[solved] 1.3 -> 1.4 upgrade woes

[cheleb]

Hi all,

I have some trouble updating our current systems from 1.3 to 1.4
There seems to be a missing attribute 'masterLDAPCACertificate' in the ldap tree.

I followed the steps provided at http://trac.ebox-platform.com/wiki/Document/Documentation/13To14Update to get the system up an running again, but without success.

Here's a quick rundown of what i got:

Code: [Select]

user@host:~$ dpkg -l | grep slapd
ii  slapd                                      2.4.21-0ubuntu2hardy1           OpenLDAP server (slapd)

user@host:~$ ps aux | grep slapd
openldap  4287  0.0  0.2  57292  5004 ?        Ssl  Feb01   0:00 /usr/sbin/slapd -h ldap://0.0.0.0 ldapi://%2fvar%2frun%2fslapd%2fldapi/????x-mod=0777 -g openldap -u openldap -F /etc/ldap/slapd.d/
1000     23135  0.0  0.0   3016   788 pts/0    S+   00:06   0:00 grep slapd

user@host:~$ sudo cat /etc/ldap/slapd.d/cn\=config/olcDatabase={0}config.ldif
dn: olcDatabase={0}config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcRootDN: cn=admin,cn=config
olcRootPW:: e2NyeXB0fURReUp3a05VV201NXc=
olcAccess: {0}to * by dn.exact=cn=localroot,cn=config manage by * break
olcAccess: {1}to * by dn="cn=ebox,dc=domain,dc=tld" write
structuralObjectClass: olcDatabaseConfig
entryUUID: 783e95a6-86a8-102e-9bac-17198d4c81a9
creatorsName: cn=config
createTimestamp: 20091226202453Z
entryCSN: 20091226203250.785866Z#000000#000#000000
modifiersName: cn=admin,cn=config
modifyTimestamp: 20091226203250Z

user@host:~$ sudo cat /etc/ldap/slapd.d/cn\=config/olcDatabase\=\{-1\}frontend.ldif
dn: olcDatabase={-1}frontend
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: {-1}frontend
olcSizeLimit: 500
olcAccess: {0}to * by dn.exact=cn=localroot,cn=config manage by * break
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to dn.base="cn=subschema" by * read
structuralObjectClass: olcDatabaseConfig
entryUUID: 783e8bce-86a8-102e-9bab-17198d4c81a9
creatorsName: cn=config
createTimestamp: 20091226202453Z
entryCSN: 20091226202453.368254Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20091226202453Z
Should be ok so far. Now, when i try to restart usersandgroups:

Code: [Select]

user@host:~$ sudo /etc/init.d/ebox users restart
 * Restarting eBox module: users                                                                                                                                                                                                      [fail]
Can't create ldapi connection
This is where my results differ from the troubleshooting guide.
ebox.log says (sensible data blanked):

Code: [Select]

2010/02/01 20:49:26 INFO> Service.pm:625 EBox::Module::Service::restartService - Restarting service for module: users
2010/02/01 20:49:27 ERROR> Ldap.pm:710 EBox::Ldap::_errorOnLdap - $VAR1 = 'cn=master,dc=domain,dc=tld';
2010/02/01 20:49:27 ERROR> Ldap.pm:712 EBox::Ldap::_errorOnLdap - Unknown error at EBox::UsersAndGroups::__ANON__ No such object
2010/02/01 20:49:27 ERROR> Ldap.pm:710 EBox::Ldap::_errorOnLdap - $VAR1 = {
          'attr' => [
                      'objectClass',
                      'masterHost',
                      'masterCertificate',
                      '-----BEGIN CERTIFICATE-----
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxx
-----END CERTIFICATE-----
',
                      'masterCACertificate',
                      '-----BEGIN CERTIFICATE-----
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxx
-----END CERTIFICATE-----
',
                      'masterLDAPCACertificate',
                      '-----BEGIN CERTIFICATE-----
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxx
-----END CERTIFICATE-----
'
                    ]
        };
2010/02/01 20:49:27 ERROR> Ldap.pm:712 EBox::Ldap::_errorOnLdap - Unknown error at EBox::UsersAndGroups::_loadCertificates masterLDAPCACertificate: attribute type undefined
2010/02/01 20:49:27 ERROR> Service.pm:630 EBox::Module::Service::__ANON__ - Error restarting service: Unknown error at EBox::UsersAndGroups::_loadCertificates masterLDAPCACertificate: attribute type undefined

