November 2012 Maintenance for OES11 is released
November 2012 Maintenance patch for OES11 has been released
Key DSfW specific bugs fixed with this maintenance patch
- – 736416: DSfW – Apple OSX Compatibility: Login to DSfW without ID mapping doesn’t work
- – 739450: DSfW: W32Time auth provider for ntp does not work in a cross partition setup
- – 768113: DSFW: xadsd crashes in dcerpc libprot_ncacn.so library
- – 769945: Assignment of users o authorise RDP Access to Windows Workstation
- – 770416: OES11SP1LH: DNS/DHCP management console can not configure update policy option as DSfW requires
- – 771993: OES11SP1LH: gposync runs in a loop
- – 774802: xadsd crashes in rpc__list_element_alloc ()
- – 778235: gposync tool reports success even if nsimAssignments is not updated
- – 783939: DSFW: No results for LDAP Query when OID is used instead of attribute name in the search filter.
- – 784366: xadsd crashes in rpc__cn_binding_inq_addr () due to failed NTLMSSP authentication requests
Key CIFS, DNS,… Continue reading
November 2012 Scheduled Maintenance for OES2SP3
November 2012 Maintenance patch for OES2P3 has been released
Key DSfW specific bugs fixed with this maintenance patch
- 736416: DSfW – Apple OSX Compatibility: Login to DSfW without ID mapping doesn’t work
- 739450: DSfW: W32Time auth provider for ntp does not work in a cross partition setup
- 768113: DSFW: xadsd crashes in dcerpc libprot\_ncacn.so library
- 769945: Assignment of users of authorise RDP Access to Windows Workstation
- 771993: gposync runs in a loop
- 774802: xadsd crashes in rpc\_\_list\_element\_alloc ()
- 778235: gposync tool reports success even if nsimAssignments is not updated
- 783939: DSFW: No results for LDAP Query when OID is used instead of attribute name in the search filter.
- 784366: xadsd crashes in rpc\_\_cn\_binding\_inq\_addr () due to failed NTLMSSP authentication requests
- 790470: KDC service and Domain services daemon does not come up post Nov 2012 patch build installed
Key CIFS, DNS, and AFT specific bugs fixed with this maintenance… Continue reading
eDirectory 8.8 SP7 Patch 2 for Linux & Unix
Stand alone eDirectory 838 SP7 Patch 2 has been released. It can be found at Novell.com/downloads
Do not apply this patch on an OES server!
Issues resolved in eDirectory 8.8 SP7 Patch 2 (20703.00)
December 2012
NDSD
– FLAIM: when performing a LDAP search on a non-existent user using a complex filter err = no such entry (-601) is returned (Bug 608436)
– NCP: NDSD cores allocating a connection slot (OES Bug 710806) (Non-OES Bug 692389)
– NDSD cores on PDC in DSFW environment iterating nested groups (Bug 719736/711799/750982)
– CIFS core during sub-tree search (Bug 751962)
– Security Vulnerability: eDirectory DoS dhost request with certains characters (Bug 772895) (CVE-2012-0429)
– Security Vulnerability: eDirectory Authorization Mechanism Bypass (Bug 772898) (CVE-2012-0430)
– Security Vulnerability: eDirectory Cross Site Scripting exploit (Bug 772899) (CVE-2012-0428)
– Nauditds.dlm fails to initialize completely during initial eDirectory startup … Continue reading
September 2012 Maintenance for OES11.1 is released
September 2012 Maintenance patch for OES11SP1 has been released
Key DSfW specific bugs fixed with this maintenance patch
- – 667829: On Win2K8 R2 client joined to DSfW domain fails to create xen Desktop image from xendesktop studio
- – 723878: Normal Domain Users have all filesystem rights to new GPOs with Oes2Sp3
- -736413: DSfW – Apple OSX Compatibility: memberOf query returns incorrect groupmembership results
- – 736414: DSfW – Apple OSX Compatibility: ObjectSid queries return incorrect results
- – 737877: CIFS- Support for CIFS invalid user name/password presented multiple times
- – 738031: DSFW: Configuration of Windows 2008R2 Remote Desktop Licensing fails
- – 765721: DSfW – Apple OSX Compatibility: OSX 10.6.x mobile account login issues when attribute loginintruderaddress is populated for users
