●
This procedure requires the LDAP server (slapd) to be listening at "
ldapi://
" (socket) and the appropriate
permission to be set in the LDAP schema to allow for roots
uid
and
gid
to perform the necessary
ldif
operations
●
This procedure assumes that the LDAP host server is running on nid00030, which is the login node on a 48
node system.
●
This procedure requires Urika-GX 2.0UP00 or latter installed on the system.
About this task
This procedure contains steps for resting a forgotten LDAP administrator password in case the OLC scheme is
not known. This procedure provides instructions for updating the LDAP admin server password for the root
domain name, i.e.,
cn=crayadm,dc=urika,dc=com
.
This procedure contains instructions for systems that have their LDAP running in OLC mode. For such systems,
the
/etc/default/slapd.conf
file contains the following entry:
SLAPD_CONF_DIR="/usr/local/openldap/etc/openldap/slapd.d"
If the LDAP passwords for "
cn=admin,cn=config
" and "
cn=crayadm,dc=urika,dc=com
" are not known, it
is possible to change either or both as root logged into the LDAP server host with no LDAP password(s) but this
requires the LDAP server (slapd) to be listening at "
ldapi://
" (socket) and the appropriate permission to be set
in the LDAP schema to allow for roots
uid
and
gid
to perform the necessary
ldif
operations, however this is
not configured in the default Urika-GX installation, therefore, setting this up for existing systems requires knowing
the OLC admin password.
Below are the configuration changes to enable
ldapi://
and allow the Linux root user access to make changes
to the LDAP server without needing any LDAP passwords using
ldapi
(via
ladpmodify
and
ldif
). These
require having the
cn=admin,cn=config
LDAP password for the initial setup.
Procedure
1. Log on to the LDAP host server as root.
2. Change the LDAP passwords using
ldif
over
ldapi://
, as shown in the following examples.
#
ldapmodify -Y EXTERNAL -H ldapi://%2Fusr%2Flocal%2Fopenldap%2Fvar%2Frun%2Fldapi -f crayadmpw_bdb.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}bdb,cn=config"
#
ldapmodify -Y EXTERNAL -H ldapi://%2Fusr%2Flocal%2Fopenldap%2Fvar%2Frun%2Fldapi -f crayadmpw_meta.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}meta,cn=config"
3. Edit the
global
file, located under the
/etc/sysconfig/uxtenant
directory, to configure the new
password in the environment variable
UXTENANT_GLOBAL_LDAP_ROOT_PW
For example, if the password requested by
slappasswd
was entered as "
changeme
" then the variable would
need to be set as:
UXTENANT_GLOBAL_LDAP_ROOT_PW="changeme"
Security
S3016
227
