From 09326585a5561480d44beb508af2cb1da52bfff6 Mon Sep 17 00:00:00 2001

From: Mark Reynolds <mreynolds@redhat.com>

Date: Mon, 18 Nov 2019 12:02:39 -0500

Subject: [PATCH] Issue 50701 - Add additional healthchecks to dsconf

Description:  New checks and several design changes have been implemented

  Design changes:

    - Moved to a "yield" design, where a lint function can return multiple results

    - Revised the lint report so it's easier to read and distiguish between multiple

      errors

    - Revised most lint errors to include CLI examples on how to fix the issue

  New Checks:

    - Check TLS certs for expired/expiring

    - Add RI plugin checks for missing indexes for RI member attributes

    - Added Disk Space check

    - Add Virtual Attribute index check

    - Add replication agmt status check

    - Add replication conflict entry check

    - File System checks (/etc/revolv.conf, and NSS pin files)

    - Replication changelog trimming

relates: https://pagure.io/389-ds-base/issue/50701

Reviewed by: firstyear, mhonek, tbordaz, and spichugi (Thanks!!!!)

add suggested changes

Improved the replication agreement health checks to use the new

state levels (red, amber, green), and we use that to generate

different reports.

Also improved report example autofilling of the values, so the exact

commands can be copied and pasted.

Added a changelog trimming check as well.

Updated the help section to wanr that htehealthcheck feature should

only be run on the local instance

Moved healthcheck to dsctl and added file permission checks

---

 src/lib389/cli/dsconf                |   2 -

 src/lib389/cli/dsctl                 |  10 +-

 src/lib389/lib389/_mapped_object.py  |   6 +-

 src/lib389/lib389/agreement.py       |  67 +++++--

 src/lib389/lib389/backend.py         | 122 +++++++++---

 src/lib389/lib389/cli_base/dsrc.py   |   6 +-

 src/lib389/lib389/cli_conf/health.py |  62 ------

 src/lib389/lib389/cli_ctl/health.py  | 123 ++++++++++++

 src/lib389/lib389/config.py          |  18 +-

 src/lib389/lib389/dseldif.py         |  43 +++-

 src/lib389/lib389/lint.py            | 287 +++++++++++++++++++++++----

 src/lib389/lib389/monitor.py         |  14 ++

 src/lib389/lib389/nss_ssl.py         |  35 +++-

 src/lib389/lib389/plugins.py         |  46 ++++-

 src/lib389/lib389/properties.py      |   1 +

 src/lib389/lib389/replica.py         |  70 +++++++

 16 files changed, 746 insertions(+), 166 deletions(-)

 delete mode 100644 src/lib389/lib389/cli_conf/health.py

 create mode 100644 src/lib389/lib389/cli_ctl/health.py

diff --git a/src/lib389/cli/dsconf b/src/lib389/cli/dsconf

index 6e3ef19c3..5143756c8 100755

--- a/src/lib389/cli/dsconf

+++ b/src/lib389/cli/dsconf

@@ -21,7 +21,6 @@ from lib389.cli_conf import backend as cli_backend

 from lib389.cli_conf import directory_manager as cli_directory_manager

 from lib389.cli_conf import plugin as cli_plugin

 from lib389.cli_conf import schema as cli_schema

-from lib389.cli_conf import health as cli_health

 from lib389.cli_conf import monitor as cli_monitor

 from lib389.cli_conf import saslmappings as cli_sasl

 from lib389.cli_conf import pwpolicy as cli_pwpolicy

@@ -80,7 +79,6 @@ cli_backup.create_parser(subparsers)

 cli_chaining.create_parser(subparsers)

 cli_config.create_parser(subparsers)

 cli_directory_manager.create_parsers(subparsers)

