Re: fresh (distro's) installation and cn=config password

["Ralf Mattes" <rm@mh-freiburg.de>]

Am Montag, 23. Januar 2017 17:59 CET, lejeczek <peljasz@yahoo.co.uk> schrieb:

> hi everybody,
> this must be one of the most ancient questions - but
> browsing (centos') local docs reveal nothing.
> I'd imagine passwords is that first & most important thing
> everybody does to make sure slapd is secured, something like
> "mysql_secure_installation"

No, why? There's a multitude of ways to restrict access to the server, password based
access is just one of them.

> I'm trying to do something I'd think is simple and should
> just work, but, I'm wrong, so I do:
>
> slapadd -v -n0 <<EOL
> dn: olcDatabase={0}config,cn=config
> objectClass: olcDatabaseConfig
> olcDatabase: {0}config


What does this have to do with setting up passwords?
This looks like you are trying to bootstrap a server installation ex nihilo.
You'd need quite a bit more than "browsing (centos') local docs" to do this.

>
> olcRootDN: cn=admin,cn=config
> olcRootPW:: exxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
>
> EOL
>
> and I get in return:
> slapadd: could not add entry
> dn="olcDatabase={0}config,cn=config" (line=1): autocreation 
> of "olcDatabase={-1}frontend" failed

That error is pretty clear, isn't it? You seem to have forgotten to add a frontend database.
Do yourself a favour and have a look at the distributions bootstrap ldif.

> So that question - how does one secure ldap installation?

This has nothig whatsoever todo with "secire ldap installation"

> But I'd insist on not referring something like "slaptest and
> convert old school to ..." or .. edit config file(s)

This is borderline rude ....

> What I think is - I have a clean installation which is
> configured in probably best possible way but missing is:

Looking at your error output it really does not at all look like you have
a "clean installation". It looks more like a steaming pile of trial-and-error
installation leftovers.
On a clean installation you'd just need to set the olcRootPW attribute of
the olcDatabase={0}config,cn=config entry (iff you really insist on using
password based access and not the way more flexible ACL based security).

 HTH Ralf Mattes



> olcRootDN, olcRootPW
> How to use slapadd for it? Is slapadd not the right tool for
> this?
>
> many thanks,
> L.
>