LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
Reload this Page Unable to start slapd, syncrepl error
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 09-20-2011, 07:10 PM   #1
wills
LQ Newbie
 
Registered: Jun 2008
Posts: 28

Rep: Reputation: 0
Unable to start slapd, syncrepl error

Oh the wise and mighty of the openLDAP community,

I have an issue that I have not been able to understand. Partially because
I'm an enthusiast, not an expert in the domain. That being said, I've used
an openLDAP RPM compiled by one of the fellow *nix admins:
http://staff.telkomsa.net/packages - Yes, besides the security reasons I'm
desperate enough to try this. I'll eventually use the spec to compile my own
RPM.

I'm running CentOS 5.7 x86_64 with the latest packages. I was able to
successfully install and configure openLDAP but when I attempt to start it
with MIrrorMode, it will not start. I ran slaptest to figure out where it's
hanging up on:

[root@ldap1 ~]# slaptest2.4 -f /etc/openldap2.4/slapd.conf
/etc/openldap2.4/slapd.conf: line 207: rootDN must be defined before
syncrepl may be used
slaptest2.4: bad configuration file!

Any suggestions why it continues to complain about rootDN? I have it
specified and if slapd is going through the lines, it should have picked up
the rootdn before syncrepl. Thoughts?

Here is my slapd.conf:

Code:
include /usr/share/openldap2.4/schema/core.schema
include /usr/share/openldap2.4/schema/cosine.schema
include /usr/share/openldap2.4/schema/corba.schema
include /usr/share/openldap2.4/schema/inetorgperson.schema
include /usr/share/openldap2.4/schema/java.schema
include /usr/share/openldap2.4/schema/krb5-kdc.schema
include /usr/share/openldap2.4/schema/kerberosobject.schema
include /usr/share/openldap2.4/schema/misc.schema
include /usr/share/openldap2.4/schema/nis.schema
include /usr/share/openldap2.4/schema/openldap.schema
include /usr/share/openldap2.4/schema/autofs.schema
include /usr/share/openldap2.4/schema/samba.schema
include /usr/share/openldap2.4/schema/kolab.schema
include /usr/share/openldap2.4/schema/evolutionperson.schema
include /usr/share/openldap2.4/schema/calendar.schema
include /usr/share/openldap2.4/schema/sudo.schema
include /usr/share/openldap2.4/schema/dnszone.schema
include /usr/share/openldap2.4/schema/dhcp.schema

#include /usr/share/openldap2.4/schema/rfc822-MailMember.schema
#include /usr/share/openldap2.4/schema/pilot.schema
#include /usr/share/openldap2.4/schema/qmail.schema
#include /usr/share/openldap2.4/schema/mull.schema
#include /usr/share/openldap2.4/schema/netscape-profile.schema
#include /usr/share/openldap2.4/schema/trust.schema

include /etc/openldap2.4/schema/local.schema
include /etc/openldap2.4/slapd.access.conf

access to dn.subtree="dc=domain,dc=pvt"
by group="cn=Replicator,ou=Group,dc=domain,dc=pvt"
by users read
by anonymous read
pidfile /var/run/ldap2.4/slapd.pid
argsfile /var/run/ldap2.4/slapd.args

modulepath /usr/lib64/openldap2.4

# database backend modules available:
#moduleloadback_dnssrv.la
#moduleloadback_ldap.la
#moduleloadback_meta.la
moduleloadback_monitor.la
#moduleloadback_passwd.la
#moduleloadback_sql.la

# overlay modules available:
#moduleload accesslog.la
#moduleload denyop.la
#moduleload dyngroup.la
#moduleload dynlist.la
#moduleload glue.la
#moduleload lastmod.la
#moduleload pcache.la
#moduleload ppolicy.la
#moduleload refint.la
#moduleload retcode.la
#moduleload rwm.la
moduleload syncprov.la
#moduleload translucent.la
#moduleload unique.la

#contrib overlays
#moduleloadsmbk5pwd.so

# SASL config
#sasl-host ldap.domain.com

# To allow TLS-enabled connections, create /etc/ssl/openldap2.4/ldap.pem
# and uncomment the following lines.
#TLSRandFile/dev/random
#TLSCipherSuite HIGH:MEDIUM:+SSLv2
TLSCertificateFile/etc/pki/tls/private/ldap.pem
TLSCertificateKeyFile /etc/pki/tls/private/ldap.pem
#TLSCACertificatePath /etc/ssl/openldap2.4/
#TLSCACertificateFile/etc/ssl/cacert.pem
TLSCACertificateFile/etc/pki/tls/private/ldap.pem
#TLSVerifyClient never # ([never]|allow|try|demand)

# logging
#loglevel 256

#######################################################################
# database definitions
#######################################################################

database bdb
suffix "dc=domain,dc=pvt"
#suffix "o=My Organization Name,c=US"
rootdn "cn=Manager,dc=domain,dc=pvt"
#rootdn "cn=Manager,o=My Organization Name,c=US"

