Tim Verhoeven wrote:
I'm happy to announce the availability of the CentOS Directory Server (CDS) for testing. The exact details on how to install it can be found on this wiki page :
Any updates on when we will see this ready for production use? I would like to get away from our current way of providing server authentication and implement CDS. I pretty much have the tools written to use CDS now, but I can not move forward untill it is out of a "testing" status in my environment.
--- Jason Cox
On Sat, Sep 20, 2008 at 12:06 AM, Jason Cox cscoman@gmail.com wrote:
Any updates on when we will see this ready for production use? I would like to get away from our current way of providing server authentication and implement CDS. I pretty much have the tools written to use CDS now, but I can not move forward untill it is out of a "testing" status in my environment.
Jason Cox
Maybe it would be possible to go straight to getting upstream IPA in centos? it working very good for me....
--
Best Regards,
Ivan Levchenko levchenko.i@gmail.com
Ivan Levchenko wrote:
Maybe it would be possible to go straight to getting upstream IPA in centos? it working very good for me....
I belive Tim Verhoeven is already working on this. He's just busy with house move and a few things in real life at the moment.
On Sun, Sep 21, 2008 at 5:39 PM, Karanbir Singh mail-lists@karan.orgwrote:
Ivan Levchenko wrote:
Maybe it would be possible to go straight to getting upstream IPA in centos? it working very good for me....
I belive Tim Verhoeven is already working on this. He's just busy with house move and a few things in real life at the moment.
-- Karanbir Singh : http://www.karan.org/ : 2522219@icq
I personally have no use for IPA nor do I want to wait for IPA since CDS is so close to being ready. Even upstream admits the differences in IPA and DS in the IPA faq. If I had extra time right now I would help complete CDS and get it ready for release, but I do not. If Centos is not going to complete CDS, just let us know so I can change my plans for some other directory server. If there still are plans to release CDS, then let us know of a possable time frame so I can update my technology roadmap to include this move for my company.
---- Jason Cox
Jason Cox wrote:
I personally have no use for IPA nor do I want to wait for IPA since CDS is so close to being ready. Even upstream admits the differences in IPA and DS in the IPA faq. If I had extra time right now I would help complete CDS and get it ready for release, but I do not. If Centos is not going to complete CDS, just let us know so I can change my plans for some other directory server. If there still are plans to release CDS, then let us know of a possable time frame so I can update my technology roadmap to include this move for my company.
CentOS-DS in the testing repo right now is pretty much stable and release worthy. There are a couple of reasons why its not released really, one of which is that we are trying to get some legal issues cleared.
Also, Tim should be back into the CentOS grind soon, so will be able to answer your other questions.
On Thu, Sep 25, 2008 at 4:37 PM, Karanbir Singh mail-lists@karan.orgwrote:
CentOS-DS in the testing repo right now is pretty much stable and release worthy. There are a couple of reasons why its not released really, one of which is that we are trying to get some legal issues cleared.
Also, Tim should be back into the CentOS grind soon, so will be able to answer your other questions.
Enough said, legal issues. Like I said before, I am using the testing repo setup already. I just can not use something that is from a testing repo in my production environment. So I will wait. Thanks.
---- Jason Cox
Jason Cox wrote:
Enough said, legal issues. Like I said before, I am using the testing repo setup already. I just can not use something that is from a testing repo in my production environment. So I will wait. Thanks.
I am eagerly awaiting CDS's move out of Testing - like Jason, I don't feel comfortable pointing production machines at the Testing repo, no matter how stable the software might be.
I was also hoping to use the IPA stuff - if we could get that even in Testing some time soon, I could at least start banging on it.
I have a bunch of in-house tools (mostly written in Perl) built on OpenLDAP that could be ported to CDS... but I don't expect they'll be particularly easy to support by anyone else besides me, so I'd like to move to CDS+IPA for my user management... even if I just use it as a base, at least there's some standard framework there instead of something totally one-off and confusing to whoever comes after me.
There might also be some nice freebies down the road, once they get the audit stuff up and running. Centralized auditing of user actions not built around remote syslog would be fantastic.
