Hi all:
I'm running OpenLDAP 2.3.27 from CentOS 5.2 to build from scratch an LDAP tree based on Phamm sample LDIF files. I have these database definition in slapd.conf:
database bdb suffix "dc=redtube,dc=com" rootdn "cn=manager,dc=redtube,dc=com" rootpw {SSHA}5b3FNT6a3PrldYD/X58ghCXa7vhUOO24 directory /var/lib/ldap mode 660
index objectClass eq index cn,mail eq,subinitial index vd,delete eq,pres index accountActive,forwardActive eq,pres index smtpAuth eq,pres index sn,uid,displayName pres,eq,sub index uidNumber,gidNumber eq index default sub
I always do the following:
1. # rm /var/lib/ldap/* (to be sure i'm starting from scratch)
2. # slapadd -b dc=redtube,dc=com redtube.ldif
After step (2) I can see that /var/lib/ldap/alock has rw-r--r-- and all the other files have -w----r-T as permissions and are owned by root.root . Is that correct?
Well, as far as I know they should be owned by ldap user and ldap group with 0660 permissions asigned (based on "mode" directive in slapd.conf). So I do the following:
3. # chown ldap.ldap /var/lib/ldap/* # chmod 660 /var/lib/ldap/* (/var/lib/ldap directory is 0700 and owned by ldap.ldap already)
4. I check against posible errors and then start OpenLDAP:
# slapd -Tt # service ldap start
5. OpenLDAP starts correctly, it works perfectly. I can even do modificatons to the LDAP tree adding entries based on attributes like vd, cn, mail, among others. I'm aware that there are no uid.bdb created yet in /var/lib/ldap, so I guess that's ok.
My problem comes when I try to perform some operation that causes OpenLDAP to create an index file in /var/lib/ldap. In example, when I try to log in with rootdn trough phpldapadmin I get something like this in logs:
Dec 30 11:31:22 ha1 slapd[1889]: conn=5 fd=12 ACCEPT from IP=127.0.0.1:38395 (IP=0.0.0.0:389) Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=0 BIND dn="" method=128 Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=0 RESULT tag=97 err=0 text= Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SRCH base="dc=redtube,dc=com" scope=2 deref=0 filter="(uid=cn=manager,dc=redtube,dc=com)"
Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SRCH attr=dn Dec 30 11:31:22 ha1 slapd[1889]: bdb(dc=redtube,dc=com): /var/lib/ldap/uid.bdb: Permission denied Dec 30 11:31:22 ha1 slapd[1889]: bdb_db_cache: db_open(uid) failed: Permission denied (13) Dec 30 11:31:22 ha1 slapd[1889]: <= bdb_equality_candidates: (uid) index_param failed (13) Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=2 UNBIND Dec 30 11:31:22 ha1 slapd[1889]: conn=5 fd=12 closed
I don't know why phpldapadmin performs a search based on a filter like "(uid=cn=manager,dc=redtube,dc=com)" but well, it doesn't matter to me.
Then I stop and start OpenLDAP and I start getting this:
# /etc/init.d/ldap stop Stopping slapd: [ OK ] # /etc/init.d/ldap start Checking configuration files for slapd: bdb_db_open: unclean shutdown detected; attempting recovery. bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap: (2) Expect poor performance for suffix dc=mailtest,dc=com. bdb_db_open: Recovery skipped in read-only mode. Run manual recovery if errors are encountered. config file testing succeeded [ OK ] Starting slapd: [ OK ]
Question is: Why can't OpenLDAP create /var/lib/ldap/uid.bdb? Why is getting permission denied messages? The hole directory /var/lib/ldap is owned by ldap user with 660 permissions. Can anybody help me? Thanks
Nothing is getting corrupt, only permission errors. Check what permissions your init script is looking for and running slapd as.
On 30/12/2008, Jason Voorhees jvoorhees1@gmail.com wrote:
Hi all:
I'm running OpenLDAP 2.3.27 from CentOS 5.2 to build from scratch an LDAP tree based on Phamm sample LDIF files. I have these database definition in slapd.conf:
database bdb suffix "dc=redtube,dc=com" rootdn "cn=manager,dc=redtube,dc=com" rootpw {SSHA}5b3FNT6a3PrldYD/X58ghCXa7vhUOO24 directory /var/lib/ldap mode 660
index objectClass eq index cn,mail eq,subinitial index vd,delete eq,pres index accountActive,forwardActive eq,pres index smtpAuth eq,pres index sn,uid,displayName pres,eq,sub index uidNumber,gidNumber eq index default sub
I always do the following:
- # rm /var/lib/ldap/*
(to be sure i'm starting from scratch)
- # slapadd -b dc=redtube,dc=com redtube.ldif
After step (2) I can see that /var/lib/ldap/alock has rw-r--r-- and all the other files have -w----r-T as permissions and are owned by root.root . Is that correct?
