1 Topic by wdbacker

  • wdbacker
  • wdbacker
  • Member
  • Offline
  • From: Belgium
  • Registered: 2011-08-06
  • Posts: 12

Topic: LDAP bdb backend system update (with yum) warning

During a system upgrade on a CentOS 6 box with 

yum upgrade

slapd refused to start after upgrading.

I want to put a word of warning before doing a system upgrade. Be sure that you first stop all system services like postfix, dovecot, ... before starting the system upgrade as it turned out after upgrading that the ldap backend database was corrupt.

slapd showed the following problem when started on commandline with:

slapd -d 1 -f /etc/openldap/slapd.conf

the following problem:

bdb(dc=xxx,dc=xxx): Program version 4.7 doesn't match environment version 4.8

and slapd refuses to start.

My first thought was to check the Berkeley DB database version, as version 4.8 already exists but not yet officially in packaged form for CentOS 6.The OpenLDAP database stores its data in a BDB database located in /var/lib/ldap/xxx.xxx. There you find all bdb files of the LDAP database.

However, after several hours debugging, I decided to install another CentOS + iRedmail box and try the bdb database on that machine. The newly installed machine showed the same error on the database, so it turned out that the database was corrupt.

I finally recovered the data with (first go to the /var/lib/ldap/xxx.xxx directory):

db_dump -f yyy.bdb > yyy

and do this for every bdb file in the directory.

To restore the data, you can use:

db_load -f yyy yyy.bdb

remove all __db.* files, log.* files, the alock file and restart slapd.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: LDAP bdb backend system update (with yum) warning

Thanks for your sharing. smile

3 Reply by Albux

  • Albux
  • Member
  • Offline
  • Registered: 2009-11-16
  • Posts: 83

Re: LDAP bdb backend system update (with yum) warning

Hello,

I'm running CentOS 6 with iRedMail 0.7.3
I've followed these instructions but it zeroed my accountStatus.bdb and id2entry.bdb and so I stopped...

The slapd is still refusing to start. I've even upgraded to db4.8 from PUIAS repository but with no luck (by the way the slapd still shows DB 4.7.25 ??!)

The mail server is completely useless, how can I downgrade to previous OpenLDAP version? Are all accounts gone?
It's a nightmare! Only for a yum update...

Here's the last portion of the messages coming up after a  "slapd -d 1 -f /etc/openldap/slapd.conf" (I've replaced the real domain name with example)

...
slapd startup: initiated.
backend_startup_one: starting "cn=config"
config_back_db_open
config_build_entry: "cn=config"
config_build_entry: "cn=module{0}"
config_build_entry: "cn=schema"
config_build_entry: "cn={0}core"
config_build_entry: "cn={1}corba"
config_build_entry: "cn={2}cosine"
config_build_entry: "cn={3}inetorgperson"
config_build_entry: "cn={4}nis"
config_build_entry: "cn={5}amavisd-new"
config_build_entry: "cn={6}iredmail"
config_build_entry: "olcDatabase={-1}frontend"
config_build_entry: "olcDatabase={0}config"
config_build_entry: "olcDatabase={1}bdb"
backend_startup_one: starting "dc=example,dc=it"
bdb_db_open: database "dc=example,dc=it": dbenv_open(/var/lib/ldap/example.it).
bdb(dc=example,dc=it): file dn2id.bdb has LSN 1/3367694, past end of log at 1/717
bdb(dc=example,dc=it): Commonly caused by moving a database from one database environment
bdb(dc=example,dc=it): to another without clearing the database LSNs, or by removing all of
bdb(dc=example,dc=it): the log files from a database environment
bdb(dc=example,dc=it): /var/lib/ldap/example.it/dn2id.bdb: unexpected file type or format
bdb_db_open: database "dc=example,dc=it": db_open(/var/lib/ldap/example.it/dn2id.bdb) failed: Invalid argument (22).
====> bdb_cache_release_all
bdb(dc=example,dc=it): Database handles still open at environment close
bdb(dc=example,dc=it): Open database handle: id2entry.bdb
bdb_db_close: database "dc=example,dc=it": close failed: Invalid argument (22)
backend_startup_one (type=bdb, suffix="dc=example,dc=it"): bi_db_open failed! (22)
slapd shutdown: initiated
====> bdb_cache_release_all
slapd destroy: freeing system resources.
slapd stopped.


What can I do? Please help!

Alberto

4 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: LDAP bdb backend system update (with yum) warning

Did you backup LDAP data before this operation? If you did, try to restore it.

5 Reply by Albux

  • Albux
  • Member
  • Offline
  • Registered: 2009-11-16
  • Posts: 83

Re: LDAP bdb backend system update (with yum) warning

ZhangHuangbin wrote:

Did you backup LDAP data before this operation? If you did, try to restore it.

No, unluckily I didn't backup.
I've seen that restarting the slapd (by moving away a couple of db that it says are corrupted) it recreates the id2entry.bdb. the only one missing is accountstatus.bdb (zeroed by the previous prcoedure) and the dn2id.bdb that the new OpenLDAP/DB4 says it's corrupted (but for this one I still have the "corrupted" file).
But even if slapd restarts (without accountstatus and dn2id) the login to iRedadmin and every other account is not recognized.

Is everything gone or is it restorable by some way?
Can I downgrade to the previous OpenLDAP and DB4 ? How?

Thanks a lot in advance,

Alberto

6 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: LDAP bdb backend system update (with yum) warning

No idea yet, sorry. Please try asking in OpenLDAP mailing list instead.

