July 2012 Maintenance for OES11 is released
July 2012 Maintenance for OES 11 along with July 2012 Scheduled Maintenance for eDirectory 8.8 SP6 patch 6 have been released
Key DSfW specific bugs fixed with this maintenance patch
- – 771737: OES11SP1LH: MMC can not create a User
- – 761449: Can not Create Groups or OUs with MMC
- – 758572: DSFW: Windows 7 remote assistance is not working.
- – 766772: UpdatePDCMaster.pl failed during PDC role transfer
- – 763854: Managing GPOs fail due to SYSVOL DFS referral link pointing to wrong path
- – 738214: DSfW – All xadsd threads stuck in pthread_cond_wait/lock wait, causing xadsd to be unresponsive
- – 758992: DSFW: Polycom SSO configuration fails with error “”Access Denied”” while changing password
- – 703655: SYSVOL DFS referral link points to ADC and interrupts GPO Administrator operations
July 2012 Scheduled Maintenance for OES11
- – 583261: httpstkd randomly stops
- – 658145: NSS volume with Di and RI flags, incorrectly blocks root user… Continue reading
July 2012 Maintenance for OES2SP3 has been released
The July 2012 Maintenance Patch for oes2 sp3 has been release
The 64 bit version can be found here
The 32 bit version can be found here
List of bug fixes in the July 2012 Maintenance for OES2SP3
- 142091: Inconsistency with naming in the GUI
- 142183: Secrets added to Gnome Keyring through CASAManager have a default key/value pair of GKPassword/novell
- 146015: A CASAKeyring is created to add secrets to the Gnome Keyring through CASAManager
- 147031: CASAManager should have a menu item.
- 155529: Firefox Tab is available in CASAManager Preferences even if Firefox is not installed
- 172719: Starting CASAManager with store locked throws exception
- 200912: After a lun is resized gpt does not work correctly
- 508945: When micasad is stopped its status is displayed as “dead”
- 509471: miCASASetCredential handles input argument incorrectly
- 523398: CASA Manager prints GTK warning messages on terminal
- 523402: CASA Manager prints messages on terminal when… Continue reading
July 2012 Maintenance for OES2SP3 eDirectory 8.8 SP6 patch 6 released
The July 2012 Maintenance Patch for eDirectory 8.8 SP6 has been release
The 64 bit version can be found here
The 32 bit version can be found here
List of bug fixes in the July 2012 Maintenance for OES2SP3 for eDirectory patch 6
- – 679767: NMAS Client aborts NCP connection and returns error -625 immediately upon having sent NMAS Start Session request on an idle NCP connection where server sent Watchdog packets.
- – 733188: eDirectory returns error 48 ‘Anonymous Simple Bind Disabled’ for authenticated TLS bind
- – 749516: Dclient DDCGetSEVList function does not return cifs users GUID causing CIFS users authorization failure and Memory/CPU spike up.
- – 765688: Right granted to dynamic group is assigned to whole tree, not just its members
| novell-dclient-32bit-8.8.6.6-0.7.x86_64.rpm | 372.8 KB (381796) |
| novell-dclient-8.8.6.6-0.7.x86_64.rpm | 385.3 KB (394647) |
| novell-edirectory-jclnt-8.8.6.6-0.7.x86_64.rpm | 273.7 KB (280353) |
| novell-edirectory-ldap-extensions-32bit-8.8.6.3-0.11.x86_64.rpm | 28.2 KB (28933) |
| novell-edirectory-ldap-extensions-8.8.6.3-0.11.x86_64.rpm | 29.7 KB (30492) |
| novell-edirectory-tsands-32bit-8.8.6.6-0.7.x86_64.rpm | 257.4 KB… Continue reading |
July 2012 Maintenance for OES11 eDirectory 8.8 SP6 patch 6 released
The July 2012 Maintenance Patch for eDirectory 8.8 SP6 has been release
The 64 bit version can be found here
List of bug fixes in the July 2012 Maintenance for OES11 for eDirectory patch 6
- – 679767: NMAS Client aborts NCP connection and returns error -625 immediately upon having sent NMAS Start Session request on an idle NCP connection where server sent Watchdog packets.
- – 733188: eDirectory returns error 48 ‘Anonymous Simple Bind Disabled’ for authenticated TLS bind
- – 749516: Dclient DDCGetSEVList function does not return cifs users GUID causing CIFS users authorization failure and Memory/CPU spike up.