-cli_health.create_parser(subparsers)

 cli_monitor.create_parser(subparsers)

 cli_plugin.create_parser(subparsers)

 cli_pwpolicy.create_parser(subparsers)

diff --git a/src/lib389/cli/dsctl b/src/lib389/cli/dsctl

index 31e906b7d..8b86629ac 100755

--- a/src/lib389/cli/dsctl

+++ b/src/lib389/cli/dsctl

@@ -16,14 +16,17 @@ import sys

 import signal

 import os

 from lib389.utils import get_instance_list

-from lib389.cli_base import _get_arg, setup_script_logger, disconnect_instance

 from lib389 import DirSrv

 from lib389.cli_ctl import instance as cli_instance

 from lib389.cli_ctl import dbtasks as cli_dbtasks

-from lib389.cli_base import disconnect_instance, setup_script_logger

-from lib389.cli_base import format_error_to_dict

 from lib389.cli_ctl import tls as cli_tls

+from lib389.cli_ctl import health as cli_health

 from lib389.cli_ctl.instance import instance_remove_all

+from lib389.cli_base import (

+    _get_arg,

+    disconnect_instance,

+    setup_script_logger,

+    format_error_to_dict)

 from lib389._constants import DSRC_CONTAINER

 parser = argparse.ArgumentParser()

@@ -54,6 +57,7 @@ if not os.path.exists(DSRC_CONTAINER):

     cli_instance.create_parser(subparsers)

 cli_dbtasks.create_parser(subparsers)

 cli_tls.create_parser(subparsers)

+cli_health.create_parser(subparsers)

 argcomplete.autocomplete(parser)

diff --git a/src/lib389/lib389/_mapped_object.py b/src/lib389/lib389/_mapped_object.py

index e331b3b27..4da112d25 100644

--- a/src/lib389/lib389/_mapped_object.py

+++ b/src/lib389/lib389/_mapped_object.py

@@ -978,9 +978,9 @@ class DSLdapObject(DSLogging):

             return None

         results = []

         for fn in self._lint_functions:

-            result = fn()

-            if result:

-                results.append(result)

+            for result in fn():

+                if result is not None:

+                    results.append(result)

         return results

diff --git a/src/lib389/lib389/agreement.py b/src/lib389/lib389/agreement.py

index a0d4597ec..93fd72895 100644

--- a/src/lib389/lib389/agreement.py

+++ b/src/lib389/lib389/agreement.py

@@ -105,6 +105,9 @@ class Agreement(DSLdapObject):

             time.sleep(2)

         return (done, error)

+    def get_name(self):

+        return self.get_attr_val_utf8_l('cn')

+

     def get_agmt_maxcsn(self):

         """Get the agreement maxcsn from the database RUV entry

         :returns: CSN string if found, otherwise None is returned

@@ -202,7 +205,7 @@ class Agreement(DSLdapObject):

         consumer.close()

         return result_msg

-    def get_agmt_status(self, binddn=None, bindpw=None):

+    def get_agmt_status(self, binddn=None, bindpw=None, return_json=False):

         """Return the status message

         :param binddn: Specifies a specific bind DN to use when contacting the remote consumer

         :type binddn: str

@@ -211,33 +214,55 @@ class Agreement(DSLdapObject):

         :returns: A status message about the replication agreement

         """

         status = "Unknown"

-

+        con_maxcsn = "Unknown"

         try:

             agmt_maxcsn = self.get_agmt_maxcsn()

+            agmt_status = json.loads(self.get_attr_val_utf8_l(AGMT_UPDATE_STATUS_JSON))

             if agmt_maxcsn is not None:

-                con_maxcsn = self.get_consumer_maxcsn(binddn=binddn, bindpw=bindpw)

-                if con_maxcsn:

-                    if agmt_maxcsn == con_maxcsn:

-                        status = "In Synchronization"

-                    else:

-                        # Not in sync - attempt to discover the cause

-                        repl_msg = "Unknown"

-                        if self.get_attr_val_utf8_l(AGMT_UPDATE_IN_PROGRESS) == 'true':

-                            # Replication is on going - this is normal

-                            repl_msg = "Replication still in progress"

-                        elif "can't contact ldap" in \

-                             self.get_attr_val_utf8_l(AGMT_UPDATE_STATUS):

-                            # Consumer is down

-                            repl_msg = "Consumer can not be contacted"

-

-                        status = ("Not in Synchronization: supplier " +

-                                  "(%s) consumer (%s) Reason(%s)" %

-                                  (agmt_maxcsn, con_maxcsn, repl_msg))

+                try:

+                    con_maxcsn = self.get_consumer_maxcsn(binddn=binddn, bindpw=bindpw)

+                    if con_maxcsn:

