写给所有OpenLDAP不能正常启动的人

anstan

原帖由 "py" 发表：
ldapadd，ldapsearch的时候有没有同样的问题？
另外你用ldappasswd改密码的用户是不是当前用户？不是的话用-u 指定一下。
你的这个问题在google上出现的很多，可以看看这个：
http://www.openldap.org/lists/open..........

我的slapd.conf中有：
rootdn        "cn=Manager,dc=test,dc=com"
rootpw        {SSHA}ra0sD47QP32ASAlaAhF8kgi+8Aflbgr7

我现在想改这个密码，应该怎么做呢？

gary_tay88

Use "slappasswd" to find out the encypted format of your new password, see "man slappasswd" for more details.

# slappasswd
New password: secret
Re-enter new password: secret
{SSHA}/BoxeE3UI+Bwtpve7Ku3rGX3Mk0JpTas

Copy the output and paste into slapd.conf's "rootpw" directive, after slapd is restarted, new "rootpw" will be the password for "cn=Manager,dc=test,dc=com".

"ldappasswd" is used to change individual user password, use the "-W" to prompt for old password entry and "-S" to prompt for new password entry, below is an example.

$ ldappasswd -x -D "uid=testuser,ou=People,dc=test,dc=com" -W -S
New password:
Re-enter new password:
Enter LDAP Password:
Result: Success (0)

Note that NEW password is entered first, then the existing OLD password which is also the bindpw of binddn (-D ...).

If you use "passwd", usually the order is to enter existing OLD password first then NEW password.

Gary

leave

[quote]原帖由 "zhaowx"]可是，LINUX下的LDAP存储中文有问题呀。[/quote 发表：


难道有区别吗？我用起来都是一样的可以存。

leave

原帖由 "anstan" 发表：


我的slapd.conf中有：
rootdn        "cn=Manager,dc=test,dc=com"
rootpw        {SSHA}ra0sD47QP32ASAlaAhF8kgi+8Aflbgr7

我现在想改这个密码，应该怎么做呢？

不知道直接修改行不行。把这一段字符串{SSHA}ra0sD47QP32ASAlaAhF8kgi+8Aflbgr7替换成明文密码例如secret

ouwind

@(#) $OpenLDAP: slapd 2.2.26 (Jul  9 2005 16:06:33) $
        test@localhost.localdomain:/home/test/openldap-2.2.26/servers/slapd
daemon: IPv6 socket() failed errno=97 (Address family not supported by protocol)
daemon: bind(6) failed errno=98 (Address already in use)
slapd stopped.
connections_destroy: nothing to destroy.
这个是什么问题，我用ldap browser访问的时候，root帐号登陆会出来invalid dn (error 34)或者匿名登陆会出来no such object (error 32)

ouwind

我的slapd.con配置
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include         /urs/local/openldap/etc/openldap/schema/core.schema
include         /urs/local/openldap/etc/openldap/schema/corba.schema
include         /urs/local/openldap/etc/openldap/schema/cosine.schema
include         /urs/local/openldap/etc/openldap/schema/inetorgperson.schema
include         /urs/local/openldap/etc/openldap/schema/misc.schema
include         /urs/local/openldap/etc/openldap/schema/openldap.schema
include         /urs/local/openldap/etc/openldap/schema/nis.schema




# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral       ldap://root.openldap.org

pidfile         /urs/local/openldap/var/run/slapd.pid
argsfile        /urs/local/openldap/var/run/slapd.args

# Load dynamic backend modules:
# modulepath    /urs/local/openldap/libexec/openldap
# moduleload    back_bdb.la
# moduleload    back_ldap.la
# moduleload    back_ldbm.la
# moduleload    back_passwd.la
# moduleload    back_shell.la

# Sample security restrictions
#       Require integrity protection (prevent hijacking)
#       Require 112-bit (3DES or better) encryption for updates
#       Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#       Root DSE: allow anyone to read it
#       Subschema (sub)entry DSE: allow anyone to read it
#       Other DSEs:
#               Allow self write access
#               Allow authenticated users read access
#               Allow anonymous users to authenticate
#       Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#       by self write
#       by users read
#       by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read"
#
# rootdn can always read and write EVERYTHING!

