Hi all,
I just went through all of this previously. I documented everything. I don't believe (yeah... believe) I changed anything.
I verified that my firewall rules are correct (although this is all local)
I just shutdown slapd with:
systemctl stop slapd
I did:
rm -rf /var/lib/ldap/* /etc/openldap/slapd.d/*
Changed my password with slappasswd and put the new one in my slapd.conf .
Re-initialized everything with:
slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
Got that the configuration passed. Checked slapd.d and /var/lib/ldap.
Both had expected values/files.
Did:
chown -R ldap:ldap /etc/openldap/slapd.d /var/lib/ldap
systemctl start slapd
Tried to add my memberof.ldif file with:
ldapadd -f /etc/openldap/memberof.ldif -v -D "cn=config" -H ldap://newldap.hq.example.com -W -c
Got prompted for the password and got an "invalid credentials (49)" (I tried re-doing this multiple times with simple passwords....but same issue...)
slapd -d -1 shows me:
5d8267a3 config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context
5d8267a3 backend_startup_one: starting "dc=hq,dc=example,dc=com"
5d8267a3 mdb_db_open: "dc=hq,dc=example,dc=com"
5d8267a3 mdb_db_open: database "dc=hq,dc=example,dc=com": dbenv_open(/var/lib/ldap).
5d8267a3 mdb_monitor_db_open: monitoring disabled; configure monitor database to enable
5d8267a3 slapd starting
5d8267a3 daemon: added 4r listener=(nil)
5d8267a3 daemon: added 7r listener=0x565118e8b500
5d8267a3 daemon: added 8r listener=0x565118e8b330
5d8267a3 daemon: epoll: listen=7 active_threads=0 tvp=zero
5d8267a3 daemon: epoll: listen=8 active_threads=0 tvp=zero
5d8267a3 daemon: activity on 1 descriptor
5d8267a3 daemon: activity on:
5d8267a3 daemon: epoll: listen=7 active_threads=0 tvp=zero
5d8267a3 daemon: epoll: listen=8 active_threads=0 tvp=zero
5d8267b8 daemon: activity on 1 descriptor
5d8267b8 daemon: activity on:
5d8267b8 slap_listener_activate(7):
5d8267b8 daemon: epoll: listen=7 busy
5d8267b8 daemon: epoll: listen=8 active_threads=0 tvp=zero
5d8267b8 >>> slap_listener(ldap:///)
5d8267b8 daemon: listen=7, new connection on 12
5d8267b8 daemon: added 12r (active) listener=(nil)
5d8267b8 conn=1000 fd=12 ACCEPT from IP=192.168.2.60:39984 (IP=0.0.0.0:389)
5d8267b8 daemon: activity on 2 descriptors
5d8267b8 daemon: activity on: 12r
5d8267b8 daemon: read active on 12
5d8267b8 daemon: epoll: listen=7 active_threads=0 tvp=zero
5d8267b8 daemon: epoll: listen=8 active_threads=0 tvp=zero
5d8267b8 connection_get(12)
5d8267b8 connection_get(12): got connid=1000
5d8267b8 connection_read(12): checking for input on id=1000
ber_get_next
ldap_read: want=8, got=8
0000: 30 27 02 01 01 60 22 02 0'...`".
ldap_read: want=33, got=33
0000: 01 03 04 09 63 6e 3d 63 6f 6e 66 69 67 80 12 62 ....cn=config..b
0010: 6f 73 74 6f 6e 2d 65 6e 67 69 6e 65 65 72 69 6e
0020: 67 g
ber_get_next: tag 0x30 len 39 contents:
ber_dump: buf=0x7f21bc001e00 ptr=0x7f21bc001e00 end=0x7f21bc001e27 len=39
0000: 02 01 01 60 22 02 01 03 04 09 63 6e 3d 63 6f 6e ...`".....cn=con
0010: 66 69 67 80 12 62 6f 73 74 6f 6e 2d 65 6e 67 69 fig..