-Brandon
On Fri, Sep 26, 2008 at 2:54 AM, Brandon Davidson brandond@uoregon.edu wrote:
Jason Cox wrote:
Enough said, legal issues. Like I said before, I am using the testing repo setup already. I just can not use something that is from a testing repo in my production environment. So I will wait. Thanks.
I am eagerly awaiting CDS's move out of Testing - like Jason, I don't feel comfortable pointing production machines at the Testing repo, no matter how stable the software might be.
I was also hoping to use the IPA stuff - if we could get that even in Testing some time soon, I could at least start banging on it.
The build process of the srpms is very straightforward, no serious problems. Only had one problem, and it was easily solved by building a newer version of ipa-server from upstream git repository, so give it a try! I even saw an article on howtoforge that gives exact details on what to build and when.
Ivan
Alright, I'm back in town. So let's get moving with CDS and IPA.
About CDS, I'm going to make a new build (some updates from upstream are still pending) and that will appears in the testing repo (I'll make a announcement for that). If people could give that one a final test then we can move CDS to the public repo's and declare it ready for production use.
For the IPA stuff. I'm willing to also port the upstreams IPA to a CentOS one, but if someone is willing to help with that (mostly involves removing branding) I'm won't say no :-) If not, I'll start working on that as soon as CDS is released.
There were some other requests for .xDS related tools, those I'll look at after IPA unless someone else is willing to help with those.
Karanbir and I also thought it would be good idea to maybe create a "Directory SIG" (everything related to LDAP and Directory Servers). This to keep the conversation a bit focussed and to not spam uninterested people to much. Do you guys feel that we have a big enough crowd to have a SIG ?
That's it for now I think. Let me know your ideas/suggestions/remarks/offers/bribes/...
Regards, Tim
Tim Verhoeven wrote:
For the IPA stuff. I'm willing to also port the upstreams IPA to a CentOS one, but if someone is willing to help with that (mostly involves removing branding) I'm won't say no :-) If not, I'll start working on that as soon as CDS is released.
I'd be glad to take this on. I'll get a hold of you on IRC for follow-up and coordination.
Karanbir and I also thought it would be good idea to maybe create a "Directory SIG" (everything related to LDAP and Directory Servers). This to keep the conversation a bit focussed and to not spam uninterested people to much. Do you guys feel that we have a big enough crowd to have a SIG ?
I would definitely join this.
-Brandon
I apologize for this. What are you referring to when you say "IPA stuff" ?
Ryan Faussett Systems Administrator NetBiz, Inc.
Phone: 888.847.2226 x1369 / DD: 971-224-2869 Cell: 503-913-7129
Brandon Davidson wrote:
Tim Verhoeven wrote:
For the IPA stuff. I'm willing to also port the upstreams IPA to a CentOS one, but if someone is willing to help with that (mostly involves removing branding) I'm won't say no :-) If not, I'll start working on that as soon as CDS is released.
I'd be glad to take this on. I'll get a hold of you on IRC for follow-up and coordination.
Karanbir and I also thought it would be good idea to maybe create a "Directory SIG" (everything related to LDAP and Directory Servers). This to keep the conversation a bit focussed and to not spam uninterested people to much. Do you guys feel that we have a big enough crowd to have a SIG ?
I would definitely join this.
-Brandon _______________________________________________ CentOS-devel mailing list CentOS-devel@centos.org http://lists.centos.org/mailman/listinfo/centos-devel
On Wed, 2008-10-15 at 07:23 -0700, Ryan Faussett wrote:
I apologize for this. What are you referring to when you say "IPA stuff" ?
http://freeipa.org/page/Main_Page
free IPA
-sv
Ryan Faussett wrote:
I apologize for this. What are you referring to when you say "IPA stuff" ?
I'd guess he refers to this: http://www.redhat.com/enterprise_ipa/
Cheers,
Ralph
On Wed, Oct 15, 2008 at 4:23 PM, Ryan Faussett ryan.faussett@netbiz.com wrote:
I apologize for this. What are you referring to when you say "IPA stuff" ?
Hi,
See this : http://freeipa.org/page/Main_Page
And upstream has released a rebranded/stable version of it. The plan is to rebuild and rebrand that one as part of the CDS suite.
Regards, Tim
Hi again,
I've build the latest version of CDS yesterday. These are now available in the testing repo. Are there people capable of testing these new packages ? I currently don't have the time/resources for this. So that would be really helpfull.
