[Date Prev][Date Next] [Chronological] [Thread] [Top]
I got the replication blues

To: OpenLDAP-Software@OpenLDAP.org
Subject: I got the replication blues
From: David Sonenberg <dsonenberg@strozllc.com>
Date: Thu, 06 Jan 2005 11:32:21 -0500
OK I think I got my configs sorted out, but the replication still
doesn't work.  Here's my log file.
 Jan  6 09:54:56 auth.dc.secure slapd[300]: conn=19 op=3 MOD
dn="cn=NextFreeUnixId,dc=strozllc,dc=com"
Jan  6 09:54:56 auth.dc.secure slapd[300]: conn=19 op=3 MOD
attr=uidNumber entryCSN modifiersName modifyTimestamp
Jan  6 09:54:56 auth.dc.secure slapd[300]: conn=19 op=3 RESULT tag=103
err=10 text=
Jan  6 09:54:56 auth.dc.secure slapd[300]: conn=19 op=4 ADD
dn="uid=emcgoff,ou=People,dc=strozllc,dc=com"
Jan  6 09:54:56 auth.dc.secure slapd[300]: conn=19 op=4 RESULT tag=105
err=10 text=
Jan  6 09:54:56 auth.dc.secure slapd[300]: conn=19 op=5 MOD
dn="cn=Domain Users,ou=People,dc=strozllc,dc=com"
Jan  6 09:54:56 auth.dc.secure slapd[300]: conn=19 op=5 MOD
attr=memberUid entryCSN modifiersName modifyTimestamp
Jan  6 09:54:56 auth.dc.secure slapd[300]: conn=19 op=5 RESULT tag=103
err=10 text=
Jan  6 09:54:56 auth.dc.secure slapd[300]: conn=19 op=6 MOD
dn="uid=emcgoff,ou=People,dc=strozllc,dc=com"
Jan  6 09:54:56 auth.dc.secure slapd[300]: conn=19 op=6 MOD
attr=objectClass sambaPwdLastSet sambaLogonTime sambaLogoffTime
sambaKickoffTime sambaPwdCanChange sambaPwdMustChange displayName
sambaAcctFlags sambaSID entryCSN modifiersName modifyTimestamp
Jan  6 09:54:56 auth.dc.secure slapd[300]: conn=19 op=6 RESULT tag=103
err=10 text=
Jan  6 09:54:56 auth.dc.secure slapd[300]: conn=19 op=7 MOD
dn="uid=emcgoff,ou=People,dc=strozllc,dc=com"
Jan  6 09:54:56 auth.dc.secure slapd[300]: conn=19 op=7 MOD
attr=sambaLMPassword sambaPrimaryGroupSID sambaNTPassword
sambaLogonScript sambaProfilePath sambaHomePath sambaHomeDrive entryCSN
modifiersName modifyTimestamp
Jan  6 09:54:56 auth.dc.secure slapd[300]: conn=19 op=7 RESULT tag=103
err=10 text=

Here's the master's slapd.conf:

-- include		/etc/openldap/schema/core.schema
include		/etc/openldap/schema/cosine.schema
include		/etc/openldap/schema/inetorgperson.schema
include		/etc/openldap/schema/nis.schema
include		/etc/openldap/schema/samba.schema


# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral	ldap://root.openldap.org

pidfile		/var/openldap/run/slapd.pid
argsfile	/var/openldap/run/slapd.args

# Load dynamic backend modules:
# modulepath	/usr/sbin/openldap
# moduleload	back_bdb.la
# moduleload	back_ldap.la
# moduleload	back_ldbm.la
# moduleload	back_passwd.la
# moduleload	back_shell.la

# Sample security restrictions
#	Require integrity protection (prevent hijacking)
#	Require 112-bit (3DES or better) encryption for updates
#	Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#	Root DSE: allow anyone to read it
#	Subschema (sub)entry DSE: allow anyone to read it
#	Other DSEs:
#		Allow self write access
#		Allow authenticated users read access
#		Allow anonymous users to authenticate
#	Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#	by self write
#	by users read
#	by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

# allow the "ldap admin dn" access, but deny everyone else
#access to attrs=lmPassword, ntPassword
#	by dn="cn=Samba Admin,ou=People,dc=strozllc,dc=com" write
#	by * none

#######################################################################
# BDB database definitions
#######################################################################

database	bdb
suffix		"dc=strozllc,dc=com"
rootdn		"cn=Manager,dc=strozllc,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoid.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# Change password with 'slappasswd -h {Md5}'

rootpw		{MD5}XXXXXXXXXXXXXXXXXXXXXX==
# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory	/var/openldap/openldap-data

