date:20110125

Re: [389-users] Announcing 389 Directory Server 1.2.8 Alpha 1 for testing

2011-01-25 Thread Jeremy A. Mates

2011/1/25 Rich Megginson rmegg...@redhat.com:
 The 389 team is pleased to announce the availability for testing of
 Alpha 1 of version 1.2.8.  This release contains many bug fixes.  On
 those platforms which have OpenLDAP built with Mozilla NSS crypto
 support (Fedora 14 and later), the packages are built with OpenLDAP
 instead of the Mozilla LDAP C SDK.

389-ds-base-1.2.8-0.1.a1.el5 will still hang randomly due to
production LDAP traffic, though seems more resilient than the 1.2.7
version (and more prone never to shutdown when it does wedge? Still
trying out variations of traffic load and backup runs (no MMR in the
mix, yet)). Do you need more strace logs or maybe gdb dumps?

https://bugzilla.redhat.com/show_bug.cgi?id=668548

https://bugzilla.redhat.com/show_bug.cgi?id=668619

Jeremy
--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users

Re: [389-users] Announcing 389 Directory Server 1.2.8 Alpha 1 for testing

2011-01-25 Thread Rich Megginson

On 01/25/2011 05:07 PM, Jeremy A. Mates wrote:
 2011/1/25 Rich Megginsonrmegg...@redhat.com:
 The 389 team is pleased to announce the availability for testing of
 Alpha 1 of version 1.2.8.  This release contains many bug fixes.  On
 those platforms which have OpenLDAP built with Mozilla NSS crypto
 support (Fedora 14 and later), the packages are built with OpenLDAP
 instead of the Mozilla LDAP C SDK.
 389-ds-base-1.2.8-0.1.a1.el5 will still hang randomly due to
 production LDAP traffic, though seems more resilient than the 1.2.7
 version (and more prone never to shutdown when it does wedge? Still
 trying out variations of traffic load and backup runs (no MMR in the
 mix, yet)). Do you need more strace logs or maybe gdb dumps?
No.  We haven't started working on those bugs yet.
 https://bugzilla.redhat.com/show_bug.cgi?id=668548

 https://bugzilla.redhat.com/show_bug.cgi?id=668619

 Jeremy
 --
 389 users mailing list
 389-users@lists.fedoraproject.org
 https://admin.fedoraproject.org/mailman/listinfo/389-users

--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users

[389-users] HOW TO INSTALL NEW INTERMEDIATE CA CERTIFICATES ON 389 DS

2011-01-25 Thread Tim Weichel

All,
I have installed 389 servers and in the process of requesting new 4 year SSL
certificates for my servers. To do so Verisign is only accepting 2048-bit and
higher CSR's only for 3 year certificates.
No problem I manually created a new CSR with 2048 bits using openssl, received
my new cert from verisign and have installed it successfully.

Now that I have the new cert installed and SSL configured and my pin.txt file
in place I find that upon start-up of the directory service the certificate
will not properly verify and the startup fails.

Based on the VeriSign advisory AD220
(https://knowledge.verisign.com/support/ssl-certificates-support/index?page=contentid=AD220)
It appears that I need to update the directory servers VeriSign intermediate
certificates in order to properly validate my new 2048 cert upon startup.
My new certificate came with the notice also as follows: In order for your
VeriSign SSL Certificate to function properly, NEW Primary and Secondary
VeriSign Intermediate CA Certificates must be installed.

So has anyone actually updated or installed the new primary and secondary
intermediate CA certificates.
The usual methods of certutil command and the Management Console wizard have
all failed to install the provided intermediate CA bundle provided by VeriSign.
Also I am not running Apache, I only have the 389 Management Console serving
web for the servers.

Thanks appreciate your assistance. Love the list server you guys
ROCK!.Tim

--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users

Re: [389-users] HOW TO INSTALL NEW INTERMEDIATE CA CERTIFICATES ON 389 DS

2011-01-25 Thread Rich Megginson

On 01/25/2011 06:08 PM, Tim Weichel wrote:

All,

I have installed 389 servers and in the process of requesting new 4
year SSL certificates for my servers. To do so Verisign is only
accepting 2048-bit and higher CSR's only for 3 year certificates.

No problem I manually created a new CSR with 2048 bits using openssl,
received my new cert from verisign and have installed it successfully.

Now that I have the new cert installed and SSL configured and my
pin.txt file in place I find that upon start-up of the directory
service the certificate will not properly verify and the startup fails.

Based on the VeriSign advisory AD220
(https://knowledge.verisign.com/support/ssl-certificates-support/index?page=contentid=AD220
https://knowledge.verisign.com/support/ssl-certificates-support/index?page=contentid=AD220)

It appears that I need to update the directory servers VeriSign
intermediate certificates in order to properly validate my new 2048
cert upon startup.

My new certificate came with the notice also as follows: In order for
your VeriSign SSL Certificate to function properly, NEW Primary and
Secondary VeriSign Intermediate CA Certificates must be installed.

So has anyone actually updated or installed the new primary and
secondary intermediate CA certificates.

The usual methods of certutil command and the Management Console
wizard have all failed to install the provided intermediate CA bundle
provided by VeriSign.

What exactly did you try and how exactly did it fail? Please provide
the exact certutil command line arguments.

Also I am not running Apache, I only have the 389 Management Console
serving web for the servers.

Thanks appreciate your assistance. Love the list server you guys
ROCK!.Tim

--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users

Re: after pre-upgrade my installation hangs, too

2011-01-25 Thread JB

Maurizio Marini maumar at datalogica.com writes:

 ... 
 Hi JB and others,
 
 before trying 
 # yum distro-sync
 as you suggested me, i would try to understand the issue with preupgrade.
 I have restarted my nb and i see it hangs on infamous:
 
   waiting for hardware to initialize
 
 like in  Ashley M. Kirchner thread.
 I would know if it makes any sense to insert these flags and the others you
 suggeted to Ashley
 
 ignore_loglevel enforcing=0 initcall_debug
 
 in grub.conf Upgrade line:
 title Upgrade to Fedora 14 (Laughlin)
 kernel /upgrade/vmlinuz preupgrade = here
 ... 

Yes, these are debugging statements. They may slow the process somewhat but
should not have impact on hardware initialization.

JB


-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

iptables and NAT

2011-01-25 Thread Jatin K


Dear All

I'm trying to configure iptables with Network Address Translation

Scenario is like

server 1 with IP address 192.168.131.131 is running httpd

server 2 with two NIC, one is  xx.xx.xx.xx ( live ip ) and another is 
192.168.131.133,


---
I run following command on server 2 ( which is going to be acting as 
firewall  )


iptables -t NAT -A PREROUTING -d xx.xx.xx.xx -J DNAT --to-destination 
192.168.131.131


but it ends with following error

iptables v1.3.5: can't initialize iptables table `nat': Table does not 
exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

--Following are some details of my server
*uname -r *

2.6.18-194.32.1.el5



*lsmod | grep ip *

ip_tables17029 0
x_tables 17349 1 ip_tables
ipv6270561  19
xfrm_nalgo13381 1 ipv6
acpiphp 27089 0
dm_multipath 25421 0
scsi_dh 12097 1 dm_multipath
dm_mod  63225 15 
dm_multipath,dm_raid45,dm_snapshot,dm_zero,dm_mirror,dm_log



Can anyone guide me ??? whats going wrong with it ? how to resolve this 
problem




Thanx  regards

--
  °v°
 /(_)\
  ^ ^  Jatin Khatri
Registerd Linux user No #501175
www.counter.li.org
No M$

-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Re: [Fedora] Re: native texlive and yum

2011-01-25 Thread Walter Cazzola


On Mon, 24 Jan 2011, Mohamed El Morabity wrote:


Le lundi 24 janvier 2011 à 13:55 +0100, Walter Cazzola a écrit :



a solution could be to build an empty RPM that will simply contain a
Provides: texlive  2007 or something like this to fool Fedora
packages requiring a LaTeX distribution.