Of course, there's also an error when trying to access the users, groups, ldap info and slave status pages in the browser:

Code: [Select]

A really nasty bug has occurred
Exception
Can't create ldapi connection
Trace
Can't create ldapi connection at /usr/share/perl5/EBox/Ldap.pm line 175
EBox::Ldap::anonymousLdapCon('EBox::Ldap=HASH(0x96756c8)') called at /usr/share/perl5/EBox/Ldap.pm line 243
EBox::Ldap::dn('EBox::Ldap=HASH(0x96756c8)') called at /usr/share/perl5/EBox/UsersAndGroups.pm line 338
EBox::UsersAndGroups::groupsDn('EBox::UsersAndGroups=HASH(0x9675554)') called at /usr/share/perl5/EBox/UsersAndGroups.pm line 1663
EBox::UsersAndGroups::groups('EBox::UsersAndGroups=HASH(0x9675554)') called at /usr/share/perl5/EBox/CGI/UsersAndGroups/Users.pm line 48
EBox::CGI::UsersAndGroups::Users::_process('EBox::CGI::UsersAndGroups::Users=HASH(0x96419c0)') called at /usr/share/perl5/EBox/CGI/Base.pm line 262
EBox::CGI::Base::run('EBox::CGI::UsersAndGroups::Users=HASH(0x96419c0)') called at /usr/share/perl5/EBox/CGI/Run.pm line 120
EBox::CGI::Run::run('EBox::CGI::Run', 'UsersAndGroups/Users', 'EBox') called at /usr/share/ebox/cgi/ebox.cgi line 19
ModPerl::ROOT::ModPerl::Registry::usr_share_ebox_cgi_ebox_2ecgi::handler('Apache2::RequestRec=SCALAR(0x8f7fffc)') called at /usr/lib/perl5/ModPerl/RegistryCooker.pm line 204
eval {...} called at /usr/lib/perl5/ModPerl/RegistryCooker.pm line 204
ModPerl::RegistryCooker::run('ModPerl::Registry=HASH(0x8f80098)') called at /usr/lib/perl5/ModPerl/RegistryCooker.pm line 170
ModPerl::RegistryCooker::default_handler('ModPerl::Registry=HASH(0x8f80098)') called at /usr/lib/perl5/ModPerl/Registry.pm line 31
ModPerl::Registry::handler('ModPerl::Registry', 'Apache2::RequestRec=SCALAR(0x8f7fffc)') called at -e line 0
eval {...} called at -e line 0
Can anyone please give me some hints on what to do next?

[isaac]

Thank you for the feedback. Yeah, I forgot to mention this in the document.

There have been some changes in the master and slaves schemas, and you have to update them manually. The process for that is the following.

Run:

Code: [Select]

hardy2% sudo ls /etc/ldap/slapd.d/cn\=config/cn\=schema
cn={0}core.ldif   cn={4}passwords.ldif cn={8}eboxmail.ldif
cn={1}cosine.ldif   cn={5}master.ldif cn={9}eboxfetchmail.ldif
cn={2}nis.ldif   cn={6}slaves.ldif
cn={3}inetorgperson.ldif  cn={7}authldap.ldif

The output should be similar to that one.

Then you should run (changing the numbers appropriately according to the result of the previous command):

Code: [Select]

sudo /etc/init.d/slapd stop
sudo cp /usr/share/ebox-usersandgroups/master.ldif /etc/ldap/slapd.d/cn\=config/cn\=schema/cn\=\{5\}master.ldif
sudo cp /usr/share/ebox-usersandgroups/slaves.ldif /etc/ldap/slapd.d/cn\=config/cn\=schema/cn\=\{6\}slaves.ldif

These files still need some small adjustments, you'll have to edit both of them:

Code: [Select]

/etc/ldap/slapd.d/cn\=config/cn\=schema/cn\=\{5\}master.ldif
/etc/ldap/slapd.d/cn\=config/cn\=schema/cn\=\{6\}slaves.ldif

And change the first line of them from, respectively:

Code: [Select]

dn: cn=master,cn=schema,cn=config
dn: cn=slaves,cn=schema,cn=config

to

Code: [Select]

dn: cn={5}master
dn: cn={6}slaves

again using the appropriate numbers

That should do the trick and you just need to restart slapd and the users module with:

Code: [Select]

sudo /etc/init.d/slapd start
sudo /etc/init.d/ebox users restart

I'll add this now to the document.

