We have LDAP and NFS setup in the lab. The lab has 16 machines and a server. All the LDAP users home directory is present in the server. Whenever, the LDAP user logs in from any of the 16 machines, his home is presented from the server in the client machine through the NFS automounting.

In all the client machines, we have installed virtualbox and created a group as vboxusers which has all the LDAP users. So, whenever the LDAP user logs in any of the client machine and runs virtual box, he will be able to use the Virtual Box.

However, in one of the machine after the fresh installation of RHEL and VirtualBox, when I run the VirtualBox as the LDAP user, I am getting the "guest OS inaccessible" error. I thought it might be some permission issue and so, I reset the permissions to the vboxusers in that machine.

However, on further investigation, we found out that the LDAP users are actually not assigned to the group "vboxusers" but rather to some other group. How can this be possible, as I copied the LDAP and NFS configuration files from the working machines in the lab and used the same files in the newly installed machine?


ldap.conf contents

# LDAP Defaults

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE   dc=example, dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#DEREF      never
URI ldap://
BASE dc=xxx,dc=xxx
#TLS_CACERTDIR /etc/openldap/cacerts
  • can you please post the content of your config files and ldifs? Which ldap distribution do you use? – vfbsilva Oct 10 '13 at 21:41
  • LDAP Version: ldapsearch: @(#) $OpenLDAP: ldapsearch 2.3.43 (Jun 26 2012 06:37:13) $ mockbuild@hs20-bc2-4.build.redhat.com:/builddir/build/BUILD/openldap-2.3.43/openldap-2.3.43/build-clients/clients/tools (LDAP library: OpenLDAP 20343) – Ramesh Oct 10 '13 at 21:43
  • I have updated the answer with the contents of ldap.conf file.. – Ramesh Oct 10 '13 at 21:45
  • Means at the end you want to Replicate LDAP Server in your Test Lab, am I correct ? – Rahul Patil Oct 10 '13 at 22:08
  • you want same LDAP Setup in your LAB ? – Rahul Patil Oct 10 '13 at 22:09
How can this be possible, as I copied the LDAP and NFS configuration
files from the working machines in the lab and used the same files in
the newly installed machine?

As I understand you need Same LDAP Server Setup in your LAB, SO we need to export Master LDAP Server database, and then import into New LDAP Server. if I'm correct then you can follow this setup.


Note: this Guide based on RHEL5.x/CentOS 5.x

Install OpenLDAP Packages using :

yum install openldap

Configure server, Edit /etc/openldap/slapd.conf, you can configure this settings same as your Master

database        bdb
suffix          "dc=example,dc=com"
rootdn          "cn=Manager,dc=example,dc=com"
rootpw          secrete # or you can use encrypted pass using slappasswd

copy required file

install -o ldap -g ldap /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

On your Master Server, export all details into LDIF file.

slapcat -l master.ldif

Copy master.ldif into New LDAP Server.

Now on your New LDAP Server.

To import the entries specified in file master.ldif into your LDAP data-base give the command:

slapadd -l ldif

Now Start LDAP Service using :

/etc/init.d/ldap start

On Client Machine : Mount NFS on HOME, add required entries in /etc/fstab

Then enable LDAP Auth using :

authconfig --enableldap --enableldapauth --ldapserver=NEW_LDAPSERVER_IP --
ldapbasedn="dc=example,dc=com" –update

Trouble shooting

By Default ldap Logs is disabled you can Enable LDAP Logs on your LDAP Server using :

Edit /etc/syslog.conf

local4.*    /var/log/ldap.log

Once restart syslog service

/etc/init.d/syslog restart
  • Hi Rahul, thanks a lot for replying back. I am relatively new to system administration. I am not sure if I am following you. I have a LDAP server (centralized server) which authenticates all the users logging to the client using NFS. For this setup, do I have to modify the above mentioned files too? Because, we never encountered such a strange scenario before. Thanks again! – Ramesh Oct 10 '13 at 23:20
  • We can't copy files one server to another server to make thing work, since by default ldap save DIT in burkly database so we need to export and import in new server. So if you have test server then you can test this steps, there is no impact on running ldap server. – Rahul Patil Oct 11 '13 at 0:17

This was due to the incorrect group ID being assigned. When the system was installed freshly, the system arbitrarily assigned the group ID 501 to another group.

In all the remaining machines of the lab, we had the group ID 501 assigned to vboxusers. That was the reason, the LDAP users were unable to access the VirtualBox in that particular machine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.