September 2012 Scheduled Maintenance for OES11SP1
- – 583261: httpstkd randomly stops
- – 667829: On Win2K8 R2 client joined to DSfW domain fails to create xen Desktop image from xendesktop studio
- – 706758:… Continue reading
September 2012 Maintenance for OES11 is released
September 2012 Maintenance patch for OES11 has been released
Key DSfW specific bugs fixed with this maintenance patch
- – 667829: On Win2K8 R2 client joined to DSfW domain fails to create xen Desktop image from xendesktop studio
- – 723878: Normal Domain Users have all filesystem rights to new GPOs with Oes2Sp3
- -736413: DSfW – Apple OSX Compatibility: memberOf query returns incorrect groupmembership results
- – 736414: DSfW – Apple OSX Compatibility: ObjectSid queries return incorrect results
- – 737877: CIFS- Support for CIFS invalid user name/password presented multiple times
- – 738031: DSFW: Configuration of Windows 2008R2 Remote Desktop Licensing fails
- – 765721: DSfW – Apple OSX Compatibility: OSX 10.6.x mobile account login issues when attribute loginintruderaddress is populated for users
- – 768348: DSFW Migration:Other service repair is failing in miggui tool from oes2sp2 and oes11fp0 to oes11sp1 migration
- – 780394 – DSFW support for resolving a Well Known GUID, AD distinguishedName format… Continue reading
September 2012 Maintenance for OES2SP3 is released
September 2012 Maintenance patch for OES2P3 has been released
Key DSfW specific bugs fixed with this maintenance patch
- – 667829: On Win2K8 R2 client joined to DSfW domain fails to create xen Desktop image from xendesktop studio
- – 723878: Normal Domain Users have all filesystem rights to new GPOs with Oes2Sp3
- -736413: DSfW – Apple OSX Compatibility: memberOf query returns incorrect groupmembership results
- – 736414: DSfW – Apple OSX Compatibility: ObjectSid queries return incorrect results
- – 737877: CIFS- Support for CIFS invalid user name/password presented multiple times
- – 738031: DSFW: Configuration of Windows 2008R2 Remote Desktop Licensing fails
- – 765721: DSfW – Apple OSX Compatibility: OSX 10.6.x mobile account login issues when attribute loginintruderaddress is populated for users
September 2012 Scheduled Maintenance for OES2SP3
- 583261: httpstkd randomly stops
- 667829: On Win2K8 R2 client joined to DSfW domain fails to create xen Desktop image from xendesktop studio
- 675596: oes-ldap not getting… Continue reading
VMWare and best practices for Timekeeping
Lately I’ve been getting a lot of requests for timekeeping best practices for VMWare
VMWare has a great support article on this. Below are the SLES recommendations. The article can be found here
| SLES 11 (All updates) | No additional kernel parameters required. | |
| SLES 10 SP4 on ESX 5.0 and later | clock=pmtmr hpet=disable |
|
| SLES 10 SP4 on ESX 4.x | Use a VMI enabled kernel. | |
| SLES 10 SP3 on ESXi 5.0 | clock=pmtmr hpet=disable |
|
| SLES 10 SP3 on ESX 3.5 and 4.x | Use a VMI enabled kernel. | |
| SLES 10 SP3 on ESX 3.0.x and earlier | clock=pmtmr hpet=disable |
|
| SLES 10 SP2 on ESXi 5.0 | clock=pmtmr hpet=disable |
|
| SLES 10 SP2 on ESX 3.5 and 4.x | Use a VMI enabled kernel. | |
| SLES 10 SP2 on ESX 3.0.x and earlier | clock=pmtmr hpet=disable |
|
| SLES 10 SP1 | clock=pmtmr hpet=disable |
|
| SLES 10 | clock=pmtmr hpet=disable |
|
| SLES 9 (All updates) | clock=pmtmr hpet=disable |
|
| SLES 8 | No additional kernel parameters required.… Continue reading |
Script to check if ports are listening
If you are concerned about a DSfW service going down and or the port is not accessible, this script will help keep the services up or notify you of a service going down. The script will check if each DSfW service is listening, then telnet to each port. If it can not telnet, the script will log which port is not accessable in the /var/opt/novell/xad/log/dsfw_portchk.log.
