hi¡¡ I can't get the replication in the slave server...I did "slapcat -v -l LDAP-transfer-LDIF.txt" in the master and "slapadd -v -l LDAP-transfer-LDIF.txt" in the slave, i started the master and later de slave server...i added an user in the master but it didn't replicate it to slave. I started from the begining and i did the same and "scp -r /var/lib/ldap slave_server:/var/lib" and it fail again...i don know what to do..., my conf files are:
slapd.conf from master:
# This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options.
####################################################################### # Global Directives:
# Features to permit #allow bind_v2
# Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/samba.schema #include /etc/ldap/schema/autofs.schema #include /etc/ldap/schema/krb5-kdc.schema
#include /etc/ldap/schema/unixtng.schema
#include /etc/ldap/schema/krb5-kdc.schema
# Schema check allows for forcing entries to # match schemas for their objectClasses's schemacheck on
# Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid
# List of arguments that were passed to the server argsfile /var/run/slapd.args
# Read slapd.conf(5) for possible values loglevel 0
# Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_ldbm
sasl-realm IRONMAN.ES sasl-host shogun.ironman.es
#################TLS/SSL#################### # Certificado firmado de una entidad certificadora y # el certificado del servidor
TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateKeyFile /etc/ldap/ssl/server.pem
# Si desea que el cliente necesite autentificaci�, # descomente la siguiente l�ea #TLSVerifyClient demand # ... si no, descomente esta otra TLSVerifyClient never
####################################################################### # Specific Backend Directives for ldbm: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend ldbm
####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other>
####################################################################### # Specific Directives for database #1, of type ldbm: # Database specific directives apply to this databasse until another # 'database' directive occurs database ldbm
# The base of your directory in database #1 suffix "dc=ironman,dc=es" rootdn "cn=admin,dc=ironman,dc=es" rootpw secret
#########REPLICA#############
replica host=shinobi.ironman.es:389 #replica uri=ldap://shinobi.ironman.es:636
binddn="cn=replicauser,dc=ironman,dc=es" bindmethod=simple credentials=replica
replogfile /var/lib/ldap/openldap-master-replog
##############################
# Where the database file are physically stored for database #1 directory "/var/lib/ldap"
# Indexing options for database #1 # Requerido por OpenLDAP index objectclass eq
index default sub index cn pres,sub,eq index sn pres,sub,eq
# Requerido para soportar pdb_getsampwnam index uid pres,sub,eq
# Requerido para soportar pdb_getsambapwrid() index displayName pres,sub,eq
# Descomente las siguientes l�eas si est�almacenando entradas # posixAccount y posixGroup en el directorio index uidNumber eq index gidNumber eq index memberUid eq
# Samba 3.* index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq
# Include the access lists include /etc/ldap/slapd.access
# Save the time that the entry gets modified, for database #1 lastmod on
# Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog
# The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only #access to attrs=userPassword # by dn="cn=admin,dc=ironman,dc=es" write # by anonymous auth # by self write # by * none
# Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. #access to dn.base="" by * read
# The admin dn has full write access, everyone else # can read everything. #access to * # by dn="cn=admin,dc=ironman,dc=es" write # by * read
# For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=ironman,dc=es" write # by dnattr=owner write
####################################################################### # Specific Directives for database #2, of type 'other' (can be ldbm too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other>
# The base of your directory for database #2 #suffix "dc=debian,dc=org"
slapd.conf from slave:
# This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options.
####################################################################### # Global Directives:
# Features to permit #allow bind_v2
# Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/samba.schema #include /etc/ldap/schema/autofs.schema #include /etc/ldap/schema/krb5-kdc.schema
#include /etc/ldap/schema/unixtng.schema
#include /etc/ldap/schema/krb5-kdc.schema
# Schema check allows for forcing entries to # match schemas for their objectClasses's schemacheck on
# Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid
# List of arguments that were passed to the server argsfile /var/run/slapd.args
# Read slapd.conf(5) for possible values loglevel 0
# Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_ldbm
sasl-realm IRONMAN.ES sasl-host shogun.ironman.es
#################TLS/SSL#################### # Certificado firmado de una entidad certificadora y # el certificado del servidor
TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateKeyFile /etc/ldap/ssl/server.pem
# Si desea que el cliente necesite autentificaci�, # descomente la siguiente l�ea #TLSVerifyClient demand # ... si no, descomente esta otra TLSVerifyClient never
####################################################################### # Specific Backend Directives for ldbm: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend ldbm
####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other>
####################################################################### # Specific Directives for database #1, of type ldbm: # Database specific directives apply to this databasse until another # 'database' directive occurs database ldbm
# The base of your directory in database #1 suffix "dc=ironman,dc=es" rootdn "cn=admin,dc=ironman,dc=es" rootpw secret
#########REPLICA#############
updatedn "cn=replicauser,dc=ironman,dc=es" updateref ldap://shogun.ironman.es:389
##############################
# Where the database file are physically stored for database #1 directory "/var/lib/ldap"
# Indexing options for database #1 # Requerido por OpenLDAP index objectclass eq
index default sub index cn pres,sub,eq index sn pres,sub,eq
# Requerido para soportar pdb_getsampwnam index uid pres,sub,eq
# Requerido para soportar pdb_getsambapwrid() index displayName pres,sub,eq
# Descomente las siguientes l�eas si est�almacenando entradas # posixAccount y posixGroup en el directorio index uidNumber eq index gidNumber eq index memberUid eq
# Samba 3.* index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq
# Include the access lists include /etc/ldap/slapd.access
# Save the time that the entry gets modified, for database #1 lastmod on
# Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog
# The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only #access to attrs=userPassword # by dn="cn=admin,dc=ironman,dc=es" write # by anonymous auth # by self write # by * none
# Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. #access to dn.base="" by * read
# The admin dn has full write access, everyone else # can read everything. #access to * # by dn="cn=admin,dc=ironman,dc=es" write # by * read
# For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=ironman,dc=es" write # by dnattr=owner write
####################################################################### # Specific Directives for database #2, of type 'other' (can be ldbm too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other>
# The base of your directory for database #2 #suffix "dc=debian,dc=org"
slapd.access access list:
access to * by * write
# These access lines apply to database #1 only access to attrs=userPassword by dn="cn=admin,dc=atc,dc=unican,dc=es" write by anonymous auth by self write by * none # allow the "ldap admin dn" access, but deny everyone else # (Samba related) access to attrs=sambaLMPassword,sambaNTPassword by dn="cn=admin,dc=ironman,dc=es" write by self write by * auth by * none
# For Netscape Roaming support, each user gets a roaming profile for # which they have write access to #access to dn=".*,ou=Roaming,dc=.*" # by dn="<YOUR ADMIN DN>" write # by dn="uid=ldapadm.++realm=<YOUR KERBEROS REALM>" write # by dnattr=owner write # by * none
# Some things should be editable by the owner, and viewable by anyone... #access to attrs=cn,givenName,sn,krbName,krb5PrincipalName,gecos # by dn="cn=admin,dc=ironman,dc=es" write # by dn="uid=ldapadm.++realm=IRONMAN.ES" write # by self write # by users read
#access to attrs=loginShell,gecos # by dn="cn=admin,dc=ironman,dc=es" write # by dn="uid=ldapadm.++realm=IRONMAN.ES" write # by self write # by * read
# Since we're using {KERBEROS}<PRINCIPAL>, we can't allow the user # to change the password. They have to use the Kerberos 'kpasswd' to # do this... But the admin can change (if need be). # Please see krb5 userPassword attribute #access to attrs=userPassword # by dn="cn=admin,dc=ironman,dc=es" write # by dn="uid=ldapadm.++realm=IRONMAN.ES" write # by anonymous auth # by * none
# The mail and mailAlternateAddress should only be readable if you # authenticate! #access to attrs=mail,mailAlternateAddress,mailHost # by dn="<YOUR ADMIN DN>" write # by dn="uid=ldapadm.++realm=<YOUR KERBEROS REALM>" write # by users read # by * none
# Should not be readable to anyone, and only editable by admin... #access to attr=mailQuota,trustModel,accessTo # by dn="<YOUR ADMIN DN>" write # by dn="uid=ldapadm.++realm=<YOUR KERBEROS REALM>" write # by self read # by * none
# The admin dn has full write access #access to * # by dn="cn=admin,dc=ironman,dc=es" write # by dn="uid=ldapadm.++realm=IRONMAN.ES" write # by * read
access to dn.base="" by * read
access to dn.base="cn=monitor" by * read
access to * by dn.base="cn=replicauser,dc=ironman,dc=es" write by * break