Package: slapd
Version: 2.6.14+dfsg-1
Severity: important
Tags: patch
slapd: /var/lib/ldap is not created when slapd/no_configuration is set
When slapd is installed with “slapd/no_configuration=true” (manual
configuration, as done e.g. by the Debian Edu installer for the main server
Tjener), /var/lib/ldap is no longer created since openldap 2.6.13+dfsg-1,
breaking slapadd, slapd itself and the Debian Edu tjener LDAP bootstrap.
Since 2.6.13+dfsg-1 the openldap user is created via systemd-sysusers
(debian/slapd.sysusers) instead of adduser.
The previous code ran |# adduser --system --home /var/lib/ldap --shell
/bin/false ...| which creates the home directory as a side effect.
systemd-sysusers only sets the home directory field in the user database and
does not create the directory.
The postinst only creates /var/lib/ldap via create_ldap_directories() in the
initial debconf-driven configuration path, which is skipped when manual
configuration is requested.
Nothing creates the directory then, so slapadd fails with “mdb_open: cannot
open database directory /var/lib/ldap” and the Debian Edu Tjener LDAP bootstrap
aborts during installation.
How to reproduce
1.
|# debootstrap forky ./tmp-forky-bootstrap http://deb.debian.org/debian|
2.
|# chroot ./tmp-forky-bootstrap /bin/bash|
3.
Preseed:
|# echo "slapd slapd/no_configuration boolean true" | debconf-set-selections|
(the full main-server preseed is in debian-edu-install package at
preseed-values/defaults.main-server)
4.
|# DEBIAN_FRONTEND=noninteractive apt-get install -y slapd|
5.
|# ls -ld /var/lib/ldap| # -> No such file or directory
With 2.6.10+dfsg-1 (trixie) the directory exists after installation (created by
adduser), so this is a regression introduced by 2.6.13+dfsg-1.
--
Daniel Teichmann
DAS-NETZWERKTEAM
Telefon: 0176 322 774 51
GnuPG Key ID: ED9F2F7A36E0D99349CC1940B500EFC78100A778
[email protected],https://das-netzwerkteam.de
​
From: Daniel Teichmann <[email protected]>
Date: Tue, 18 Aug 2026 14:35:28 +0200
Subject: [PATCH] Ensure /var/lib/ldap is created even with manual
configuration
Since 2.6.13+dfsg-1 the openldap user is created via systemd-sysusers,
which only sets the home directory field in the user database but does
not create the directory, unlike the adduser call it replaced. When
slapd/no_configuration is set (manual configuration, as done by Debian
Edu), create_ldap_directories was never reached, so /var/lib/ldap was
not created, breaking slapadd and the Debian Edu tjener LDAP bootstrap.
Create the directory unconditionally in postinst.
---
debian/slapd.postinst | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/debian/slapd.postinst b/debian/slapd.postinst
index 764a80f1c..f15ccc730 100644
--- a/debian/slapd.postinst
+++ b/debian/slapd.postinst
@@ -60,6 +60,12 @@ ignore_init_failure() { # {{{
# Create the openldap user/group early, before chown calls below.
if [ "$MODE" = "configure" ] || [ "$MODE" = "reconfigure" ] ; then
systemd-sysusers ${DPKG_ROOT:+--root="$DPKG_ROOT"} slapd.conf
+ # systemd-sysusers only sets the home directory field in the user
+ # database, it does not create the home directory itself.
+ # Create it unconditionally since it is required even when
+ # slapd/no_configuration is set (manual configuration, e.g. by
+ # Debian Edu)
+ create_ldap_directories
fi
# Initialize the FAILED_TO_UPGRADE_CONFIGURATION variable to 0. This
