Ubuntu – Working with OpenLDAP 2.4 LDIF config backend

openldapredhatUbuntu

In OpenLDAP 2.4, the configuration has been moved into an LDIF backend called cn=config. The OpenLDAP documentation says "you should never edit any of the LDIF files directly. Configuration changes should be performed via LDAP operations…" but does not give details any further details.

There's lots of conflicting information and to make matters worse, distros, such as Redhat Linux and Ubuntu, have specific configuration.

Best Answer

There are two ways to edit the cn=config date: directly and indirectly. Indirect uses normal ldap tools, such as ldapmodify and ldapsearch, which provides the simplest and most logical approach. HOWEVER, many distros use SASL to restrict access to just the root user on the local box. Assuming, you have a preconfigured instance, you can easily change this:

Enabling external access to cn=config

  1. sudo -i / su -

  2. Create a new password:

    slappasswd
  3. Copy result, including "{SSHA}"

  4. Prepare auth.ldif. Replace olcRootPW with your password hash from last command

    dn: olcDatabase={0}config,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,cn=config 
-
replace: olcRootPW
olcRootPW: {SSHA}jCMTRlz/iT4cw3CZno5z2PtCkJQbKrqK

  5. Import LDIF:

    ldapmodify -Y EXTERNAL -H ldapi:/// -f auth.ldif

  6. You may now connect externally (assuming you have network access), using any LDAP client. E.g.

    ldapsearch -b cn=config -D cn=admin,cn=config -H ldap://myldapserver -W
  7. Configure SSL ASAP!

Direct Mode

In direct mode, you can edit the cn=config database (and any other database), even if slapd is down. This is through the use of slapadd and slapcat tools. You must pass the database suffix. For example:

slapcat -b cn=config

IMHO, direct mode is best used when you know the exact LDIF you need to apply. I rarely do, so I tend to use normal LDAP tools to add, replace, and delete configuration on the fly.

Related Topic