After this I still need to do another rebuild, but that is just to change some text in the about dialog box, so functionality wise nothing changes with that.
When this is all done we will release CDS to the general public and I'll start working on IPA.
Regards, Tim
Tim Verhoeven wrote:
Hi again,
I've build the latest version of CDS yesterday. These are now available in the testing repo. Are there people capable of testing these new packages ? I currently don't have the time/resources for this. So that would be really helpfull.
I'll try, as I'm looking at openldap alternatives anyway - but that doesn't count, as I'm a CentOS member >:)
So it would be great if others could test that, too.
I guess that the instructions on the wiki still apply?
http://wiki.centos.org/HowTos/DirectoryServerSetup
Cheers,
Ralph
On Wed, Oct 15, 2008 at 10:54 AM, Ralph Angenendt ra+centos@br-online.de wrote:
I'll try, as I'm looking at openldap alternatives anyway - but that doesn't count, as I'm a CentOS member >:)
So it would be great if others could test that, too.
I guess that the instructions on the wiki still apply?
Yes, I presume they are still valid. And if not make the appropriate changes :-)
Regards, Tim
Tim Verhoeven wrote:
Hi again,
I've build the latest version of CDS yesterday. These are now available in the testing repo. Are there people capable of testing these new packages ? I currently don't have the time/resources for this. So that would be really helpfull.
Houston, we have a problem:
Error Downloading Packages: idm-console-framework - 1.1.1-0.el5.centos.4.noarch: failure: RPMS/idm-console-framework-1.1.1-0.el5.centos.4.noarch.rpm from c5-testing: [Errno 256] No more mirrors to try.
Local download and install works.
Cheers,
Ralph
Ralph Angenendt wrote:
Houston, we have a problem:
Error Downloading Packages: idm-console-framework - 1.1.1-0.el5.centos.4.noarch: failure: RPMS/idm-console-framework-1.1.1-0.el5.centos.4.noarch.rpm from c5-testing: [Errno 256] No more mirrors to try.
Local download and install works.
Okay, that wasn't the complete error message >:)
Downloading Packages: (1/1): idm-console-framew 100% |=========================| 1.0 MB 00:00 http://dev.centos.org/centos/5/testing/x86_64/RPMS/idm-console-framework-1.1...: [Errno -1] Package does not match intended download Trying other mirror.
Cheers,
Ralph
On Wed, Oct 15, 2008 at 2:59 PM, Ralph Angenendt ra+centos@br-online.de wrote:
Ralph Angenendt wrote:
Houston, we have a problem:
Error Downloading Packages: idm-console-framework - 1.1.1-0.el5.centos.4.noarch: failure: RPMS/idm-console-framework-1.1.1-0.el5.centos.4.noarch.rpm from c5-testing: [Errno 256] No more mirrors to try.
Local download and install works.
Okay, that wasn't the complete error message >:)
Downloading Packages: (1/1): idm-console-framew 100% |=========================| 1.0 MB 00:00 http://dev.centos.org/centos/5/testing/x86_64/RPMS/idm-console-framework-1.1...: [Errno -1] Package does not match intended download Trying other mirror.
Weird, that used to work. I've seen that error before and recreate the metadata usually works, but I can't do that for the testing repo.
Regards, Tim
Tim Verhoeven wrote:
Downloading Packages: (1/1): idm-console-framew 100% |=========================| 1.0 MB 00:00 http://dev.centos.org/centos/5/testing/x86_64/RPMS/idm-console-framework-1.1...: [Errno -1] Package does not match intended download Trying other mirror.
Weird, that used to work. I've seen that error before and recreate the metadata usually works, but I can't do that for the testing repo.
I can rerun that now. But the fact that it ( yum ) can see the new package should / would indicate that createrepo saw the package the first time out as well.
Karanbir Singh wrote:
Tim Verhoeven wrote:
Downloading Packages: (1/1): idm-console-framew 100% |=========================| 1.0 MB 00:00 http://dev.centos.org/centos/5/testing/x86_64/RPMS/idm-console-framework-1.1...: [Errno -1] Package does not match intended download Trying other mirror.