0020: 6e 65 65 72 69 6e 67 neering
5d8267b8 op tag 0x60, time 1568827320
ber_get_next
ldap_read: want=8 error=Resource temporarily unavailable
5d8267b8 conn=1000 op=0 do_bind
ber_scanf fmt ({imt) ber:
ber_dump: buf=0x7f21bc001e00 ptr=0x7f21bc001e03 end=0x7f21bc001e27 len=36
0000: 60 22 02 01 03 04 09 63 6e 3d 63 6f 6e 66 69 67 `".....cn=config
0010: 80 12 62 6f 73 74 6f 6e 2d 65 6e 67 69 6e 65 65 .
0020: 72 69 6e 67 ring
ber_scanf fmt (m}) ber:
ber_dump: buf=0x7f21bc001e00 ptr=0x7f21bc001e13 end=0x7f21bc001e27 len=20
0000: 00 12 62 6f 73 74 6f 6e 2d 65 6e 67 69 6e 65 65 .
0010: 72 69 6e 67 ring
5d8267b8 >>> dnPrettyNormal: <cn=config>
=> ldap_bv2dn(cn=config,0)
<= ldap_bv2dn(cn=config)=0
=> ldap_dn2bv(272)
<= ldap_dn2bv(cn=config)=0
=> ldap_dn2bv(272)
<= ldap_dn2bv(cn=config)=0
5d8267b8 <<< dnPrettyNormal: <cn=config>, <cn=config>
5d8267b8 conn=1000 op=0 BIND dn="cn=config" method=128
5d8267b8 do_bind: version=3 dn="cn=config" method=128
5d8267b8 send_ldap_result: conn=1000 op=0 p=3
5d8267b8 send_ldap_result: err=49 matched="" text=""
5d8267b8 send_ldap_response: msgid=1 tag=97 err=49
ber_flush2: 14 bytes to sd 12
0000: 30 0c 02 01 01 61 07 0a 01 31 04 00 04 00 0....a...1....
ldap_write: want=14, written=14
0000: 30 0c 02 01 01 61 07 0a 01 31 04 00 04 00 0....a...1....
5d8267b8 conn=1000 op=0 RESULT tag=97 err=49 text=
5d8267b8 daemon: activity on 1 descriptor
5d8267b8 daemon: activity on:
5d8267b8 daemon: epoll: listen=7 active_threads=0 tvp=zero
5d8267b8 daemon: epoll: listen=8 active_threads=0 tvp=zero
5d8267b8 daemon: activity on 1 descriptor
5d8267b8 daemon: activity on: 12r
5d8267b8 daemon: read active on 12
5d8267b8 daemon: epoll: listen=7 active_threads=0 tvp=zero
5d8267b8 daemon: epoll: listen=8 active_threads=0 tvp=zero
5d8267b8 connection_get(12)
5d8267b8 connection_get(12): got connid=1000
5d8267b8 connection_read(12): checking for input on id=1000
ber_get_next
ldap_read: want=8, got=7
0000: 30 05 02 01 02 42 00 0....B.
ber_get_next: tag 0x30 len 5 contents:
ber_dump: buf=0x7f21bc000a80 ptr=0x7f21bc000a80 end=0x7f21bc000a85 len=5
0000: 02 01 02 42 00 ...B.
5d8267b8 op tag 0x42, time 1568827320
ber_get_next
ldap_read: want=8, got=0
5d8267b8 ber_get_next on fd 12 failed errno=0 (Success)
5d8267b8 connection_read(12): input error=-2 id=1000, closing.
5d8267b8 connection_closing: readying conn=1000 sd=12 for close
5d8267b8 connection_close: deferring conn=1000 sd=12
5d8267b8 conn=1000 op=1 do_unbind
5d8267b8 conn=1000 op=1 UNBIND
5d8267b8 connection_resched: attempting closing conn=1000 sd=12
5d8267b8 connection_close: conn=1000 sd=12
5d8267b8 daemon: removing 12
5d8267b8 conn=1000 fd=12 closed
5d8267b8 daemon: activity on 1 descriptor
5d8267b8 daemon: activity on:
5d8267b8 daemon: epoll: listen=7 active_threads=0 tvp=zero
5d8267b8 daemon: epoll: listen=8 active_threads=0 tvp=zero