Martin Kosek wrote:
On 03/13/2013 06:06 PM, Rob Crittenden wrote:
Martin Kosek wrote:
On 03/11/2013 09:39 AM, Petr Spacek wrote:
On 11.3.2013 09:09, Martin Kosek wrote:
On 03/08/2013 09:49 AM, Petr Spacek wrote:
On 8.3.2013 00:14, Rob Crittenden wrote:
Martin Kosek wrote:
Remove obsolete BIND GSSAPI configuration options tkey-gssapi-credential
and tkey-domain and replace them with tkey-gssapi-keytab which avoids
unnecessary Kerberos checks on BIND startup and can cause issues when
KDC is not available.
Both new and current IPA installations are updated.
https://fedorahosted.org/freeipa/ticket/3429
Still reviewing this but I noticed that after upgrading my 3.1.99 server
pre-patch to with with-patch version the connections argument in named.conf
got set to 4 (courtesy of ipa-upgradeconfig). Should we be setting that to 4
during the initial install too?
For 3.2 it doesn't matter. Anything >= 2 should be okay, but more connections
should not harm.
Higher value should allow higher level of parallelism, it is one of tuning
parameters. Value 4 was necessary to prevent deadlocks in some previous
versions of bind-dyndb-ldap.
Previously, when I implemented the upgrade script, I set connections arg only
if it was present in named.conf and thus bind-dyndb-ldap could not use a
reasonable default on its own decision.
This was changed in e578183ea25a40aedf6dcc3e1ee4bcb19b73e70f and connections
is set always. Rob is correct, that in that case we might want to add it to
named.conf by default to make it consistent... or we could also fix upgrade
script to change connections only if it is present in named.conf.
Petr, what does make more sense bind-dyndb-ldap wise?
Default values should work. Personally I would include only "override" values
in named.conf, but technically it doesn't matter.
Note: Latest bind-dyndb-ldap versions refuse to start if configuration is
insane. Fatal error will point admin to errors in configuration and should
prevent surprises from auto-magically changed values.
Invalid configurations - examples:
connections < 1
connections < 2 && psearch is enabled
serial_autoincrement enabled && psearch disabled
Ok, lets set the connections argument only if it is in named.conf _and_ it is
lower than the required minimum. All patches attached.
Martin
This works ok if the format of named.conf is stable.
If, for example, there are extra spaces between options and { then the values
are not updated. This is nothing new with this patch, our previous code was
also space dependent (augeas will address this eventually)
I just wonder: Should we log if a warning if a change has not been applied?
rob
There is already a warning if we could not match tkey-gssapi-credential,
tkey-domain or tkey-gssapi-keytab. It would look like that:
# ipa-upgradeconfig --quiet
Either tkey-gssapi-credential or tkey-domain is missing in /etc/named.conf.
Skip update.
At least I made our crappy named.conf parser more resilient to spaces in
section start (i.e. it should now work with "options {" and made the
regular expression object naming more consistent. But you are right, this will
be eventually improved by augueas.
Important thing for now is, that our updater works fine with our template
named.conf we ship with freeipa including user changes, if user does not go too
wild into breaking what's already there...
Martin
ACK, pushed to master x 3.
rob
_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