#######################################################################
# BDB database definitions
#######################################################################

database        bdb
suffix          "dc=it,dc=com"
rootdn          "cn=root,dc=it,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoid.  See slappasswd( and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw          aaa
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory       /urs/local/openldap/var/openldap-data
# Indices to maintain
index   objectClass     eq
#ACL configure
#access to attr=userPassword
#by self write
#by anonymous auth
#access to attr=mail
#by dn="cn=root,dc=it,dc=tigerhead"
#by self write
by anonymous auth
#access to dn="cn=*,dc=it,dc=tigerhead"
access to *
by self write
by * read

leave

原帖由 "ouwind" 发表：
@(#) $OpenLDAP: slapd 2.2.26 (Jul  9 2005 16:06:33) $
       test@localhost.localdomain:/home/test/openldap-2.2.26/servers/slapd
daemon: IPv6 socket() failed errno=97 (Address family not supported by protocol)
daemon: bind(6) failed errno=98 (Address already in use)
slapd stopped.
connections_destroy: nothing to destroy.
这个是什么问题，我用ldap browser访问的时候，root帐号登陆会出来invalid dn (error 34)或者匿名登陆会出来no such object (error 32)

slapd没有启动怎么还能用ldap browser登录？
daemon: IPv6 socket() failed errno=97 (Address family not supported by protocol)
daemon: bind(6) failed errno=98 (Address already in use)
slapd stopped.

从这两句找原因。你配置了什么东西吗？我没见过这样的信息。

ouwind

但是从ps -aux可以看到./slapd是在的(这个是查看线程的?),而且netstat -a也可以看到ldap端口已经打开.是不是因为我已经启动了,所以再打开./slapd是这个回应.另外我编写了一个root.ldif
ldapadd -x -D "cn=root,dc=it,dc=com" -W -f root.ldif
然后提示add success.
然后ldapsearch -x -b 'dc=it,dc=com' '(objectclass=*)'
系统提示:
version: 2

#
# filter: (objectclass=*)
# requesting: ALL
#

# search result
search: 2
result: 0 Success

# numResponses: 1

这是为什么,我已经贴加了，为什么result 0 success

leave

你看我的，我的LDAP的所有配置都在http://bbs.chinaunix.net/forum/viewtopic.php?t=572951&show_type=
这个帖子里面下午我刚添加的一条数据。然后我用下面的搜索：

C:\openldap>;ldapsearch -x -b c=cn
# extended LDIF
#
# LDAPv3
# base <c=cn>; with scope sub
# filter: (objectclass=*)
# requesting: ALL
#

# cn
dn: c=cn
objectClass: country
objectClass: top
c: cn

# qq, cn
dn: uid=qq,c=cn
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: qq
cn: qq
sn: qq
telephoneNumber: 138888888
description: openldap test
telexNumber: tex-8888888
street: my street
postOfficeBox: postofficebox
displayName: qqdisplay
homePhone: home1111111
mobile: mobile99999
mail: qq@qq.com

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2

C:\openldap>;ldapsearch -x -b 'c=cn' "objectClass=*"
# extended LDIF
#
# LDAPv3
# base <'c=cn'>; with scope sub
# filter: objectClass=*
# requesting: ALL
#

# search result
search: 2
result: 34 Invalid DN syntax
text: invalid DN

# numResponses: 1

C:\openldap>;

leave

把上面的c=cn的引号去掉再搜索：
C:\openldap>;ldapsearch -x -b c=cn "objectClass=*"
# extended LDIF
#
# LDAPv3
# base <c=cn>; with scope sub
# filter: objectClass=*
# requesting: ALL
#

# cn
dn: c=cn
objectClass: country
objectClass: top
c: cn

# qq, cn
dn: uid=qq,c=cn
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: qq
cn: qq
sn: qq
telephoneNumber: 138888888
description: openldap test
telexNumber: tex-8888888
street: my street
postOfficeBox: postofficebox
displayName: qqdisplay
homePhone: home1111111
mobile: mobile99999
mail: qq@qq.com

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2
C:\openldap>;ldapsearch -x -b c=cn "objectClass=person"
# extended LDIF
#
# LDAPv3
# base <c=cn>; with scope sub
# filter: objectClass=person
# requesting: ALL
#

# qq, cn
dn: uid=qq,c=cn
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: qq
cn: qq
sn: qq
telephoneNumber: 138888888
description: openldap test
telexNumber: tex-8888888
street: my street
postOfficeBox: postofficebox
displayName: qqdisplay
homePhone: home1111111
mobile: mobile99999
mail: qq@qq.com

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1
C:\openldap>;