+                        if agmt_maxcsn == con_maxcsn:

+                            if return_json:

+                                return json.dumps({

+                                    'msg': "In Synchronization",

+                                    'agmt_maxcsn': agmt_maxcsn,

+                                    'con_maxcsn': con_maxcsn,

+                                    'state': agmt_status['state'],

+                                    'reason': agmt_status['message']

+                                })

+                            else:

+                                return "In Synchronization"

+                except:

+                    pass

+            else:

+                agmt_maxcsn = "Unknown"

+

+            # Not in sync - attempt to discover the cause

+            repl_msg = agmt_status['message']

+            if self.get_attr_val_utf8_l(AGMT_UPDATE_IN_PROGRESS) == 'true':

+                # Replication is on going - this is normal

+                repl_msg = "Replication still in progress"

+            elif "can't contact ldap" in agmt_status['message']:

+                    # Consumer is down

+                    repl_msg = "Consumer can not be contacted"

+

+            if return_json:

+                return json.dumps({

+                    'msg': "Not in Synchronization",

+                    'agmt_maxcsn': agmt_maxcsn,

+                    'con_maxcsn': con_maxcsn,

+                    'state': agmt_status['state'],

+                    'reason': repl_msg

+                })

+            else:

+                return ("Not in Synchronization: supplier " +

+                        "(%s) consumer (%s) State (%s) Reason (%s)" %

+                        (agmt_maxcsn, con_maxcsn, agmt_status['state'], repl_msg))

         except ldap.INVALID_CREDENTIALS as e:

             raise(e)

         except ldap.LDAPError as e:

             raise ValueError(str(e))

-        return status

     def get_lag_time(self, suffix, agmt_name, binddn=None, bindpw=None):

         """Get the lag time between the supplier and the consumer

diff --git a/src/lib389/lib389/backend.py b/src/lib389/lib389/backend.py

index 62fd0ae94..ac2af021c 100644

--- a/src/lib389/lib389/backend.py

+++ b/src/lib389/lib389/backend.py

@@ -7,6 +7,7 @@

 # --- END COPYRIGHT BLOCK ---

 from datetime import datetime

+import copy

 import ldap

 from lib389._constants import *

 from lib389.properties import *

@@ -19,6 +20,8 @@ from lib389._mapped_object import DSLdapObjects, DSLdapObject

 from lib389.mappingTree import MappingTrees

 from lib389.exceptions import NoSuchEntryError, InvalidArgumentError

 from lib389.replica import Replicas

+from lib389.cos import (CosTemplates, CosIndirectDefinitions,

+                        CosPointerDefinitions, CosClassicDefinitions)

 # We need to be a factor to the backend monitor

 from lib389.monitor import MonitorBackend

@@ -30,7 +33,7 @@ from lib389.encrypted_attributes import EncryptedAttr, EncryptedAttrs

 # This is for sample entry creation.

 from lib389.configurations import get_sample_entries

-from lib389.lint import DSBLE0001

+from lib389.lint import DSBLE0001, DSBLE0002, DSBLE0003, DSVIRTLE0001

 class BackendLegacy(object):

@@ -410,10 +413,92 @@ class Backend(DSLdapObject):

         self._must_attributes = ['nsslapd-suffix', 'cn']

         self._create_objectclasses = ['top', 'extensibleObject', BACKEND_OBJECTCLASS_VALUE]

         self._protected = False

-        self._lint_functions = [self._lint_mappingtree]

+        self._lint_functions = [self._lint_mappingtree, self._lint_search, self._lint_virt_attrs]

         # Check if a mapping tree for this suffix exists.

         self._mts = MappingTrees(self._instance)

+    def _lint_virt_attrs(self):

+        """Check if any virtual attribute are incorrectly indexed"""

+        indexes = self.get_indexes()

+        suffix = self.get_attr_val_utf8('nsslapd-suffix')

+

+        # First check nsrole

+        try:

+            indexes.get('nsrole')

+            report = copy.deepcopy(DSVIRTLE0001)

+            report['detail'] = report['detail'].replace('ATTR', 'nsrole')

+            report['fix'] = report['fix'].replace('ATTR', 'nsrole')

+            report['fix'] = report['fix'].replace('SUFFIX', suffix)