- – 765688: Right granted to dynamic group is assigned to whole tree, not just its members
| novell-dclient-32bit-8.8.6.6-1.1.x86_64.rpm | 350.2 KB (358675) |
| novell-dclient-8.8.6.6-1.1.x86_64.rpm | 352.7 KB (361182) |
| novell-edirectory-jclnt-8.8.6.6-1.1.x86_64.rpm | 267.9 KB (274431) |
| novell-edirectory-tsands-32bit-8.8.6.6-1.1.x86_64.rpm | 258.3 KB (264554) |
| novell-edirectory-tsands-8.8.6.6-1.1.x86_64.rpm | 265.3 KB (271675) |
| novell-NDSbase-32bit-8.8.6.6-1.1.x86_64.rpm | 406.9 KB (416672) |
| novell-NDSbase-8.8.6.6-1.1.x86_64.rpm | 553.3 KB (566596) |
| novell-NDScommon-8.8.6.6-1.1.x86_64.rpm | 225.7 KB (231121) |
| novell-NDSimon-8.8.6.6-1.4.x86_64.rpm | 2.5 MB (2672112)… Continue reading |
Stand alone eDirectory 8.8 SP7 Patch 1
eDirectory 8.8 SP7 Patch 1 has been release for stand alone (non OES) Linux, Unix, and Windows
Issues addressed in the patch include
NDSD
– Object modifications taking longer on the Windows platform than on Linux (Bug 759576)
– Installing an eDirectory patch on Windows 2008 fails stating that the installed patch is of a later version (Bug 766254)
resulted in
– Alias objects not being returned during searches in iMonitor or iManager (Bug 738688)
– Dynamic group rights issue (Bug 765688)
– NDSD core from libslp.so.1 (Bug 492605)
– NDSD core after upgrading eDirectory to 64-bit on Solaris (Bug 750264)
LDAP
– LDAP control information is now shown in ndstrace (Bug 757770)
NMAS
– On Solaris an LDAP search on login time returned, “loginTime: 19700101000000Z” (Bug 734632)
– Error: -222 when changing a user’s password with write rights to the… Continue reading
OES11 SP1 Beta released
The OES11 SP1 Beta has been publicly released
Check it out if you are interested in seeing some of the new features in OES
The big news for Domain Services for Windows is the simplified install.
The install allows for a simplified install
For the simplified install the YaST configuration screens have been minimized.
The first screen start with what type of install instead of the eDirectory screen.
Some screens have been eliminated and common default values are used automatically making the install less confusing.
Plus it runs on SLES11 SP2
For more info see http://www.novell.com/beta/auth/beta.jsp?id=4425&type=1
The ISOs can be found here:
ISOs:http://download.novell.com/Download?buildid=hXpxKX0Z4g8~
The documentation can be found here:
Docs:http://www.novell.com/documentation/beta/oes11/oes11_toc/data/index-stand.html
Delete an attribute on all users with a script
Here is the bases of a script to delete an attribute on a user.
I come across issues where an attribute was populated on several users that shouldn’t be there or you want to create new objectsids or just remove the existing objectsids and replace them with a back up.
Most DSfW installs are a name mapped install meaning the install is mapped to an existing container in the tree. If this is the case the domain name most likely will not patch to context in the tree and most likely the objectclass wit not be domain. An example of a domain with the name of novell.com mapped to a container with an objectclass of Organization (o=novell) and not domain (dc=novell). Even it if is a dc most likely the fdn does not match the domain name. Continuing with our example of novell.com that would… Continue reading
Troubleshooting slow logins and unresponsive DSfW servers
I have seen several issues were a DSfW server becomes sluggish or unresponsive. Logins can take several minutes. Some times ndsd or another DSfW process crashes.
If a DSfW server running DNS has a DSfW specific process stop or crash a quick stop gap measure is to monitor the DSfW processes and restart them if one or more of the DSfW processes stop. I created a simple script that will check that a pid exists for each process. The script is called dsfw_processchk.sh. While it does not restart DSfW in every condition like if a process continues to run but is not responding or say a process crashes but the pid is never cleaned up, it does work for most situations. Create a cron job to run the script every hour, 30 minutes, 10 minutes, what ever you desire. My… Continue reading
Script to monitor DSfW processes and restart services
If a DSfW server running DNS has a DSfW specific process stop or crash a quick stop gap mesure is to monitor the DSfW processes and restart them if one or more of the DSfW processes stop. I created a simple script that will check that a pid exists for each process. The script is called dsfw_monitor.sh. While it does not restart DSfW in every condition like if a process continues to run but is not responding or say a process crashes but the pid is never cleaned up, it does work for most situations.
Create a cron job to run the script every hour, 30 minutes, 10 minutes, what ever you desire. My recomendation is to not go below 5 minutes since eDirectory might take several minutes to stop and start again.
To create a cronjob use the crontab command with the -e… Continue reading
Novell DSfW and Authasas Bio-metrics authentication
Authasas provides biometric, smartcard, OTP, and any BioAPI compliant device. They have a solution to provide biometric authentication with DSfW. To learn more about this take a look at this presentation.