# Use crypt to has the passwords
password-hash {crypt}

# Define SSL and TLS properties
TLSCertificateFile 	/etc/ssl/ldap.pem
TLSCertificateKeyFile	/etc/openldap/ssl/ldap.pem
TLSCACertificateFile	/etc/ssl/ldap.pem

# Indices to maintain

index	objectClass		eq
index	cn			pres,sub,eq
index	sn			pres,sub,eq
index	uid			pres,sub,eq
index	displayName		pres,sub,eq
index	uidNumber		eq
index	gidNumber		eq
index	memberUid		eq
index	sambaSID		eq
index	sambaPrimaryGroupSID	eq
index	sambaDomainName		eq
index	default			sub	

#######################################################################
# replication via slurpd(8)
#######################################################################

# master server configuration
replogfile      /var/openldap/openldap-slurp/replica.log
replica-pidfile /var/openldap/slurpd.pid
replica         uri=ldaps://auth.dc.secure:636
                binddn="cn=Manager,dc=strozllc,dc=com"
                bindmethod=simple credentials="XXXXXXXXXXX"

And here's the slave's slapd.conf:
include		/etc/openldap/schema/core.schema
include		/etc/openldap/schema/cosine.schema
include		/etc/openldap/schema/inetorgperson.schema
include		/etc/openldap/schema/nis.schema
include		/etc/openldap/schema/samba.schema


# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral	ldap://root.openldap.org

pidfile		/var/openldap/run/slapd.pid
argsfile	/var/openldap/run/slapd.args

# Load dynamic backend modules:
# modulepath	/usr/sbin/openldap
# moduleload	back_bdb.la
# moduleload	back_ldap.la
# moduleload	back_ldbm.la
# moduleload	back_passwd.la
# moduleload	back_shell.la

# Sample security restrictions
#	Require integrity protection (prevent hijacking)
#	Require 112-bit (3DES or better) encryption for updates
#	Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#	Root DSE: allow anyone to read it
#	Subschema (sub)entry DSE: allow anyone to read it
#	Other DSEs:
#		Allow self write access
#		Allow authenticated users read access
#		Allow anonymous users to authenticate
#	Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#	by self write
#	by users read
#	by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

# allow the "ldap admin dn" access, but deny everyone else
#access to attrs=lmPassword, ntPassword
#	by dn="cn=Samba Admin,ou=People,dc=strozllc,dc=com" write
#	by * none

#######################################################################
# BDB database definitions
#######################################################################

database	bdb
suffix		"dc=strozllc,dc=com"
rootdn		"cn=Manager,dc=strozllc,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoid.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# Change password with 'slappasswd -h {Md5}'

rootpw		{MD5}XXXXXXXXXXXXXXXXXXXXXX==
# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory	/var/openldap/openldap-data

# Use crypt to has the passwords
password-hash {crypt}

# Define SSL and TLS properties
TLSCertificateFile 	/etc/ssl/ldap.pem
TLSCertificateKeyFile	/etc/openldap/ssl/ldap.pem
TLSCACertificateFile	/etc/ssl/ldap.pem

# Indices to maintain

index	objectClass		eq
index	cn			pres,sub,eq
index	sn			pres,sub,eq
index	uid			pres,sub,eq
index	displayName		pres,sub,eq
index	uidNumber		eq
index	gidNumber		eq
index	memberUid		eq
index	sambaSID		eq
index	sambaPrimaryGroupSID	eq
index	sambaDomainName		eq
index	default			sub	

#######################################################################
# replication via slurpd(8)
#######################################################################

# master server configuration
#replogfile      /var/openldap/openldap-slurp/replica.log
#replica-pidfile /var/openldap/slurpd.pid
#replica         host=auth.dc.secure:636
#                binddn="cn=Manager,dc=strozllc,dc=com"
#                bindmethod=simple credentials="XXXXXXXXXX"

# slave server(s) configuration
updatedn        "cn=admin,dc=strozllc,dc=com"
updateref       ldaps://auth.ny.secure:636

David Sonenberg
Systems / Network Administrator
Stroz Friedberg, LLC
15 Maiden Lane, Suite 1208
New York, NY 10038
212.981.6527 (o) | 917.495.4918 (c)
Follow-Ups:
- Re: I got the replication blues
  - From: Quanah Gibson-Mount <quanah@stanford.edu>
Prev by Date: back-meta hangs
Next by Date: Re: Subordinate Referrals redundant? [auf Viren überprüft]
Index(es):
- Chronological
- Thread