+            report['fix'] = report['fix'].replace('YOUR_INSTANCE', self._instance.serverid)

+            report['items'].append(suffix)

+            report['items'].append('nsrole')

+            yield report

+        except:

+            pass

+

+        # Check COS next

+        for cosDefType in [CosIndirectDefinitions, CosPointerDefinitions, CosClassicDefinitions]:

+            defs = cosDefType(self._instance, self._dn).list()

+            for cosDef in defs:

+                attrs = cosDef.get_attr_val_utf8_l("cosAttribute").split()

+                for attr in attrs:

+                    if attr in ["default", "override", "operational", "operational-default", "merge-schemes"]:

+                        # We are at the end, just break out

+                        break

+                    try:

+                        indexes.get(attr)

+                        # If we got here there is an index (bad)

+                        report = copy.deepcopy(DSVIRTLE0001)

+                        report['detail'] = report['detail'].replace('ATTR', attr)

+                        report['fix'] = report['fix'].replace('ATTR', attr)

+                        report['fix'] = report['fix'].replace('SUFFIX', suffix)

+                        report['fix'] = report['fix'].replace('YOUR_INSTANCE', self._instance.serverid)

+                        report['items'].append(suffix)

+                        report['items'].append("Class Of Service (COS)")

+                        report['items'].append("cosAttribute: " + attr)

+                        yield report

+                    except:

+                        # this is what we hope for

+                        pass

+

+    def _lint_search(self):

+        """Perform a search and make sure an entry is accessible

+        """

+        dn = self.get_attr_val_utf8('nsslapd-suffix')

+        suffix = DSLdapObject(self._instance, dn=dn)

+        try:

+            suffix.get_attr_val('objectclass')

+        except ldap.NO_SUCH_OBJECT:

+            # backend root entry not created yet

+            DSBLE0003['items'] = [dn, ]

+            yield DSBLE0003

+        except ldap.LDAPError as e:

+            # Some other error

+            DSBLE0002['detail'] = DSBLE0002['detail'].replace('ERROR', str(e))

+            DSBLE0002['items'] = [dn, ]

+            yield DSBLE0002

+

+    def _lint_mappingtree(self):

+        """Backend lint

+

+        This should check for:

+        * missing mapping tree entries for the backend

+        * missing indices if we are local and have log access?

+        """

+

+        # Check for the missing mapping tree.

+        suffix = self.get_attr_val_utf8('nsslapd-suffix')

+        bename = self.get_attr_val_bytes('cn')

+        try:

+            mt = self._mts.get(suffix)

+            if mt.get_attr_val_bytes('nsslapd-backend') != bename and mt.get_attr_val('nsslapd-state') != ensure_bytes('backend'):

+                raise ldap.NO_SUCH_OBJECT("We have a matching suffix, but not a backend or correct database name.")

+        except ldap.NO_SUCH_OBJECT:

+            result = DSBLE0001

+            result['items'] = [bename, ]

+            yield result

+        return None

+

     def create_sample_entries(self, version):

         """Creates sample entries under nsslapd-suffix value

@@ -552,27 +637,6 @@ class Backend(DSLdapObject):

         # Now remove our children, this is all ldbm config

         self._instance.delete_branch_s(self._dn, ldap.SCOPE_SUBTREE)

-    def _lint_mappingtree(self):

-        """Backend lint

-

-        This should check for:

-        * missing mapping tree entries for the backend

-        * missing indices if we are local and have log access?

-        """

-

-        # Check for the missing mapping tree.

-        suffix = self.get_attr_val_utf8('nsslapd-suffix')

-        bename = self.get_attr_val_bytes('cn')

-        try:

-            mt = self._mts.get(suffix)

-            if mt.get_attr_val_bytes('nsslapd-backend') != bename and mt.get_attr_val('nsslapd-state') != ensure_bytes('backend'):

-                raise ldap.NO_SUCH_OBJECT("We have a matching suffix, but not a backend or correct database name.")

