Master is Dead - Promote LDAP Slave to Master

Question

I have inherited an undocumented openLdap setup - one Master server with two slaves. The Master died hard last night - disc corruption - the backup was a clone system on the same server and disk - so that is useless. Users can still authenticate using the two backup server.

Can anyone tell me how to promote one of the slaves to master, then change the other server to point to it? The configuration seems to be in the slapd.conf file on each server - they are similar - a copy is below:

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/misc.schema
include         /etc/openldap/schema/ppolicy.schema

pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args

modulepath /usr/lib64/openldap
moduleload accesslog.la
moduleload syncprov.la
moduleload back_bdb.la

database config
rootdn "cn=admin,cn=config"
rootpw {CRYPT}XXXXXXXXXXXXX

database monitor
access to *
       by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"   read
       by dn.base="cn=manager,dc=company,dc=com" read
       by * none

database bdb
suffix dc=company,dc=com
rootdn dc=company,dc=com
directory /var/lib/ldap/company.com
index objectclass,entryCSN,entryUUID eq

syncrepl rid=002
        provider=ldap://auth1.company.com:389
        searchbase="dc=company,dc=com"
        type=refreshOnly
        interval=00:00:05:00
        retry="60 10 300 3"
        filter="(objectClass=*)"
        scope=sub
        schemachecking=off
        bindmethod=simple
        binddn="cn=sssd,dc=company,dc=com"
        credentials=XXXXXXXXXXXXXX

Thanks for any assistance with this!

Mike

So no chance of recovering the disk? It has physical damage? Have you tried Spinrite? — Edwin, Nov 02 '15 at 20:42
The master is a hosted instance inside a hosting provider - bad journal. The recovery would be read-only if possible — Mike C, Nov 02 '15 at 20:56
It looks like your replicas don't have any ACLs. I hope you don't store authentication information on them. — 84104, Nov 03 '15 at 19:17

score 1 · Answer 1 · answered Nov 03 '15 at 07:39

It could be as easy as deleting whole syncrepl section on one slave, than modify provider setting on the other slave to point to the first one.

As I understand, the syncrepl bind user, cn=sssd,dc=company,dc=com is replicated, so it's present in all nodes, so no need to change the authentication section.

Best luck, anyhow.

Master is Dead - Promote LDAP Slave to Master

1 Answers1