The dsfw_portchk.sh script can be ran on PDC or ADC, running Novell DNS or not running Novell DNS.
The script can also e-mail and restart the services if desired.
It will detect if the server has IPv6 enabled so to properly detect the correct port Samba and NetBios is listening on.
The script detects if Novell DNS is configured to start. Some times on ADC servers DNS is not configured or is not set to run. The original script… Continue reading
Open Enterprise Server 11 SP1 is released
Open Enterprise Server 11 SP1 has been released today
LearnEventually, hopefully in the next update or two to more about OES11SP1 here
The download links for OES11 SP1 are:
Download link: http://download.novell.com/SummaryFree.jsp?buildid=rmqoq2iehSQ~
Documentation: http://www.novell.com/documentation/oes11/
As far as Domain Services for Windows goes, the install will now allow you to choose between a simplified install or the standard. The simplified install of DSfW reduces the number of screen, removing many of the screens that most people click next on with out any changes too. The install is also more intuitive. If follows along with the type of DSfW install you are doing instead of starting with the eDirectory configuration.
OES11SP1 has also improved gposync. This should help reduce issues with gopsync not working correctly or properly syncing gpos out to the ADC DSfW servers.
OES11SP1 migrations for DSfW servers are now supported. The supported migrations are:… Continue reading
July 2012 Maintenance for OES11 is released
July 2012 Maintenance for OES 11 along with July 2012 Scheduled Maintenance for eDirectory 8.8 SP6 patch 6 have been released
Key DSfW specific bugs fixed with this maintenance patch
- – 771737: OES11SP1LH: MMC can not create a User
- – 761449: Can not Create Groups or OUs with MMC
- – 758572: DSFW: Windows 7 remote assistance is not working.
- – 766772: UpdatePDCMaster.pl failed during PDC role transfer
- – 763854: Managing GPOs fail due to SYSVOL DFS referral link pointing to wrong path
- – 738214: DSfW – All xadsd threads stuck in pthread_cond_wait/lock wait, causing xadsd to be unresponsive
- – 758992: DSFW: Polycom SSO configuration fails with error “”Access Denied”” while changing password
- – 703655: SYSVOL DFS referral link points to ADC and interrupts GPO Administrator operations
July 2012 Scheduled Maintenance for OES11
- – 583261: httpstkd randomly stops
- – 658145: NSS volume with Di and RI flags, incorrectly blocks root user… Continue reading
July 2012 Maintenance for OES2SP3 eDirectory 8.8 SP6 patch 6 released
The July 2012 Maintenance Patch for eDirectory 8.8 SP6 has been release
The 64 bit version can be found here
The 32 bit version can be found here
List of bug fixes in the July 2012 Maintenance for OES2SP3 for eDirectory patch 6
- – 679767: NMAS Client aborts NCP connection and returns error -625 immediately upon having sent NMAS Start Session request on an idle NCP connection where server sent Watchdog packets.
- – 733188: eDirectory returns error 48 ‘Anonymous Simple Bind Disabled’ for authenticated TLS bind
- – 749516: Dclient DDCGetSEVList function does not return cifs users GUID causing CIFS users authorization failure and Memory/CPU spike up.
- – 765688: Right granted to dynamic group is assigned to whole tree, not just its members
| novell-dclient-32bit-8.8.6.6-0.7.x86_64.rpm | 372.8 KB (381796) |
| novell-dclient-8.8.6.6-0.7.x86_64.rpm | 385.3 KB (394647) |
| novell-edirectory-jclnt-8.8.6.6-0.7.x86_64.rpm | 273.7 KB (280353) |
| novell-edirectory-ldap-extensions-32bit-8.8.6.3-0.11.x86_64.rpm | 28.2 KB (28933) |
| novell-edirectory-ldap-extensions-8.8.6.3-0.11.x86_64.rpm | 29.7 KB (30492) |
| novell-edirectory-tsands-32bit-8.8.6.6-0.7.x86_64.rpm | 257.4 KB… Continue reading |
July 2012 Maintenance for OES11 eDirectory 8.8 SP6 patch 6 released
The July 2012 Maintenance Patch for eDirectory 8.8 SP6 has been release
The 64 bit version can be found here
List of bug fixes in the July 2012 Maintenance for OES11 for eDirectory patch 6
- – 679767: NMAS Client aborts NCP connection and returns error -625 immediately upon having sent NMAS Start Session request on an idle NCP connection where server sent Watchdog packets.