The presentation is a case study of the City of Apopka, Florida utilizing Novell eDirectory, Domain Services for Windows, Zenworks, and Authasas to provide bio-metric authentication and GPO implementation.
Eliot Lanes from Viable Solutions, Donald Kahrs from City of Apopka, and Rik Peters, and Paul Robertson from Authasas describe their implementation of Authasas with Domain Services for Windows.
ATT Live Training May 15-18
ATT Live has some great OES specific trainings coming up in May starting the 15th through the 18th at the M Resort in Las Vegas, Nevada.
I will be doing two four hour session on DSfW for Advance Technical Training
The first session will be “Installing a Domain Service for Windows: Domain Tips and Tricks”
We will be going over Installs, different configurations, recommendations, troubleshooting and hands on installs.
The second session will be “Configuring File Servers and Active Directory with Domain Services for Windows”
We will install a second Domain controller, configure Cifs on another OES server, and set up a cross forest trust.
If you are interested in learning about DSfW and would like some hands on experience installing DSfW into an existing tree this will be a great opportunity for you. Besides DSfW a variety of classes will be taught covering Novell, NetIQ… Continue reading
OES2 SP3 March 2012 Maintenance Patch released
March 2012 Scheduled Maintenance for OES2 SP3
TID 5137450
Here are a list of bug fixes in the patch
- – 520981: Disable Login does not work if the source server is OES Linux
- – 612452: Restore of NSS metadata fails via xattr when there are no local replica on the server
- – 637743: NCPCON NSS VERIFY shows trustee differences after moving a volume from NetWare to Linux
- – 647600: OES2SP2 ncpcon log level ALL
- – 666858: Dynamic DNS update for a Windows 7 or Windows 2008R2 WS fails
- – 668859: Directory quotas incorrectly displayed.
- – 681363: Samify Objects fails on NetWare License Object
- – 681567: VLOG does not have any option to specify a different location for stream files
- – 685243: ndsd core stack in GetVolInfo()
- – 687449: Copying files across mounted volumes fails with a -50 error on Mac Clients
- – 692761: CIFS quits working and service needs… Continue reading
How to merge DNS zones
The creation of the DSfW domain will create a DNS zone for the domain along with the reverse zone. If there is already a zone with the same name then merging the zones is necessary.
This video shows how to use the DNS/DHCP Console to export, merge, and import zones.
Manage the Domain Boundary
Starting with OES2SP3 DSfW domain boundaries were no longer restricted to a single partition. Now partitions directly below the partitioned container mapped to the domain can be mapped to the domain as well. This can be done during the install of DSfW and creation of the domain with custom provisioning option or after the creation of the domain using the tool domaincntrl.
Here is a playlist for the videos covering Managing the Domain Boundary
The command and usage for managing the domain boundary can be found in the documentation.
The syntax for domaincntrl is:
domaincntrl <Operation> [arguments]
Operators:
–list
Lists partitions in the domain
–add
Adds a partition to the domain
–remove
Removes a partition (and desamify users) from a domain… Continue reading
Install OES11 DSfW
Here is a playlist for videos covering the install of OES11 DSfW
It is broken out into 6 videos
Install OES11 DSfW – Yast section
Install OES11 DSfW – Log Files
Install OES11 DSfW – Provisioning Wizard
Start with the oes11 documentation and TID 7002172 Preparing for Domain Services for Windows Install
OES2SP3 January Maintenance Patch released
Here are a list of bug fixes in the patch
January 2012 Scheduled Maintenance for OES2 SP3
– 496114: FIRST_WATCHDOG_PACKET Parameter Incorrect
– 498911: iprint_nss_relocate script fails to with errors if dn’s have space in them.
– 517837: Unable to create users with MMC due to the Top superclass on Person
– 557645: random dsfw samba crash log errors in oes2sp1.
– 605154: Mac client misleads users about characters unsupported by Windows
– 616747: Bump version for each milestone.
– 632850: NCP is causing ndsd segfault.
– 641812: owcimomd crash when performing an xml import with an invalid IP address for dserver
– 642072: Modifying DNS Entry For DHCP Zone Breaks DDNS Updates
– 647600: OES2SP2 ncpcon log level ALL
– 648340: creating printer from Manage Print manager throws plugin error after successful creation
– 653310: iPrint database becomes out of sync
– 658145: NSS volume with Di and RI… Continue reading
Prepare to install an ADC DSfW server
This video will go through the preparation of installing an ADC DSfW server. It will guide you through TID 7009927.