# Cleartext passwords, especially for the rootdn, should
# be avoided.See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw secret
# rootpw {crypt}ijFYNcSNctBYg
rootpw {SSHA}[NeeeNer NeeeNer NeeeNer]

# The database directory MUST exist prior to running slapd AND
# should only be accessable by the slapd/tools. Mode 700 recommended.
directory /var/lib/ldap2.4

# Tuning settings, please see the man page for slapd-bdb for more
information
# as well as the DB_CONFIG file in the database directory
# commented entries are at their defaults
# In-memory cache size in entries
#cachesize 1000
# Checkpoint the bdb database after 256kb of writes or 5 minutes have passed
# since the last checkpoint
checkpoint 256 5

# Indices to maintain
index objectClass eq

# persion-type searches
index cn,mail,surname,givenname
eq,subinitial

# nss_ldap exact searches:
index uidNumber,gidNumber,memberuid,member,uniqueMember eq
# username completion via nss_ldap needs uid indexed sub:
index uid
eq,subinitial

# samba:
index sambaSID,sambaDomainName,displayName eq

# autofs:
#index nisMapName eq

# bind sdb_ldap:
#index zoneName,relativeDomainName eq

# sudo
index sudoUser eq

# syncprov
#indexentryCSN,entryUUIDeq


limits group="cn=Replicator,ou=Group,dc=domain,dc=pvt"
size=unlimited
time=unlimited


database monitor

overlay syncprov
syncprov-checkpoint 10 1
syncprov-sessionlog 100

syncrepl rid=000
provider=ldap://ldap1.oak.domain.pvta
type=refreshAndPersist
interval=01:00:00:00
retry="5 5 300 +"
rootdn="dc=domain,dc=pvt"
attrs="*,+"
bindmethod=simple
binddn="cn=Manager,dc=domain,dc=pvt"
credentials=domain1

syncrepl rid=001
provider=ldap://ldap2.oak.domain.pvt
type=refreshAndPersist
interval=01:00:00:00
retry="5 5 300 +"
rootdn="dc=domain,dc=pvt"
attrs="*,+"
bindmethod=simple
binddn="cn=Manager,dc=domain,dc=pvt"
credentials=domain1

mirrormode TRUE
serverID 1
Last edited by wills; 09-20-2011 at 07:25 PM. Reason: encoding problem...
 
Old 09-21-2011, 12:54 PM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
well it complains because of the exact reasons it gives you. the rootDN doesn't go there. compare your config to an example:

http://www.fxp0.org.ua/2006/sep/22/l...sing-syncrepl/

syncrepl is a single command, you indent the options to keep it as a single option split over multiple lines, and rootdn is not a valid option for a syncrepl command.
 
Old 09-21-2011, 06:47 PM   #3
wills
LQ Newbie
 
Registered: Jun 2008
Posts: 28

Original Poster
Rep: Reputation: 0
Shoot, wrong config file. Sorry, I've gone through several iterations. That being said, I copied the syntax in your example, still no go:

Also, the tabs are replaced by **** for some reason. Ignore, the original doesn't have it.

Code:
include	/usr/share/openldap2.4/schema/core.schema
include	/usr/share/openldap2.4/schema/cosine.schema
include	/usr/share/openldap2.4/schema/corba.schema
include	/usr/share/openldap2.4/schema/inetorgperson.schema
include	/usr/share/openldap2.4/schema/java.schema
include	/usr/share/openldap2.4/schema/krb5-kdc.schema
include /usr/share/openldap2.4/schema/kerberosobject.schema
include	/usr/share/openldap2.4/schema/misc.schema
include	/usr/share/openldap2.4/schema/nis.schema
include	/usr/share/openldap2.4/schema/openldap.schema
include /usr/share/openldap2.4/schema/autofs.schema
include /usr/share/openldap2.4/schema/samba.schema
include /usr/share/openldap2.4/schema/kolab.schema
include /usr/share/openldap2.4/schema/evolutionperson.schema
include /usr/share/openldap2.4/schema/calendar.schema
include /usr/share/openldap2.4/schema/sudo.schema
include /usr/share/openldap2.4/schema/dnszone.schema
include /usr/share/openldap2.4/schema/dhcp.schema

#include /usr/share/openldap2.4/schema/rfc822-MailMember.schema
#include /usr/share/openldap2.4/schema/pilot.schema
#include /usr/share/openldap2.4/schema/qmail.schema
#include /usr/share/openldap2.4/schema/mull.schema
#include /usr/share/openldap2.4/schema/netscape-profile.schema
#include /usr/share/openldap2.4/schema/trust.schema

include	/etc/openldap2.4/schema/local.schema
include 	/etc/openldap2.4/slapd.access.conf

# Provide write access to replicators, and cover access to any other
# attributes (default anonymous read access may be undesirable)
access to dn.subtree="dc=domain,dc=com"
********by group="cn=Replicator,ou=Group,dc=domain,dc=com"
********by users read
********by anonymous read

pidfile		/var/run/ldap2.4/slapd.pid
argsfile	/var/run/ldap2.4/slapd.args
modulepath	/usr/lib64/openldap2.4

database config
#rootdn "cn=Manager,cn=config"
# use any of the supported password formats e.g. {SSHA} etc
# or plaintext as shown
rootpw config

