OpenLDAP — LDAP Directory

If you like this project, consider supporting me on Buy Me a Coffee ☕️

tags:

• identity
• ldap
• openldap
• authentication
• sysadmin

• linux

  📇 OpenLDAP Cheatsheet

Description

OpenLDAP is an open-source LDAP directory service used for centralized identity, authentication, and authorization. Clients include Linux PAM/nsswitch, Samba, FreeIPA, and custom apps. / OpenLDAP — открытый LDAP-каталог для централизованной идентификации, аутентификации и авторизации. Клиенты — PAM/nsswitch, Samba, FreeIPA, кастомные приложения.

Common use cases / Типовые сценарии:

• Central user/group directory / Централизованный каталог пользователей
• SSH/PAM authentication backend / Бэкенд аутентификации SSH/PAM
• Samba AD/DC integration / Интеграция с Samba
• Service account lookups / Поиск сервисных учёток

Status: Actively maintained (OpenLDAP Project). Alternatives: FreeIPA (integrated stack), Microsoft AD, 389-ds, OpenDJ. / Статус: активно развивается; альтернативы — FreeIPA, AD, 389-ds.

Default ports: 389/tcp (LDAP), 636/tcp (LDAPS).
Paths: Debian /etc/ldap/slapd.conf or cn=config; RHEL /etc/openldap/slapd.d/; data /var/lib/ldap/.

Cross-reference: SSSD, FreeIPA, Samba, sudoers/PAM.

Installation

Install OpenLDAP / Установка OpenLDAP

# Debian/Ubuntu
apt install slapd ldap-utils

# RHEL/Rocky/Alma/Fedora
dnf install openldap openldap-servers openldap-clients

slapd -VV 2>&1 | head
ldapsearch -VV 2>&1 | head

Configuration

Main files / Основные файлы

/etc/ldap/slapd.conf (Debian legacy)

/etc/ldap/slapd.d/ (cn=config)

/etc/openldap/slapd.d/ (RHEL)

/etc/openldap/ldap.conf

/var/lib/ldap/

slapd.conf (legacy example) / slapd.conf (устаревший пример)

/etc/ldap/slapd.conf

include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/inetorgperson.schema
include /etc/ldap/schema/nis.schema

pidfile /var/run/slapd/slapd.pid
argsfile /var/run/slapd/slapd.args

database mdb
maxsize 1073741824
suffix "dc=example,dc=com"
rootdn "cn=admin,dc=example,dc=com"
rootpw <SECRET_KEY>
directory /var/lib/ldap

index objectClass eq
index uid,uidNumber,gidNumber eq
index cn,sn,mail eq

slaptest -u -f /etc/ldap/slapd.conf
systemctl restart slapd

Base DNs and OUs / Base DN и OU

# Example tree
# dc=example,dc=com
#   ou=people,dc=example,dc=com
#   ou=groups,dc=example,dc=com

Core Management

ldapsearch / ldapsearch

ldapsearch -x -H ldap://<LDAP_HOST> \
  -D "cn=admin,dc=example,dc=com" -w '<PASSWORD>' \
  -b "dc=example,dc=com" '(objectClass=person)' dn cn mail

ldapsearch -x -H ldap://<LDAP_HOST> -b "dc=example,dc=com" \
  '(uid=<USER>)' dn cn memberUid

ldapadd / ldapadd

# LDIF add
ldapadd -x -H ldap://<LDAP_HOST> \
  -D "cn=admin,dc=example,dc=com" -w '<PASSWORD>' \
  -f /tmp/user.ldif

/tmp/user.ldif

dn: uid=alice,ou=people,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
uid: alice
cn: Alice Example
sn: Example
mail: alice@<DOMAIN>
uidNumber: 10001
gidNumber: 10001
homeDirectory: /home/alice
loginShell: /bin/bash
userPassword: <SECRET_KEY>

ldapmodify / ldapmodify

ldapmodify -x -H ldap://<LDAP_HOST> \
  -D "cn=admin,dc=example,dc=com" -w '<PASSWORD>' \
  -f /tmp/change.ldif

ldapdelete / ldapdelete

ldapdelete -x -H ldap://<LDAP_HOST> \
  -D "cn=admin,dc=example,dc=com" -w '<PASSWORD>' \
  "uid=alice,ou=people,dc=example,dc=com"

Sysadmin Operations

Logs / Логи

journalctl -u slapd --no-pager -n 50
tail -f /var/log/slapd.log

Logrotate / Ротация логов

/etc/logrotate.d/slapd

/var/log/slapd.log {
    weekly
    rotate 4
    compress
    delaycompress
    missingok
    notifempty
    create 0640 openldap openldap
    sharedscripts
    postrotate
        systemctl kill -s HUP slapd >/dev/null 2>&1 || true
    endscript
}

Security

Hardening checklist / Чек-лист ужесточения

1. Use LDAPS (636) or StartTLS on production / Используйте LDAPS/StartTLS
2. Restrict rootdn network access / Ограничьте rootdn по сети
3. ACLs on sensitive attributes (userPassword) / ACL на userPassword
4. Disable anonymous binds where possible / Отключите anonymous binds
5. Backup database regularly / Регулярно бэкапьте БД
6. Keep OpenLDAP patched / Обновляйте OpenLDAP
7. Monitor failed binds / Мониторьте неудачные bind

# ACL example (slapd.conf)
access to attrs=userPassword
  by dn="cn=admin,dc=example,dc=com" write
  by anonymous auth
  by self write
  by * none

Backup and Restore

Backup / Резервное копирование

# Online backup via slapcat
slapcat -l /var/backups/ldap-$(date +%F).ldif

Restore / Восстановление

systemctl stop slapd
rm -rf /var/lib/ldap/*   # only if intentional restore
slapadd -l /var/backups/ldap-<DATE>.ldif
chown -R openldap:openldap /var/lib/ldap
systemctl start slapd

[!CAUTION] Restore replaces directory contents. Verify the LDIF and target DB before running slapadd. / Restore перезаписывает каталог — проверьте LDIF и БД.

Troubleshooting

slaptest -u -f /etc/ldap/slapd.conf
ldapsearch -x -H ldap://<LDAP_HOST> -b "dc=example,dc=com" -s base namingContexts
journalctl -u slapd -n 30

Comparison Tables

Directory services / Каталожные службы

Production Runbooks

Runbook: Bootstrap directory / Инициализация каталога

1. Install slapd; configure suffix/rootdn / Установить и настроить
2. Set root password; enable TLS / Задать пароль; включить TLS
3. Create base DN and OUs (people, groups) / Создать OU
4. Add first admin user / Добавить первого администратора
5. Configure PAM/nsswitch on clients / Настроить PAM/nsswitch
6. Test ldapsearch from client / Проверить ldapsearch
7. Schedule slapcat backups / Запланировать бэкапы

Runbook: Rotate LDAP admin password / Ротация пароля LDAP admin

1. Ensure alternate admin access exists / Убедиться в альтернативном доступе
2. ldappasswd -S cn=admin,dc=example,dc=com / Сменить пароль
3. Update service accounts referencing rootdn / Обновить сервисные учётки
4. Test bind with new password / Проверить bind
5. Document change in secret manager / Задокументировать в vault

Documentation Links

• OpenLDAP admin guide — https://www.openldap.org/doc/admin26/
• ldapsearch(1) — https://linux.die.net/man/1/ldapsearch
• slapd.conf(5) — https://linux.die.net/man/5/slapd.conf
• Debian OpenLDAP — https://wiki.debian.org/OpenLDAP