Cross Forest Trust Password
Some times the cross forest trust between DSfW and AD fails and a common reason for this failure is the cross forest trust password. By default the Windows server will reset the trust password every 30 days. Some times the change only occurs on the Windows side and trust object in DSfW does not get the update leading to a broken trust. Validating and reseting the trust is one way to fix this. Another option is to disable the server from changing the password. This video will show how to validate the trust, reset the password, modify the number of days when a password is changed, and how to disable password changes.
How to disable the automatic machine account password changes.
-
In the registry go toHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange
- Change the registry subkey to a value of 1 (default is 0 which enables password changes, 1 disables password changes)
- Restart the… Continue reading
OES11 is now available
OES11 is can be downloaded now.
OES11 runs on SLES11SP1. Besides running on SLES11 SP1 there are not a lot of new features. Samba is updated to 3.5 which allows winbind to be configured with out recompiling winbind.
How to create a cross forest trust
This video will guide you through the creation of a cross forest trust between DSfW and AD.
For more information on creating a cross forest trust please read through the documentation
http://www.novell.com/documentation/oes11/acc_dsfw_lx/data/ber65jt.html
The trust password will change every 30 days by default. Consider disabling the automatic machine password changes or increasing the time before the password is changed. Some times when a workstation or in this case trust changes its password the change does not get set in the directory and the trust relationship is broken. In that case the trust needs to be re-established.
If a trust is removed and then re-established, before creating the trust again be sure that the trust object in cn=users, is removed as well. The object will look like a user object with the name of the AD Domain with a $ at the end.
Good MS documents to help troubleshoot errors:
Known… Continue reading
How to create DNS forwarders
In order to create a cross forest trust both the DSfW server and the AD server need to resolve each others domains. The video will show you how to create a forward and reverse forwarder for only the AD zone (domain) to the AD server and how to put a forwarder on the AD server to the DSfW DNS server.
Novell Filr, taking network files to a new level
I’m trying to keep this site more along the lines of DSfW related topics, but I think this is so cool. I can’t wait to have to test this out with DSfW.
For more info about Novell Filr, check out the Filr product page.
Novell DNS Tools – iManager and DNS/DHCP Console
The Novell DNS DHCP Console is what most prefer to use to manager Novell DNS. It allows for easy viewing, modification, and creation of zones, records, and DNS servers.
If there are more than one dns locator objects in the tree use the -C switch after the executable to specify which locator object to use.
-C OESSystemobjects.novell
If updates made in the DNS/DHCP tool are not fast enough for you, loo at the novell_dyn_reconfigure setting on the DNS server object or restart novell-named.
At 6:51 on the video this setting is displayed. 15 minutes is recommend . If the reconfigure is set to 5 minutes in a large environment, the reconfigure might not finish updating cache before the the process is started again.
iManager is the second tool available to use to manage DNS and DHCP. The second video will… Continue reading
LDAP Proxy 1.0 is Released
The much awaited LDAP Proxy has been released and is available for download on the download.novell.com site.
The documentation can be found at http://www.novell.com/documentation/ldapproxy/
If you are unfamiliar with LDAP Proxy, it allows a single access point for access to multiple directories. That is the basic function of LDAP Proxy. It does way more than that. Very cool product. I have been waiting a long time for this.
How to take a LDAP trace – quick version
This video will show you how to take a ldap trace on a linux/DSfW server.
This applies to both eDirectory and DSfW (since DSfW is built on eDir)
A ldap trace is helpf in troublehooting applications or workstations authenticating,
searching, or modifying the directory.
Some commands used in the video
ldapconfig utility:
See the screen level
ldapconfig get |grep -i “ldap screen level”
set the screen level for everything but packet dumping
ldapconfig -s “Operation| Connection| Config| Extensions| Error| Critical| DataConnection”
Setting the screen level to all
ldapconfig -s “ldap screen level=all”
Going back to default screen level
ldapconfig -s “ldap screen level= Error| Critical”
ndstrace section:
turn off the screen and file logging
ndstrace off
clear the filter
set ndstrace = nodebug
enabeling ldap and nmas in the filter
ndstrace +time +tags +ldap +nmas
turn on the screen and logging
ndstrace on
The ndstrace.log is located in
/var/opt/novell/eDirectory/log/
How to take a LDAP trace – long version
How to take a LDAP NMAS trace for DSfW TID 7009602
LDAP on DSfW and how it differs from standard eDirectory LDAP ports
TID 7001886 has information on the ports DSfW uses including the ldap ports.
How to recreate the Domain Users Group
See TID 7009288 for the steps to re-create the Domain Users group
DSfW and Novell Cifs
Novell Cifs is a wonderful way to access files from a workstation not running the Novell Client.
This video shows how to install Novell Cifs and configure it to work with Domain Services for Windows.
The key is to assign the cifs proxy user to the password policy for the DSfW users.