0

I am following these instructions to install OpenLDAP on Debian 6.0.

The instructions tell me to run slapindex as root, but it sounds like Debian does not like the idea:

WARNING!
Runnig as root!
There's a fair chance slapd will fail to start.
Check file permissions!

Google leads me to a discussion that suggests running slapindex as openldap. I find it strange as slapindex is not in the $PATH of openldap.

Which user should I run slapindex as?
If not root, why is slapindex in /usr/sbin?

Improve this question

2 Answers 2

Reset to default
1

You sure can use both root and openldap as user running slapindex, but if you do it as root, please don't forget to change the OpenLDAP data directory permissions back to openldap:openldap if you do so. For example,

chown -R openldap:openldap /var/lib/ldap/

Why slapindex is under /usr/sbin, I don't know. Perhaps because it is a very powerful and potentially dangerous tool which should be used those capable of being root, anyway.

Improve this answer
2
  • It's probably in /usr/sbin because it is an administrative tool that requires specific permissions (though not necessarily root, obviously) to run. Displaying it in the hypothetical list of "user" commands, such as with tab completion in bash, would be silly.
    – Falcon Momot
    Aug 14, 2013 at 7:40
  • 1
    Thanks for the comment about /var/lib/ldap. I accidentally ran slapd in debug mode as root and it stole all the file permissions away from the openldap user. A service restart failed due to err 13 and told me to restore from backup. chown back to openldap for the files in /var/lib/ldap fixed me all up.
    – Christopher Schultz
    Apr 18, 2018 at 14:30
1

If not root, why is slapindex in /usr/sbin?

According to the FHS (Filesystem Hierarchy Standard) /usr/sbin are used for Non-essential system binaries, e.g., daemons for various network-services.

On CentOS, after executing slapindex as root you should change owner of the index in /var/lib/ldap to the ldap user, which is by default ldap. You could try to use su instead

# su - <ldap_user> -s /bin/bash /usr/sbin/slapindex
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .