Syncrepl

ldap master

dump the config database to a text file

• master:$ slapcat -F /etc/ldap/slapd.d -b cn=config -l config.ldif

replicate account

erstellen

cat admin.ldif

dn: ou=admins,dc=linuggs,dc=de
objectClass: organizationalUnit
ou: admins
       
dn: uid=replicate,ou=admins,dc=linuggs,dc=de
cn: replicate
objectClass: posixAccount
objectClass: shadowAccount
objectClass: Account
objectClass: top
uid: replicate
uidNumber:  9001
gidNumber:  9001
homeDirectory: /home/replicate
loginShell: /bin/bash

• ldapadd -xD cn=admin,dc=linuggs,dc=de" -w geheim -f admin.ldif

acl anpassen

cat acl.ldif

dn: olcDatabase={1}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {2}to * by self write by dn="cn=admin,dc=xinux,dc=de" write by dn="uid=replicate,ou=admins,dc=xinux,dc=de" read   by * read

• ldapmodify -Y EXTERNAL -H ldapi:/// -f acl.ldif

syncprov hinzufügen

modul

cat syncprov.ldif

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: syncprov

• ldapmodify -Y EXTERNAL -H ldapi:/// -f syncprov.ldif

objekt

cat syncprov.ldif

dn: olcOverlay={0}syncprov, olcDatabase={1}hdb,cn=config
changetype: modify
objectclass: olcSyncProvConfig
olcOverlay: syncprov
olcSpCheckpoint: 100 10
-
add: olcSpSessionlog
olcSpSessionlog: 100

• ldapmodify -Y EXTERNAL -H ldapi:/// -f syncprov.ldif

kopieren auch den slave

• master:$ scp config.ldif slave:

ldap slave

• slave:$ service slapd stop

anpassen der TLS parameter

config.ldif

olcTLSCACertificateFile: /etc/ldap/ssl/lin-ca.crt
olcTLSCertificateFile: /etc/ldap/ssl/slave.linnugs.de.crt
olcTLSCertificateKeyFile: /etc/ldap/ssl/slave.linuggs.de.key

einspielen der datenbank

• slave:$ rm -r /etc/ldap/slapd.d/*
• slave:$ slapadd -F /etc/ldap/slapd.d -b cn=config -l config.ldif
• slave:$ chown -R openldap.openldap /etc/ldap/slapd.d
• slave:$ service slapd start

slave konfigurieren

cat syncprov.ldif

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: syncprov

• ldapmodify -Y EXTERNAL -H ldapi:/// -f syncprov.ldif

cat index.ldif

# syncrepl specific indices
dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: entryUUID eq

• ldapmodify -Y EXTERNAL -H ldapi:/// -f index.ldif

cat syncrepl.ldif

# syncrepl specific indices
dn: olcDatabase={1}hdb,cn=config
changetype: modify
replace: olcSyncRepl
olcSyncRepl: rid=00 provider=ldap://master.linuggs.de type=refreshAndPersist retry="5 5 300 +" searchbase="dc=linuggs,dc=de"  attrs="*,+"   bindmethod=simple binddn="uid=replicate,ou=admins,dc=linuggs,dc=de" credentials=suxer

• ldapmodify -Y EXTERNAL -H ldapi:/// -f syncrepl.ldif

• rid=00 -> Replizierungs ID
• provider=ldaps://master.linuggs.de -> Masterslapd hier über ldaps
• type=refreshAndPersist ->

retry="20 5 300 +" -> siehe unten 
searchbase="dc=linuggs,dc=de" -> Zu replzierende Wurzel 
attrs="*,+"   -> repliziere alles
bindmethod=simple  -> einfache Authentifizierung
binddn="uid=replicate,ou=admins,dc=linuggs,dc=de"  -> Account auf dem Masterslapd 
credentials=suxer -> Passwort auf dem Masterslapd

Links

• http://www.zytrax.com/books/ldap/ch7/#ol-syncrepl
• http://www.fxp0.org.ua/2006/sep/22/ldap-replication-setup-using-syncrepl/
• http://gagravarr.livejournal.com/145679.html
• http://www.openldap.org/doc/admin24/replication.html
• http://www.openldap.org/doc/admin24/slapdconfig.html#syncrepl