[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
slapd replication fails
hiÂÂ
I can't get the replication in the slave server...I did "slapcat -v -l
LDAP-transfer-LDIF.txt" in the master and "slapadd -v -l
LDAP-transfer-LDIF.txt" in the slave, i started the master and later de
slave server...i added an user in the master but it didn't replicate it
to slave. I started from the begining and i did the same and "scp
-r /var/lib/ldap slave_server:/var/lib" and it fail again...i don know
what to do..., my conf files are:
slapd.conf from master:
# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.
#######################################################################
# Global Directives:
# Features to permit
#allow bind_v2
# Schema and objectClass definitions
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/misc.schema
include /etc/ldap/schema/inetorgperson.schema
include /etc/ldap/schema/openldap.schema
include /etc/ldap/schema/samba.schema
#include /etc/ldap/schema/autofs.schema
#include /etc/ldap/schema/krb5-kdc.schema
#include /etc/ldap/schema/unixtng.schema
#include /etc/ldap/schema/krb5-kdc.schema
# Schema check allows for forcing entries to
# match schemas for their objectClasses's
schemacheck on
# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile /var/run/slapd/slapd.pid
# List of arguments that were passed to the server
argsfile /var/run/slapd.args
# Read slapd.conf(5) for possible values
loglevel 0
# Where the dynamically loaded modules are stored
modulepath /usr/lib/ldap
moduleload back_ldbm
sasl-realm IRONMAN.ES
sasl-host shogun.ironman.es
#################TLS/SSL####################
# Certificado firmado de una entidad certificadora y
# el certificado del servidor
TLSCipherSuite HIGH:MEDIUM:+SSLv2
TLSCertificateFile /etc/ldap/ssl/server.pem
TLSCertificateFile /etc/ldap/ssl/server.pem
TLSCertificateKeyFile /etc/ldap/ssl/server.pem
# Si desea que el cliente necesite autentificaciï,
# descomente la siguiente lïea
#TLSVerifyClient demand
# ... si no, descomente esta otra
TLSVerifyClient never
#######################################################################
# Specific Backend Directives for ldbm:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend ldbm
#######################################################################
# Specific Backend Directives for 'other':
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
#backend <other>
#######################################################################
# Specific Directives for database #1, of type ldbm:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database ldbm
# The base of your directory in database #1
suffix "dc=ironman,dc=es"
rootdn "cn=admin,dc=ironman,dc=es"
rootpw secret
#########REPLICA#############
replica host=shinobi.ironman.es:389
#replica uri=ldap://shinobi.ironman.es:636
binddn="cn=replicauser,dc=ironman,dc=es"
bindmethod=simple
credentials=replica
replogfile /var/lib/ldap/openldap-master-replog
##############################
# Where the database file are physically stored for database #1
directory "/var/lib/ldap"
# Indexing options for database #1
# Requerido por OpenLDAP
index objectclass eq
index default sub
index cn pres,sub,eq
index sn pres,sub,eq
# Requerido para soportar pdb_getsampwnam
index uid pres,sub,eq
# Requerido para soportar pdb_getsambapwrid()
index displayName pres,sub,eq
# Descomente las siguientes lïeas si estïalmacenando entradas
# posixAccount y posixGroup en el directorio
index uidNumber eq
index gidNumber eq
index memberUid eq
# Samba 3.*
index sambaSID eq
index sambaPrimaryGroupSID eq
index sambaDomainName eq
# Include the access lists
include /etc/ldap/slapd.access
# Save the time that the entry gets modified, for database #1
lastmod on
# Where to store the replica logs for database #1
# replogfile /var/lib/ldap/replog
# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
#access to attrs=userPassword
# by dn="cn=admin,dc=ironman,dc=es" write
# by anonymous auth
# by self write
# by * none
# Ensure read access to the base for things like
# supportedSASLMechanisms. Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work
# happily.
#access to dn.base="" by * read
# The admin dn has full write access, everyone else
# can read everything.
#access to *
# by dn="cn=admin,dc=ironman,dc=es" write
# by * read
# For Netscape Roaming support, each user gets a roaming
# profile for which they have write access to
#access to dn=".*,ou=Roaming,o=morsnet"
# by dn="cn=admin,dc=ironman,dc=es" write
# by dnattr=owner write
#######################################################################
# Specific Directives for database #2, of type 'other' (can be ldbm
too):
# Database specific directives apply to this databasse until another
# 'database' directive occurs
#database <other>
# The base of your directory for database #2
#suffix "dc=debian,dc=org"
slapd.conf from slave:
# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.