- – 733188: eDirectory returns error 48 ‘Anonymous Simple Bind Disabled’ for authenticated TLS bind
- – 749516: Dclient DDCGetSEVList function does not return cifs users GUID causing CIFS users authorization failure and Memory/CPU spike up.
- – 765688: Right granted to dynamic group is assigned to whole tree, not just its members
| novell-dclient-32bit-8.8.6.6-1.1.x86_64.rpm | 350.2 KB (358675) |
| novell-dclient-8.8.6.6-1.1.x86_64.rpm | 352.7 KB (361182) |
| novell-edirectory-jclnt-8.8.6.6-1.1.x86_64.rpm | 267.9 KB (274431) |
| novell-edirectory-tsands-32bit-8.8.6.6-1.1.x86_64.rpm | 258.3 KB (264554) |
| novell-edirectory-tsands-8.8.6.6-1.1.x86_64.rpm | 265.3 KB (271675) |
| novell-NDSbase-32bit-8.8.6.6-1.1.x86_64.rpm | 406.9 KB (416672) |
| novell-NDSbase-8.8.6.6-1.1.x86_64.rpm | 553.3 KB (566596) |
| novell-NDScommon-8.8.6.6-1.1.x86_64.rpm | 225.7 KB (231121) |
| novell-NDSimon-8.8.6.6-1.4.x86_64.rpm | 2.5 MB (2672112)… Continue reading |
Stand alone eDirectory 8.8 SP7 Patch 1
eDirectory 8.8 SP7 Patch 1 has been release for stand alone (non OES) Linux, Unix, and Windows
Issues addressed in the patch include
NDSD
– Object modifications taking longer on the Windows platform than on Linux (Bug 759576)
– Installing an eDirectory patch on Windows 2008 fails stating that the installed patch is of a later version (Bug 766254)
resulted in
– Alias objects not being returned during searches in iMonitor or iManager (Bug 738688)
– Dynamic group rights issue (Bug 765688)
– NDSD core from libslp.so.1 (Bug 492605)
– NDSD core after upgrading eDirectory to 64-bit on Solaris (Bug 750264)
LDAP
– LDAP control information is now shown in ndstrace (Bug 757770)
NMAS
– On Solaris an LDAP search on login time returned, “loginTime: 19700101000000Z” (Bug 734632)
– Error: -222 when changing a user’s password with write rights to the… Continue reading
How to find all DNS Locator objects
When installing DSfW into an environment were Novell DNS is already in use, be sure to use the existing DNS Locator object. It will simplify management for the all the zones and DNS servers. The locator object is used by the DNS/DHCP Console to return all zones and DNS servers the locator object knows about. If there are multiple locator objects then the first locator object discovered by the DNS/DHCP Console will be used. What will happen is only zones and DNS servers the DNS Loctor object knows about will be displayed and managed in the DNS/DHCP Console. This makes managing DNS difficult. Before installing doe a quick search for existing locator objects.
Do the following search to discover existing locator objects
ldapsearch -x -b “” -s sub objectClass=dNIPlocator
OES11 SP1 Beta released
The OES11 SP1 Beta has been publicly released
Check it out if you are interested in seeing some of the new features in OES
The big news for Domain Services for Windows is the simplified install.
The install allows for a simplified install
For the simplified install the YaST configuration screens have been minimized.
The first screen start with what type of install instead of the eDirectory screen.
Some screens have been eliminated and common default values are used automatically making the install less confusing.
Plus it runs on SLES11 SP2
For more info see http://www.novell.com/beta/auth/beta.jsp?id=4425&type=1
The ISOs can be found here:
ISOs:http://download.novell.com/Download?buildid=hXpxKX0Z4g8~
The documentation can be found here:
Docs:http://www.novell.com/documentation/beta/oes11/oes11_toc/data/index-stand.html
Delete an attribute on all users with a script
Here is the bases of a script to delete an attribute on a user.
I come across issues where an attribute was populated on several users that shouldn’t be there or you want to create new objectsids or just remove the existing objectsids and replace them with a back up.