Weird, that used to work. I've seen that error before and recreate the metadata usually works, but I can't do that for the testing repo.
I can rerun that now. But the fact that it ( yum ) can see the new package should / would indicate that createrepo saw the package the first time out as well.
And as that package is from April 2008 ...
Cheers,
Ralph
On Wed, 2008-10-15 at 14:18 +0100, Karanbir Singh wrote:
Tim Verhoeven wrote:
Downloading Packages: (1/1): idm-console-framew 100% |=========================| 1.0 MB 00:00 http://dev.centos.org/centos/5/testing/x86_64/RPMS/idm-console-framework-1.1...: [Errno -1] Package does not match intended download Trying other mirror.
Weird, that used to work. I've seen that error before and recreate the metadata usually works, but I can't do that for the testing repo.
I can rerun that now. But the fact that it ( yum ) can see the new package should / would indicate that createrepo saw the package the first time out as well.
Are you running parallel createrepos with the same cachedir? In other words could the recent commits:
d88de04e301cbe5383e88505ea133f07a659fcbd e4edc4aa4d6446686c9c796c8d1996c6122b9a71
...affect your createrepo runs?
It doesn't look like the same failure mode, but I thought I'd ping you to make sure.
James Antill wrote:
Are you running parallel createrepos with the same cachedir? In other words could the recent commits:
d88de04e301cbe5383e88505ea133f07a659fcbd e4edc4aa4d6446686c9c796c8d1996c6122b9a71
...affect your createrepo runs?
It doesn't look like the same failure mode, but I thought I'd ping you to make sure.
no, dont use cache at all anywhere. And since that rpm in question isnt even from the most recent push, it gets even more interesting.
the process, as it works now is ( completely automated ):
buildqueue -> builder -> results -> collect rpms -> sign -> rsync to dev.centos.org; the metadata is then build locally on the machine via a ssh trigger. So not sure why it would break. Next time this happens, I'll backup the repomd/ dir
Karanbir Singh wrote:
the process, as it works now is ( completely automated ):
buildqueue -> builder -> results -> collect rpms -> sign -> rsync to dev.centos.org; the metadata is then build locally on the machine via a ssh trigger. So not sure why it would break. Next time this happens, I'll backup the repomd/ dir
Works now.
Cheers (and thanks),
Ralph
Tim Verhoeven a écrit :
Hi again,
I've build the latest version of CDS yesterday. These are now available in the testing repo. Are there people capable of testing these new packages ? I currently don't have the time/resources for this. So that would be really helpfull.
We currently use FDS. We'll try to install/replace one replicant with CDS. The final roadmap is to use CDS like master.
After this I still need to do another rebuild, but that is just to change some text in the about dialog box, so functionality wise nothing changes with that.
When this is all done we will release CDS to the general public and I'll start working on IPA.
Regards, Tim
Jean-Marc LIGER a écrit :
Tim Verhoeven a écrit :
Hi again,
I've build the latest version of CDS yesterday. These are now available in the testing repo. Are there people capable of testing these new packages ? I currently don't have the time/resources for this. So that would be really helpfull.
We currently use FDS. We'll try to install/replace one replicant with CDS. The final roadmap is to use CDS like master.
One instance of CDS is now used as a replicant of the FDS master (Solaris 9).
The next step is to interrogate this replicant instead of the current FDS replicant (CentOS 4).
After this I still need to do another rebuild, but that is just to change some text in the about dialog box, so functionality wise nothing changes with that.
When this is all done we will release CDS to the general public and I'll start working on IPA.
Regards, Tim
CentOS-devel mailing list CentOS-devel@centos.org http://lists.centos.org/mailman/listinfo/centos-devel
Tim Verhoeven wrote:
Hi again,
I've build the latest version of CDS yesterday. These are now available in the testing repo. Are there people capable of testing these new packages ? I currently don't have the time/resources for this. So that would be really helpfull.
One thing which is really ugly is that the package does not create a user and group for the directory server and uses "nobody" as a default.
This can easily be patched into the perl modules (has to happen in modules in centos-ds-base and centos-ds-admin) - and the base package should create a user and group "dirserv" (or similar).
Opinions?