Well, as far as I know they should be owned by ldap user and ldap group with 0660 permissions asigned (based on "mode" directive in slapd.conf). So I do the following:
# chown ldap.ldap /var/lib/ldap/* # chmod 660 /var/lib/ldap/* (/var/lib/ldap directory is 0700 and owned by ldap.ldap already)
I check against posible errors and then start OpenLDAP:
# slapd -Tt # service ldap start
OpenLDAP starts correctly, it works perfectly. I can even do
modificatons to the LDAP tree adding entries based on attributes like vd, cn, mail, among others. I'm aware that there are no uid.bdb created yet in /var/lib/ldap, so I guess that's ok.
My problem comes when I try to perform some operation that causes OpenLDAP to create an index file in /var/lib/ldap. In example, when I try to log in with rootdn trough phpldapadmin I get something like this in logs:
Dec 30 11:31:22 ha1 slapd[1889]: conn=5 fd=12 ACCEPT from IP=127.0.0.1:38395 (IP=0.0.0.0:389) Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=0 BIND dn="" method=128 Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=0 RESULT tag=97 err=0 text= Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SRCH base="dc=redtube,dc=com" scope=2 deref=0 filter="(uid=cn=manager,dc=redtube,dc=com)"
Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SRCH attr=dn Dec 30 11:31:22 ha1 slapd[1889]: bdb(dc=redtube,dc=com): /var/lib/ldap/uid.bdb: Permission denied Dec 30 11:31:22 ha1 slapd[1889]: bdb_db_cache: db_open(uid) failed: Permission denied (13) Dec 30 11:31:22 ha1 slapd[1889]: <= bdb_equality_candidates: (uid) index_param failed (13) Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=2 UNBIND Dec 30 11:31:22 ha1 slapd[1889]: conn=5 fd=12 closed
I don't know why phpldapadmin performs a search based on a filter like "(uid=cn=manager,dc=redtube,dc=com)" but well, it doesn't matter to me.
Then I stop and start OpenLDAP and I start getting this:
# /etc/init.d/ldap stop Stopping slapd: [ OK ] # /etc/init.d/ldap start Checking configuration files for slapd: bdb_db_open: unclean shutdown detected; attempting recovery. bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap: (2) Expect poor performance for suffix dc=mailtest,dc=com. bdb_db_open: Recovery skipped in read-only mode. Run manual recovery if errors are encountered. config file testing succeeded [ OK ] Starting slapd: [ OK ]
Question is: Why can't OpenLDAP create /var/lib/ldap/uid.bdb? Why is getting permission denied messages? The hole directory /var/lib/ldap is owned by ldap user with 660 permissions. Can anybody help me? Thanks
(Sorry if maybe I'm sending this message twice. I think I sent the first one in HTML format and I guess that format isn't allowed here).