Most DSfW installs are a name mapped install meaning the install is mapped to an existing container in the tree. If this is the case the domain name most likely will not patch to context in the tree and most likely the objectclass wit not be domain. An example of a domain with the name of novell.com mapped to a container with an objectclass of Organization (o=novell) and not domain (dc=novell). Even it if is a dc most likely the fdn does not match the domain name. Continuing with our example of novell.com that would… Continue reading
Troubleshooting slow logins and unresponsive DSfW servers
I have seen several issues were a DSfW server becomes sluggish or unresponsive. Logins can take several minutes. Some times ndsd or another DSfW process crashes.
If a DSfW server running DNS has a DSfW specific process stop or crash a quick stop gap measure is to monitor the DSfW processes and restart them if one or more of the DSfW processes stop. I created a simple script that will check that a pid exists for each process. The script is called dsfw_processchk.sh. While it does not restart DSfW in every condition like if a process continues to run but is not responding or say a process crashes but the pid is never cleaned up, it does work for most situations. Create a cron job to run the script every hour, 30 minutes, 10 minutes, what ever you desire. My… Continue reading
eDirectory Post-887 Kerberos
TID 5088210
This patch has been made available to resolve installation failures due to signed Kerberos packages when installing eDirectory 8.8 SP6 or 8.8 SP7 on a recently patched Red Hat 6.2 server. For more information please refer to TID 7006535.
details
This patch can be used to avoid signed kerberos package errors during the installation of 8.8 SP6 and 8.8. SP7 on non-OES platforms. This patch also contains instructions on how to resolve the installation failure after it has happened.
Issues Resolved:
Post 887 Kerberos
Linux:
– Installation of novell-kerberos-base and novell-kerberos-ldap-extensions rpms fails on RedHat 6.2 with current updates.
TID 7006535
Installation Instructions
Before attempting to install eDirectory 8.8.7 on Red Hat 6.2
Essentially an overlay will be created by replacing the original Kerberos packages with the new ones prior to installing eDirectory on the server.
32-Bit eDirectory :
Log in as a user with root privileges… Continue reading
April 2012 Scheduled Maintenance for OES11 for eDirectory 8.8 SP6 Patch5
April 2012 Scheduled Maintenance for OES11 for eDirectory 8.8 SP6 Patch5
TID 5141051Files Included Size
license_agreement.txt 2.8 KB (2909)
novell-dclient-32bit-8.8.6.5-3.14.x86_64.rpm 350.0 KB (358449)
novell-dclient-8.8.6.5-3.14.x86_64.rpm 352.5 KB (361035)
novell-edirectory-jclnt-8.8.6.5-3.29.x86_64.rpm 267.6 KB (274042)
novell-edirectory-tsands-32bit-8.8.6.5-3.29.x86_64.rpm 257.9 KB (264148)
novell-edirectory-tsands-8.8.6.5-3.29.x86_64.rpm 264.9 KB (271293)
novell-NDSbase-32bit-8.8.6.5-3.29.x86_64.rpm 406.4 KB (416224)
novell-NDSbase-8.8.6.5-3.29.x86_64.rpm 552.7 KB (566025)
novell-NDScommon-8.8.6.5-3.29.x86_64.rpm 225.3 KB (230725)
novell-NDSimon-8.8.6.5-3.124.x86_64.rpm 2.5 MB (2665985)
novell-NDSserv-32bit-8.8.6.5-3.29.x86_64.rpm 4.5 MB (4769948)
novell-NDSserv-8.8.6.5-3.29.x86_64.rpm 6.0 MB (6392800)
novell-NOVLembox-8.8.6.5-3.90.x86_64.rpm 2.3 MB (2428914)
novell-NOVLice-32bit-8.8.6.5-3.29.x86_64.rpm 263.3 KB (269625)
novell-NOVLice-8.8.6.5-3.29.x86_64.rpm 443.4 KB (454111)
novell-NOVLsnmp-8.8.6.5-3.16.x86_64.rpm 70.7 KB (72481)
novell-NOVLsubag-8.8.6.5-3.16.x86_64.rpm 685.7 KB (702220)
novell-sasl-gssapi-method-2.8.3.3-4.1.x86_64.rpm 1.4 MB (1567378)
readme_5141051.html 10.5 KB (10797)