-        except ldap.NO_SUCH_OBJECT:

-            result = DSBLE0001

-            result['items'] = [bename, ]

-            return result

-        return None

-

     def get_suffix(self):

         return self.get_attr_val_utf8_l('nsslapd-suffix')

@@ -753,6 +817,18 @@ class Backend(DSLdapObject):

                         break

         return subsuffixes

+    def get_cos_indirect_defs(self):

+        return CosIndirectDefinitions(self._instance, self._dn).list()

+

+    def get_cos_pointer_defs(self):

+        return CosPointerDefinitions(self._instance, self._dn).list()

+

+    def get_cos_classic_defs(self):

+        return CosClassicDefinitions(self._instance, self._dn).list()

+

+    def get_cos_templates(self):

+        return CosTemplates(self._instance, self._dn).list()

+

 class Backends(DSLdapObjects):

     """DSLdapObjects that represents DN_LDBM base DN

diff --git a/src/lib389/lib389/cli_base/dsrc.py b/src/lib389/lib389/cli_base/dsrc.py

index bbd160e8e..20b240df5 100644

--- a/src/lib389/lib389/cli_base/dsrc.py

+++ b/src/lib389/lib389/cli_base/dsrc.py

@@ -41,12 +41,15 @@ def dsrc_arg_concat(args, dsrc_inst):

             'uri': args.instance,

             'basedn': args.basedn,

             'binddn': args.binddn,

+            'bindpw': None,

             'saslmech': None,

             'tls_cacertdir': None,

             'tls_cert': None,

             'tls_key': None,

             'tls_reqcert': ldap.OPT_X_TLS_HARD,

             'starttls': args.starttls,

+            'prompt': False,

+            'pwdfile': None,

             'args': {}

         }

         # Now gather the args

@@ -137,7 +140,8 @@ def dsrc_to_ldap(path, instance_name, log):

     else:

         dsrc_inst['tls_reqcert'] = ldap.OPT_X_TLS_HARD

     dsrc_inst['starttls'] = config.getboolean(instance_name, 'starttls', fallback=False)

-

+    dsrc_inst['pwdfile'] = None

+    dsrc_inst['prompt'] = False

     # Now gather the args

     dsrc_inst['args'][SER_LDAP_URL] = dsrc_inst['uri']

     dsrc_inst['args'][SER_ROOT_DN] = dsrc_inst['binddn']

diff --git a/src/lib389/lib389/cli_conf/health.py b/src/lib389/lib389/cli_conf/health.py

deleted file mode 100644

index 040d85674..000000000

--- a/src/lib389/lib389/cli_conf/health.py

+++ /dev/null

@@ -1,62 +0,0 @@

-# --- BEGIN COPYRIGHT BLOCK ---

-# Copyright (C) 2016 Red Hat, Inc.

-# All rights reserved.

-#

-# License: GPL (version 3 or any later version).

-# See LICENSE for details.

-# --- END COPYRIGHT BLOCK ---

-

-from lib389.backend import Backend, Backends

-from lib389.config import Encryption, Config

-from lib389 import plugins

-

-# These get all instances, then check them all.

-CHECK_MANY_OBJECTS = [

-    Backends,

-]

-

-# These get single instances and check them.

-CHECK_OBJECTS = [

-    Config,

-    Encryption,

-    plugins.ReferentialIntegrityPlugin

-]

-

-

-def _format_check_output(log, result):

-    log.info("==== DS Lint Error: %s ====" % result['dsle'])

-    log.info(" Severity: %s " % result['severity'])

-    log.info(" Affects:")

-    for item in result['items']:

-        log.info(" -- %s" % item)

-    log.info(" Details:")

-    log.info(result['detail'])

-    log.info(" Resolution:")

-    log.info(result['fix'])

-

-

-def health_check_run(inst, basedn, log, args):

-    log.info("Beginning lint report, this could take a while ...")

-    report = []

-    for lo in CHECK_MANY_OBJECTS:

-        log.info("Checking %s ..." % lo.__name__)

-        lo_inst = lo(inst)

-        for clo in lo_inst.list():

-            result = clo.lint()

-            if result is not None:

-                report += result

-    for lo in CHECK_OBJECTS:

-        log.info("Checking %s ..." % lo.__name__)

-        lo_inst = lo(inst)

-        result = lo_inst.lint()

-        if result is not None:

-            report += result

-    log.info("Healthcheck complete!")