Your idea looks interesting but doesn't work. I've just installed (as
yum localinstall) the rpm generated by the attached rpm and when I try
to install a2ps I get:

 Dependencies Resolved

 =
  Package
 =
 Installing:
  a2ps
 Installing for dependencies:
  html2ps
  kpathsea
  tex-preview
  texinfo-tex
  texlive
  texlive-dvips
  texlive-latex
  texlive-texmf
  texlive-texmf-dvips
  texlive-texmf-errata
  texlive-texmf-errata-dvips
  texlive-texmf-errata-fonts
  texlive-texmf-errata-latex
  texlive-texmf-fonts
  texlive-texmf-latex
  texlive-utils

 Transaction Summary
 =
 Install  17 Package(s)

 Total download size: 61 M
 Installed size: 159 M
 Is this ok [y/N]: n

That is not what I desire.

The fake rpm is correctly installed:

  yum list installed|grep texlive
  texlive2010-fake.noarch1.0-1.fc13 
@/texlive2010-fake-1.0-1.fc13.noarch

Any other suggestion?

Walter

--
Walter Cazzola, PhD - Associate Professor, DICo, University of Milano
E-mail: cazz...@dico.unimi.it  Ph.: +39 02 503 16300  Fax: +39 02 503 16253
· · ·  · · ·  · · ·
   ... recursive: adjective, see recursive ...
· · ·  · · ·  · · ·Name:texlive2010-fake   
Version: 1.0
Release: 1%{?dist}
Summary: This is a fake TeXLive package
Source0: fake.tgz
Group:   System Environment/Base
License: GPLv2 and BSD and Public Domain and LGPLv2+ and GPLv2+ and LPPL
BuildRoot:  %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XX)

Provides: texlive  2007

%description
This was necessary to have a tlmgr-based installation of texlive and all the 
rpm packages that requires texlive (e.g., a2ps and R-core) still installable.

%prep

%build

%install
rm -rf $RPM_BUILD_ROOT

%clean
rm -rf $RPM_BUILD_ROOT

%files
%defattr(-,root,root,-)
%doc

%changelog

-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Re: [Fedora] Re: native texlive and yum

2011-01-25 Thread Walter Cazzola


On Mon, 24 Jan 2011, suvayu ali wrote:


On Mon, Jan 24, 2011 at 1:55 PM, Walter Cazzola cazz...@dico.unimi.it wrote:

That has been a great idea except for a couple of issues on some
*nonrelated packages. To remove texlive yum forced the remotion of a2ps
and R-core (and few other but these are the most important for me) and I
can't reinstall them without reinstalling texlive (at least in part).



Although it might seem so, but they might not be entirely independent.


yes I know they use LaTeX to render something but they can work also
without LaTeX so if someone want these tools is forced to install LaTeX
as well.


Now I've already installed texlive but not through yum and I'm wondering
why the rpm for these packages not really related to LaTeX and in
any case working also without LaTeX can't check for the bins instead of
the whole package.



That is how rpm (or any other package manager works). Checking for
binaries can be ambiguous as some package might not place the binaries
in the path the package manager might check.


uhm this is not convincing me, to avoid misplaced binaries there are
several methods, where, which, the only mandatory point is to have the
binaries you are looking for in the PATH that is not such a big issue
since I'm supposing you want to use them.

I think this is just an issue of laziness since it is easier to have
hard dependencies and let the rpm dbms to deal with them rather than to
check real dependencies thoroughly.


Is there a way for forcing their installation without installing
texlive?



If you don't mind the disk space taken by the rpm version of texlive,
you can solve the problem with setting your environment variables
appropriately. This is how I get around this issue:


I know about this possibility but I'd prefer to save 200Mb and to have a
cleaner installation.

Thanks for the advice 
Walter


--
Walter Cazzola, PhD - Associate Professor, DICo, University of Milano
E-mail: cazz...@dico.unimi.it  Ph.: +39 02 503 16300  Fax: +39 02 503 16253
· · ·  · · ·  · · ·
   ... recursive: adjective, see recursive ...
· · ·  · · ·  · · ·-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Re: [Fedora] Re: native texlive and yum

2011-01-25 Thread François Patte

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Le 25/01/2011 11:46, Walter Cazzola a écrit :
 On Mon, 24 Jan 2011, Mohamed El Morabity wrote:
 
 Le lundi 24 janvier 2011 à 13:55 +0100, Walter Cazzola a écrit :
 
 a solution could be to build an empty RPM that will simply contain a
 Provides: texlive  2007 or something like this to fool Fedora
 packages requiring a LaTeX distribution.
 