Ok, maybe I'm missing some essential knowledge about how OpenLDAP and indexing works. This is what I'm doing (as simple as possible after too many failed tests with more complex scenarios):
1. Create a new database in slapd.conf withouy any ACLs yet:
database bdb suffix dc=test,dc=com rootdn cn=manager,dc=test,dc=com rootpw {SSHA}5b3FNT6a3PrldYD/X58ghCXa7vhUOO24 directory /var/lib/ldap/test mode 600 cachesize 10000
index objectClass eq index mail eq,sub
2. After stopping OpenLDAP I create the basic content of my LDAP tree using slapadd:
# slapadd -l test.ldif -b dc=test,dc=com # cat test.ldif dn: dc=test,dc=com objectClass: domain dc: test
(all worked fine, no errors, no problems)
3. Then I fix perms and ownership of database directory (/var/lib/ldap/test):
# chown -R ldap.ldap /var/lib/ldap/test # chmod 700 /var/lib/ldap/test # chmod 600 /var/lib/ldap/test/* # ls -ld /var/lib/ldap /var/lib/ldap/test drwx------ 3 ldap ldap 4096 Dec 31 07:38 /var/lib/ldap/ drwx------ 2 ldap ldap 4096 Jan 1 10:39 /var/lib/ldap/test/
# ls -l /var/lib/ldap/test total 732 -rw------- 1 ldap ldap 2048 Jan 1 10:39 alock -rw------- 1 ldap ldap 24576 Jan 1 10:38 __db.001 -rw------- 1 ldap ldap 278528 Jan 1 10:38 __db.002 -rw------- 1 ldap ldap 270336 Jan 1 10:38 __db.003 -rw------- 1 ldap ldap 98304 Jan 1 10:38 __db.004 -rw------- 1 ldap ldap 352256 Jan 1 10:38 __db.005 -rw------- 1 ldap ldap 24576 Jan 1 10:38 __db.006 -rw------- 1 ldap ldap 8192 Jan 1 10:39 dn2id.bdb -rw------- 1 ldap ldap 32768 Jan 1 10:39 id2entry.bdb -rw------- 1 ldap ldap 10485760 Jan 1 10:39 log.0000000001 -rw------- 1 ldap ldap 8192 Jan 1 10:39 objectClass.bdb
(pay attetion, there's no mail.bdb file yet!, right?)
4. Check slapd syntax, start OpenLDAP and make a test:
# slaptest -u config file testing succeeded # service ldap start # ldapsearch -xLLL -b dc=test,dc=com
(and Yes, /etc/init.d/ldap it forces slapd to run as ldap user)
5. Everithing is fine. Then I try to add some content from an LDIF file:
# ldapmodify -a -x -D cn=manager,dc=test,dc=com -w secret -f test.ldif adding new entry "mail=jvoorhees1@gmail.com,dc=test,dc=com" ldap_add: Internal (implementation specific) error (80) additional info: index generation failed
# cat test.ldif dn: mail=jvoorhees1@gmail.com,dc=test,dc=com objectClass: inetOrgPerson mail: jvoorhees1@gmail.com cn: Jason Voorhees sn: Voorhees
6. What happened? What am I doing wrong? I'm working with "loglevel 256" in slapd.conf and sending local4.* logs to /var/log/ldap.log and I'm getting this error message while using ldapmodify:
Jan 1 10:51:49 ha1 slapd[26023]: @(#) $OpenLDAP: slapd 2.3.27 (Jul 9 2008 13:10:56) $ mockbuild@builder16.centos.org:/builddir/build/BUILD/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd Jan 1 10:51:49 ha1 slapd[26024]: bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap/test: (2) Expect poor performance for suffix dc=test,dc=com. Jan 1 10:51:49 ha1 slapd[26024]: slapd starting Jan 1 10:51:56 ha1 slapd[26024]: conn=0 fd=12 ACCEPT from IP=127.0.0.1:40112 (IP=0.0.0.0:389) Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=0 BIND dn="cn=manager,dc=test,dc=com" method=128 Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=0 BIND dn="cn=manager,dc=test,dc=com" mech=SIMPLE ssf=0 Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=0 RESULT tag=97 err=0 text= Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=1 ADD dn="mail=jvoorhees1@gmail.com,dc=test,dc=com" Jan 1 10:51:56 ha1 slapd[26024]: bdb(dc=test,dc=com): /var/lib/ldap/test/mail.bdb: Permission denied Jan 1 10:51:56 ha1 slapd[26024]: bdb_db_cache: db_open(mail) failed: Permission denied (13) Jan 1 10:51:56 ha1 slapd[26024]: bdb_index_read: Could not open DB mail Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=1 RESULT tag=105 err=80 text=index generation failed Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=2 UNBIND Jan 1 10:51:56 ha1 slapd[26024]: conn=0 fd=12 closed Jan 1 10:51:56 ha1 slapd[26024]: connection_read(12): no connection!
Why can't slapd create any index file in its database directory? Does slapd need to have index files created before it is started? Is it possible to slapd to create new index files when it is already running? Those are my essential doubts :(
7. OK, according to error message I must check perms and ownership of database files. But OMG everything is apparently fine!. Look:
# ls -ld /var/lib/ldap /var/lib/ldap/test drwx------ 3 ldap ldap 4096 Dec 31 07:38 /var/lib/ldap/ drwx------ 2 ldap ldap 4096 Jan 1 10:51 /var/lib/ldap/test/
# ls -l /var/lib/ldap/test total 752 -rw------- 1 ldap ldap 4096 Jan 1 10:51 alock -rw------- 1 ldap ldap 24576 Jan 1 10:38 __db.001 -rw------- 1 ldap ldap 278528 Jan 1 10:38 __db.002 -rw------- 1 ldap ldap 270336 Jan 1 10:38 __db.003 -rw------- 1 ldap ldap 98304 Jan 1 10:38 __db.004 -rw------- 1 ldap ldap 352256 Jan 1 10:38 __db.005 -rw------- 1 ldap ldap 24576 Jan 1 10:38 __db.006 -rw------- 1 ldap ldap 8192 Jan 1 10:51 dn2id.bdb -rw------- 1 ldap ldap 32768 Jan 1 10:39 id2entry.bdb -rw------- 1 ldap ldap 10485760 Jan 1 10:51 log.0000000001 -rw------- 1 ldap ldap 8192 Jan 1 10:51 objectClass.bdb
What else? SElinux?
# getenforce Disabled
So, what's the problem?
SO: CentOS 5.2 OpenLDAP: 2.3.27 (openldap-servers-2.3.27-8.el5_2.4.rpm) Kernel: 2.6.18-92.1.22.el5xen SElinux: disabled
The same problem occurs in an equal envinronment but with no Xen kernel. Could somebody help me? Thanks a lot
Gavin Henry escribió:
Nothing is getting corrupt, only permission errors. Check what permissions your init script is looking for and running slapd as.
On 30/12/2008, Jason Voorhees jvoorhees1@gmail.com wrote:
Hi all:
I'm running OpenLDAP 2.3.27 from CentOS 5.2 to build from scratch an LDAP tree based on Phamm sample LDIF files. I have these database definition in slapd.conf:
database bdb suffix "dc=redtube,dc=com" rootdn "cn=manager,dc=redtube,dc=com" rootpw {SSHA}5b3FNT6a3PrldYD/X58ghCXa7vhUOO24 directory /var/lib/ldap mode 660
index objectClass eq index cn,mail eq,subinitial index vd,delete eq,pres index accountActive,forwardActive eq,pres index smtpAuth eq,pres index sn,uid,displayName pres,eq,sub index uidNumber,gidNumber eq index default sub
I always do the following:
- # rm /var/lib/ldap/*
(to be sure i'm starting from scratch)
- # slapadd -b dc=redtube,dc=com redtube.ldif
After step (2) I can see that /var/lib/ldap/alock has rw-r--r-- and all the other files have -w----r-T as permissions and are owned by root.root . Is that correct?
Well, as far as I know they should be owned by ldap user and ldap group with 0660 permissions asigned (based on "mode" directive in slapd.conf). So I do the following:
# chown ldap.ldap /var/lib/ldap/* # chmod 660 /var/lib/ldap/* (/var/lib/ldap directory is 0700 and owned by ldap.ldap already)
I check against posible errors and then start OpenLDAP:
# slapd -Tt # service ldap start
OpenLDAP starts correctly, it works perfectly. I can even do
modificatons to the LDAP tree adding entries based on attributes like vd, cn, mail, among others. I'm aware that there are no uid.bdb created yet in /var/lib/ldap, so I guess that's ok.
My problem comes when I try to perform some operation that causes OpenLDAP to create an index file in /var/lib/ldap. In example, when I try to log in with rootdn trough phpldapadmin I get something like this in logs:
Dec 30 11:31:22 ha1 slapd[1889]: conn=5 fd=12 ACCEPT from IP=127.0.0.1:38395 (IP=0.0.0.0:389) Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=0 BIND dn="" method=128 Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=0 RESULT tag=97 err=0 text= Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SRCH base="dc=redtube,dc=com" scope=2 deref=0 filter="(uid=cn=manager,dc=redtube,dc=com)"
Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SRCH attr=dn Dec 30 11:31:22 ha1 slapd[1889]: bdb(dc=redtube,dc=com): /var/lib/ldap/uid.bdb: Permission denied Dec 30 11:31:22 ha1 slapd[1889]: bdb_db_cache: db_open(uid) failed: Permission denied (13) Dec 30 11:31:22 ha1 slapd[1889]: <= bdb_equality_candidates: (uid) index_param failed (13) Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=2 UNBIND Dec 30 11:31:22 ha1 slapd[1889]: conn=5 fd=12 closed
I don't know why phpldapadmin performs a search based on a filter like "(uid=cn=manager,dc=redtube,dc=com)" but well, it doesn't matter to me.
Then I stop and start OpenLDAP and I start getting this:
# /etc/init.d/ldap stop Stopping slapd: [ OK ] # /etc/init.d/ldap start Checking configuration files for slapd: bdb_db_open: unclean shutdown detected; attempting recovery. bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap: (2) Expect poor performance for suffix dc=mailtest,dc=com. bdb_db_open: Recovery skipped in read-only mode. Run manual recovery if errors are encountered. config file testing succeeded [ OK ] Starting slapd: [ OK ]
Question is: Why can't OpenLDAP create /var/lib/ldap/uid.bdb? Why is getting permission denied messages? The hole directory /var/lib/ldap is owned by ldap user with 660 permissions. Can anybody help me? Thanks
--On Monday, January 05, 2009 9:42 AM -0500 Jason Voorhees jvoorhees1@gmail.com wrote:
(Sorry if maybe I'm sending this message twice. I think I sent the first one in HTML format and I guess that format isn't allowed here).
Ok, maybe I'm missing some essential knowledge about how OpenLDAP and indexing works. This is what I'm doing (as simple as possible after too many failed tests with more complex scenarios):
- Create a new database in slapd.conf withouy any ACLs yet:
database bdb suffix dc=test,dc=com rootdn cn=manager,dc=test,dc=com rootpw {SSHA}5b3FNT6a3PrldYD/X58ghCXa7vhUOO24 directory /var/lib/ldap/test mode 600 cachesize 10000
index objectClass eq index mail eq,sub
- After stopping OpenLDAP I create the basic content of my LDAP tree
using slapadd:
# slapadd -l test.ldif -b dc=test,dc=com # cat test.ldif dn: dc=test,dc=com objectClass: domain dc: test
(all worked fine, no errors, no problems)
- Then I fix perms and ownership of database directory
(/var/lib/ldap/test):
# chown -R ldap.ldap /var/lib/ldap/test # chmod 700 /var/lib/ldap/test # chmod 600 /var/lib/ldap/test/* # ls -ld /var/lib/ldap /var/lib/ldap/test drwx------ 3 ldap ldap 4096 Dec 31 07:38 /var/lib/ldap/ drwx------ 2 ldap ldap 4096 Jan 1 10:39 /var/lib/ldap/test/
# ls -l /var/lib/ldap/test total 732 -rw------- 1 ldap ldap 2048 Jan 1 10:39 alock -rw------- 1 ldap ldap 24576 Jan 1 10:38 __db.001 -rw------- 1 ldap ldap 278528 Jan 1 10:38 __db.002 -rw------- 1 ldap ldap 270336 Jan 1 10:38 __db.003 -rw------- 1 ldap ldap 98304 Jan 1 10:38 __db.004 -rw------- 1 ldap ldap 352256 Jan 1 10:38 __db.005 -rw------- 1 ldap ldap 24576 Jan 1 10:38 __db.006 -rw------- 1 ldap ldap 8192 Jan 1 10:39 dn2id.bdb -rw------- 1 ldap ldap 32768 Jan 1 10:39 id2entry.bdb -rw------- 1 ldap ldap 10485760 Jan 1 10:39 log.0000000001 -rw------- 1 ldap ldap 8192 Jan 1 10:39 objectClass.bdb
(pay attetion, there's no mail.bdb file yet!, right?)
