doc:appunti:linux:sa:sldap_2_5
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionLast revisionBoth sides next revision | ||
doc:appunti:linux:sa:sldap_2_5 [2023/12/02 11:10] – [(Re)installation from scratch] niccolo | doc:appunti:linux:sa:sldap_2_5 [2023/12/02 12:29] – [Enable SSL] niccolo | ||
---|---|---|---|
Line 15: | Line 15: | ||
FIXME La **[[https:// | FIXME La **[[https:// | ||
- | ===== Restore from the backup file ===== | + | Per ripristinare il servizio si sono eseguite ex-nove tutte le operazoni necessarie, in particolare: |
- | The upgrade process created a backup of the existing LDAP database into the **/ | + | |
- | + | | |
- | Beware that the restore will be not a perfect copy of the previous database. Several items must be purged from the backup file before feeding it back to the LDAP server because they are not allowed to be set directly. They are: | + | * Creata la organizationalUnit |
- | + | * Creata la inetOrgPerson **cn=guest**. | |
- | * structuralObjectClass | + | * Caricate tutte le entry objectClass |
- | | + | |
- | | + | |
- | | + | |
- | | + | |
- | * modifiersName | + | |
- | | + | |
- | + | ||
- | Once a snippet of the file is ready, you can feed it to the slapd service with the following command: | + | |
- | + | ||
- | < | + | |
- | ldapadd -x -W -D "cn=admin, | + | |
- | </ | + | |
- | + | ||
- | ==== Create the Addressbook organizationalUnit ==== | + | |
- | + | ||
- | < | + | |
- | dn: ou=Addressbook, | + | |
- | objectClass: top | + | |
- | objectClass: | + | |
- | ou: Addressbook | + | |
- | </ | + | |
- | + | ||
- | ==== Create the Addressbook guest person ==== | + | |
- | + | ||
- | < | + | |
- | dn: cn=guest, | + | |
- | objectclass: | + | |
- | objectclass: | + | |
- | objectclass: | + | |
- | objectclass: | + | |
- | sn: guest | + | |
- | cn: guest | + | |
- | userPassword: | + | |
- | </ | + | |
- | + | ||
- | + | ||
- | ==== Load all the mozillaAbPersonAlpha | + | |
- | + | ||
- | Each mozillaAbPersonAlpha item is somethink like this, after removing the unallowed tags: | + | |
- | + | ||
- | < | + | |
- | dn: cn=Niccolo Rigacci, | + | |
- | objectClass: | + | |
- | objectClass: | + | |
- | objectClass: | + | |
- | objectClass: | + | |
- | objectClass: | + | |
- | cn: Niccolo Rigacci | + | |
- | givenName: Niccolo | + | |
- | sn: Rigacci | + | |
- | mail: niccolo@rigacci.org | + | |
- | telephoneNumber: | + | |
- | mobile: 327-5556667 | + | |
- | facsimileTelephoneNumber: | + | |
- | homePhone: 055-8979395 | + | |
- | mozillaWorkUrl: | + | |
- | </ | + | |
===== (Re)installation from scratch ===== | ===== (Re)installation from scratch ===== | ||
Line 99: | Line 42: | ||
Reading the dump of database #0, you can see that the **cn=config** database has the **olcRootDN: | Reading the dump of database #0, you can see that the **cn=config** database has the **olcRootDN: | ||
+ | |||
+ | ===== Enable SSL ===== | ||
+ | |||
+ | Create a self signed certificate or get it from some provider, like **[[https:// | ||
+ | |||
+ | Create the following file **config-ssl.ldif**: | ||
+ | |||
+ | < | ||
+ | dn: cn=config | ||
+ | changetype: modify | ||
+ | replace: olcTLSCertificateFile | ||
+ | olcTLSCertificateFile: | ||
+ | - | ||
+ | replace: olcTLSCertificateKeyFile | ||
+ | olcTLSCertificateKeyFile: | ||
+ | - | ||
+ | replace: olcTLSCACertificatePath | ||
+ | olcTLSCACertificatePath: | ||
+ | </ | ||
+ | |||
+ | and load it into the slapd 2.5 configuration: | ||
+ | |||
+ | < | ||
