Hi Ryan,
thanks for the quick reply.
Would it be a challenge for Debian Edu to adapt and handle creating its
desired database directory itself?
No. See this simple debian-edu-config patch:
|--- diff --git a/cf3/cf.ldapserver b/cf3/cf.ldapserver index b973dfb3..78051d64 100644 --- a/cf3/cf.ldapserver +++ b/cf3/cf.ldapserver @@ -8,6 +8,12 @@ files: debian.server.installation:: + "/var/lib/ldap/." + create => "true", + perms => mog("700","openldap","openldap"); + "/etc/ldap/slapd.conf" link_from => ln_s("/etc/ldap/slapd-debian-edu-mdb.conf"), move_obstructions => "true"; diff --git a/debian/debian-edu-config.postinst b/debian/debian-edu-config.postinst index e4ba32c2..bfc1b6bf 100755 --- a/debian/debian-edu-config.postinst +++ b/debian/debian-edu-config.postinst @@ -153,6 +153,15 @@ configure) chmod 0755 /var/lib/debian-edu/ fi + mkdir -p /var/lib/ldap + if getent passwd openldap >/dev/null && getent group openldap >/dev/null; then + chown openldap:openldap /var/lib/ldap + fi + chmod 0700 /var/lib/ldap + fi # silence dovecot's message: if you have trouble with authentication failures, diff --git a/ldap-tools/ldap-debian-edu-install
b/ldap-tools/ldap-debian-edu-install index f1a8c762..908fbf77 100755 --- a/ldap-tools/ldap-debian-edu-install +++ b/ldap-tools/ldap-debian-edu-install @@ -183,6 +183,16 @@ dns_stop() { # Init tree init_ldap () { + mkdir -p /var/lib/ldap + if getent passwd openldap | grep -q openldap ; then + chown openldap:openldap /var/lib/ldap + fi + chmod 0700 /var/lib/ldap + rm -f /var/lib/ldap/* if [ -f /etc/shadow ] ; then |
We can apply it on our side if you prefer not to create the directory from
slapd.
Why slapd/no_configuration
slapd’s first-time wizard would create a generic |cn=config| and an initial MDB
(suffix/admin from debconf) that we would then have to tear down.
We ship a complete slapd.conf with extra schemas, ACLs, suffix
|dc=skole,dc=skolelinux,dc=no|, and admin DN |cn=admin,ou=ldap-access,...,| and
we slapadd a set of LDIFs during the main-server (Tjener) install using
cfengine.
That is exactly what slapd/no_configuration is for: skip slapd’s initial
configuration and database, we will do it ourselves.
Relevant files:
* Preseed (skip slapd’s wizard):
o
https://salsa.debian.org/debian-edu/debian-edu-install/-/blob/master/preseed-values/defaults.main-server
* Installer runs ldap-debian-edu-install via cfengine:
o
https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/cf3/cf.ldapserver
* Our slapd.conf, still using directory “/var/lib/ldap”:
o
https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/etc/ldap/slapd-debian-edu-mdb.conf
* Bootstrap: wipe /var/lib/ldap, slapadd the LDIFs, chown:
o
https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/ldap-tools/ldap-debian-edu-install
We do still use the documented Debian default path.
The template for slapd/no_configuration says no initial configuration or
database will be created; it does not say the default data directory will be
withheld.
Also /var/lib/ldap remains the openldap home in slapd.sysusers, olcDbDirectory
in slapd.init.ldif, and “The slapd database location is /var/lib/ldap” in
README.Debian.
An empty 0700 directory owned by openldap does not commit the admin to using it.
Not creating it would drop a side effect of adduser from before I was born. :)
thanks,
Daniel
--
Daniel Teichmann
DAS-NETZWERKTEAM
Telefon: 0176 322 774 51
GnuPG Key ID: ED9F2F7A36E0D99349CC1940B500EFC78100A778
[email protected],https://das-netzwerkteam.de
​
