| 1 | To set up a new LDAP server: |
|---|
| 2 | |
|---|
| 3 | - Install the RPM 389-ds-base with yum |
|---|
| 4 | - root# env NSS_NONLOCAL_IGNORE=1 useradd -r -d /var/lib/dirsrv fedora-ds |
|---|
| 5 | - root# /usr/sbin/setup-ds.pl |
|---|
| 6 | - Choose a typical install |
|---|
| 7 | - Tell it to use the fedora-ds user and group |
|---|
| 8 | - Directory server identifier: scripts |
|---|
| 9 | - Suffix: dc=scripts,dc=mit,dc=edu |
|---|
| 10 | - Input directory manager password |
|---|
| 11 | - yum install ldapvi |
|---|
| 12 | - /sbin/service dirsrv start |
|---|
| 13 | - Apply ./fedora-ds-enable-ssl-and-kerberos.diff manually |
|---|
| 14 | - Also set nsslapd-ldapifilepath: /var/run/dirsrv/slapd-scripts.socket |
|---|
| 15 | and nsslapd-ldapilisten: on, otherwise ldapi won't work. |
|---|
| 16 | - /sbin/service dirsrv stop |
|---|
| 17 | - Add the scripts schemas to /var/lib/dirsrv/slapd-scripts |
|---|
| 18 | - wget http://web.mit.edu/geofft/Public/scripts-ca.pem |
|---|
| 19 | - certutil -d /etc/dirsrv/slapd-scripts -A -n "scripts.mit.edu CA" -t CT,, -a -i scripts-ca.pem |
|---|
| 20 | - Generate a pkcs12 cert for the server: |
|---|
| 21 | - openssl pkcs12 -export -in c-w.pem -inkey c-w.key -name 'ldap/cats-whiskers' -out c-w.pkcs12 |
|---|
| 22 | - pk12util -i ldap-server-cert.p12 -d /etc/dirsrv/slapd-scripts |
|---|
| 23 | - Put LDAP keytab in /etc/dirsrv/keytab |
|---|
| 24 | - Uncomment and modify in /etc/syscnfig/dirsrv: KRB5_KTNAME=/etc/dirsrv/keytab ; export KRB5_KTNAME |
|---|
| 25 | - mkdir -p /var/tmp/dirsrv |
|---|
| 26 | - chown fedora-ds:fedora-ds /var/tmp/dirsrv |
|---|
| 27 | - chmod 755 /var/run/dirsrv |
|---|
| 28 | - /sbin/service dirsrv restart |
|---|
| 29 | - Use ldapvi -b cn=config to add these indexes: |
|---|
| 30 | |
|---|
| 31 | add cn=apacheServerName, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config |
|---|
| 32 | objectClass: top |
|---|
| 33 | objectClass: nsIndex |
|---|
| 34 | cn: apacheServerName |
|---|
| 35 | nsSystemIndex: false |
|---|
| 36 | nsIndexType: eq |
|---|
| 37 | nsIndexType: pres |
|---|
| 38 | |
|---|
| 39 | add cn=apacheServerAlias, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config |
|---|
| 40 | objectClass: top |
|---|
| 41 | objectClass: nsIndex |
|---|
| 42 | cn: apacheServerAlias |
|---|
| 43 | nsSystemIndex: false |
|---|
| 44 | nsIndexType: eq |
|---|
| 45 | nsIndexType: pres |
|---|
| 46 | |
|---|
| 47 | add cn=scriptsVhostName, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config |
|---|
| 48 | objectClass: top |
|---|
| 49 | objectClass: nsIndex |
|---|
| 50 | cn: scriptsVhostName |
|---|
| 51 | nsSystemIndex: false |
|---|
| 52 | nsIndexType: eq |
|---|
| 53 | nsIndexType: pres |
|---|
| 54 | |
|---|
| 55 | add cn=scriptsVhostAlias, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config |
|---|
| 56 | objectClass: top |
|---|
| 57 | objectClass: nsIndex |
|---|
| 58 | cn: scriptsVhostAlias |
|---|
| 59 | nsSystemIndex: false |
|---|
| 60 | nsIndexType: eq |
|---|
| 61 | nsIndexType: pres |
|---|
| 62 | |
|---|
| 63 | add cn=scriptsVhostAccount, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config |
|---|
| 64 | objectClass: top |
|---|
| 65 | objectClass: nsIndex |
|---|
| 66 | cn: scriptsVhostAccount |
|---|
| 67 | nsSystemIndex: false |
|---|
| 68 | nsIndexType: eq |
|---|
| 69 | nsIndexType: pres |
|---|
| 70 | |
|---|
| 71 | add cn=memberuid, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config |
|---|
| 72 | objectClass: top |
|---|
| 73 | objectClass: nsIndex |
|---|
| 74 | cn: memberuid |
|---|
| 75 | nsSystemIndex: false |
|---|
| 76 | nsIndexType: eq |
|---|
| 77 | nsIndexType: pres |
|---|
| 78 | |
|---|
| 79 | add cn=uidnumber, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config |
|---|
| 80 | objectClass: top |
|---|
| 81 | objectClass: nsIndex |
|---|
| 82 | cn: uidnumber |
|---|
| 83 | nsSystemIndex: false |
|---|
| 84 | nsIndexType: eq |
|---|
| 85 | nsIndexType: pres |
|---|
| 86 | |
|---|
| 87 | add cn=gidnumber, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config |
|---|
| 88 | objectClass: top |
|---|
| 89 | objectClass: nsIndex |
|---|
| 90 | cn: gidnumber |
|---|
| 91 | nsSystemIndex: false |
|---|
| 92 | nsIndexType: eq |
|---|
| 93 | nsIndexType: pres |
|---|
| 94 | |
|---|
| 95 | - Build the indexes for all the fields: |
|---|
| 96 | |
|---|
| 97 | /usr/lib64/dirsrv/slapd-scripts/db2index.pl -D "cn=Directory Manager" -j /etc/signup-ldap-pw -n userRoot |
|---|
| 98 | |
|---|
| 99 | - Watch for the indexing operations to finish with this command: |
|---|
| 100 | |
|---|
| 101 | ldapsearch -x -y /etc/signup-ldap-pw -D 'cn=Directory Manager' -b cn=tasks,cn=config |
|---|
| 102 | |
|---|
| 103 | - Set up replication: |
|---|
| 104 | (basically, execute |
|---|
| 105 | http://directory.fedoraproject.org/sources/contrib/mmr.pl |
|---|
| 106 | manually) |
|---|