 Your idea looks interesting but doesn't work. I've just installed (as
 yum localinstall) the rpm generated by the attached rpm and when I try
 to install a2ps I get:
 
  Dependencies Resolved
 
 Any other suggestion?

Get the rpm package of a2ps and install it with

rpm -ivh a2ps.xxx.rpm --nodeps

And see if a2ps works.

BTW why do you want a2ps it is quite obsolete now for it is unable to
handle utf-8 encodage.

- --
François Patte
UFR de mathématiques et informatique
Université Paris Descartes
Tél. +33 (0)1 8394 5849
http://www.math-info.univ-paris5.fr/~patte
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk0+rbkACgkQdE6C2dhV2JV1WwCfSvqHkbwTZ9Xs8zkYPQoHqfwC
5+gAn37r4bFQkKYMH0a5OQIOqxcFnCc1
=9/Xs
-END PGP SIGNATURE-
-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Re: iptables and NAT

2011-01-25 Thread Jorge Fábregas

On 01/25/2011 06:15 AM, Jatin K wrote:
 iptables -t NAT -A PREROUTING -d xx.xx.xx.xx -J DNAT --to-destination 
 192.168.131.131
 
 but it ends with following error

Hi,

The names of the tables are case-sensitive.  It should be nat instead of
NAT.

HTH,
JOrge
-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Re: iptables and NAT

2011-01-25 Thread JB

Jatin K ssh.fedora at gmail.com writes:

 ... 
 Dear All
 I'm trying to configure iptables with Network Address Translation 
 ...
 iptables v1.3.5: can’t initialize iptables table `nat’: Table does
 not exist (do you need to insmod?)
 Perhaps iptables or your kernel needs to be upgraded.

On F14.

Kernel configuration:
$ less /boot/config-*
search for NAT

If configured as modules, see kernel modules:
$ less /lib/modules/2.6.*/modules.dep
search for nat (or nf_nat)

Test:
# modprobe nf_nat

Other config files:
# less /etc/sysconfig/iptables-config

Also /proc fs.

JB



-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

newbie wireless question

2011-01-25 Thread Adel ESSAFI

Hi users,


I connect to wireless with network manager called HOME with wep key  through
NetworkManager.


I don t find how to connect to the same network through  CL with iwconfig
and ifconfig.

Could you help me please.


Regards




-- 
PhD candidate in Computer Science
Address
3 avenue lamine, cité ezzahra, Sousse 4000
Tunisia
tel: +216 97 246 706 (+33640302046 jusqu'au 15/6)
fax: +216 71 391 166
-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Help test extras installer

2011-01-25 Thread Chris Smart

In case anyone's interested, please help me test the new Kororaa bash
extras installer script for Fedora. Essentially, I’ve merged the
original Flash and NVIDIA driver installers into a new bash script,
which also handles AMD’s fglrx driver. It supports KDE, GNOME as well
as console, and if you don't have the required repositories it can
configure these for you too.

It’s now ready for testing, so please test it out and let me know if
you have any problems!

wget http://kororaa.org/files/add-remove-extras.sh
chmod a+x add-remove-extras.sh
sudo ./add-remove-extras.sh

And feel free to fix my horrible bash, if you feel so motivated! ;-)

See http://ur1.ca/30a0g

Thanks,
Chris
-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Re: iptables and NAT

2011-01-25 Thread Jatin K

On Tuesday 25 January 2011 05:07 PM, Jorge Fábregas wrote:
 On 01/25/2011 06:15 AM, Jatin K wrote:
 iptables -t NAT -A PREROUTING -d xx.xx.xx.xx -J DNAT --to-destination
 192.168.131.131

 but it ends with following error
 Hi,

 The names of the tables are case-sensitive.  It should be nat instead of
 NAT.

 HTH,
 JOrge
Thnx

I'got your point replaced NAT with nat  ... saved iptables wiht service 
iptable save

but server is not forwarding the packets to the web server

if i try http://xx.xx.xx.xx  ( live ip )  .. .. no page is displayed

what it could be ???


