| [861] | 1 | To set up a new LDAP server: |
|---|
| 2 | |
|---|
| 3 | - Install the RPM fedora-ds-base with yum |
|---|
| 4 | - root# env NSS_NONLOCAL_IGNORE=1 useradd -r -d /var/lib/dirsrv fedora-ds |
|---|
| 5 | - root# /usr/sbin/setup-ds.pl |
|---|
| 6 | - Choose a typical install |
|---|
| 7 | - Tell it to use the fedora-ds user and group |
|---|
| 8 | - Directory server identifier: scripts |
|---|
| 9 | - Suffix: dc=scripts,dc=mit,dc=edu |
|---|
| 10 | - Input directory manager password |
|---|
| 11 | - yum install ldapvi |
|---|
| 12 | - /sbin/service dirsrv start |
|---|
| 13 | - Apply ./fedora-ds-enable-ssl-and-kerberos.diff manually |
|---|
| [1178] | 14 | - Also set nsslapd-ldapifilepath: /var/run/dirsrv/slapd-scripts.socket |
|---|
| 15 | and nsslapd-ldapilisten: on, otherwise ldapi won't work. |
|---|
| [861] | 16 | - /sbin/service dirsrv stop |
|---|
| [880] | 17 | - Add the scripts schemas to /var/lib/dirsrv/slapd-scripts |
|---|
| [861] | 18 | - wget http://web.mit.edu/geofft/Public/scripts-ca.pem |
|---|
| 19 | - certutil -d /etc/dirsrv/slapd-scripts -A -n "scripts.mit.edu CA" -t CT,, -a -i scripts-ca.pem |
|---|
| [862] | 20 | - Generate a pkcs12 cert for the server: |
|---|
| [1177] | 21 | - openssl pkcs12 -export -in c-w.pem -inkey c-w.key -name 'ldap/cats-whiskers' -out c-w.pkcs12 |
|---|
| [861] | 22 | - pk12util -i ldap-server-cert.p12 -d /etc/dirsrv/slapd-scripts |
|---|
| 23 | - Put LDAP keytab in /etc/dirsrv/keytab |
|---|
| 24 | - Uncomment and modify in /etc/syscnfig/dirsrv: KRB5_KTNAME=/etc/dirsrv/keytab ; export KRB5_KTNAME |
|---|
| 25 | - mkdir -p /var/tmp/dirsrv |
|---|
| 26 | - chown fedora-ds:fedora-ds /var/tmp/dirsrv |
|---|
| [951] | 27 | - chmod 755 /var/run/dirsrv |
|---|
| [861] | 28 | - /sbin/service dirsrv restart |
|---|
| [880] | 29 | - Use ldapvi -b cn=config to add these indexes: |
|---|
| [861] | 30 | |
|---|
| [880] | 31 | add cn=apacheServerName, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config |
|---|
| 32 | objectClass: top |
|---|
| 33 | objectClass: nsIndex |
|---|
| 34 | cn: apacheServerName |
|---|
| 35 | nsSystemIndex: false |
|---|
| 36 | nsIndexType: eq |
|---|
| 37 | nsIndexType: pres |
|---|
| 38 | |
|---|
| 39 | add cn=apacheServerAlias, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config |
|---|
| 40 | objectClass: top |
|---|
| 41 | objectClass: nsIndex |
|---|
| 42 | cn: apacheServerAlias |
|---|
| 43 | nsSystemIndex: false |
|---|
| 44 | nsIndexType: eq |
|---|
| 45 | nsIndexType: pres |
|---|
| 46 | |
|---|
| 47 | - Build the indexes with: |
|---|
| 48 | - /usr/lib64/dirsrv/slapd-scripts/db2index.pl -D "cn=Directory Manager" -j /etc/signup-ldap-pw -n userRoot -t apacheServerName |
|---|
| 49 | - Watch the progress with: ldapsearch -x -y /etc/signup-ldap-pw -D 'cn=Directory Manager' -b cn=tasks,cn=config |
|---|
| 50 | - Wait for it to finish before: |
|---|
| 51 | - /usr/lib64/dirsrv/slapd-scripts/db2index.pl -D "cn=Directory Manager" -j /etc/signup-ldap-pw -n userRoot -t apacheServerAlias |
|---|
| 52 | |
|---|
| [862] | 53 | - Set up replication: |
|---|
| 54 | (basically, execute |
|---|
| 55 | http://directory.fedoraproject.org/sources/contrib/mmr.pl |
|---|
| [951] | 56 | manually) |
|---|
