Linux System Administration Recipes A Problem-Solution Approach

CHAPTER 2 ■ CENTRALIZING YOUR NETWORK: KERBEROS, LDAP, AND NFSTo import an existing LDAP database, run this:/etc/init.d/slapd stopslapadd -l existing_database.ldif/etc/init.d/slapd startwhere existing_database.ldif is an LDIF dump of an existing database, obtained by the following, runfrom the machine where the existing database and LDAP server lives:/etc/init.d/slapd stop; /usr/sbin/slapcat -l existing_database.ldif;/etc/init.d/slapd startYou may need to empty the target database first, if you’ve been experimenting with it.Remove the rootdn and rootpw entries from /etc/ldap/slapd.conf. They’re just used to get youstarted (after which you should be using Kerberos to handle admin)./etc/init.d/slapd start/etc/init.d/slapd stopNow import the database as earlier.If you have startup problems, check that the database directory is owned by the LDAP user(openldap on Debian).Finally, you need to make sure that there are no password references in your user database.Kerberos will be handling passwords for you, and the easiest way to make this happen is simply toremove all password references from LDAP.Use ldapsearch to get the attributes for any user:kinit ldapadmldapsearch (“uid=jkemp”)Look for any password attributes.dn: uid=jkemp,ou=People,dc=example.comuid: jkempcn: Juliet KempobjectClass: accountobjectClass: posixAccountobjectClass: topobjectClass: shadowAccountuserPassword: HASHshadowLastChange: 13166shadowMax: 99999shadowWarning: 7uidNumber: 444gidNumber: 2222homeDirectory: /home/jkempgecos: Juliet KemploginShell: /bin/bashHere the field is userPassword. Depending on where you got your database from, your setup mayhave a slightly different field name.36Download at WoweBook.Com