# database backend modules available:
#moduleload******back_dnssrv.la
#moduleload******back_ldap.la
#moduleload******back_meta.la
moduleload******back_monitor.la
#moduleload******back_passwd.la
#moduleload******back_sql.la

# overlay modules available:
#moduleload**** accesslog.la
#moduleload**** denyop.la
#moduleload**** dyngroup.la
#moduleload**** dynlist.la
#moduleload**** glue.la
#moduleload**** lastmod.la
#moduleload**** pcache.la
#moduleload**** ppolicy.la
#moduleload**** refint.la
#moduleload**** retcode.la
#moduleload**** rwm.la
moduleload**** syncprov.la
#moduleload**** translucent.la
#moduleload**** unique.la

#contrib overlays
#moduleload******smbk5pwd.so

# SASL config
#sasl-host ldap.domain.com

#TLSCipherSuite******** HIGH:MEDIUM:+SSLv2
TLSCertificateFile******/etc/pki/tls/private/ldap.pem
TLSCertificateKeyFile** /etc/pki/tls/private/ldap.pem
TLSCACertificateFile****/etc/pki/tls/private/ldap.pem
#TLSVerifyClient never # ([never]|allow|try|demand)

# logging
loglevel 256

database	bdb
suffix		"dc=domain,dc=com"
rootdn		"cn=replica,dc=domain,dc=com"
rootpw	{SSHA}askjdhakljdhaskldjhadlkahsdlkjahsdklajsh
directory	/var/lib/ldap2.4

checkpoint 256 5
index	objectClass						eq
index	cn,mail,surname,givenname				eq,subinitial
index	uidNumber,gidNumber,memberuid,member,uniqueMember	eq
index** uid************************************ 		eq,subinitial
index** sambaSID,sambaDomainName,displayName****		eq
# autofs:
#index** nisMapName******************************		eq
# bind sdb_ldap:
#index** zoneName,relativeDomainName************ 		eq
index** sudoUser********************************		eq
index**entryCSN,entryUUID**************************************eq

# Replicas running syncrepl as non-rootdn need unrestricted size/time limits:
#limits group="cn=Replicator,ou=Group,dc=domain,dc=com"
# size=unlimited
# time=unlimited

database monitor

overlay syncprov
syncprov-checkpoint 10 1
syncprov-sessionlog 100

syncrepl** rid=1
****************provider=ldap://10.1.101.55
****************type=refreshOnly
****************interval=00:00:05:00
****************searchbase="dc=domain,dc=com"
****************filter="(objectClass=*)"
****************attrs="*"
****************scope=sub
****************schemachecking=off
****************updatedn="cn=Manager (or replicator),dc=domain,dc=com"
****************bindmethod=simple
****************binddn="cn=Manager (or replicator),dc=domain,dc=com"
****************credentials="domain1"

#mirrormode TRUE
#serverID 1
Last edited by wills; 09-21-2011 at 07:02 PM.
 
Old 09-22-2011, 02:09 AM   #4
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
so what errors are you getting now?
 
Old 09-22-2011, 01:03 PM   #5
wills
LQ Newbie
 
Registered: Jun 2008
Posts: 28

Original Poster
Rep: Reputation: 0
Same error:

Checking config file /etc/openldap2.4/slapd.conf: [FAILED]
/etc/openldap2.4/slapd.conf: line 128: rootDN must be defined before syncrepl may be used
slaptest2.4: bad configuration file!

Obviously there is a syntax issue but I'm thinking the configtest isn't referring to the correct line. Could be wrong, I've been wrong before.
 
Old 09-22-2011, 01:10 PM   #6
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
well you have a monitor database and that is the database you're apparently trying to replicate. you need a database followed by a rootdn followed by the synrepl.
 
Old 09-22-2011, 01:35 PM   #7
wills
LQ Newbie
 
Registered: Jun 2008
Posts: 28

Original Poster
Rep: Reputation: 0
That was it, the monitor database was the issue. I also removed updatedn since slapd was complaining about:
Error: parse_syncrepl_line: unable to parse "updatedn=cn ... "

Thanks for being my second set to eyes.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Openldap does not start ./slapd does nothing chinho Linux - Software 3 01-05-2011 04:52 AM
syslogd refuses to start whenever slapd process is running kris240376 Slackware 2 10-08-2009 06:44 PM
Unable to start apache on CentOS Linux with error Starting httpd: Syntax error on lin pkumar2533 Linux - Newbie 9 08-26-2009 07:48 AM
Setting up LDAP on RHEL4 with Webmin - slapd will not start. AoiShikaku Red Hat 7 12-15-2008 01:31 AM
SLAPD wont start xkape Fedora 1 11-13-2006 01:12 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 06:04 AM.

Contact Us - Advertising Info - Rules - Privacy - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration