wy+xYbq1n jV/zafHmIdaqRnFCGVHd1UNGHVAC4v8OEc6YQD9AEckXI28BehDj5gYipTyIS4dq 9pTflbgOQvjGxg006rxg =c9yl -----END PGP SIGNATURE-----
--- End Message ---