-- 
   °v°
  /(_)\
   ^ ^  Jatin Khatri
Registerd Linux user No #501175
www.counter.li.org
No M$

-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Re: [Fedora] Re: FC14 Installation Hangs

2011-01-25 Thread JB

Ashley M. Kirchner ashley at pcraft.com writes:

 
 On 1/24/2011 4:33 PM, JB wrote:
  Read Lamar Owen's post.
  You may search Google and Bugzilla for problems related to your Broadcom
  CNB20LE board.
 
  There is a chance that Alan drops by and he is expert on hard disks.
 
  Tomorrow will try some more.
 
  JB
 
  Yep, I'm going to try and boot an FC13 install disk tomorrow 
 morning, see how that fares ...

Check the board's BIOS date. 

In Bugzilla 665109 they claim that this board can have old or incomplete BIOS.
Does it seem to be outdated ? Is there any update on manufacturer's or
reseller's web site ?

I would look at the BIOS settings too (sometimes their automatic settings
work better than our manual ones).

JB


-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Re: iptables and NAT

2011-01-25 Thread Dan Catana

Hi ,

On the server where you have the web page you have iptables up and blocking
the 80 port ? the service is up and running ? it's accepting connection from
all interfaces , not only on localhost ?

On Tue, Jan 25, 2011 at 2:17 PM, Jatin K ssh.fed...@gmail.com wrote:

 On Tuesday 25 January 2011 05:07 PM, Jorge Fábregas wrote:
  On 01/25/2011 06:15 AM, Jatin K wrote:
  iptables -t NAT -A PREROUTING -d xx.xx.xx.xx -J DNAT --to-destination
  192.168.131.131
 
  but it ends with following error
  Hi,
 
  The names of the tables are case-sensitive.  It should be nat instead of
  NAT.
 
  HTH,
  JOrge
 Thnx

 I'got your point replaced NAT with nat  ... saved iptables wiht service
 iptable save

 but server is not forwarding the packets to the web server

 if i try http://xx.xx.xx.xx  ( live ip )  .. .. no page is displayed

 what it could be ???


 --
   °v°
  /(_)\
   ^ ^  Jatin Khatri
 Registerd Linux user No #501175
 www.counter.li.org
 No M$

  --
 users mailing list
 users@lists.fedoraproject.org
 To unsubscribe or change subscription options:
 https://admin.fedoraproject.org/mailman/listinfo/users
 Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Re: iptables and NAT

2011-01-25 Thread Jatin K

On Tuesday 25 January 2011 06:16 PM, Jorge Fábregas wrote:
 On 01/25/2011 08:17 AM, Jatin K wrote:
 but server is not forwarding the packets to the web server
 Besides the NAT rule, you'll need a forward rule (as that traffic is not
 for the machine hosting the firewall).  I think you'll need something like:

 iptables -A FORWARD -d 192.168.131.131 -p tcp --dport 80 -j ACCEPT

 ...and of course check the firewall on the web-server to allow incoming
 TCP/80.

 --
 Jorge
I've done the following

[1]echo 1  /proc/sys/net/ipv4/ip_forward ( enabled ip forwarding )


[2]iptables -A FORWARD -d 192.168.131.131 -p tcp --dport 80 -j ACCEPT

[3]iptables -t nat -A PREROUTING -d xx.xx.xx.xx -p tcp --dport 80 -j 
DNAT --to-destination 192.168.131.131

port 80 is opened on the web server  I'm able to access the web -page 
from internal systems as well as from the firewall it self through elinks
but not able to access the web-page from Internet ( means firewall 
system is not forwarding the packets to the web server )

I've also tried following rule in firewall for SNAT

iptables -t nat -A POSTROUTING -s 192.168.131.131 -j SNAT --to-source 
xx.xx.xx.xx

but it fails

what do  I need to check further  what other configuration do I need ??

Thnx

-- 
   °v°
  /(_)\
   ^ ^  Jatin Khatri
Registerd Linux user No #501175
www.counter.li.org
No M$

-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Re: iptables and NAT

2011-01-25 Thread Tim

On Tue, 2011-01-25 at 17:47 +0530, Jatin K wrote:
 I'got your point replaced NAT with nat  ... saved iptables wiht
 service iptable save
  
 but server is not forwarding the packets to the web server
  
 if i try http://xx.xx.xx.xx  ( live ip )  .. .. no page is displayed
  
 what it could be ???