+ | ldapmodify -Y EXTERNAL -H ldapi:/// -f config-ssl.ldif | ||
+ | </ | ||
===== Adding a second (new) database ===== | ===== Adding a second (new) database ===== | ||
Line 108: | Line 76: | ||
Using '' | Using '' | ||
- | Here it is the example of an LDIF file to create a new DIT database, supposed to contain an addressbook. We will use the MDB backend and the ''/ | + | Here it is the example of an LDIF file to create a new DIT database, supposed to contain an addressbook. We will use the MDB backend and the ''/ |
The file was named **abook-db.ldif**: | The file was named **abook-db.ldif**: | ||
Line 130: | Line 98: | ||
</ | </ | ||
- | Notice we will grant read-only privileges to an item **cn=guest** in the same LDAP tree. Before creating the database we create the destination directory and assign the required permissions: | + | Notice we will grant read-only privileges to an item **cn=guest** in the same LDAP tree; that item will be added into the database later. Before creating the database we create the destination directory and assign the required permissions: |
< | < | ||
Line 216: | Line 184: | ||
</ | </ | ||
+ | ===== Restore from the backup file ===== | ||
+ | |||
+ | The upgrade process created a backup of the existing LDAP database into the **/ | ||
+ | |||
+ | Beware that the restore will be not a perfect copy of the previous database. Several tags must be purged from the backup file before feeding it back to the LDAP server because they are not allowed to be set directly. They are: | ||
+ | |||
+ | * structuralObjectClass | ||
+ | * entryUUID | ||
+ | * creatorsName | ||
+ | * createTimestamp | ||
+ | * entryCSN | ||
+ | * modifiersName | ||
+ | * modifyTimestamp | ||
+ | |||
+ | Once a snippet of the file is ready, you can feed it to the slapd service with the following command: | ||
+ | |||
+ | < | ||
+ | ldapadd -x -W -D " | ||
+ | </ | ||
+ | |||
+ | In the following three paragraphs we will see what is needed for a full restore. | ||
+ | |||
+ | |||
+ | ==== Create the Addressbook organizationalUnit ==== | ||
+ | |||
+ | < | ||
+ | dn: ou=Addressbook, | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | ou: Addressbook | ||
+ | </ | ||
+ | |||
+ | ==== Create the Addressbook guest person ==== | ||
+ | |||
+ | < | ||
+ | dn: cn=guest, | ||
+ | objectclass: | ||
+ | objectclass: | ||
+ | objectclass: | ||
+ | objectclass: | ||
+ | sn: guest | ||
+ | cn: guest | ||
+ | userPassword: | ||
+ | </ | ||
+ | |||
+ | ==== Load all the mozillaAbPersonAlpha entries ==== | ||
+ | |||
+ | Each mozillaAbPersonAlpha item is somethink like this, after removing the unallowed tags: | ||
+ | |||
+ | < | ||
+ | dn: cn=Niccolo Rigacci, | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | cn: Niccolo Rigacci | ||
+ | givenName: Niccolo | ||
+ | sn: Rigacci | ||
+ | mail: niccolo@rigacci.org | ||
+ | telephoneNumber: | ||
+ | mobile: 327-5556667 | ||
+ | facsimileTelephoneNumber: | ||
+ | homePhone: 055-8979395 | ||
+ | mozillaWorkUrl: | ||
+ | </ | ||
+ | |||
+ | ==== Testing an ldapsearch ==== | ||
+ | |||
+ | Finally you can test if the LDAP database is working doing a full search with **ldapsearch**: | ||
+ | |||
+ | <code bash> | ||
+ | ldapsearch -W \ | ||
+ | -H ldap:// | ||
+ | -D " | ||
+ | -b ' | ||
+ | </ | ||
+ | |||
+ | The **ldap** protocol is on port **389/ | ||
===== Web References ===== | ===== Web References ===== | ||
doc/appunti/linux/sa/sldap_2_5.txt · Last modified: 2023/12/02 12:31 by niccolo