Unsolved
This post is more than 5 years old
1 Rookie
•
12 Posts
0
1482
March 5th, 2014 08:00
LDAP errors on VNX5300 in multiprotocol NIS/2003 AD
I want to clean up some LDAP errors in the server_checkup command. I'll be honest, I tried to follow the manuals on the multiprotocol setup, but I could have something incorrect. The system is a VNX5300 Unified system Block 05.32.000.5.206 and File 7.1.71-1. The environment is NIS-2 and Win2003 AD. The users and groups from AD and NIS seem to be coming into the secmap with the correct SIDs and GIDs and permissions seem to be working, so it appears that at least that much is working. My problem is the errors that I am getting. I am not a Windows guru, so I'm hoping someone can assist in this case or point me to a document that can help. Here are the errors:
[nasadmin@vnxcs0 ~]$ server_checkup server_2 -test cifs -subtest LDAP
server_2 :
------------------------------------Checks--------------------------------------
Component CIFS :
LDAP : Checking the LDAP configuration................................ Fail
--------------------------------------------------------------------------------
-----------------------------CIFS : LDAP Warnings-------------------------------
Warning 17453416503: server_2 : LDAP server 192.206.235.70: No posixAccount container configured yet.
No search base was defined for the given object class, and the default container was not retained since it does not exist in the directory.
The LDAP service cannot look up users. This may result in denial of access during exploitation.
--> You must set up one or multiple containers for this object class, or the LDAP service for this class will not work;
You may use server_ldap [movername] -info -verbose to display possible containers.
Warning 17453416503: server_2 : LDAP server 192.206.235.70: No posixGroup container configured yet.
No search base was defined for the given object class, and the default container was not retained since it does not exist in the directory.
The LDAP service cannot look up groups. This may result in denial of access during exploitation.
--> You must set up one or multiple containers for this object class, or the LDAP service for this class will not work;
You may use server_ldap [movername] -info -verbose to display possible containers.
Warning 17453416503: server_2 : LDAP server 192.206.235.70: No ipHost container configured yet.
No search base was defined for the given object class, and the default container was not retained since it does not exist in the directory.
The LDAP service cannot look up hosts. This may result in denial of access during exploitation.
--> You must set up one or multiple containers for this object class, or the LDAP service for this class will not work;
You may use server_ldap [movername] -info -verbose to display possible containers.
Warning 17453416503: server_2 : LDAP server 192.206.235.70: No nisNetgroup container configured yet.
No search base was defined for the given object class, and the default container was not retained since it does not exist in the directory.
The LDAP service cannot look up netgroups. This may result in denial of access during exploitation.
--> You must set up one or multiple containers for this object class, or the LDAP service for this class will not work;
You may use server_ldap [movername] -info -verbose to display possible containers.
Warning 17453416505: server_2 : The LDAP service is started, but is not enabled for any service in /.etc/nsswitch.conf: The LDAP service is thus useless.
--> Use the ldap keyword in /.etc/nsswitch.conf to validate LDAP searches, or stop/clear the LDAP service using the server_ldap command.
Warning 17453416507: server_2 : The current LDAP configuration uses Active Directory. In this configuration Usermapper should be disabled.
The Usermapper service creates automatic Unix identifiers for users/groups not found in the AD.
It is better to get an error and update the Active Directory than to have Usermapper stamp the files with undesired IDs.
--> Disable Usermapper using server_usermapper.
--------------------------------------------------------------------------------
------------------------------CIFS : LDAP Errors--------------------------------
Error 13158449198: server_2 : The Data Mover issued a LDAP search request on LDAP server 192.206.235.70 that resulted in the following error: Operations error.
--> Check the server_ldap configuration command usage and LDAP server connectivity and binding requirements.
Error 13158449224: server_2 : LDAP Organizational Units are containers in the LDAP Directory Information Tree that contain users, group, etc.
Searching for OUs on server 192.206.235.70 failed: dn: dc=nationalmachinery,dc=local -scope: sub - filter: (|(objectClass=organizationalUnit)(objectClass=container)) - error: 000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1.
The LDAP service is not operational.
--> Check network connectivity. Check basedn / domain in LDAP setup.
The most likely problem is a typo in the LDAP domain name or base DN, or a wrong LDAP server IP address.
--------------------------------------------------------------------------------
Total : 2 errors, 6 warnings
[nasadmin@vnxcs0 ~]$ server_ldap server_2 -info -verbose
server_2 :
LDAP domain: nationalmachinery.local
State: Configured - Connected
Schema: Active Directory
Base dn: dc=nationalmachinery,dc=local
Bind dn:
Configuration: RFC-2307 defaults
LDAP server: 192.206.235.70 - Port: 389 - Active
SSL: Not enabled
Naming ctx: (baseDn is ticked)
DC=nationalmachinery,DC=local
[ ] CN=Configuration,DC=nationalmachinery,DC=local
[ ] CN=Schema,CN=Configuration,DC=nationalmachinery,DC=local
[ ] DC=ForestDnsZones,DC=nationalmachinery,DC=local
[ ] DC=DomainDnsZones,DC=nationalmachinery,DC=local
Containers: (no [scope] means ignored, unless parent container with sub scope is valid)
Passwd: Class: posixAccount - Attributes: uid, uidNumber, gidNumber, userPassword, homeDirectory
memberUid syntax is IA5String (Posix)
Group: Class: posixGroup - Attributes: gidNumber, memberUid
memberUid syntax is IA5String (Posix)
Hosts: Class: ipHost - Attributes: ipHostNumber
memberUid syntax is IA5String (Posix)
Netgroup: Class: nisNetgroup - Attributes: nisNetgroupTriple, memberNisNetgroup
memberUid syntax is IA5String (Posix)
Server warnings & errors
{
[Expired errors exist. Use "server_ldap -set" to refresh]
}