Ralph
Ralph Angenendt wrote:
Tim Verhoeven wrote:
Hi again,
I've build the latest version of CDS yesterday. These are now available in the testing repo. Are there people capable of testing these new packages ? I currently don't have the time/resources for this. So that would be really helpfull.
One thing which is really ugly is that the package does not create a user and group for the directory server and uses "nobody" as a default.
This can easily be patched into the perl modules (has to happen in modules in centos-ds-base and centos-ds-admin) - and the base package should create a user and group "dirserv" (or similar).
Opinions?
IIRC setup-ds.pl already asks for user/group you want to use for the new instance and creates them/sets up the appropriate permissions. So what would this rpm-created user buy us?
BTW, I've been running the new rpms in a couple instances for over a day now and they've answered a few 10s of thousands of queries without a glitch.
Angel Marin wrote:
Ralph Angenendt wrote:
One thing which is really ugly is that the package does not create a user and group for the directory server and uses "nobody" as a default.
This can easily be patched into the perl modules (has to happen in modules in centos-ds-base and centos-ds-admin) - and the base package should create a user and group "dirserv" (or similar).
Opinions?
IIRC setup-ds.pl already asks for user/group you want to use for the new instance and creates them/sets up the appropriate permissions. So what would this rpm-created user buy us?
Okay, I didn't see that when installing, I think you had to create those users beforehand.
Let me test again >:)
Cheers,
Ralph
Angel Marin wrote:
Ralph Angenendt wrote:
One thing which is really ugly is that the package does not create a user and group for the directory server and uses "nobody" as a default.
IIRC setup-ds.pl already asks for user/group you want to use for the new instance and creates them/sets up the appropriate permissions. So what would this rpm-created user buy us?
Yes, it asks - no, it doesn't create:
System User [nobody]: dirserv The user 'dirserv' is invalid.
So: Opinions on hacking that into the RPMs/setup script?
Cheers,
Ralph
Ralph Angenendt wrote:
Yes, it asks - no, it doesn't create:
System User [nobody]: dirserv The user 'dirserv' is invalid.
So: Opinions on hacking that into the RPMs/setup script?
Is there a bugreport about this somewhere ?
If that should get into the rpms/setup script is Tim's call....
- KB
Karanbir Singh wrote:
Ralph Angenendt wrote:
Yes, it asks - no, it doesn't create:
System User [nobody]: dirserv The user 'dirserv' is invalid.
So: Opinions on hacking that into the RPMs/setup script?
Is there a bugreport about this somewhere ?
Not that I know - And I wonder if that should happen upstream or here.
If that should get into the rpms/setup script is Tim's call....
Yeah. I already identified where it has to be changed, so: "TIM! HUHU!"
Cheers,
Ralph
On Fri, Oct 17, 2008 at 2:55 PM, Karanbir Singh mail-lists@karan.org wrote:
Ralph Angenendt wrote:
Yes, it asks - no, it doesn't create:
System User [nobody]: dirserv The user 'dirserv' is invalid.
So: Opinions on hacking that into the RPMs/setup script?
Is there a bugreport about this somewhere ?
If that should get into the rpms/setup script is Tim's call....
IMHO, I would create a bugreport in upstreams bugzilla (and in ours for reference), document it on the wiki page and wait for upstream to fix it. I prefer to keep the packages as closely to upstreams as possible.
In this case is a pretty simple thing that can be done manually, not a real bug in the code, more a missing feature.
Anyway, if people shout hard enough I just might add it.
Regards, Tim
On 2008-10-17, Tim Verhoeven tim.verhoeven.be@gmail.com wrote:
So: Opinions on hacking that into the RPMs/setup script?
I would expect it to follow upstream.
Actually the upstream documentation strongly recommends one use "nobody". Sounds like a bad idea to me (and I use "dirsrv"), but that's the *strong* recommendation in the installation guide:
"1.2.2. Directory Server User and Group
The setup process sets a user ID (UID) and group ID (GID) as which the servers will run. The default UID is a non-privileged (non-root) user, nobody on Red Hat Enterprise Linux and Solaris and daemon on HP-UX. Red Hat strongly recommends using this default value."
-jf
Hi Tim,
I know that we're still kind of in the middle of 5.3 testing, but I thought that I'd pop this back to the top so that perhaps it can find some time between 5.3 and whatever comes up next for QA.