To test the NAT rule, you'd have to make an incoming connection through
that network.  You could use an outside proxy.  Or, you could go to one
of the HTML validator sites, and ask it to validate your homepage.
That's a simple check, without having to set up anything special.

e.g. Visit http://validator.w3.org/ and give it the address to your
website (your IP address that you've not being telling us).

-- 
[tim@localhost ~]$ uname -r
2.6.27.25-78.2.56.fc9.i686

Don't send private replies to my address, the mailbox is ignored.  I
read messages from the public lists.



-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Re: iptables and NAT

2011-01-25 Thread Jatin K

On Tuesday 25 January 2011 07:08 PM, Tim wrote:
 On Tue, 2011-01-25 at 17:47 +0530, Jatin K wrote:
 I'got your point replaced NAT with nat  ... saved iptables wiht
 service iptable save

 but server is not forwarding the packets to the web server

 if i try http://xx.xx.xx.xx  ( live ip )  .. .. no page is displayed

 what it could be ???
 To test the NAT rule, you'd have to make an incoming connection through
 that network.  You could use an outside proxy.  Or, you could go to one
 of the HTML validator sites, and ask it to validate your homepage.
 That's a simple check, without having to set up anything special.

 e.g. Visit http://validator.w3.org/ and give it the address to your
 website (your IP address that you've not being telling us).

I've tested this function through other ISP  ( from my other branch ) 
 and also checked it from my phone on 3G network

-- 
   °v°
  /(_)\
   ^ ^  Jatin Khatri
Registerd Linux user No #501175
www.counter.li.org
No M$

-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Re: iptables and NAT

2011-01-25 Thread Tim

On Tue, 2011-01-25 at 19:33 +0530, Jatin K wrote:
 I've tested this function through other ISP  ( from my other branch ) 
  and also checked it from my phone on 3G network

Then, you've got several things to think about:

Firewall.  Is it getting in the way, before or after the NAT rule?

Is there something before your computer (e.g. a modem/router)?  Does it
need configuring to let it through.

Is your webserver listening for connections on all interfaces?

Once you get it going, I'd go back and refine your NAT rule.  Do you
want all ports to be NATed through, or just port 80?

By way of example, I've just copied (below) a few rules that I have on
an old Fedora box, back from when I was using dial-up.  Those narrowed
down connections to only TCP, particular TCP port numbers, particular
interfaces, and/or particular source addresses.


iptables --table nat --append PREROUTING --protocol tcp --destination-port 80 
--jump DNAT --to-destination 192.168.1.1:80

iptables --table nat --append PREROUTING --protocol tcp --in-interface ppp+ 
--source 2.3.4.5 --destination-port 80 --jump DNAT --to-destination 
192.168.1.1:80

iptables --table nat --append PREROUTING --protocol tcp --in-interface ppp+ 
--source 0.0.0.0/0 --destination-port 443 --jump DNAT --to-destination 
192.168.1.6:443

-- 
[tim@localhost ~]$ uname -r
2.6.27.25-78.2.56.fc9.i686

Don't send private replies to my address, the mailbox is ignored.  I
read messages from the public lists.



-- 
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Re: [389-users] Sync AD with 389-DS Unable to parse response

2011-01-25 Thread Rich Megginson

On 01/25/2011 01:29 AM, remy d1 wrote:

Hi Rich,

I tried to raise the log level, but when I did it, I was not able to
stop/restart my dirsrv service.
What log level did you use? What error messages did you see when you
attempted to stop/restart the service? Anything in the errors log?
To stop it, I must kill the process and remove the pid file. Then I
could start it.