-    for item in report:

-        _format_check_output(log, item)

-

-

-def create_parser(subparsers):

-    run_healthcheck_parser = subparsers.add_parser('healthcheck', help="Run a healthcheck report on your Directory Server instance. This is a safe, read only operation.")

-    run_healthcheck_parser.set_defaults(func=health_check_run)

-

diff --git a/src/lib389/lib389/cli_ctl/health.py b/src/lib389/lib389/cli_ctl/health.py

new file mode 100644

index 000000000..d8f3d732b

--- /dev/null

+++ b/src/lib389/lib389/cli_ctl/health.py

@@ -0,0 +1,123 @@

+# --- BEGIN COPYRIGHT BLOCK ---

+# Copyright (C) 2016 Red Hat, Inc.

+# All rights reserved.

+#

+# License: GPL (version 3 or any later version).

+# See LICENSE for details.

+# --- END COPYRIGHT BLOCK ---

+

+import json

+from getpass import getpass

+from lib389.cli_base import connect_instance, disconnect_instance, format_error_to_dict

+from lib389.cli_base.dsrc import dsrc_to_ldap, dsrc_arg_concat

+from lib389.backend import Backend, Backends

+from lib389.config import Encryption, Config

+from lib389.monitor import MonitorDiskSpace

+from lib389.replica import Replica, Changelog5

+from lib389.nss_ssl import NssSsl

+from lib389.dseldif import FSChecks

+from lib389 import plugins

+from lib389._constants import DSRC_HOME

+

+# These get all instances, then check them all.

+CHECK_MANY_OBJECTS = [

+    Backends,

+]

+

+# These get single instances and check them.

+CHECK_OBJECTS = [

+    Config,

+    Encryption,

+    FSChecks,

+    plugins.ReferentialIntegrityPlugin,

+    MonitorDiskSpace,

+    Replica,

+    Changelog5,

+    NssSsl,

+]

+

+

+def _format_check_output(log, result, idx):

+    log.info("\n\n[{}] DS Lint Error: {}".format(idx, result['dsle']))

+    log.info("-" * 80)

+    log.info("Severity: %s " % result['severity'])

+    log.info("Affects:")

+    for item in result['items']:

+        log.info(" -- %s" % item)

+    log.info("\nDetails:")

+    log.info('-----------')

+    log.info(result['detail'])

+    log.info("\nResolution:")

+    log.info('-----------')

+    log.info(result['fix'])

+

+

+def health_check_run(inst, log, args):

+    """Connect to the local server using LDAPI, and perform various health checks

+    """

+

+    # update the args for connect_instance()

+    args.basedn = None

+    args.binddn = None

+    args.bindpw = None

+    args.starttls = None

+    args.pwdfile = None

+    args.prompt = False

+    dsrc_inst = dsrc_to_ldap(DSRC_HOME, args.instance, log.getChild('dsrc'))

+    dsrc_inst = dsrc_arg_concat(args, dsrc_inst)

+    try:

+        inst = connect_instance(dsrc_inst=dsrc_inst, verbose=args.verbose, args=args)

+    except Exception as e:

+        raise ValueError('Failed to connect to Directory Server instance: ' + str(e))

+

+    if not args.json:

+        log.info("Beginning lint report, this could take a while ...")

+    report = []

+    for lo in CHECK_MANY_OBJECTS:

+        if not args.json:

+            log.info("Checking %s ..." % lo.__name__)

+        lo_inst = lo(inst)

+        for clo in lo_inst.list():

+            result = clo.lint()

+            if result is not None:

+                report += result

+    for lo in CHECK_OBJECTS:

+        if not args.json:

+            log.info("Checking %s ..." % lo.__name__)

+        lo_inst = lo(inst)

+        result = lo_inst.lint()

+        if result is not None:

+            report += result

+    if not args.json:

+        log.info("Healthcheck complete.")

+    count = len(report)

+    if count == 0:

+        if not args.json:

+            log.info("No issues found.")

