hi¡¡ I have working openldap, and I want to add replication, I follow hpwtos from many maillist but it doesn't works, my slapd.conf files are:
MASTER:
# This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options.
####################################################################### # Global Directives:
# Features to permit #allow bind_v2
# Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/samba.schema #include /etc/ldap/schema/autofs.schema #include /etc/ldap/schema/krb5-kdc.schema
#include /etc/ldap/schema/unixtng.schema
#include /etc/ldap/schema/krb5-kdc.schema
# Schema check allows for forcing entries to # match schemas for their objectClasses's schemacheck on
# Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid
# List of arguments that were passed to the server argsfile /var/run/slapd.args
# Read slapd.conf(5) for possible values loglevel 0
# Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_ldbm
sasl-realm IRONMAN.ES sasl-host shogun.ironman.es
#################TLS/SSL#################### # Certificado firmado de una entidad certificadora y # el certificado del servidor
TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateKeyFile /etc/ldap/ssl/server.pem
# Si desea que el cliente necesite autentificaci�, # descomente la siguiente l�ea #TLSVerifyClient demand # ... si no, descomente esta otra TLSVerifyClient never
####################################################################### # Specific Backend Directives for ldbm: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend ldbm
####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other>
####################################################################### # Specific Directives for database #1, of type ldbm: # Database specific directives apply to this databasse until another # 'database' directive occurs database ldbm
# The base of your directory in database #1 suffix "dc=ironman,dc=es" rootdn "cn=admin,dc=ironman,dc=es" rootpw secret
#########REPLICA#############
replica host=shinobi.ironman.es:636 tls=yes bindmethod=sasl
binddn="cn=replicauser,dc=ironman,dc=es"
saslmech=gssapi
replogfile /var/lib/ldap/openldap-master-replog
##############################
# Where the database file are physically stored for database #1 directory "/var/lib/ldap"
# Indexing options for database #1 # Requerido por OpenLDAP index objectclass eq
index default sub index cn pres,sub,eq index sn pres,sub,eq
# Requerido para soportar pdb_getsampwnam index uid pres,sub,eq
# Requerido para soportar pdb_getsambapwrid() index displayName pres,sub,eq
# Descomente las siguientes l�eas si est�almacenando entradas # posixAccount y posixGroup en el directorio index uidNumber eq index gidNumber eq index memberUid eq
# Samba 3.* index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq
# Include the access lists include /etc/ldap/slapd.access
# Save the time that the entry gets modified, for database #1 lastmod on
# Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog
# The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only #access to attrs=userPassword # by dn="cn=admin,dc=ironman,dc=es" write # by anonymous auth # by self write # by * none
# Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. #access to dn.base="" by * read
# The admin dn has full write access, everyone else # can read everything. #access to * # by dn="cn=admin,dc=ironman,dc=es" write # by * read
# For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=ironman,dc=es" write # by dnattr=owner write
####################################################################### # Specific Directives for database #2, of type 'other' (can be ldbm too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other>
# The base of your directory for database #2 #suffix "dc=debian,dc=org"
SLAVE
# This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options.
####################################################################### # Global Directives:
# Features to permit #allow bind_v2
# Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/samba.schema #include /etc/ldap/schema/autofs.schema #include /etc/ldap/schema/krb5-kdc.schema
#include /etc/ldap/schema/unixtng.schema
#include /etc/ldap/schema/krb5-kdc.schema
# Schema check allows for forcing entries to # match schemas for their objectClasses's schemacheck on
# Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid
# List of arguments that were passed to the server argsfile /var/run/slapd.args
# Read slapd.conf(5) for possible values loglevel 0
# Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_ldbm
sasl-realm IRONMAN.ES sasl-host shogun.ironman.es
#################TLS/SSL#################### # Certificado firmado de una entidad certificadora y # el certificado del servidor
TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateKeyFile /etc/ldap/ssl/server.pem
# Si desea que el cliente necesite autentificaci�, # descomente la siguiente l�ea #TLSVerifyClient demand # ... si no, descomente esta otra TLSVerifyClient never
####################################################################### # Specific Backend Directives for ldbm: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend ldbm
####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other>
####################################################################### # Specific Directives for database #1, of type ldbm: # Database specific directives apply to this databasse until another # 'database' directive occurs database ldbm
# The base of your directory in database #1 suffix "dc=ironman,dc=es" rootdn "cn=admin,dc=ironman,dc=es" rootpw secret
#########ESCLAVO#############
updatedn cn=replicauser,dc=ironman,dc=es updateref ldaps://shogun.ironman.es ##############################
# Where the database file are physically stored for database #1 directory "/var/lib/ldap"
# Indexing options for database #1 # Requerido por OpenLDAP index objectclass eq
index default sub index cn pres,sub,eq index sn pres,sub,eq
# Requerido para soportar pdb_getsampwnam index uid pres,sub,eq
# Requerido para soportar pdb_getsambapwrid() index displayName pres,sub,eq
# Descomente las siguientes l�eas si est�almacenando entradas # posixAccount y posixGroup en el directorio #index uidNumber eq #index gidNumber eq #index memberUid eq
# Samba 3.* index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq
# Include the access lists #include /etc/ldap/slapd.access access to * by dn=cn=replicauser,dc=ironman,dc=es write by * read
# Save the time that the entry gets modified, for database #1 lastmod on
# Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog
# The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only #access to attrs=userPassword # by dn="cn=admin,dc=ironman,dc=es" write # by anonymous auth # by self write # by * none
# Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. #access to dn.base="" by * read
# The admin dn has full write access, everyone else # can read everything. #access to * # by dn="cn=admin,dc=ironman,dc=es" write # by * read
# For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=ironman,dc=es" write # by dnattr=owner write
####################################################################### # Specific Directives for database #2, of type 'other' (can be ldbm too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other>
# The base of your directory for database #2 #suffix "dc=debian,dc=org"
I add user replicauser to ldap, and I add the key to kerberos database by:
kadmin.local -q "addprinc -randkey replicauser@IRONMAN.ES"
kadmin.local -q "ktadd -k /etc/krb5.keytab.slurpd replicauser" kinit -r 7d -k -t /etc/krb5.keytab.slurpd replicauser@IRONMAN.ES
thanks