Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been configuring OpenLDAP on RHEL 6 and its seems you have run the following to rebuild the config dirs. I'm ok with that, but my issues is, say I want to change the server passwd, do I have to go through the whole process every time I change the config? Is there a way of changing the slapd config after its been built using the RHEL6 method?

Below is the advice I've found on the net here.

This example assumes that the file to convert from the old slapd configuration is located at /etc/openldap/slapd.conf and the new directory for OpenLDAP configuration is located at /etc/openldap/slapd.d/. Remove the contents of the new /etc/openldap/slapd.d/ directory:

rm -rf /etc/openldap/slapd.d/*

Run slaptest to check the validity of the configuration file and specify the new configuration directory: slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d

Configure permissions on the new directory: chown -R ldap:ldap /etc/openldap/slapd.d

chmod -R 000 /etc/openldap/slapd.d

chmod -R u+rwX /etc/openldap/slapd.d

To clarify: I'm after help on how to edit the slapd configuration using the newer versions of openldap where the config is held in a schema rather than the original slapd.conf.

share|improve this question
up vote 5 down vote accepted

After migration to slapd.d configuration directory, slapd.conf file is converted to few LDIF files.

For every database that were configured in slapd.conf there is now new ldif file in slapd.d/cn=config/. Name of that files consist of olcDatabase={Number}NameOfDatabase.ldif.

Below there is structure of slapd.d in my case (on Debian):

├── cn=config
│   ├── cn=module{0}.ldif
│   ├── cn=schema
│   │   └── cn={0}core.ldif
│   ├── cn=schema.ldif
│   ├── olcDatabase={0}config.ldif
│   ├── olcDatabase={1}bdb.ldif
│   └── olcDatabase={-1}frontend.ldif
└── cn=config.ldif

Most important are files olcDatabase={1}bdb.ldif and olcDatabase={0}config.ldif that includes configuration of two database backends: bdb - my primary ldap base and virtual config database that is used for dynamic modification of slapd config.

Each database have it's own password and root user that are configured in ldif file. Root user and password are defined by these attributes:

olcRootDN: cn=Manager,cn=config
olcRootPW:: c2VjcmV0

so first method of changing password is just changing value of olcRootPW. In that example password is set to word secret and is encoded by base64.

We may change olcRootPW line to:

olcRootPW: plaintextpassword
olcRootPW:: base64decodedtext (in base64 method there is double `:` after attribute name)
olcRootPW: {SSHA}8IAb01fZAtNBH5F0n4x5t2WkmQbhZnWm (SSHA encoded password generated by `slappaswd` command)

So if you edit your database file it is done (I'm not sure if slapd may be running when you editing ldif files - it's safer to stop it)... but there is another option... ;)

If you have enabled config database you could just bind to it using any ldap client (I recommend Apache Directory Studio which is really great ldap client/editor). Of course for binding to that database you must know olcRootDN and olcRootPW configured for that backend. In that case BaseDN must be set to cn=config. After connecting username and password are normal editable values in olcDatabase={1}bdb,cn=config.

share|improve this answer
Great post - Many thanks – AndyM Jul 6 '11 at 13:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.