Description of problem: The file /etc/openldap/schema/dnszone.schema provided by bind-sdb-9.3.3-9.0.1.el5 has the wrong file permissions ... causing openldap to not start. File is currently: -rw-r----- 1 root named Needs to be 644 not 640 (or owner/group needs to be openldap). This is also #2240 in the CentOS Bug Tracker: http://bugs.centos.org/view.php?id=2240
Best should be change perms to root:root 644 (like other schemas). Will be fixed in 5.2 Adam
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux maintenance release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Update release for currently deployed products. This request is not yet committed for inclusion in an Update release.
Please raise the severity and the priority of this; it is very serious. For my part I just lost two remote servers because of it. The bind update of 5.1 set the permissions of the schema file wrong. Seconds later, the ldap update caused ldap to restart and fail. Since I'm using ldap authentication for all accounts except root, ldap down means mail down and no login of any kind for users. Add now a 'permitrootlogin no' in sshd_config and the bliss is complete: two machines in a data centre in another country and I have to get someone there with a keyboard to go recover them.
(In reply to comment #5) > Please raise the severity and the priority of this; it is very serious. For my > part I just lost two remote servers because of it. The bind update of 5.1 set > the permissions of the schema file wrong. Seconds later, the ldap update caused > ldap to restart and fail. Since I'm using ldap authentication for all accounts > except root, ldap down means mail down and no login of any kind for users. Add > now a 'permitrootlogin no' in sshd_config and the bliss is complete: two > machines in a data centre in another country and I have to get someone there > with a keyboard to go recover them. Severity and priority is only informational. Fix is already commited into CVS and update is scheduled to 5.2 Adam
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2008-0300.html