Open Directory Replica to a master in public domain

[lucas_mat]

I am trying to consolidate our network design in order to make more efficient use of resources/logons etc etc.

The difficulty I have is this:
The current ODMaster (which I would (ideally) like to remain as the master) is out on the internet with a public IP so we have access to the wiki etc from other locations without worrying about VPN's etc. That's not set in stone, but is preferable.

The remaining 4 sites all need ODReplicas, however they are on our private network behind routers. When I try and create a replica using all the correct info, it reports it has succeeded, but back in Server Mgr, it reports it is a standalone and there is no indication on the master that any replica exists.

Have heard that SSH access is needed, so have set up Port forwarding on the router to allow SSH (port 22 TCP) pointing to the potential replica also on port 22, however still no joy. There is nothing in the OD error logs at all.

On another router on another site I just tried opening port 22, and get the same effect when trying to create a replica, but the OD error log reports the following:

2009-01-23 10:10:07 +0000 - ssh command failed with status 1
2009-01-23 10:10:07 +0000 - Removing replica due to an error copying LDAP database. (error = 69)
2009-01-23 10:10:07 +0000 - command: ssh root@85.113.82.31 /usr/sbin/slapconfig -removereplica 192.168.1.11 diradmin
2009-01-23 10:10:10 +0000 - command: ssh root@85.113.82.31 /usr/sbin/slapconfig -startldapserver
2009-01-23 11:05:15 +0000 - slapconfig -setmacosxodpol2009-01-23 11:05:15 +0000 - command: ssh root@85.112.82.31 /usr/sbin/slapconfig -checkmaster diradmin 0 4 4
2009-01-23 11:06:31 +0000 - ssh command failed with status 255
2009-01-23 11:06:31 +0000 - (error = 255)
2009-01-23 11:08:15 +0000 - slapconfig -createreplica
2009-01-23 11:08:15 +0000 - command: ssh root@85.113.82.31 /usr/sbin/slapconfig -checkmaster diradmin 0 4 4
2009-01-23 11:08:18 +0000 - Warning: An error occurred while disabling GSSAPI binding.
2009-01-23 11:08:18 +0000 - 1 Updating master's configuration
2009-01-23 11:08:18 +0000 - command: ssh root@85.113.82.31 /usr/sbin/slapconfig -addreplica 192.168.1.11
2009-01-23 11:08:21 +0000 - 2 Stopping master LDAP server
2009-01-23 11:08:21 +0000 - command: ssh root@85.113.82.31 /usr/sbin/slapconfig -stopldapserver
2009-01-23 11:08:24 +0000 - command: ssh root@85.113.82.31 /usr/bin/db_recover -h /var/db/openldap/openldap-data ; /usr/sbin/slapcat -l /var/db/openldap/openldap-data/backup.ldif
2009-01-23 11:08:29 +0000 - ssh command output:
# no data for entry id=00000001

Obviously it looks like SSH is causing some difficulties, but I'm not sure what exactly.

Anybody any thoughts?

 

[warhorse25]

Were you ever able to get this working? I'm having the same issue.

Thanks,

 

[lucas_mat]

No, I didn't in the end - had to resort to initially having the OD master within the WAN and replicating that way, but we had various other complicating issues that ended up meaning no one could log on at any of the replica sites unless the replicas had direct connectivity with the master (which with the state of our VPN's wasn't always the case). The clients were authenticating to the local replicas but it just wouldn't work if the replicas couldn't see the master. I think in the end it was down to Kerberos, but I lost interest at that point and since our arrangement allowed it, I just dropped down to 4 masters.

At any rate, I discussed the initial issue further on the apple support forums at this link http://discussions.apple.com/thread.jspa?threadID=1880985&tstart=0 and got some interesting replies but nothing that I managed to get working in the end. Have a look there and see if there's anything of use to you.

Let me know how you get on, would be interested to see if you get it working.

Matt