Package: slapd Version: 2.4.31-1+nmu2 Severity: normal Hi,
After a default install of slapd, check the permissions of the admin DN on the base suffix: $ sudo -u openldap slapacl -b dc=ki,dc=iif,dc=hu -D cn=admin,dc=ki,dc=iif,dc=hu entry authcDN: "cn=admin,dc=ki,dc=iif,dc=hu" entry: manage(=mwrscxd) Now stop slapd, just to get it out of the picture (this changes nothing): $ sudo service slapd stop [ ok ] Stopping OpenLDAP: slapd. and introduce a typo (hu -> huu) into the base suffix: $ sudo -u openldap slapacl -b dc=ki,dc=iif,dc=huu -D cn=admin,dc=ki,dc=iif,dc=hu entry 531d8fa7 hdb_db_open: database "dc=ki,dc=iif,dc=hu": unclean shutdown detected; attempting recovery. 531d8fa7 hdb_db_open: database "dc=ki,dc=iif,dc=hu": recovery skipped in read-only mode. Run manual recovery if errors are encountered. authcDN: "cn=admin,dc=ki,dc=iif,dc=hu" dc=ki,dc=iif,dc=huu: no target database has been found for baseDN="slapacl"; you may try with "-u" (dry run). Doing it correctly again does not get rid of the warnings: $ sudo -u openldap slapacl -b dc=ki,dc=iif,dc=hu -D cn=admin,dc=ki,dc=iif,dc=hu entry 531d8fb1 hdb_db_open: database "dc=ki,dc=iif,dc=hu": unclean shutdown detected; attempting recovery. 531d8fb1 hdb_db_open: database "dc=ki,dc=iif,dc=hu": recovery skipped in read-only mode. Run manual recovery if errors are encountered. authcDN: "cn=admin,dc=ki,dc=iif,dc=hu" entry: manage(=mwrscxd) Starting slapd fixes the corruption, though. I think there's at least one bug here: 1. slapacl should be a read only operation, which may not be possible with the underlying DB libraries. 2. Even if it was documented to corrupt the checked database, it should not find it with a mistyped base DN. 3. Its man page does not warn against its use while slapd is running, so I suppose it's allowed (as I'd expect). Please help be better assess the situation! Thanks, Feri. -- System Information: Debian Release: 7.4 APT prefers stable APT policy: (500, 'stable'), (30, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 3.13-trunk-amd64 (SMP w/2 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages slapd depends on: ii adduser 3.113+nmu3 ii coreutils 8.13-3.5 ii debconf [debconf-2.0] 1.5.49 ii libc6 2.13-38+deb7u1 ii libdb5.1 5.1.29-5 ii libgcrypt11 1.5.0-5+deb7u1 ii libgnutls26 2.12.20-8+deb7u1 ii libldap-2.4-2 2.4.31-1+nmu2 ii libltdl7 2.4.2-1.1 ii libodbc1 2.2.14p2-5 ii libperl5.14 5.14.2-21+deb7u1 ii libsasl2-2 2.1.25.dfsg1-6+deb7u1 ii libslp1 1.2.1-9 ii libwrap0 7.6.q-24 ii lsb-base 4.1+Debian8+deb7u1 ii multiarch-support 2.13-38+deb7u1 ii perl [libmime-base64-perl] 5.14.2-21+deb7u1 ii psmisc 22.19-1+deb7u1 Versions of packages slapd recommends: ii libsasl2-modules 2.1.25.dfsg1-6+deb7u1 Versions of packages slapd suggests: ii ldap-utils 2.4.31-1+nmu2 -- debconf information: slapd/allow_ldap_v2: false slapd/password_mismatch: slapd/invalid_config: true shared/organization: ki.iif.hu slapd/upgrade_slapcat_failure: slapd/no_configuration: false slapd/move_old_database: true slapd/dump_database_destdir: /var/backups/slapd-VERSION slapd/purge_database: false slapd/domain: ki.iif.hu slapd/backend: HDB slapd/dump_database: when needed -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
