doc:appunti:linux:sa:sldap_2_5
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionLast revisionBoth sides next revision | ||
doc:appunti:linux:sa:sldap_2_5 [2023/12/02 10:29] – [Restore from the backup file] niccolo | doc:appunti:linux:sa:sldap_2_5 [2023/12/02 12:29] – [Enable SSL] niccolo | ||
---|---|---|---|
Line 15: | Line 15: | ||
FIXME La **[[https:// | FIXME La **[[https:// | ||
- | ===== Restore from the backup file ===== | + | Per ripristinare il servizio si sono eseguite ex-nove tutte le operazoni necessarie, in particolare: |
- | The upgrade process created a backup of the existing LDAP database into the **/ | + | |
- | + | | |
- | Beware that the restore will be not a perfect copy of the previous database. Several items must be purged from the backup file before feeding it back to the LDAP server because they are not allowed to be set directly. They are: | + | * Creata la organizationalUnit |
- | + | * Creata la inetOrgPerson **cn=guest**. | |
- | * structuralObjectClass | + | * Caricate tutte le entry objectClass |
- | | + | |
- | | + | |
- | | + | |
- | | + | |
- | * modifiersName | + | |
- | | + | |
- | + | ||
- | Once a snippet of the file is ready, you can feed it to the slapd service with the following command: | + | |
- | + | ||
- | < | + | |
- | ldapadd -x -W -D "cn=admin, | + | |
- | </ | + | |
- | + | ||
- | ==== Create the Addressbook organizationalUnit ==== | + | |
- | + | ||
- | < | + | |
- | dn: ou=Addressbook, | + | |
- | objectClass: | + | |
- | objectClass: | + | |
- | ou: Addressbook | + | |
- | </ | + | |
- | + | ||
- | ==== Create the Addressbook | + | |
- | + | ||
- | ==== Load all the mozillaAbPersonAlpha entries ==== | + | |
- | + | ||
- | To restore all the address book entries (the '' | + | |
- | + | ||
- | | + | |
- | | + | |
- | * creatorsName | + | |
- | | + | |
- | | + | |
- | | + | |
- | | + | |
===== (Re)installation from scratch ===== | ===== (Re)installation from scratch ===== | ||
- | By installing the **slapd** package from scratch, an empty LDAP database is created using the **dn** (// | + | By installing the **slapd** package from scratch, an empty LDAP database is created using the **dn** (// |
The LDAP database is numbered as **#1**; initially it contains only the root objext **objectClass: | The LDAP database is numbered as **#1**; initially it contains only the root objext **objectClass: | ||
Line 77: | Line 42: | ||
Reading the dump of database #0, you can see that the **cn=config** database has the **olcRootDN: | Reading the dump of database #0, you can see that the **cn=config** database has the **olcRootDN: | ||
+ | |||
+ | ===== Enable SSL ===== | ||
+ | |||
+ | Create a self signed certificate or get it from some provider, like **[[https:// | ||
+ | |||
+ | Create the following file **config-ssl.ldif**: | ||
+ | |||
+ | < | ||
+ | dn: cn=config | ||
+ | changetype: modify | ||
+ | replace: olcTLSCertificateFile | ||
+ | olcTLSCertificateFile: | ||
+ | - | ||
+ | replace: olcTLSCertificateKeyFile | ||
+ | olcTLSCertificateKeyFile: | ||
+ | - | ||
+ | replace: olcTLSCACertificatePath | ||
+ | olcTLSCACertificatePath: | ||
+ | </ | ||
+ | |||
+ | and load it into the slapd 2.5 configuration: | ||
+ | |||
+ | < | ||
+ | ldapmodify -Y EXTERNAL -H ldapi:/// -f config-ssl.ldif | ||
+ | </ | ||
===== Adding a second (new) database ===== | ===== Adding a second (new) database ===== | ||
- | Suppose you want to create a new LDAP database, beside the **#0** (the '' | + | Suppose you want to create a new LDAP database, beside the **#0** (the '' |
To add a new LDAP database you will use the **ldapadd** command. You may find several tutorials on the net that instruct on how to use the **slapadd** command, but beware that '' | To add a new LDAP database you will use the **ldapadd** command. You may find several tutorials on the net that instruct on how to use the **slapadd** command, but beware that '' | ||
Line 86: | Line 76: | ||
Using '' | Using '' | ||
- | Here it is the example of an LDIF file to create a new DIT database, supposed to contain an addressbook. We will use the MDB backend and the ''/ | + | Here it is the example of an LDIF file to create a new DIT database, supposed to contain an addressbook. We will use the MDB backend and the ''/ |
The file was named **abook-db.ldif**: | The file was named **abook-db.ldif**: | ||
Line 96: | Line 86: | ||
olcDatabase: | olcDatabase: | ||
olcDbDirectory: | olcDbDirectory: | ||
- | olcRootDN: cn=admin, | + | olcRootDN: cn=admin, |
olcRootPW: MySecret | olcRootPW: MySecret | ||
olcSizeLimit: | olcSizeLimit: | ||
olcDbMaxSize: | olcDbMaxSize: | ||
- | olcSuffix: ou=Addressbook, | + | olcSuffix: ou=Addressbook, |
olcDbIndex: objectClass eq | olcDbIndex: objectClass eq | ||
olcDbIndex: cn, | olcDbIndex: cn, | ||
- | olcAccess: to * by dn=" | + | olcAccess: to * by dn=" |
by anonymous auth | by anonymous auth | ||
- | by * read | + | by dn=" |
</ | </ | ||
- | Create | + | Notice we will grant read-only privileges to an item **cn=guest** in the same LDAP tree; that item will be added into the database later. Before creating the database we create |
< | < | ||
Line 194: | Line 184: | ||
</ | </ | ||
+ | ===== Restore from the backup file ===== | ||
+ | |||
+ | The upgrade process created a backup of the existing LDAP database into the **/ | ||
+ | |||
+ | Beware that the restore will be not a perfect copy of the previous database. Several tags must be purged from the backup file before feeding it back to the LDAP server because they are not allowed to be set directly. They are: | ||
+ | |||
+ | * structuralObjectClass | ||
+ | * entryUUID | ||
+ | * creatorsName | ||
+ | * createTimestamp | ||
+ | * entryCSN | ||
+ | * modifiersName | ||
+ | * modifyTimestamp | ||
+ | |||
+ | Once a snippet of the file is ready, you can feed it to the slapd service with the following command: | ||
+ | |||
+ | < | ||
+ | ldapadd -x -W -D " | ||
+ | </ | ||
+ | |||
+ | In the following three paragraphs we will see what is needed for a full restore. | ||
+ | |||
+ | |||
+ | ==== Create the Addressbook organizationalUnit ==== | ||
+ | |||
+ | < | ||
+ | dn: ou=Addressbook, | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | ou: Addressbook | ||
+ | </ | ||
+ | |||
+ | ==== Create the Addressbook guest person ==== | ||
+ | |||
+ | < | ||
+ | dn: cn=guest, | ||
+ | objectclass: | ||
+ | objectclass: | ||
+ | objectclass: | ||
+ | objectclass: | ||
+ | sn: guest | ||
+ | cn: guest | ||
+ | userPassword: | ||
+ | </ | ||
+ | |||
+ | ==== Load all the mozillaAbPersonAlpha entries ==== | ||
+ | |||
+ | Each mozillaAbPersonAlpha item is somethink like this, after removing the unallowed tags: | ||
+ | |||
+ | < | ||
+ | dn: cn=Niccolo Rigacci, | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | cn: Niccolo Rigacci | ||
+ | givenName: Niccolo | ||
+ | sn: Rigacci | ||
+ | mail: niccolo@rigacci.org | ||
+ | telephoneNumber: | ||
+ | mobile: 327-5556667 | ||
+ | facsimileTelephoneNumber: | ||
+ | homePhone: 055-8979395 | ||
+ | mozillaWorkUrl: | ||
+ | </ | ||
+ | |||
+ | ==== Testing an ldapsearch ==== | ||
+ | |||
+ | Finally you can test if the LDAP database is working doing a full search with **ldapsearch**: | ||
+ | |||
+ | <code bash> | ||
+ | ldapsearch -W \ | ||
+ | -H ldap:// | ||
+ | -D " | ||
+ | -b ' | ||
+ | </ | ||
+ | |||
+ | The **ldap** protocol is on port **389/ | ||
===== Web References ===== | ===== Web References ===== | ||
doc/appunti/linux/sa/sldap_2_5.txt · Last modified: 2023/12/02 12:31 by niccolo