- Check slapd syntax, start OpenLDAP and make a test:
# slaptest -u config file testing succeeded # service ldap start # ldapsearch -xLLL -b dc=test,dc=com
(and Yes, /etc/init.d/ldap it forces slapd to run as ldap user)
- Everithing is fine. Then I try to add some content from an LDIF file:
# ldapmodify -a -x -D cn=manager,dc=test,dc=com -w secret -f test.ldif adding new entry "mail=jvoorhees1@gmail.com,dc=test,dc=com" ldap_add: Internal (implementation specific) error (80) additional info: index generation failed
# cat test.ldif dn: mail=jvoorhees1@gmail.com,dc=test,dc=com objectClass: inetOrgPerson mail: jvoorhees1@gmail.com cn: Jason Voorhees sn: Voorhees
- What happened? What am I doing wrong? I'm working with "loglevel 256"
in slapd.conf and sending local4.* logs to /var/log/ldap.log and I'm getting this error message while using ldapmodify:
Jan 1 10:51:49 ha1 slapd[26023]: @(#) $OpenLDAP: slapd 2.3.27 (Jul 9 2008 13:10:56) $ mockbuild@builder16.centos.org:/builddir/build/BUILD/openldap-2.3.27/open ldap-2.3.27/build-servers/servers/slapd Jan 1 10:51:49 ha1 slapd[26024]: bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap/test: (2) Expect poor performance for suffix dc=test,dc=com. Jan 1 10:51:49 ha1 slapd[26024]: slapd starting Jan 1 10:51:56 ha1 slapd[26024]: conn=0 fd=12 ACCEPT from IP=127.0.0.1:40112 (IP=0.0.0.0:389) Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=0 BIND dn="cn=manager,dc=test,dc=com" method=128 Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=0 BIND dn="cn=manager,dc=test,dc=com" mech=SIMPLE ssf=0 Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=0 RESULT tag=97 err=0 text= Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=1 ADD dn="mail=jvoorhees1@gmail.com,dc=test,dc=com" Jan 1 10:51:56 ha1 slapd[26024]: bdb(dc=test,dc=com): /var/lib/ldap/test/mail.bdb: Permission denied Jan 1 10:51:56 ha1 slapd[26024]: bdb_db_cache: db_open(mail) failed: Permission denied (13) Jan 1 10:51:56 ha1 slapd[26024]: bdb_index_read: Could not open DB mail Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=1 RESULT tag=105 err=80 text=index generation failed Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=2 UNBIND Jan 1 10:51:56 ha1 slapd[26024]: conn=0 fd=12 closed Jan 1 10:51:56 ha1 slapd[26024]: connection_read(12): no connection!
Why can't slapd create any index file in its database directory? Does slapd need to have index files created before it is started? Is it possible to slapd to create new index files when it is already running? Those are my essential doubts :(
- OK, according to error message I must check perms and ownership of
database files. But OMG everything is apparently fine!. Look:
# ls -ld /var/lib/ldap /var/lib/ldap/test drwx------ 3 ldap ldap 4096 Dec 31 07:38 /var/lib/ldap/ drwx------ 2 ldap ldap 4096 Jan 1 10:51 /var/lib/ldap/test/
# ls -l /var/lib/ldap/test total 752 -rw------- 1 ldap ldap 4096 Jan 1 10:51 alock -rw------- 1 ldap ldap 24576 Jan 1 10:38 __db.001 -rw------- 1 ldap ldap 278528 Jan 1 10:38 __db.002 -rw------- 1 ldap ldap 270336 Jan 1 10:38 __db.003 -rw------- 1 ldap ldap 98304 Jan 1 10:38 __db.004 -rw------- 1 ldap ldap 352256 Jan 1 10:38 __db.005 -rw------- 1 ldap ldap 24576 Jan 1 10:38 __db.006 -rw------- 1 ldap ldap 8192 Jan 1 10:51 dn2id.bdb -rw------- 1 ldap ldap 32768 Jan 1 10:39 id2entry.bdb -rw------- 1 ldap ldap 10485760 Jan 1 10:51 log.0000000001 -rw------- 1 ldap ldap 8192 Jan 1 10:51 objectClass.bdb
What else? SElinux?
# getenforce Disabled
So, what's the problem?
SO: CentOS 5.2 OpenLDAP: 2.3.27 (openldap-servers-2.3.27-8.el5_2.4.rpm) Kernel: 2.6.18-92.1.22.el5xen SElinux: disabled
The same problem occurs in an equal envinronment but with no Xen kernel. Could somebody help me? Thanks a lot
Well, other than you are using an ancient version of OpenLDAP with many known issues, which I would advise against, have you tried actually touching a file in /var/lib/ldap/test as the ldap user? I.e., that's the one test I don't see you performing, but is the first thing that comes to my mind to test.
--Quanah
--
Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration
Quanah Gibson-Mount escribió:
--On Monday, January 05, 2009 9:42 AM -0500 Jason Voorhees jvoorhees1@gmail.com wrote:
(Sorry if maybe I'm sending this message twice. I think I sent the first one in HTML format and I guess that format isn't allowed here).
