Re: slurpd replication problmes

[Oliver Liebel <oliver@itc.li>]

"TLS: unable to get peer certificate."
- check if your name resolution is working correct and 
if the cn in the user certificates are identical
to the fqhns of the hosts.

refereral chasing:
- check if you used the correct
fqhn in the referral object in the the dit of the master.
and it looks like you got no superior referral-statement in your
slaves slapd.conf.

overlay chain offers an easy way to setup automatic referral
chasing and id assertion to get a "writeable" slave or consumer.

anyway you should upgrade to the lastest 2.3.* version,
and compile it from the scratch, because the
openldap packages from most distributions are out of date
an compiled with unnecessary dependencies.

and think about changing your replication to syncrepl,
since slurpd is really outdated, and syncrepl is way more stable
and flexible.




Almir Karic schrieb:
> i'm trying to set up the repliacation with openldap 2.3 (using the one
> debian etch), when i add things to master everything is fine, it
> replicates it to slave just fine, on the other hand when i add things
> to slave it simply writes it to it's own tree.
>
>
> here is slapd.conf of the slave (stripped of any comments):
>
> include         /etc/ldap/schema/core.schema
> include         /etc/ldap/schema/cosine.schema
> include         /etc/ldap/schema/nis.schema
> include         /etc/ldap/schema/inetorgperson.schema
> pidfile         /var/run/slapd/slapd.pid
> argsfile        /var/run/slapd/slapd.args
> modulepath      /usr/lib/ldap
> moduleload      back_bdb
> sizelimit 500
> tool-threads 1
> backend         bdb
> checkpoint 512 30
> TLSCipherSuite HIGH:MEDIUM:+SSLv2
> TLSCACertificateFile /etc/ldap/cacert.pem
> TLSCertificateFile /etc/ldap/servercrt.pem
> TLSCertificateKeyFile /etc/ldap/serverkey.pem
> loglevel stats
> database        bdb
> suffix          "dc=kiberpipa,dc=org"
> directory       "/var/lib/ldap"
> dbconfig set_cachesize 0 2097152 0
> dbconfig set_lk_max_objects 1500
> dbconfig set_lk_max_locks 1500
> dbconfig set_lk_max_lockers 1500
> index           objectClass eq
> lastmod         on
> access to attrs=userPassword,shadowLastChange
>         by dn="cn=admin,dc=kiberpipa,dc=org" write
>         by anonymous auth
>         by self write
>         by * none
> access to dn.base="" by * read
> access to *
>         by dn="cn=admin,dc=kiberpipa,dc=org" write
>         by * read
> updatedn        "cn=admin,dc=kiberpipa,dc=org"
> updateref       "ldaps://chat.kiberpipa.org:636"
>
>
>
> with this command "ldapadd -d 65535 -WxD
> 'cn=admin,dc=kiberpipa,dc=org' -f /tmp/b00" (on slave) i'm getting
> http://static.kiberpipa.org/~redduck666/local_adding.txt with
> "ldapadd -d 65535 -WxD 'cn=admin,dc=kiberpipa,dc=org' -f /tmp/b00 -H
> ldaps://chat.kiberpipa.org:636" i get
> http://static.kiberpipa.org/~redduck666/add_to_master.txt (passing it
> the same password they write to
>
>
> i have seen the certificate error there, if i change the ldap.conf on
> slave to point to ldap:// instead of ldaps:// that error goes away,
> however it still doesn't touch master.
>
>
> i also read i really shouldn't set updatedn to be the same as rootdn,
> well, tried changing it and granting full priviledges to the newly
> created account, no difference
>
>
> any pointers appreciated :-)
>
>
>   

____________
Virus checked by G DATA AntiVirusKit
Version: AVK 18.3959 from 30.05.2008
Virus news: www.antiviruslab.com