7 Reply by Albux

  • Albux
  • Member
  • Offline
  • Registered: 2009-11-16
  • Posts: 83

Re: LDAP bdb backend system update (with yum) warning

ZhangHuangbin wrote:

No idea yet, sorry. Please try asking in OpenLDAP mailing list instead.

Hello Zhang, do you know if the accountStatus.bdb is absolutely necessary for the iredmail or can it be recreated by some way? What's stored in accountStatus.bdb ?

Thx

8 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: LDAP bdb backend system update (with yum) warning

accountStatus is a LDAP attribute name used in iRedMail LDAP schema, it's required.

9 Reply by Albux

  • Albux
  • Member
  • Offline
  • Registered: 2009-11-16
  • Posts: 83

Re: LDAP bdb backend system update (with yum) warning

ZhangHuangbin wrote:

accountStatus is a LDAP attribute name used in iRedMail LDAP schema, it's required.

Hello Zhang,

I've run the clean_iredmail.sh and reinstalled the whole iRedMail package, reconfigured everything, restored all the MySQL passwords and recreated all the accounts manually...

Now everthing seems OK, except that it doesn't let the users change the passwords in Roundcube. It says 'Impossible to change the password' and I don't see anything in the logs...

Any idea? smile

10 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: LDAP bdb backend system update (with yum) warning

Some steps you should check:

- Turn on related debug settings in Roundcube config file: /var/www/roundcubemail/config/main.inc.php, then check Roundcube log file (it's same as Postfix log file by default) to see whether there's some related log about this issue. The try fixing it.

- Changing password through Roundcube requires addition privilege of MySQL user "roundcube", so please make sure this MySQL user has SELECT and UPDATE privileges on database "vmail". You can execute below SQL command as MySQL root user to fix it (It's safe to re-execute it):

mysql> GRANT UPDATE,SELECT ON vmail.mailbox TO "roundcube"@localhost;

Restarting Apache is strongly recommended after you applied above steps.

11 Reply by Albux

  • Albux
  • Member
  • Offline
  • Registered: 2009-11-16
  • Posts: 83

Re: LDAP bdb backend system update (with yum) warning

ZhangHuangbin wrote:

Some steps you should check:

- Turn on related debug settings in Roundcube config file: /var/www/roundcubemail/config/main.inc.php, then check Roundcube log file (it's same as Postfix log file by default) to see whether there's some related log about this issue. The try fixing it.

- Changing password through Roundcube requires addition privilege of MySQL user "roundcube", so please make sure this MySQL user has SELECT and UPDATE privileges on database "vmail". You can execute below SQL command as MySQL root user to fix it (It's safe to re-execute it):

mysql> GRANT UPDATE,SELECT ON vmail.mailbox TO "roundcube"@localhost;

Restarting Apache is strongly recommended after you applied above steps.

Hello again Zhang,

I've enabled all the possible logs in the main.inc.php, restarted apache and proceeded to change the password on Roundcube.
It didn't work (Impossible to change password) and no error showed up in the logs. In fact when I made the change password nothing showed up in the logs, on the contrary every other action I did generated lines and lines of logging.

For the "roundcube" user it has privileges on the DB "roundcubemail". I have no "vmail" DB... is it normal?

Thx again,

Alberto

12 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: LDAP bdb backend system update (with yum) warning

Oops, my mistake. LDAP backend doesn't have vmail database at all.

Please check config file of Roundcube password plugin, /var/www/roundcubemail/plugins/password/config.inc.php, do you use "ssha" password scheme or md5crypt? ssha requires addition PHP module "php5-mhash", if you don't have this module, try to change ssha to md5crypt.

13 Reply by Albux

  • Albux
  • Member
  • Offline
  • Registered: 2009-11-16
  • Posts: 83

Re: LDAP bdb backend system update (with yum) warning

ZhangHuangbin wrote:

Oops, my mistake. LDAP backend doesn't have vmail database at all.

Please check config file of Roundcube password plugin, /var/www/roundcubemail/plugins/password/config.inc.php, do you use "ssha" password scheme or md5crypt? ssha requires addition PHP module "php5-mhash", if you don't have this module, try to change ssha to md5crypt.

Hello Zhang,

the mhash extension is no more provided and has been replaced by the HASH Framework, included in the PHP core since 5.1.2


Anyway in the password config file there are two sha config:

$rcmail_config['password_hash_algorithm'] = 'sha1';
$rcmail_config['password_ldap_encodage'] = "ssha";

what am I supposed to change ?

Thx

14 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: LDAP bdb backend system update (with yum) warning

Use 'ssha' please.

15 Reply by Albux (edited by Albux 2011-12-28 18:20:15)

  • Albux
  • Member
  • Offline
  • Registered: 2009-11-16
  • Posts: 83

Re: LDAP bdb backend system update (with yum) warning

ZhangHuangbin wrote:

Use 'ssha' please.


OK, I've changed:
$rcmail_config['password_ldap_encodage'] = "ssha";
to
$rcmail_config['password_ldap_encodage'] = "md5crypt";

and everything works smile

Thanks a lot!

Just a last question: if I change a password through iredadmin how will it be encoded? SSHA or MD5?
Will it work OK even if there are two different kinds of password encodings?

16 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: LDAP bdb backend system update (with yum) warning

iRedAdmin will encrypt password in SSHA, because we have required module for Python, and OpenLDAP works well with multiple encryptions.