Ok, maybe I'm missing some essential knowledge about how OpenLDAP and indexing works. This is what I'm doing (as simple as possible after too many failed tests with more complex scenarios):
- Create a new database in slapd.conf withouy any ACLs yet:
database bdb suffix dc=test,dc=com rootdn cn=manager,dc=test,dc=com rootpw {SSHA}5b3FNT6a3PrldYD/X58ghCXa7vhUOO24 directory /var/lib/ldap/test mode 600 cachesize 10000
index objectClass eq index mail eq,sub
- After stopping OpenLDAP I create the basic content of my LDAP tree
using slapadd:
# slapadd -l test.ldif -b dc=test,dc=com # cat test.ldif dn: dc=test,dc=com objectClass: domain dc: test
(all worked fine, no errors, no problems)
- Then I fix perms and ownership of database directory
(/var/lib/ldap/test):
# chown -R ldap.ldap /var/lib/ldap/test # chmod 700 /var/lib/ldap/test # chmod 600 /var/lib/ldap/test/* # ls -ld /var/lib/ldap /var/lib/ldap/test drwx------ 3 ldap ldap 4096 Dec 31 07:38 /var/lib/ldap/ drwx------ 2 ldap ldap 4096 Jan 1 10:39 /var/lib/ldap/test/
# ls -l /var/lib/ldap/test total 732 -rw------- 1 ldap ldap 2048 Jan 1 10:39 alock -rw------- 1 ldap ldap 24576 Jan 1 10:38 __db.001 -rw------- 1 ldap ldap 278528 Jan 1 10:38 __db.002 -rw------- 1 ldap ldap 270336 Jan 1 10:38 __db.003 -rw------- 1 ldap ldap 98304 Jan 1 10:38 __db.004 -rw------- 1 ldap ldap 352256 Jan 1 10:38 __db.005 -rw------- 1 ldap ldap 24576 Jan 1 10:38 __db.006 -rw------- 1 ldap ldap 8192 Jan 1 10:39 dn2id.bdb -rw------- 1 ldap ldap 32768 Jan 1 10:39 id2entry.bdb -rw------- 1 ldap ldap 10485760 Jan 1 10:39 log.0000000001 -rw------- 1 ldap ldap 8192 Jan 1 10:39 objectClass.bdb
(pay attetion, there's no mail.bdb file yet!, right?)
- Check slapd syntax, start OpenLDAP and make a test:
# slaptest -u config file testing succeeded # service ldap start # ldapsearch -xLLL -b dc=test,dc=com
(and Yes, /etc/init.d/ldap it forces slapd to run as ldap user)
- Everithing is fine. Then I try to add some content from an LDIF file:
# ldapmodify -a -x -D cn=manager,dc=test,dc=com -w secret -f test.ldif adding new entry "mail=jvoorhees1@gmail.com,dc=test,dc=com" ldap_add: Internal (implementation specific) error (80) additional info: index generation failed
# cat test.ldif dn: mail=jvoorhees1@gmail.com,dc=test,dc=com objectClass: inetOrgPerson mail: jvoorhees1@gmail.com cn: Jason Voorhees sn: Voorhees
- What happened? What am I doing wrong? I'm working with "loglevel 256"
in slapd.conf and sending local4.* logs to /var/log/ldap.log and I'm getting this error message while using ldapmodify:
Jan 1 10:51:49 ha1 slapd[26023]: @(#) $OpenLDAP: slapd 2.3.27 (Jul 9 2008 13:10:56) $ mockbuild@builder16.centos.org:/builddir/build/BUILD/openldap-2.3.27/open ldap-2.3.27/build-servers/servers/slapd Jan 1 10:51:49 ha1 slapd[26024]: bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap/test: (2) Expect poor performance for suffix dc=test,dc=com. Jan 1 10:51:49 ha1 slapd[26024]: slapd starting Jan 1 10:51:56 ha1 slapd[26024]: conn=0 fd=12 ACCEPT from IP=127.0.0.1:40112 (IP=0.0.0.0:389) Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=0 BIND dn="cn=manager,dc=test,dc=com" method=128 Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=0 BIND dn="cn=manager,dc=test,dc=com" mech=SIMPLE ssf=0 Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=0 RESULT tag=97 err=0 text= Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=1 ADD dn="mail=jvoorhees1@gmail.com,dc=test,dc=com" Jan 1 10:51:56 ha1 slapd[26024]: bdb(dc=test,dc=com): /var/lib/ldap/test/mail.bdb: Permission denied Jan 1 10:51:56 ha1 slapd[26024]: bdb_db_cache: db_open(mail) failed: Permission denied (13) Jan 1 10:51:56 ha1 slapd[26024]: bdb_index_read: Could not open DB mail Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=1 RESULT tag=105 err=80 text=index generation failed Jan 1 10:51:56 ha1 slapd[26024]: conn=0 op=2 UNBIND Jan 1 10:51:56 ha1 slapd[26024]: conn=0 fd=12 closed Jan 1 10:51:56 ha1 slapd[26024]: connection_read(12): no connection!