In my error logs, there is a lot of informations :

[root@KingKong ~]# tail /var/log/dirsrv/slapd-KingKong/errors
[24/Jan/2011:16:18:30 +0100] NSMMReplicationPlugin - changelog program
- cl5GetOperationCount: could not get DB object for replica
[24/Jan/2011:16:18:30 +0100] NSMMReplicationPlugin - changelog program
- _cl5GetDBFile: no DB object found for database
/var/lib/dirsrv/slapd-KingKong/changelogdb/1d934402-27b111e0-b651ef2e-02b602d3_4d0b2887.db4
[24/Jan/2011:16:18:30 +0100] NSMMReplicationPlugin - changelog program
- cl5GetOperationCount: could not get DB object for replica
[24/Jan/2011:16:18:40 +0100] NSMMReplicationPlugin - changelog program
- _cl5GetDBFile: no DB object found for database
/var/lib/dirsrv/slapd-KingKong/changelogdb/1d934402-27b111e0-b651ef2e-02b602d3_4d0b2887.db4
[24/Jan/2011:16:18:40 +0100] NSMMReplicationPlugin - changelog program
- cl5GetOperationCount: could not get DB object for replica
[24/Jan/2011:16:18:41 +0100] NSMMReplicationPlugin - changelog program
- _cl5GetDBFile: no DB object found for database
/var/lib/dirsrv/slapd-KingKong/changelogdb/1d934402-27b111e0-b651ef2e-02b602d3_4d0b2887.db4
[24/Jan/2011:16:18:41 +0100] NSMMReplicationPlugin - changelog program
- cl5GetOperationCount: could not get DB object for replica
[24/Jan/2011:16:18:42 +0100] NSMMReplicationPlugin - changelog program
- _cl5GetDBFile: no DB object found for database
/var/lib/dirsrv/slapd-KingKong/changelogdb/1d934402-27b111e0-b651ef2e-02b602d3_4d0b2887.db4
[24/Jan/2011:16:18:42 +0100] NSMMReplicationPlugin - changelog program
- cl5GetOperationCount: could not get DB object for replica
[24/Jan/2011:16:24:18 +0100] NSMMReplicationPlugin - changelog program
- cl5ExportLDIF: failed to locate changelog file for replica at
(dc=mydomain,dc=com)

This problem is very similar to this post :
http://www.redhat.com/archives/fedora-directory-commits/2009-March/msg5.html
Although I have the last version of 389-DS.
Are you sure this is the correct post you wanted to refer to? Because
this is a patch commit for a fix when moving the changelog directory -
did you move the changelog directory? Because you did not mention it in
your earlier post.

I think I have also some troubleshooting with my hostname because bind
is not configured. However, I have choosen to put it my /etc/hosts file

[root@KingKong ~]# nl /etc/host.conf
1multi on
2order hosts,bind
hostname command reply the full fqdn if I choose the option
--all-fqdn, contrary to the option --fqdn. The reply is just my
hostname without the domain. By the way, if I say

#hostname KingKong.mydomain.com http://KingKong.mydomain.com
Eveything is now good for my hostname but I can not launch my
389-console. I think the adress to connect is not ok... I do not know
if this problem is linked to the previous problems...

So, I do #hostname KingKong
Then, I launch the console again. Now, if I try to initiate a full
synchronization, I can see (and I am still stuck on it) the window
please wait while data is being synchronized..., but nothing else...
Data are not synchronized and I do not see anything in my Windows
event viewer while replica agreement seems to be ok and PassSync
service is installed...
It is very difficult to change your hostname after you have configured
the admin server and console. I suggest starting over from scratch, and
first make sure your hostname is correct.

I also suggest using
http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html-single/Administration_Guide/index.html#Windows_Sync
to configure Windows Sync.

Thanks for help,

-Regards

2011/1/21 Rich Megginson rmegg...@redhat.com
mailto:rmegg...@redhat.com

Date:
Fri, 21 Jan 2011 10:25:56 +0100
To:
General discussion list for the 389 Directory server project.
389-us...@lists.fedoraproject.org
mailto:389-us...@lists.fedoraproject.org

Hi Rich,

Thanks for this usefull link.

I have successfully initiate replica between Windows AD and my
server 389-DS. Ldapsearch is working. But even if everything
seems to be ok, the update does not work and I do not see any
error in the log files... So, my AD server stay empty, the
accounts are not migrate...

Here you have my access log file which is more verbose...
(mydomain.com http://mydomain.com for the example) :

snip

Obviously I am connecting to the server 389-DS itself whereas it
can resolve the DNS name of my Windows server... There is no
error in the AD event viewer while I

78 matches

Mail list logo