~$ rpm -q --scripts openldap-servers ... postinstall scriptlet (using /bin/sh): ... # generate sample TLS certificate for server (will not replace) /usr/libexec/openldap/generate-server-cert.sh -o &>/dev/null || :
# generate/upgrade configuration if [ ! -f /etc/openldap/slapd.d/cn=config.ldif ]; then if [ -f /etc/openldap/slapd.conf ]; then /usr/libexec/openldap/convert-config.sh &>/dev/null mv /etc/openldap/slapd.conf /etc/openldap/slapd.conf.bak else /usr/libexec/openldap/convert-config.sh -f /usr/share/openldap-servers/slapd.ldif &>/dev/null fi fi ...
# debian/slapd.postinst postinst_initial_configuration() { # {{{ # Configure slapd for the first time (when first installed) # Usage: postinst_initial_configuration
if manual_configuration_wanted; then echo" Omitting slapd configuration as requested." >&2 else crypt_admin_pass create_new_configuration fi }
# Configuration. if is_initial_configuration "$@"; then postinst_initial_configuration else postinst_upgrade_configuration fi
# debian/slapd.scripts-common create_new_configuration() { # {{{ # Create a new configuration and directory
local basedn dc backend
# For the domain really.argh.org we create the basedn # dc=really,dc=argh,dc=org with the dc entry dc: really db_get slapd/domain basedn="dc=`echo $RET | sed 's/^\.//; s/\.$//; s/\./,dc=/g'`" dc="`echo $RET | sed 's/^\.//; s/\..*$//'`"
~$ vi root.ldif dn: dc=runsisi,dc=com objectClass: top objectClass: dcObject objectClass: organization dc: runsisi o: my own company
注意这里的 dn 需要与用户数据库中定义的 olcSuffix 一致（即用户数据库与用户 DIT 两者的名称空间命名要一致），否则会报如下的错：
1 2 3 4
~# slapadd -F /etc/openldap/slapd.d/ -n 2 -l root.ldif slapadd: line 1: database #2 (dc=runsisi,dc=com) not configured to hold "dc=hustlrb,dc=com"; no database configured for that naming context _#################### 100.00% eta none elapsed none fast! Closing DB...
--- /usr/share/slapd/slapd.init.ldif 2018-10-23 21:01:47.000000000 +0800 +++ slapd.init.ldif 2019-06-05 15:38:56.773924017 +0800 @@ -49,32 +49,32 @@ cn: module{0} # Where the dynamically loaded modules are stored olcModulePath: /usr/lib/ldap -olcModuleLoad: back_@BACKEND@ +olcModuleLoad: back_mdb
# Set defaults for the backend -dn: olcBackend=@BACKEND@,cn=config +dn: olcBackend=mdb,cn=config objectClass: olcBackendConfig -olcBackend: @BACKEND@ +olcBackend: mdb
# The database definition. -dn: olcDatabase=@BACKEND@,cn=config +dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig -objectClass: @BACKENDOBJECTCLASS@ -olcDatabase: @BACKEND@ +objectClass: olcMdbConfig +olcDatabase: mdb # Checkpoint the database periodically in case of system # failure and to speed slapd shutdown. olcDbCheckpoint: 512 30 -@BACKENDOPTIONS@ +olcDbMaxSize: 1073741824 # Save the time that the entry gets modified, for database #1 olcLastMod: TRUE # The base of your directory in database #1 -olcSuffix: @SUFFIX@ +olcSuffix: dc=runsisi,dc=com # Where the database file are physically stored for database #1 olcDbDirectory: /var/lib/ldap # olcRootDN directive for specifying a superuser on the database. This # is needed for syncrepl. -olcRootDN: cn=admin,@SUFFIX@ -olcRootPW: @PASSWORD@ +olcRootDN: cn=admin,dc=runsisi,dc=com +olcRootPW: {SSHA}UNC/GjBr74HdBGx92smagS0sjP0HhT2u # Indexing options for database #1 olcDbIndex: objectClass eq olcDbIndex: cn,uid eq
~$ vi root.ldif dn: dc=runsisi,dc=com objectClass: top objectClass: dcObject objectClass: organization dc: runsisi o: my own company
注意这里的 dn 需要与用户数据库中定义的 olcSuffix 一致（即用户数据库与用户 DIT 两者的名称空间命名要一致），否则会报如下的错：
1 2 3 4
~# slapadd -F /etc/ldap/slapd.d/ -n 1 -l root.ldif slapadd: line 1: database #1 (dc=runsisi,dc=com) not configured to hold "dc=hustlrb,dc=com"; no database configured for that naming context _#################### 100.00% eta none elapsed none fast! Closing DB...
