Commit 1fe59d33 authored by Howard Chu's avatar Howard Chu
Browse files

More conversion notes

parent c26e71de
......@@ -1104,27 +1104,37 @@ E: 52. olcAccess: to * by users read
H2: Converting old style {{slapd.conf}}(5) file to {{cn=config}} format
Before converting to the {{cn=config}} format you should make sure that the
config backend is properly configured in your existing config file.
config backend is properly configured in your existing config file. While
the config backend is always present inside slapd, by default it is only
accessible by its rootDN, and there are no default credentials assigned
so unless you explicitly configure a means to authenticate to it, it will be
unusable.
If you do not already have a {{EX:database config}} section, add something
like this to the end of {{EX:slapd.conf}}
> database config
>
> rootdn "cn=config"
> rootpw secret
> rootpw VerySecret
Note: Since the config backend can be used to load arbitrary code into the
slapd process, it is extremely important to carefully guard whatever
credentials are used to access it. Since simple passwords are vulnerable to
password guessing attacks, it is usually better to omit the rootpw and only
use SASL authentication for the config rootDN.
An existing {{slapd.conf}}(5) file can be converted to the new format using
{{slaptest}}(8) or any of the slap tools:
> slaptest -f /usr/local/etc/openldap/slapd.conf -F /usr/local/etc/openldap/slapd.d
Test that you can access entries under {{EX:cn=config}} using the {{rootdn}}
and {{rootpw}} configured above:
Test that you can access entries under {{EX:cn=config}} using the
default {{rootdn}} and the {{rootpw}} configured above:
> ldapsearch -x -D cn=config -w secret -b cn=config
> ldapsearch -x -D cn=config -w VerySecret -b cn=config
You can then discard the old {{slapd.conf}}(5) file. Make sure to launch
{{slapd}}(8) with the {{-F}} option to specify the configuration directory.
{{slapd}}(8) with the {{-F}} option to specify the configuration directory
if you are not using the default directory path.
Note: When converting from the slapd.conf format to slapd.d format, any
included files will also be integrated into the resulting configuration
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment