[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: cn=config example
> > > On Friday 21 September 2007 06:07:47 Howard Chu wrote:
> > >> Use slaptest instead.
> > > except that slaptest doesn't have a "run as another user" flag, and -u is
> > > already taken :-(.
I was just working with converting a conf file to a config backend and
swear I saw a specific note somewhere to use slaptest (and I knew to use
slaptest). Now poking around a bit I can't find it.
> > Nor do the tools need such an option; you can just use su. The reason slapd
> > can't be started with just "su ldap" is because it may need root privs to
> > open the listener sockets. That's the only reason it has -u/-g options.
> Sure, and I use su in our init script when testing the configuration. But,
> some other distros don't, and don't use -u, and end up creating transaction
> log files as root, preventing startup later.
I don't perceive this as an OpenLDAP problem; it is more of a "bad
distribution! bad!" kind of issue.
> I am not aware of any
> recommendation of using su for slaptest (though it is quite obvious to many,
> it may be worth mentioning explicitly). And, it should certainly be mentioned
> in any documentation covering converting to back-config.
Nah, it is simply obvious/standard practice. Configuring services as a
user or root and then setting permissions as the last step is just how
things are done.
> > > At present, it seems that if you want to do the conversion while slapd is
> > > running, and for a slapd that runs as non-root, something like this is
> > > the best option:
> > > # slapd -u ldap -g ldap -d none -h
> > > ldap://localhost:391/ -f /etc/openldap/slapd.conf -F
> > > /etc/openldap/slapd.d
> > > As then
> > > -The configuration will be converted
> > > -slapd won't start up
> > What makes you say that?
> It will fail to open the database already opened by the running slapd.
I'm confused by all of this; who is going to be converting their
configuration (which one assumes would also include testing the
resulting configuration) while slapd is hot?
> > > -you will see any relevant errors
> > > -all the files will be owned by the ldap user/group
> > > -if it succeeds, a restart of slapd is all that is necessary to continue
> > That seems like far more trouble than just using su...
> It's aobut the same amount of typing:
slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
chown -R ldap.ldap /etc/openldap/slapd.d
--
Consonance: an Open Source .NET OpenGroupware client.
http://code.google.com/p/consonance/ - Searching for a bored Cairo# hacker.
Contact:awilliam@whitemiceconsulting.com http://www.opengroupware.org