[389-users] Re: Unable to establish replication with STARTTLS

2023-06-06 Thread Jakob Moser
Sadly, the problem persists after executing "trust anchor .pem" for both the ISRG Root X1 and Let's Encrypt R3 cert files as extracted from the fullchain.pem provided by Certbot. Regards Jakob ___ 389-users mailing list -- 389-users@lists.fedoraproject

[389-users] Access to 389-ds in Cockpit without sudo to root

2023-06-06 Thread Brian Mattey (UK)
Hi, I would like to grant a non-privileged user (cannot sudo to root) access to 389-ds configuration in Cockpit. (I've googled a _lot_ for this and can't find any way to do it). Thanks, Brian ___ 389-users mailing list -- 389-users@lists.fedoraproje

[389-users] Re: Unable to establish replication with STARTTLS

2023-06-06 Thread Jakob Moser
Actually, trusting the certificate made everything worse. # trust list | grep ISRG\ Root\ X1 yielded the same certificate twice, and the supplier was then unable to connect to the consumer (or itself), yielding "unable to get issuer certificate" (so not only when replicating, but also when usi

[389-users] Re: Access to 389-ds in Cockpit without sudo to root

2023-06-06 Thread Mark Reynolds
Hi Brian, Unfortunately you can't because Cockpit calls the DS CLI tools (dsconf, dsctl, etc) which must be run as a privileged user in order to work correctly. Regards, Mark On 6/6/23 7:58 AM, Brian Mattey (UK) wrote: Hi, I would like to grant a non-privileged user (cannot sudo to root)

[389-users] Re: Unable to establish replication with STARTTLS

2023-06-06 Thread Jakob Moser
Could it be a programming error in 389-ds-base? After all, the error message we're getting is: [06/Jun/2023:14:41:05.346079522 +0200] - ERR - slapi_ldap_bind - Could not send bind request for id [cn=replication manager,cn=config] authentication mechanism [SIMPLE]: error -1 (Can't contact LDAP s