#######################################################################
# Global Directives:
# Features to permit
#allow bind_v2
# Schema and objectClass definitions
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/misc.schema
include /etc/ldap/schema/inetorgperson.schema
include /etc/ldap/schema/openldap.schema
include /etc/ldap/schema/samba.schema
#include /etc/ldap/schema/autofs.schema
#include /etc/ldap/schema/krb5-kdc.schema
#include /etc/ldap/schema/unixtng.schema
#include /etc/ldap/schema/krb5-kdc.schema
# Schema check allows for forcing entries to
# match schemas for their objectClasses's
schemacheck on
# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile /var/run/slapd/slapd.pid
# List of arguments that were passed to the server
argsfile /var/run/slapd.args
# Read slapd.conf(5) for possible values
loglevel 0
# Where the dynamically loaded modules are stored
modulepath /usr/lib/ldap
moduleload back_ldbm
sasl-realm IRONMAN.ES
sasl-host shogun.ironman.es
#################TLS/SSL####################
# Certificado firmado de una entidad certificadora y
# el certificado del servidor
TLSCipherSuite HIGH:MEDIUM:+SSLv2
TLSCertificateFile /etc/ldap/ssl/server.pem
TLSCertificateFile /etc/ldap/ssl/server.pem
TLSCertificateKeyFile /etc/ldap/ssl/server.pem
# Si desea que el cliente necesite autentificaciï,
# descomente la siguiente lïea
#TLSVerifyClient demand
# ... si no, descomente esta otra
TLSVerifyClient never
#######################################################################
# Specific Backend Directives for ldbm:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend ldbm
#######################################################################
# Specific Backend Directives for 'other':
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
#backend <other>
#######################################################################
# Specific Directives for database #1, of type ldbm:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database ldbm
# The base of your directory in database #1
suffix "dc=ironman,dc=es"
rootdn "cn=admin,dc=ironman,dc=es"
rootpw secret
#########REPLICA#############
updatedn "cn=replicauser,dc=ironman,dc=es"
updateref ldap://shogun.ironman.es:389
##############################
# Where the database file are physically stored for database #1
directory "/var/lib/ldap"
# Indexing options for database #1
# Requerido por OpenLDAP
index objectclass eq
index default sub
index cn pres,sub,eq
index sn pres,sub,eq
# Requerido para soportar pdb_getsampwnam
index uid pres,sub,eq
# Requerido para soportar pdb_getsambapwrid()
index displayName pres,sub,eq
# Descomente las siguientes lïeas si estïalmacenando entradas
# posixAccount y posixGroup en el directorio
index uidNumber eq
index gidNumber eq
index memberUid eq
# Samba 3.*
index sambaSID eq
index sambaPrimaryGroupSID eq
index sambaDomainName eq
# Include the access lists
include /etc/ldap/slapd.access
# Save the time that the entry gets modified, for database #1
lastmod on
# Where to store the replica logs for database #1
# replogfile /var/lib/ldap/replog
# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
#access to attrs=userPassword
# by dn="cn=admin,dc=ironman,dc=es" write
# by anonymous auth
# by self write
# by * none
# Ensure read access to the base for things like
# supportedSASLMechanisms. Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work
# happily.
#access to dn.base="" by * read
# The admin dn has full write access, everyone else
# can read everything.
#access to *
# by dn="cn=admin,dc=ironman,dc=es" write
# by * read
# For Netscape Roaming support, each user gets a roaming
# profile for which they have write access to
#access to dn=".*,ou=Roaming,o=morsnet"
# by dn="cn=admin,dc=ironman,dc=es" write
# by dnattr=owner write
#######################################################################
# Specific Directives for database #2, of type 'other' (can be ldbm
too):
# Database specific directives apply to this databasse until another
# 'database' directive occurs
#database <other>
# The base of your directory for database #2
#suffix "dc=debian,dc=org"
slapd.access access list:
access to * by * write
# These access lines apply to database #1 only
access to attrs=userPassword
by dn="cn=admin,dc=atc,dc=unican,dc=es" write
by anonymous auth
by self write
by * none
# allow the "ldap admin dn" access, but deny everyone else
# (Samba related)
access to attrs=sambaLMPassword,sambaNTPassword
by dn="cn=admin,dc=ironman,dc=es" write
by self write
by * auth
by * none
# For Netscape Roaming support, each user gets a roaming profile for
# which they have write access to
#access to dn=".*,ou=Roaming,dc=.*"
# by dn="<YOUR ADMIN DN>" write
# by dn="uid=ldapadm.+\+realm=<YOUR KERBEROS REALM>" write
# by dnattr=owner write
# by * none
# Some things should be editable by the owner, and viewable by anyone...
#access to attrs=cn,givenName,sn,krbName,krb5PrincipalName,gecos
# by dn="cn=admin,dc=ironman,dc=es" write
# by dn="uid=ldapadm.+\+realm=IRONMAN.ES" write
# by self write
# by users read
#access to attrs=loginShell,gecos
# by dn="cn=admin,dc=ironman,dc=es" write
# by dn="uid=ldapadm.+\+realm=IRONMAN.ES" write
# by self write
# by * read
# Since we're using {KERBEROS}<PRINCIPAL>, we can't allow the user
# to change the password. They have to use the Kerberos 'kpasswd' to
# do this... But the admin can change (if need be).
# Please see krb5 userPassword attribute
#access to attrs=userPassword
# by dn="cn=admin,dc=ironman,dc=es" write
# by dn="uid=ldapadm.+\+realm=IRONMAN.ES" write
# by anonymous auth
# by * none
# The mail and mailAlternateAddress should only be readable if you
# authenticate!
#access to attrs=mail,mailAlternateAddress,mailHost
# by dn="<YOUR ADMIN DN>" write
# by dn="uid=ldapadm.+\+realm=<YOUR KERBEROS REALM>" write
# by users read
# by * none
# Should not be readable to anyone, and only editable by admin...
#access to attr=mailQuota,trustModel,accessTo
# by dn="<YOUR ADMIN DN>" write
# by dn="uid=ldapadm.+\+realm=<YOUR KERBEROS REALM>" write
# by self read
# by * none
# The admin dn has full write access
#access to *
# by dn="cn=admin,dc=ironman,dc=es" write
# by dn="uid=ldapadm.+\+realm=IRONMAN.ES" write
# by * read
access to dn.base=""
by * read
access to dn.base="cn=monitor"
by * read
access to *
by dn.base="cn=replicauser,dc=ironman,dc=es" write
by * break