linux - OpenLDAP 错误 : entry -1 has no dn Slaptest won't work

Question

我正在尝试在 centOS 6.6 上配置 OPENLDAP，我已经通过 yum 安装程序安装了它，并下载了 openldap-server openldap-client openldap 2.4.39-8 版本。

我在 http://www.thegeekstuff.com/2015/01/openldap-linux/ http://dopensource.com/openldapforlinuxauth/

我继续并通过输入 slappasswd 添加了一个密码，它给了我一个 olcRootPW: {SSHA} 我在/etc/openldap/slapd.d/cn=config/olcDatabase={ 2}bdb.ldif

我也改变了olcsuffix:dc=my-domain,dc=com 到 olcsuffix:dc=mycompanyname,dc=com

olcRootDN:cn=Manager,dc=my-domain,dc=com 到 olcRootDN:cn=Manager,dc=mycompanyname,dc=com

我运行 ldaptest -u 来测试连接，但出现以下错误:5577050f ldif_read_file:“/etc/openldap/slapd.d/cn=config.ldif”上的校验和错误5577050f str2entry: 条目 -1 没有 dnslaptest:错误的配置文件!

我用谷歌搜索了上面的错误，但没有成功。

Below are my cn=config.ldif and my olcDatabase={2}bdb.ldif

/etc/openldap/slapd.d/cn=cconfig.ldif

# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 3db96e4e
dn: cn=config
objectClass: olcGlobal
cn: config
olcConfigFile: /usr/share/openldap-servers/slapd.conf.obsolete
olcConfigDir: /etc/openldap/slapd.d
olcAllows: bind_v2
olcArgsFile: /var/run/openldap/slapd.args
olcAttributeOptions: lang-
olcAuthzPolicy: none
olcConcurrency: 0
olcConnMaxPending: 100
olcConnMaxPendingAuth: 1000
olcGentleHUP: FALSE
olcIdleTimeout: 0
olcIndexSubstrIfMaxLen: 4
olcIndexSubstrIfMinLen: 2
olcIndexSubstrAnyLen: 4
olcIndexSubstrAnyStep: 2
olcIndexIntLen: 4
olcListenerThreads: 1
olcLocalSSF: 71
olcLogLevel: 0
olcPidFile: /var/run/openldap/slapd.pid
olcReadOnly: FALSE
olcReverseLookup: FALSE
olcSaslSecProps: noplain,noanonymous
olcSockbufMaxIncoming: 262143
olcSockbufMaxIncomingAuth: 16777215
olcThreads: 16
olcTLSCACertificatePath: /etc/openldap/certs
olcTLSCertificateFile: "OpenLDAP Server"
olcTLSCertificateKeyFile: /etc/openldap/certs/password
olcTLSVerifyClient: never
olcTLSProtocolMin: 0.0
olcToolThreads: 1
olcWriteTimeout: 0
structuralObjectClass: olcGlobal
entryUUID: 9b0553c8-9ffb-1034-96cd-7ddcc9b7a61f
creatorsName: cn=config
createTimestamp: 20150605182245Z
entryCSN: 20150605182245.037496Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20150605182245Z

and my /etc/openldap/slapd/cn=config/olcDatabase={2}bdb.ldif

# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 b7acf931
dn: olcDatabase={2}bdb
objectClass: olcDatabaseConfig
objectClass: olcBdbConfig
olcDatabase: {2}bdb
olcSuffix: dc=mycompany,dc=com
olcAddContentAcl: FALSE
olcLastMod: TRUE
olcMaxDerefDepth: 15
olcReadOnly: FALSE
olcRootDN: cn=Manager,dc=mycompany,dc=com
olcRootPW: {SSHA}XIThNMsDcLUdHPBsVQcr6P6Qn8lDr+9B
olcSyncUseSubentry: FALSE
olcMonitoring: TRUE
olcDbDirectory: /var/lib/ldap
olcDbCacheSize: 1000
olcDbCheckpoint: 1024 15
olcDbNoSync: FALSE
olcDbDirtyRead: FALSE
olcDbIDLcacheSize: 0
olcDbIndex: objectClass pres,eq
olcDbIndex: cn pres,eq,sub
olcDbIndex: uid pres,eq,sub
olcDbIndex: uidNumber pres,eq
olcDbIndex: gidNumber pres,eq
olcDbIndex: ou pres,eq,sub
olcDbIndex: mail pres,eq,sub
olcDbIndex: sn pres,eq,sub
olcDbIndex: givenName pres,eq,sub
olcDbIndex: memberUid pres,eq,sub
olcDbIndex: loginShell pres,eq
olcDbIndex: nisMapName pres,eq,sub
olcDbIndex: nisMapEntry pres,eq,sub
olcDbLinearIndex: FALSE
olcDbMode: 0600
olcDbSearchStack: 16
olcDbShmKey: 0
olcDbCacheFree: 1
olcDbDNcacheSize: 0
structuralObjectClass: olcBdbConfig
entryUUID: 9b06a840-9ffb-1034-96de-7ddcc9b7a61f
creatorsName: cn=config
createTimestamp: 20150605182245Z
entryCSN: 20150605182245.037496Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20150605182245Z
olcAccess: {0}to attrs=userPassword by self write by dn.base="cn=Manager,dc=mycompany,dc=com" write by anonymous auth by * none
olcAccess: {1}to * by dn.base="cn=Manager,dc=mycompany,dc=com" write by self write by * read 

Answer 1

如果您发现自己遵循要求您手动修改以以下内容开头的文件的说明:

# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.

考虑到您可能正在追求一条不太理想的路径。

---

CentOS 6 上的默认 openldap 安装包括以下 ACL，在 slapd.d/cn=config/olcDatabase={0}config.ldif 中定义:

olcAccess: {0}to *  by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,
  cn=auth" manage  by * none
olcAddContentAcl: TRUE

这允许您使用外部身份验证访问 cn=config 而无需使用 UID 0(“root”)的密码。看起来像:

ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=config"

有了这个访问权限，您几乎可以做任何您需要做的事情，包括修改目录树的后缀和根 dn。将以下内容放入 access.ldif:

dn: olcDatabase={2}bdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=mycompanyname,dc=com
-
replace: olcRootDN
olcRootDN: cn=manager,dc=mycompanyname,dc=com
-
replace: olcRootPW
olcRootPW: {SSHA}ZvsONlpgNnLlAqKDRQBFup/W+0/LXm5q

然后用它来修改配置:

# ldapmodify -Y EXTERNAL -H ldapi:/// -f access.ldif

现在您已经修改了目录后缀和密码，您可以将以下内容放入toplevel.ldif:

dn: dc=mycompanyname,dc=com
objectclass: dcObject
objectclass: organization
dc: mycompanyname
o: my company name

然后添加:

# ldapadd -D cn=manager,dc=mycompanyname,dc=com -w admin -f toplevel.ldif
adding new entry "dc=mycompanyname,dc=com"

现在您可以搜索它了:

# ldapsearch -x -b dc=mycompanyname,dc=com
# extended LDIF
#
# LDAPv3
# base <dc=mycompanyname,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# mycompanyname.com
dn: dc=mycompanyname,dc=com
objectClass: dcObject
objectClass: organization
dc: mycompanyname
o: my company name

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1