Unknown LDAP cn=config admin password
I don't know how the current Ubuntu packages do the initial OpenLDAP setup but both in 10.04 and 12.04 that process didn't account very well for cn=config. If set you should find the password in the attribute olcRootPW
in /etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif
(it's probably base64 encoded).
To change the password use ldapmodify
as root. Save this as an LDIF file rootpw_cnconfig.ldif
:
dn: olcDatabase={0}config,cn=config changetype: modify replace: olcRootPW olcRootPW: foobar123
Note: In order to change the root password on CentOS7 use dn: olcDatabase={2}hdb,cn=config
instead of dn: olcDatabase={0}config,cn=config
.
Obviously set your password to something other than foobar123
. Then run ldapmodify
:
$ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f rootpw_cnconfig.ldif
This presumes that the LDAP server and the cn=config
database can be accessed using the ldapi protocol (-H ldapi:///
) and that external SASL authentication (-Y EXTERNAL
) is enabled and working, which it should by default on new OpenLDAP setups in Debian and Ubuntu. If you look at /etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif
it should contain an attribute olcAccess
:
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break