Why can't slapd create any index file in its database directory? Does slapd need to have index files created before it is started? Is it possible to slapd to create new index files when it is already running? Those are my essential doubts :(
- OK, according to error message I must check perms and ownership of
database files. But OMG everything is apparently fine!. Look:
# ls -ld /var/lib/ldap /var/lib/ldap/test drwx------ 3 ldap ldap 4096 Dec 31 07:38 /var/lib/ldap/ drwx------ 2 ldap ldap 4096 Jan 1 10:51 /var/lib/ldap/test/
# ls -l /var/lib/ldap/test total 752 -rw------- 1 ldap ldap 4096 Jan 1 10:51 alock -rw------- 1 ldap ldap 24576 Jan 1 10:38 __db.001 -rw------- 1 ldap ldap 278528 Jan 1 10:38 __db.002 -rw------- 1 ldap ldap 270336 Jan 1 10:38 __db.003 -rw------- 1 ldap ldap 98304 Jan 1 10:38 __db.004 -rw------- 1 ldap ldap 352256 Jan 1 10:38 __db.005 -rw------- 1 ldap ldap 24576 Jan 1 10:38 __db.006 -rw------- 1 ldap ldap 8192 Jan 1 10:51 dn2id.bdb -rw------- 1 ldap ldap 32768 Jan 1 10:39 id2entry.bdb -rw------- 1 ldap ldap 10485760 Jan 1 10:51 log.0000000001 -rw------- 1 ldap ldap 8192 Jan 1 10:51 objectClass.bdb
What else? SElinux?
# getenforce Disabled
So, what's the problem?
SO: CentOS 5.2 OpenLDAP: 2.3.27 (openldap-servers-2.3.27-8.el5_2.4.rpm) Kernel: 2.6.18-92.1.22.el5xen SElinux: disabled
The same problem occurs in an equal envinronment but with no Xen kernel. Could somebody help me? Thanks a lot
Well, other than you are using an ancient version of OpenLDAP with many known issues, which I would advise against, have you tried actually touching a file in /var/lib/ldap/test as the ldap user? I.e., that's the one test I don't see you performing, but is the first thing that comes to my mind to test.
--Quanah
--
Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc
Zimbra :: the leader in open source messaging and collaboration
The same problem occurs in OpenSuSE 11 with OpenLDAP 2.4.9. I became ldap user and I was able to create any files inside /var/lib/ldap/test:
# su -s /bin/bash ldap $ pwd /var/lib/ldap $ touch first $ echo $? 0 $ cd /var/lib/ldap/test $ touch second $ echo $? 0
There's no problem creating files under /var/lib/ldap/*. What's the problem then?
--On Monday, January 05, 2009 12:31 PM -0500 Jason Voorhees jvoorhees1@gmail.com wrote:
There's no problem creating files under /var/lib/ldap/*. What's the problem then?
What happens if you comment out the "mode" directive you have in slapd.conf?
--Quanah
--
Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration
I can't believe it. After so many years in Linux world I didn't note the difference between using "mode 600" and "mode 0600". OpenLDAP was trying to use 6000 perms instead 0600 when using "mode 600", so it tried to asign sticky bit permission.
Thanks Quanah, and Sorry for my mistake.
Bytes :)
Quanah Gibson-Mount escribió:
--On Monday, January 05, 2009 12:31 PM -0500 Jason Voorhees jvoorhees1@gmail.com wrote:
There's no problem creating files under /var/lib/ldap/*. What's the problem then?
What happens if you comment out the "mode" directive you have in slapd.conf?
--Quanah
--
Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc
Zimbra :: the leader in open source messaging and collaboration
openldap-technical@openldap.org
-
Gavin Henry -
Jason Voorhees -
Quanah Gibson-Mount