+        else:

+            log.info(json.dumps(report))

+    else:

+        plural = ""

+        if count > 1:

+            plural = "s"

+        if not args.json:

+            log.info("{} Issue{} found!  Generating report ...".format(count, plural))

+            idx = 1

+            for item in report:

+                _format_check_output(log, item, idx)

+                idx += 1

+            log.info('\n\n===== End Of Report ({} Issue{} found) ====='.format(count, plural))

+        else:

+            log.info(json.dumps(report))

+

+    disconnect_instance(inst)

+

+

+def create_parser(subparsers):

+    run_healthcheck_parser = subparsers.add_parser('healthcheck', help=

+        "Run a healthcheck report on a local Directory Server instance. This "

+        "is a safe and read-only operation.  Do not attempt to run this on a "

+        "remote Directory Server as this tool needs access to local resources, "

+        "otherwise the report may be inaccurate.")

+    run_healthcheck_parser.set_defaults(func=health_check_run)

+

diff --git a/src/lib389/lib389/config.py b/src/lib389/lib389/config.py

index db5359a68..f71baf2d8 100644

--- a/src/lib389/lib389/config.py

+++ b/src/lib389/lib389/config.py

@@ -16,6 +16,7 @@

    DirSrv.backend.methodName()

 """

+import copy

 import ldap

 from lib389._constants import *

 from lib389 import Entry

@@ -199,17 +200,18 @@ class Config(DSLdapObject):

     def _lint_hr_timestamp(self):

         hr_timestamp = self.get_attr_val('nsslapd-logging-hr-timestamps-enabled')

         if ensure_bytes('on') != hr_timestamp:

-            return DSCLE0001

-        pass # nsslapd-logging-hr-timestamps-enabled

+            report = copy.deepcopy(DSCLE0001)

+            report['fix'] = report['fix'].replace('YOUR_INSTANCE', self._instance.serverid)

+            yield report

     def _lint_passwordscheme(self):

         allowed_schemes = ['SSHA512', 'PBKDF2_SHA256']

         u_password_scheme = self.get_attr_val_utf8('passwordStorageScheme')

         u_root_scheme = self.get_attr_val_utf8('nsslapd-rootpwstoragescheme')

         if u_root_scheme not in allowed_schemes or u_password_scheme not in allowed_schemes:

-            return DSCLE0002

-        return None

-

+            report = copy.deepcopy(DSCLE0002)

+            report['fix'] = report['fix'].replace('YOUR_INSTANCE', self._instance.serverid)

+            yield report

 class Encryption(DSLdapObject):

     """

@@ -237,8 +239,10 @@ class Encryption(DSLdapObject):

     def _lint_check_tls_version(self):

         tls_min = self.get_attr_val('sslVersionMin')

         if tls_min < ensure_bytes('TLS1.1'):

-            return DSELE0001

-        return None

+            report = copy.deepcopy(DSELE0001)

+            report['fix'] = report['fix'].replace('YOUR_INSTANCE', self._instance.serverid)

+            yield report

+        yield None

     @property

     def ciphers(self):

diff --git a/src/lib389/lib389/dseldif.py b/src/lib389/lib389/dseldif.py

index dfe3b91e2..4155abcdd 100644

--- a/src/lib389/lib389/dseldif.py

+++ b/src/lib389/lib389/dseldif.py

@@ -1,14 +1,17 @@

 # --- BEGIN COPYRIGHT BLOCK ---

-# Copyright (C) 2017 Red Hat, Inc.

+# Copyright (C) 2019 Red Hat, Inc.

 # All rights reserved.

 #

 # License: GPL (version 3 or any later version).

 # See LICENSE for details.

 # --- END COPYRIGHT BLOCK ---

 #

+

+import copy

 import os

+from stat import ST_MODE

 from lib389.paths import Paths

-

+from lib389.lint import DSPERMLE0001, DSPERMLE0002

 class DSEldif(object):

     """A class for working with dse.ldif file

@@ -155,3 +158,39 @@ class DSEldif(object):

             self._instance.log.debug("During replace operation: {}".format(e))

         self.add(entry_dn, attr, value)

         self._update()

+

+

+class FSChecks(object):

+    """This is for the healthcheck feature, check commonly used system config files the

+    server uses.  This is here for lack of a better place to add this class.

+    """

+    def __init__(self, dirsrv=None):

+        self.dirsrv = dirsrv

+        self._certdb = self.dirsrv.get_cert_dir()

+        self.ds_files = [

+            ('/etc/resolv.conf', '644', DSPERMLE0001),

+            (self._certdb + "/pin.txt", '600', DSPERMLE0002),