Cheers!

[cheleb]

isaac,

thank you so much for the very quick answer.
After doing those steps, the server is up and running again!

[isaac]

great 

[cheleb]

Whoops ... i posted too early.

There is still a problem with the "slave staus" page:

Code: [Select]

A really nasty bug has occurred
Exception
Missing argument: Port
Trace
Missing argument: Port at /usr/share/perl5/EBox/Types/Abstract.pm line 415
EBox::Types::Abstract::setMemValue('EBox::Types::Int=HASH(0xa99dbbc)', 'HASH(0xa93f6b4)') called at /usr/share/perl5/EBox/Types/Basic.pm line 137
EBox::Types::Basic::_setValue('EBox::Types::Int=HASH(0xa99dbbc)', 'undef') called at /usr/share/perl5/EBox/Types/Abstract.pm line 380
EBox::Types::Abstract::setValue('EBox::Types::Int=HASH(0xa99dbbc)', 'undef') called at /usr/share/perl5/EBox/Model/DataTable.pm line 3189
EBox::Model::DataTable::_setValueRow('EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)', 'slave', 'server', 'port', 'undef') called at /usr/share/perl5/EBox/UsersAndGroups/Model/Slaves.pm line 162
EBox::UsersAndGroups::Model::Slaves::row('EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)', 'server') called at /usr/share/ebox/templates/ajax/tableBody.mas line 240
HTML::Mason::Commands::__ANON__('model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)', 'model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)', 'hasChanged', 'undef', 'action', 'view') called at /usr/share/perl5/HTML/Mason/Component.pm line 135
HTML::Mason::Component::run('HTML::Mason::Component::Subcomponent=HASH(0xa8e962c)', 'model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)', 'model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)', 'hasChanged', 'undef', 'action', 'view', ...) called at /usr/share/perl5/HTML/Mason/Request.pm line 1262
eval {...} called at /usr/share/perl5/HTML/Mason/Request.pm line 1252
HTML::Mason::Request::comp('undef', 'undef', 'model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)', 'model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)', 'hasChanged', 'undef', 'action', ...) called at /usr/share/ebox/templates/ajax/modelViewer.mas line 149
HTML::Mason::Commands::__ANON__('model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)') called at /usr/share/perl5/HTML/Mason/Component.pm line 135
HTML::Mason::Component::run('HTML::Mason::Component::Subcomponent=HASH(0xa90f568)', 'model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)') called at /usr/share/perl5/HTML/Mason/Request.pm line 1262
eval {...} called at /usr/share/perl5/HTML/Mason/Request.pm line 1252
HTML::Mason::Request::comp('undef', 'undef', 'model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)') called at /usr/share/ebox/templates/ajax/modelViewer.mas line 69
HTML::Mason::Commands::__ANON__('model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)', 'hasChanged', 'undef', 'action', 'view') called at /usr/share/perl5/HTML/Mason/Component.pm line 135
HTML::Mason::Component::run('HTML::Mason::Component::Subcomponent=HASH(0xa90f664)', 'model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)', 'hasChanged', 'undef', 'action', 'view') called at /usr/share/perl5/HTML/Mason/Request.pm line 1262
eval {...} called at /usr/share/perl5/HTML/Mason/Request.pm line 1252
HTML::Mason::Request::comp('undef', 'undef', 'model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)', 'hasChanged', 'undef', 'action', 'view') called at /usr/share/ebox/templates/ajax/tableBodyWithoutEdit.mas line 18
HTML::Mason::Commands::__ANON__('model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)', 'hasChanged', 'undef', 'action', 'view') called at /usr/share/perl5/HTML/Mason/Component.pm line 135
HTML::Mason::Component::run('HTML::Mason::Component::FileBased=HASH(0xa9139e0)', 'model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)', 'hasChanged', 'undef', 'action', 'view') called at /usr/share/perl5/HTML/Mason/Request.pm line 1262