I think the consensus was that the DS builds all work well - everything seems to be stable, and with the exception of a few minor install-time items that could be reported to upstream and/or fixed in CentOS packages, it's pretty much ready to go. I believe there were some legal questions about the Java bits that were never satisfactorily answered, but that OpenJDK was a possible solution?
There's also the issue of the IPA packages: http://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHEIPA/SRPMS/
Last I heard, you were going to attempt to get these built, but were hoping for some help with repackaging/branding checks. Did that ever go anywhere? If someone can give me some direction or something to work on, I'd be glad to put some time into it.
Regards,
-Brandon
Brandon Davidson a écrit :
Hi Tim,
I know that we're still kind of in the middle of 5.3 testing, but I thought that I'd pop this back to the top so that perhaps it can find some time between 5.3 and whatever comes up next for QA.
I think the consensus was that the DS builds all work well - everything seems to be stable, and with the exception of a few minor install-time items that could be reported to upstream and/or fixed in CentOS packages, it's pretty much ready to go.
CentOS DS is also stable for us in production environment. So It'd be fine to add it in the next CentOS 5.3 release.
I believe there were some legal questions about the Java bits that were never satisfactorily answered, but that OpenJDK was a possible solution?
This part should be solved, as OpenJDK is now officialy part of RHL 5.3 :-)
There's also the issue of the IPA packages: http://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHEIPA/SRPMS/
Last I heard, you were going to attempt to get these built, but were hoping for some help with repackaging/branding checks. Did that ever go anywhere? If someone can give me some direction or something to work on, I'd be glad to put some time into it.
Regards,
-Brandon _______________________________________________ CentOS-devel mailing list CentOS-devel@centos.org http://lists.centos.org/mailman/listinfo/centos-devel
Jean-Marc LIGER wrote:
I believe there were some legal questions about the Java bits that were never satisfactorily answered, but that OpenJDK was a possible solution?
This part should be solved, as OpenJDK is now officialy part of RHL 5.3 :-)
The present CentOS-DS was built on a different OpenJDK stack, so it would atleast need a rebuilt.
- KB
Karanbir Singh a écrit :
Jean-Marc LIGER wrote:
I believe there were some legal questions about the Java bits that were never satisfactorily answered, but that OpenJDK was a possible solution?
This part should be solved, as OpenJDK is now officialy part of RHL 5.3 :-)
The present CentOS-DS was built on a different OpenJDK stack, so it would atleast need a rebuilt.
You're absolutly right ; although we use it with last OpenJDK from Epel without any problems.
On 2009-02-27, Jean-Marc LIGER jean-marc.liger@siris.sorbonne.fr wrote:
CentOS DS is also stable for us in production environment. So It'd be fine to add it in the next CentOS 5.3 release.
Just want to add another praise for centos-ds-8.0.0-1.4.el5.centos.4. Have been running 3 multi-master replicating clusters on it for months (with around 1 million entries). Works perfectly.
Would love to see the non-beta stamp on it :-)
-jf
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Tim Verhoeven wrote:
Alright, I'm back in town. So let's get moving with CDS and IPA.
About CDS, I'm going to make a new build (some updates from upstream are still pending) and that will appears in the testing repo (I'll make a announcement for that). If people could give that one a final test then we can move CDS to the public repo's and declare it ready for production use.
Just curious. Are we ready for this? I think it is still part of testing.
Hugo.
- -- hvdkooij@vanderkooij.org http://hugo.vanderkooij.org/ PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc
A: Yes. >Q: Are you sure? >>A: Because it reverses the logical flow of conversation. >>>Q: Why is top posting frowned upon?
Bored? Click on http://spamornot.org/ and rate those images.
Nid wyf yn y swyddfa ar hyn o bryd. Anfonwch unrhyw waith i'w gyfieithu.
Jason Cox wrote:
Enough said, legal issues. Like I said before, I am using the testing repo setup already. I just can not use something that is from a testing repo in my production environment. So I will wait. Thanks.
I think a better term would be 'legal clarifications' and those are not about Red Hat, but more JRE / OpenJDK centric. I'll leave the details for Tim to fill in, since I am not upto speed with progress on that front.