slapd: /var/lib/ldap is not created when slapd/no_configuration is set

When slapd is installed with “slapd/no_configuration=true” (manual configuration, as done e.g. by the Debian Edu installer for the main server Tjener), /var/lib/ldap is no longer created since openldap 2.6.13+dfsg-1, breaking slapadd, slapd itself and the Debian Edu tjener LDAP bootstrap.

Since 2.6.13+dfsg-1 the openldap user is created via systemd-sysusers (debian/slapd.sysusers) instead of adduser.
The previous code ran |# adduser --system --home /var/lib/ldap --shell /bin/false ...| which creates the home directory as a side effect.

systemd-sysusers only sets the home directory field in the user database and does not create the directory.

The postinst only creates /var/lib/ldap via create_ldap_directories() in the initial debconf-driven configuration path, which is skipped when manual configuration is requested.

Nothing creates the directory then, so slapadd fails with “mdb_open: cannot open database directory /var/lib/ldap” and the Debian Edu Tjener LDAP bootstrap aborts during installation.


  How to reproduce

 1.

    |# debootstrap forky ./tmp-forky-bootstrap http://deb.debian.org/debian|

 2.

    |# chroot ./tmp-forky-bootstrap /bin/bash|

 3.

    Preseed:
    |# echo "slapd slapd/no_configuration boolean true" | debconf-set-selections|
    (the full main-server preseed is in debian-edu-install package at preseed-values/defaults.main-server)

 4.

    |# DEBIAN_FRONTEND=noninteractive apt-get install -y slapd|

 5.

    |# ls -ld /var/lib/ldap| # -> No such file or directory

With 2.6.10+dfsg-1 (trixie) the directory exists after installation (created by adduser), so this is a regression introduced by 2.6.13+dfsg-1.

Hello, thanks for the report.

I apologize for the unexpected and undocumented change.

I'm actually wondering if the change might be an improvement. When
slapd/no_configuration is requested, we don't know where the database
will eventually be stored, or whether a file-backed one will even be
used. I don't see a reason to assume the admin will use, or wants,
/var/lib/ldap.

To put it differently, if someone had opened a bug pointing out that
slapd/no_configuration still created an unnecessary /var/lib/ldap
directory, I might have acted on it.

Would it be a challenge for Debian Edu to adapt and handle creating its
desired database directory itself?

Would you mind pointing me to the relevant code that installs and
configures slapd for Debian Edu? I'm interested in why
slapd/no_configuration is the best solution for its needs.

thanks,
Ryan

Hello, thanks for the report.

I apologize for the unexpected and undocumented change.

I'm actually wondering if the change might be an improvement. When
slapd/no_configuration is requested, we don't know where the database
will eventually be stored, or whether a file-backed one will even be
used. I don't see a reason to assume the admin will use, or wants,
/var/lib/ldap.

To put it differently, if someone had opened a bug pointing out that
slapd/no_configuration still created an unnecessary /var/lib/ldap
directory, I might have acted on it.

Would it be a challenge for Debian Edu to adapt and handle creating its
desired database directory itself?

Would you mind pointing me to the relevant code that installs and
configures slapd for Debian Edu? I'm interested in why
slapd/no_configuration is the best solution for its needs.

thanks,
Ryan

Hi Ryan,

thanks for the quick reply.

    Would it be a challenge for Debian Edu to adapt and handle creating its desired database directory itself?

No. See this simple debian-edu-config patch:

|--- diff --git a/cf3/cf.ldapserver b/cf3/cf.ldapserver index b973dfb3..78051d64 100644 --- a/cf3/cf.ldapserver +++ b/cf3/cf.ldapserver @@ -8,6 +8,12 @@ files: debian.server.installation:: + "/var/lib/ldap/." + create => "true", + perms => mog("700","openldap","openldap"); + "/etc/ldap/slapd.conf" link_from => ln_s("/etc/ldap/slapd-debian-edu-mdb.conf"), move_obstructions => "true"; diff --git a/debian/debian-edu-config.postinst b/debian/debian-edu-config.postinst index e4ba32c2..bfc1b6bf 100755 --- a/debian/debian-edu-config.postinst +++ b/debian/debian-edu-config.postinst @@ -153,6 +153,15 @@ configure) chmod 0755 /var/lib/debian-edu/ fi + mkdir -p /var/lib/ldap + if getent passwd openldap >/dev/null && getent group openldap >/dev/null; then + chown openldap:openldap /var/lib/ldap + fi + chmod 0700 /var/lib/ldap + fi # silence dovecot's message: if you have trouble with authentication failures, diff --git a/ldap-tools/ldap-debian-edu-install
b/ldap-tools/ldap-debian-edu-install index f1a8c762..908fbf77 100755 --- a/ldap-tools/ldap-debian-edu-install +++ b/ldap-tools/ldap-debian-edu-install @@ -183,6 +183,16 @@ dns_stop() { # Init tree init_ldap () { + mkdir -p /var/lib/ldap + if getent passwd openldap | grep -q openldap ; then + chown openldap:openldap /var/lib/ldap + fi + chmod 0700 /var/lib/ldap + rm -f /var/lib/ldap/* if [ -f /etc/shadow ] ; then |

We can apply it on our side if you prefer not to create the directory from slapd.


  Why slapd/no_configuration

slapd’s first-time wizard would create a generic |cn=config| and an initial MDB (suffix/admin from debconf) that we would then have to tear down.
We ship a complete slapd.conf with extra schemas, ACLs, suffix |dc=skole,dc=skolelinux,dc=no|, and admin DN |cn=admin,ou=ldap-access,...,| and we slapadd a set of LDIFs during the main-server (Tjener) install using cfengine.

That is exactly what slapd/no_configuration is for: skip slapd’s initial configuration and database, we will do it ourselves.

Relevant files:

  * Preseed (skip slapd’s wizard):
      o https://salsa.debian.org/debian-edu/debian-edu-install/-/blob/master/preseed-values/defaults.main-server
  * Installer runs ldap-debian-edu-install via cfengine:
      o https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/cf3/cf.ldapserver
  * Our slapd.conf, still using directory “/var/lib/ldap”:
      o https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/etc/ldap/slapd-debian-edu-mdb.conf
  * Bootstrap: wipe /var/lib/ldap, slapadd the LDIFs, chown:
      o https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/ldap-tools/ldap-debian-edu-install

We do still use the documented Debian default path.
The template for slapd/no_configuration says no initial configuration or database will be created; it does not say the default data directory will be withheld.

Also /var/lib/ldap remains the openldap home in slapd.sysusers, olcDbDirectory in slapd.init.ldif, and “The slapd database location is /var/lib/ldap” in README.Debian.

An empty 0700 directory owned by openldap does not commit the admin to using it.
Not creating it would drop a side effect of adduser from before I was born. :)

thanks,
Daniel

Hi Ryan,

thanks for the quick reply.

    Would it be a challenge for Debian Edu to adapt and handle creating its desired database directory itself?

No. See this simple debian-edu-config patch:

|--- diff --git a/cf3/cf.ldapserver b/cf3/cf.ldapserver index b973dfb3..78051d64 100644 --- a/cf3/cf.ldapserver +++ b/cf3/cf.ldapserver @@ -8,6 +8,12 @@ files: debian.server.installation:: + "/var/lib/ldap/." + create => "true", + perms => mog("700","openldap","openldap"); + "/etc/ldap/slapd.conf" link_from => ln_s("/etc/ldap/slapd-debian-edu-mdb.conf"), move_obstructions => "true"; diff --git a/debian/debian-edu-config.postinst b/debian/debian-edu-config.postinst index e4ba32c2..bfc1b6bf 100755 --- a/debian/debian-edu-config.postinst +++ b/debian/debian-edu-config.postinst @@ -153,6 +153,15 @@ configure) chmod 0755 /var/lib/debian-edu/ fi + mkdir -p /var/lib/ldap + if getent passwd openldap >/dev/null && getent group openldap >/dev/null; then + chown openldap:openldap /var/lib/ldap + fi + chmod 0700 /var/lib/ldap + fi # silence dovecot's message: if you have trouble with authentication failures, diff --git a/ldap-tools/ldap-debian-edu-install
b/ldap-tools/ldap-debian-edu-install index f1a8c762..908fbf77 100755 --- a/ldap-tools/ldap-debian-edu-install +++ b/ldap-tools/ldap-debian-edu-install @@ -183,6 +183,16 @@ dns_stop() { # Init tree init_ldap () { + mkdir -p /var/lib/ldap + if getent passwd openldap | grep -q openldap ; then + chown openldap:openldap /var/lib/ldap + fi + chmod 0700 /var/lib/ldap + rm -f /var/lib/ldap/* if [ -f /etc/shadow ] ; then |

We can apply it on our side if you prefer not to create the directory from slapd.


  Why slapd/no_configuration

slapd’s first-time wizard would create a generic |cn=config| and an initial MDB (suffix/admin from debconf) that we would then have to tear down.
We ship a complete slapd.conf with extra schemas, ACLs, suffix |dc=skole,dc=skolelinux,dc=no|, and admin DN |cn=admin,ou=ldap-access,...,| and we slapadd a set of LDIFs during the main-server (Tjener) install using cfengine.

That is exactly what slapd/no_configuration is for: skip slapd’s initial configuration and database, we will do it ourselves.

Relevant files:

  * Preseed (skip slapd’s wizard):
      o https://salsa.debian.org/debian-edu/debian-edu-install/-/blob/master/preseed-values/defaults.main-server
  * Installer runs ldap-debian-edu-install via cfengine:
      o https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/cf3/cf.ldapserver
  * Our slapd.conf, still using directory “/var/lib/ldap”:
      o https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/etc/ldap/slapd-debian-edu-mdb.conf
  * Bootstrap: wipe /var/lib/ldap, slapadd the LDIFs, chown:
      o https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/ldap-tools/ldap-debian-edu-install

We do still use the documented Debian default path.
The template for slapd/no_configuration says no initial configuration or database will be created; it does not say the default data directory will be withheld.

Also /var/lib/ldap remains the openldap home in slapd.sysusers, olcDbDirectory in slapd.init.ldif, and “The slapd database location is /var/lib/ldap” in README.Debian.

An empty 0700 directory owned by openldap does not commit the admin to using it.
Not creating it would drop a side effect of adduser from before I was born. :)

thanks,
Daniel

Oof, i’ve f’ed up setting up my mail client…

see attachment for the patch please :)

Greetings Daniel

–
Daniel Teichmann
DAS-NETZWERKTEAM
Telefon: 0176 322 774 51
GnuPG Key ID: ED9F2F7A36E0D99349CC1940B500EFC78100A778
daniel.teichmann@das-netzwerkteam.de, https://das-netzwerkteam.de

​
​

Oof, i’ve f’ed up setting up my mail client…

see attachment for the patch please :)

Greetings Daniel

–
Daniel Teichmann
DAS-NETZWERKTEAM
Telefon: 0176 322 774 51
GnuPG Key ID: ED9F2F7A36E0D99349CC1940B500EFC78100A778
daniel.teichmann@das-netzwerkteam.de, https://das-netzwerkteam.de

​
​

Hi, sorry for the slow response.

I decided I will fix the bug and restore the behaviour from trixie and
earlier (always create /var/lib/ldap).

I just haven't had time to actually test and upload the fix. Will do it
within the week.