eval {...} called at /usr/share/perl5/HTML/Mason/Request.pm line 1252
HTML::Mason::Request::comp('undef', 'undef', 'model', 'EBox::UsersAndGroups::Model::Slaves=HASH(0xa6fc970)', 'hasChanged', 'undef', 'action', 'view') called at (eval 1914) line 169
HTML::Mason::Commands::__ANON__('model', 'EBox::UsersAndGroups::Composite::SlaveInfo=HASH(0xa75453c)', 'hasChanged', 'undef') called at /usr/share/perl5/HTML/Mason/Component.pm line 135
HTML::Mason::Component::run('HTML::Mason::Component=HASH(0xa941988)', 'model', 'EBox::UsersAndGroups::Composite::SlaveInfo=HASH(0xa75453c)', 'hasChanged', 'undef') called at /usr/share/perl5/HTML/Mason/Request.pm line 1262
eval {...} called at /usr/share/perl5/HTML/Mason/Request.pm line 1252
HTML::Mason::Request::comp('undef', 'undef', 'undef', 'model', 'EBox::UsersAndGroups::Composite::SlaveInfo=HASH(0xa75453c)', 'hasChanged', 'undef') called at /usr/share/perl5/HTML/Mason/Request.pm line 468
eval {...} called at /usr/share/perl5/HTML/Mason/Request.pm line 468
eval {...} called at /usr/share/perl5/HTML/Mason/Request.pm line 418
HTML::Mason::Request::exec('HTML::Mason::Request=HASH(0xa944b48)') called at /usr/share/perl5/HTML/Mason/Interp.pm line 342
HTML::Mason::Interp::exec('undef', 'undef', 'model', 'EBox::UsersAndGroups::Composite::SlaveInfo=HASH(0xa75453c)', 'hasChanged', 'undef') called at /usr/share/perl5/EBox/CGI/Base.pm line 141
EBox::CGI::Base::_body('EBox::CGI::View::Composite=HASH(0xa826b0c)') called at /usr/share/perl5/EBox/CGI/Base.pm line 180
EBox::CGI::Base::_print('EBox::CGI::View::Composite=HASH(0xa826b0c)') called at /usr/share/perl5/EBox/CGI/Base.pm line 336
EBox::CGI::Base::run('EBox::CGI::View::Composite=HASH(0xa826b0c)') called at /usr/share/perl5/EBox/CGI/Run.pm line 120
EBox::CGI::Run::run('EBox::CGI::Run', 'Users/Composite/SlaveInfo', 'EBox') called at /usr/share/ebox/cgi/ebox.cgi line 19
ModPerl::ROOT::ModPerl::Registry::usr_share_ebox_cgi_ebox_2ecgi::handler('Apache2::RequestRec=SCALAR(0xa931d30)') called at /usr/lib/perl5/ModPerl/RegistryCooker.pm line 204
eval {...} called at /usr/lib/perl5/ModPerl/RegistryCooker.pm line 204
ModPerl::RegistryCooker::run('ModPerl::Registry=HASH(0xa95636c)') called at /usr/lib/perl5/ModPerl/RegistryCooker.pm line 170
ModPerl::RegistryCooker::default_handler('ModPerl::Registry=HASH(0xa95636c)') called at /usr/lib/perl5/ModPerl/Registry.pm line 31
ModPerl::Registry::handler('ModPerl::Registry', 'Apache2::RequestRec=SCALAR(0xa931d30)') called at -e line 0
eval {...} called at -e line 0

[isaac]

So do you actually have slaves or were you looking at that page for fun?

Let's assume the former, you should do the following, replacing 'dc=hardy2' with your actual base DN:

Code: [Select]

#install ldapvi
sudo apt-get install ldapvi
ldapvi -D 'cn=ebox,dc=hardy2' --bind simple -w $(sudo cat /var/lib/ebox/conf/ebox-ldap.passwd) -b 'dc=hardy2'

That will open a vi (or other) editor session with the contents of your LDAP. Look for the slave entries, that will look like this:

Code: [Select]

7 hostname=hardy1,ou=slaves,dc=hardy2
objectClass: slaveHost
hostname: hardy1

Add a new line right after hostname so it looks like:

Code: [Select]

7 hostname=hardy1,ou=slaves,dc=hardy2
objectClass: slaveHost
hostname: hardy1
port: 443

Then exit saving changes and it should work

[cheleb]

So do you actually have slaves or were you looking at that page for fun?

Haha! I can tell you ... i wasn't looking for fun. No, actually we have currently nine slaves running in this system. Another one still pending.

Don't know what caused this error, but the server was fine before the upgrade to usersandgroups 1.3.17.

Then exit saving changes and it should work

And it does!

Again, thanks a million for your time and quick answers.