Translations by Alexandre Niset

The output above is the current configuration options for the <emphasis>cn=config</emphasis> backend database. Your output may be vary.

The following is an example of a <emphasis>Single-Master</emphasis> configuration. In this configuration one OpenLDAP server is configured as a <emphasis>provider</emphasis> and another as a <emphasis>consumer</emphasis>.

First, configure the provider server. Copy the following to a file named <filename>provider_sync.ldif</filename>:

# Add indexes to the frontend db. dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcDbIndex olcDbIndex: entryCSN eq - add: olcDbIndex olcDbIndex: entryUUID eq #Load the syncprov and accesslog modules. dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov - add: olcModuleLoad olcModuleLoad: accesslog # Accesslog database definitions dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=accesslog olcRootDN: cn=admin,dc=example,dc=com olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart # Accesslog db syncprov. dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE # syncrepl Provider for primary db dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpNoPresent: TRUE # accesslog overlay definitions for primary db dn: olcOverlay=accesslog,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE # scan the accesslog DB every day, and purge entries older than 7 days olcAccessLogPurge: 07+00:00 01+00:00

The <application>AppArmor</application> profile for <application>slapd</application> will need to be adjusted for the accesslog database location. Edit <filename>/etc/apparmor.d/usr.sbin.slapd</filename> adding:

Then create the directory, reload the <application>apparmor</application> profile, and copy the <filename>DB_CONFIG</filename> file:

sudo -u openldap cp /var/lib/ldap/DB_CONFIG /var/lib/ldap/accesslog/

Using the <emphasis>-u openldap</emphasis> option with the <application>sudo</application> commands above removes the need to adjust permissions for the new directory later.

Edit the file and change the <emphasis>olcRootDN</emphasis> to match your directory:

Next, add the LDIF file using the <application>ldapadd</application> utility:

The <emphasis>Provider</emphasis> server is now configured, and it is time to configure a <emphasis>Consumer</emphasis> server.

Consumer Configuration

On the <emphasis>Consumer</emphasis> server configure it the same as the <emphasis>Provider</emphasis> except for the <emphasis>Syncrepl</emphasis> configuration steps.

Add the additional schema files:

Also, create, or copy from the provider server, the <filename>backend.example.com.ldif</filename>

# Load dynamic backend modules dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/ldap olcModuleload: back_hdb # Database settings dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcSuffix: dc=example,dc=com olcDbDirectory: /var/lib/ldap olcRootDN: cn=admin,dc=example,dc=com olcRootPW: secret olcDbConfig: set_cachesize 0 2097152 0 olcDbConfig: set_lk_max_objects 1500 olcDbConfig: set_lk_max_locks 1500 olcDbConfig: set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcLastMod: TRUE olcDbCheckpoint: 512 30 olcAccess: to attrs=userPassword by dn="cn=admin,dc=example,dc=com" write by anonymous auth by self write by * none olcAccess: to attrs=shadowLastChange by self write by * read olcAccess: to dn.base="" by * read olcAccess: to * by dn="cn=admin,dc=example,dc=com" write by * read

And add the LDIF by entering:

Do the same with the <filename>frontend.example.com.ldif</filename> file listed above, and add it:

The two severs should now have the same configuration except for the <emphasis>Syncrepl</emphasis> options.

Now create a file named <filename>consumer_sync.ldif</filename> containing:

You will probably want to change the following attributes:

<emphasis>ldap01.example.com</emphasis> to your server's hostname.

credentials

searchbase

Add the LDIF file to the configuration tree:

The frontend database should now sync between servers. You can add additional servers using the steps above as the need arises.

To view the Access Control List (ACL) for the <emphasis>cn=config</emphasis> tree, use the <application>ldapsearch</application> utility:

sudo ldapsearch -c -Y EXTERNAL -H ldapi:/// -LLL -b cn=config olcDatabase=config olcAccess

SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: olcDatabase={0}config,cn=config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break

To see the ACL for the frontend tree enter:

sudo ldapsearch -c -Y EXTERNAL -H ldapi:/// -LLL -b cn=config olcDatabase={1}hdb olcAccess

The first step in the process is to obtain or create a <emphasis>certificate</emphasis>. Because <application>slapd</application> is compiled using the <application>gnutls</application> library, the <application>certtool</application> utility will be used to create certificates.

First, install <application>gnutls-bin</application> by entering the following in a terminal:

Next, create a private key for the <emphasis>Certificate Authority</emphasis> (CA):

Create a <filename>/etc/ssl/ca.info</filename> details file to self-sign the CA certificate containing:

Now create the self-signed CA certificate:

Make a private key for the server:

To sign the server's certificate with the CA, create the <filename>/etc/ssl/ldap01.info</filename> info file containing:

Create the server's certificate:

Adjust the <filename>ldap01_slapd_cert.pem</filename>, <filename>ldap01_slapd_key.pem</filename>, and <filename>cacert.pem</filename> names if yours are different.

Assuming you have followed the above instructions and created a CA certificate and server certificate on the <emphasis>Provider</emphasis> server. Follow the following instructions to create a certificate and key for the <emphasis>Consumer</emphasis> server.

Create a new key for the Consumer server:

Creating a new directory is not strictly necessary, but it will help keep things organized and make it easier to copy the files to the Consumer server.

Next, create an info file, <filename>ldap02.info</filename> for the Consumer server, changing the attributes to match your locality and server: