slapd: /var/lib/ldap is not created when slapd/no_configuration is set

When slapd is installed with “slapd/no_configuration=true” (manual configuration, as done e.g. by the Debian Edu installer for the main server Tjener), /var/lib/ldap is no longer created since openldap 2.6.13+dfsg-1, breaking slapadd, slapd itself and the Debian Edu tjener LDAP bootstrap.

Since 2.6.13+dfsg-1 the openldap user is created via systemd-sysusers (debian/slapd.sysusers) instead of adduser.
The previous code ran |# adduser --system --home /var/lib/ldap --shell /bin/false ...| which creates the home directory as a side effect.

systemd-sysusers only sets the home directory field in the user database and does not create the directory.

The postinst only creates /var/lib/ldap via create_ldap_directories() in the initial debconf-driven configuration path, which is skipped when manual configuration is requested.

Nothing creates the directory then, so slapadd fails with “mdb_open: cannot open database directory /var/lib/ldap” and the Debian Edu Tjener LDAP bootstrap aborts during installation.


  How to reproduce

 1.

    |# debootstrap forky ./tmp-forky-bootstrap http://deb.debian.org/debian|

 2.

    |# chroot ./tmp-forky-bootstrap /bin/bash|

 3.

    Preseed:
    |# echo "slapd slapd/no_configuration boolean true" | debconf-set-selections|
    (the full main-server preseed is in debian-edu-install package at preseed-values/defaults.main-server)

 4.

    |# DEBIAN_FRONTEND=noninteractive apt-get install -y slapd|

 5.

    |# ls -ld /var/lib/ldap| # -> No such file or directory

With 2.6.10+dfsg-1 (trixie) the directory exists after installation (created by adduser), so this is a regression introduced by 2.6.13+dfsg-1.

Hello, thanks for the report.

I apologize for the unexpected and undocumented change.

I'm actually wondering if the change might be an improvement. When
slapd/no_configuration is requested, we don't know where the database
will eventually be stored, or whether a file-backed one will even be
used. I don't see a reason to assume the admin will use, or wants,
/var/lib/ldap.

To put it differently, if someone had opened a bug pointing out that
slapd/no_configuration still created an unnecessary /var/lib/ldap
directory, I might have acted on it.

Would it be a challenge for Debian Edu to adapt and handle creating its
desired database directory itself?

Would you mind pointing me to the relevant code that installs and
configures slapd for Debian Edu? I'm interested in why
slapd/no_configuration is the best solution for its needs.

thanks,
Ryan

Hello, thanks for the report.

I apologize for the unexpected and undocumented change.

I'm actually wondering if the change might be an improvement. When
slapd/no_configuration is requested, we don't know where the database
will eventually be stored, or whether a file-backed one will even be
used. I don't see a reason to assume the admin will use, or wants,
/var/lib/ldap.

To put it differently, if someone had opened a bug pointing out that
slapd/no_configuration still created an unnecessary /var/lib/ldap
directory, I might have acted on it.

Would it be a challenge for Debian Edu to adapt and handle creating its
desired database directory itself?

Would you mind pointing me to the relevant code that installs and
configures slapd for Debian Edu? I'm interested in why
slapd/no_configuration is the best solution for its needs.

thanks,
Ryan

Hi Ryan,

thanks for the quick reply.

    Would it be a challenge for Debian Edu to adapt and handle creating its desired database directory itself?

No. See this simple debian-edu-config patch:

|--- diff --git a/cf3/cf.ldapserver b/cf3/cf.ldapserver index b973dfb3..78051d64 100644 --- a/cf3/cf.ldapserver +++ b/cf3/cf.ldapserver @@ -8,6 +8,12 @@ files: debian.server.installation:: + "/var/lib/ldap/." + create => "true", + perms => mog("700","openldap","openldap"); + "/etc/ldap/slapd.conf" link_from => ln_s("/etc/ldap/slapd-debian-edu-mdb.conf"), move_obstructions => "true"; diff --git a/debian/debian-edu-config.postinst b/debian/debian-edu-config.postinst index e4ba32c2..bfc1b6bf 100755 --- a/debian/debian-edu-config.postinst +++ b/debian/debian-edu-config.postinst @@ -153,6 +153,15 @@ configure) chmod 0755 /var/lib/debian-edu/ fi + mkdir -p /var/lib/ldap + if getent passwd openldap >/dev/null && getent group openldap >/dev/null; then + chown openldap:openldap /var/lib/ldap + fi + chmod 0700 /var/lib/ldap + fi # silence dovecot's message: if you have trouble with authentication failures, diff --git a/ldap-tools/ldap-debian-edu-install
b/ldap-tools/ldap-debian-edu-install index f1a8c762..908fbf77 100755 --- a/ldap-tools/ldap-debian-edu-install +++ b/ldap-tools/ldap-debian-edu-install @@ -183,6 +183,16 @@ dns_stop() { # Init tree init_ldap () { + mkdir -p /var/lib/ldap + if getent passwd openldap | grep -q openldap ; then + chown openldap:openldap /var/lib/ldap + fi + chmod 0700 /var/lib/ldap + rm -f /var/lib/ldap/* if [ -f /etc/shadow ] ; then |

We can apply it on our side if you prefer not to create the directory from slapd.


  Why slapd/no_configuration

slapd’s first-time wizard would create a generic |cn=config| and an initial MDB (suffix/admin from debconf) that we would then have to tear down.
We ship a complete slapd.conf with extra schemas, ACLs, suffix |dc=skole,dc=skolelinux,dc=no|, and admin DN |cn=admin,ou=ldap-access,...,| and we slapadd a set of LDIFs during the main-server (Tjener) install using cfengine.

That is exactly what slapd/no_configuration is for: skip slapd’s initial configuration and database, we will do it ourselves.

Relevant files:

  * Preseed (skip slapd’s wizard):
      o https://salsa.debian.org/debian-edu/debian-edu-install/-/blob/master/preseed-values/defaults.main-server
  * Installer runs ldap-debian-edu-install via cfengine:
      o https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/cf3/cf.ldapserver
  * Our slapd.conf, still using directory “/var/lib/ldap”:
      o https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/etc/ldap/slapd-debian-edu-mdb.conf
  * Bootstrap: wipe /var/lib/ldap, slapadd the LDIFs, chown:
      o https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/ldap-tools/ldap-debian-edu-install

We do still use the documented Debian default path.
The template for slapd/no_configuration says no initial configuration or database will be created; it does not say the default data directory will be withheld.

Also /var/lib/ldap remains the openldap home in slapd.sysusers, olcDbDirectory in slapd.init.ldif, and “The slapd database location is /var/lib/ldap” in README.Debian.

An empty 0700 directory owned by openldap does not commit the admin to using it.
Not creating it would drop a side effect of adduser from before I was born. :)

thanks,
Daniel

Hi Ryan,

thanks for the quick reply.

    Would it be a challenge for Debian Edu to adapt and handle creating its desired database directory itself?

No. See this simple debian-edu-config patch:

|--- diff --git a/cf3/cf.ldapserver b/cf3/cf.ldapserver index b973dfb3..78051d64 100644 --- a/cf3/cf.ldapserver +++ b/cf3/cf.ldapserver @@ -8,6 +8,12 @@ files: debian.server.installation:: + "/var/lib/ldap/." + create => "true", + perms => mog("700","openldap","openldap"); + "/etc/ldap/slapd.conf" link_from => ln_s("/etc/ldap/slapd-debian-edu-mdb.conf"), move_obstructions => "true"; diff --git a/debian/debian-edu-config.postinst b/debian/debian-edu-config.postinst index e4ba32c2..bfc1b6bf 100755 --- a/debian/debian-edu-config.postinst +++ b/debian/debian-edu-config.postinst @@ -153,6 +153,15 @@ configure) chmod 0755 /var/lib/debian-edu/ fi + mkdir -p /var/lib/ldap + if getent passwd openldap >/dev/null && getent group openldap >/dev/null; then + chown openldap:openldap /var/lib/ldap + fi + chmod 0700 /var/lib/ldap + fi # silence dovecot's message: if you have trouble with authentication failures, diff --git a/ldap-tools/ldap-debian-edu-install
b/ldap-tools/ldap-debian-edu-install index f1a8c762..908fbf77 100755 --- a/ldap-tools/ldap-debian-edu-install +++ b/ldap-tools/ldap-debian-edu-install @@ -183,6 +183,16 @@ dns_stop() { # Init tree init_ldap () { + mkdir -p /var/lib/ldap + if getent passwd openldap | grep -q openldap ; then + chown openldap:openldap /var/lib/ldap + fi + chmod 0700 /var/lib/ldap + rm -f /var/lib/ldap/* if [ -f /etc/shadow ] ; then |

We can apply it on our side if you prefer not to create the directory from slapd.


  Why slapd/no_configuration

slapd’s first-time wizard would create a generic |cn=config| and an initial MDB (suffix/admin from debconf) that we would then have to tear down.
We ship a complete slapd.conf with extra schemas, ACLs, suffix |dc=skole,dc=skolelinux,dc=no|, and admin DN |cn=admin,ou=ldap-access,...,| and we slapadd a set of LDIFs during the main-server (Tjener) install using cfengine.

That is exactly what slapd/no_configuration is for: skip slapd’s initial configuration and database, we will do it ourselves.

Relevant files:

  * Preseed (skip slapd’s wizard):
      o https://salsa.debian.org/debian-edu/debian-edu-install/-/blob/master/preseed-values/defaults.main-server
  * Installer runs ldap-debian-edu-install via cfengine:
      o https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/cf3/cf.ldapserver
  * Our slapd.conf, still using directory “/var/lib/ldap”:
      o https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/etc/ldap/slapd-debian-edu-mdb.conf
  * Bootstrap: wipe /var/lib/ldap, slapadd the LDIFs, chown:
      o https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/ldap-tools/ldap-debian-edu-install

We do still use the documented Debian default path.
The template for slapd/no_configuration says no initial configuration or database will be created; it does not say the default data directory will be withheld.

Also /var/lib/ldap remains the openldap home in slapd.sysusers, olcDbDirectory in slapd.init.ldif, and “The slapd database location is /var/lib/ldap” in README.Debian.

An empty 0700 directory owned by openldap does not commit the admin to using it.
Not creating it would drop a side effect of adduser from before I was born. :)

thanks,
Daniel

Oof, i’ve f’ed up setting up my mail client…

see attachment for the patch please :)

Greetings Daniel

–
Daniel Teichmann
DAS-NETZWERKTEAM
Telefon: 0176 322 774 51
GnuPG Key ID: ED9F2F7A36E0D99349CC1940B500EFC78100A778
daniel.teichmann@das-netzwerkteam.de, https://das-netzwerkteam.de

​
​

Oof, i’ve f’ed up setting up my mail client…

see attachment for the patch please :)

Greetings Daniel

–
Daniel Teichmann
DAS-NETZWERKTEAM
Telefon: 0176 322 774 51
GnuPG Key ID: ED9F2F7A36E0D99349CC1940B500EFC78100A778
daniel.teichmann@das-netzwerkteam.de, https://das-netzwerkteam.de

​
​

Hi, sorry for the slow response.

I decided I will fix the bug and restore the behaviour from trixie and
earlier (always create /var/lib/ldap).

I just haven't had time to actually test and upload the fix. Will do it
within the week.

We believe that the bug you reported is fixed in the latest version of
openldap, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144741@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Ryan Tandy <ryan@nardis.ca> (supplier of updated openldap package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 24 Aug 2026 17:46:58 -0700
Source: openldap
Architecture: source
Version: 2.6.14+dfsg-2
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenLDAP Maintainers <pkg-openldap-devel@lists.alioth.debian.org>
Changed-By: Ryan Tandy <ryan@nardis.ca>
Closes: 1144741
Changes:
 openldap (2.6.14+dfsg-2) unstable; urgency=medium
 .
   * Create /var/lib/ldap when slapd is first installed, even if
     slapd/no_configuration is set. (Closes: #1144741)
Checksums-Sha1:
 6d087fd28a662711d65dc5bbbbc42c93a586ee82 3413 openldap_2.6.14+dfsg-2.dsc
 4fb2d1c102f87c4a2e1d877a3ff146eef0e6f782 175912 openldap_2.6.14+dfsg-2.debian.tar.xz
Checksums-Sha256:
 3d110ed9ef9110c297e475f9b01f54c9703d375fd2767935717e72f2d241ac40 3413 openldap_2.6.14+dfsg-2.dsc
 b4c0a5f29516ffba66553f53b9b3fb62253a2b79c7f5dbcc44c5ec34303ae610 175912 openldap_2.6.14+dfsg-2.debian.tar.xz
Files:
 89fe6afae1b2ae704919f8d21afd47f7 3413 net optional openldap_2.6.14+dfsg-2.dsc
 6d34e97e0dc6fbe1aedab18aeff69e77 175912 net optional openldap_2.6.14+dfsg-2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQJDBAEBCgAtFiEEPSfh0nqdQTd5kOFlIp/PEvXWa7YFAmqM6DwPHHJ5YW5AbmFy
ZGlzLmNhAAoJECKfzxL11mu2dGQP/0ziXkTTu2xY+nwanAXVuJGW4fNvogUzMMus
zHkwPf5X5wBQcZ9QVKbzD11R7hFnXe9eV2pScahNtLLDX2pnBCus6gH8VVAtUaFT
IYcpaic77LyQFQJf9KpstCN9HhVWZgwnm02obfAQk/D3L7cunGqRy2oOQNPxk3f4
/qQHdTj1PRL2RNWS7rC32DGOi6gAiK/BQQXfyH2xxSU3zTGaWA1iNsAEFFDLfp78
SVqp2KOP4/TITe92Jfej4nmqIzHkP71XR2hyaHZLVjjWYaZpaWerDnaQsZLvsziD
cxfs8OPJ6zgNNqHVohY93uI1FsgMTtFJIMjR9JB7eIxXJNrP7tObzSDW7ZDYsxQ9
Bbz5SgTapoVwvJ+4fBzH0oczmFwUHJwH2uys2W7hkx1B8Hxw5lk8Tu+nn0UzI+km
OrFXdHhQS5PNv1v3lhtxIGILc91jiYnjN/OkEK5YG8HMiMoZJXFvUkIQ2Ru0mgqK
0lXBIHSUJ3lDPYNty9UIjsSzT/pLViqVFHbCWABRwcOpRtTje1LuT2fOhw2tO2+b
nCbh4TCv+4XoROJ520eCKvDS/NIA5B4JlpOVj1NOwSZTZbw9Jf/4xFAyKnEGnmcE
FVxgr9BtZ4ksj/TPyvYxGG5TZPvQY2ZfP98dzZ1e+n0vnLgZcyY28cs2ZpCbKYnm
r+sRHORn
=xcUK
-----END PGP SIGNATURE-----