0

I have 'inherited' an openldap (CentOS 7) server which configuration is handled dynamically (using a slapd.d directory and a tree of ldif files).

I used ldapmodify to add an attribute (olcDbCheckpoint) to one of the backends. The change had the expected results, and I can see it with an ldapsearch -D 'cn=config' ... query.

But none of the files in /etc/openldap/slapd.d has been updated and I cannot find any reference to my new attribute in it... The slapcat -b "cn=config" command (which seems to be reading this directory) does not show the parameter either. The slapd process command does not refer to another directory that would be located elsewhere. I also checked that the ldap user running the service is owner with write permissions on all of the slapd.d tree.

I thought this directory was maintained by the openldap service and read at the service start? Now I'm afraid the olcDbCheckpoint parameter and others that might have been modified in the past won't survive a restart.

Should the slapd.d directory have been updated, and is there any way to force a dump of the in-memory configuration to slapd.d?

EDIT:

  • I have restarted the slapd service, the value is not persisted. I have modified the configuration again, and restarted the service again: still not persisted, and slapd.d still not updated.
  • There are in fact 2 mirrored OpenLDAP servers which present the same behaviour. The data backend is synchronized correctly but the configuration backend is not - although it should according to the configuration. At slapd restart, the initial config sync fails because there is no entryUUID in slapd.d/cn=config/cn=module{0}.ldif (on both servers). I'm starting to think that some config files where edited manually...
nathou
  • 163
  • 6
  • Does the value persist if you restart the slapd service? – larsks Nov 16 '22 at 23:11
  • I have not tried restarting the slapd service yet @larsks, I'm planning to do this as a last resort if there's no other solution. – nathou Nov 17 '22 at 09:24
  • Restarting the service would confirm whether or not the changes were being persisted correctly, which would help define the nature of this problem. I think adding the result of that test to your question now, rather than later, would be helpful. – larsks Nov 17 '22 at 12:24
  • The thing is the service has been running for a long time and I'm not sure whether other changes have been made in the past. So if restarting = losing those changes, well, I'd rather not do it unless there's no other solution. – nathou Nov 17 '22 at 13:51
  • So the value does not persist after a restart (question edited with more detail). Fortunately, my change was the only one lost. – nathou Nov 23 '22 at 15:56

0 Answers0