Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an OpenLDAP server installed on FreeBSD 8.x. I am getting this error:
Mar 25 16:11:45 ldap2 slapd[1268]: nss_ldap: could not search LDAP server - Server is unavailable

I have included my LDAP configuration information below. In addition the pam_ldap PAM module is enabled for both the sshd and system service.


ldap.conf:

#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE   dc=example,dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never
base      dc=albiruni,dc=com
uri       ldap://localhost/
rootbinddn cn=admin,dc=albiruni,dc=com
#bind_policy soft
ssl start_tls
TLS_REQCERT allow
pam_login_attribute uid

nsswitch.conf

# nsswitch.conf(5) - name service switch configuration file
# $FreeBSD: src/etc/nsswitch.conf,v 1.1.10.1.6.1 2010/12/21 17:09:25 kensmith Exp $
#

group: files cache ldap
passwd: files cache ldap
sudoers: files cache ldap


#group: compat
#group_compat: nis
hosts: files dns
networks: files
#passwd: compat
#passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files
share|improve this question
1  
And after reading the error more closely it's the ldap server itself trying to log into the system as it starts up, and of course it's unavailable. So that error is normal, did your ldap server start?? –  Chris S Mar 25 '11 at 12:40

1 Answer 1

As @ChrisS said, this appears to be a case of your LDAP server trying to query itself before it's started up.

Some solutions:

  1. Point ldap2 at ldap1 and vice-versa in /etc/ldap.conf
    Your system's hostname is ldap2, so I assume there's also an ldap1 around.
    If you configure the systems to query each other then as long as you only reboot one at a time you'll always have at least one server up to bootstrap the other.

  2. Make sure you have nss_initgroups_ignoreusers set correctly in /etc/ldap.conf
    This is a good general practice anyway -- Users referenced during startup (e.g. the LDAP server user) should not need LDAP to be up and running, and shouldn't initiate LDAP queries to look up group memberships. The nss_initgroups_ignoreusers option suppresses LDAP group membership queries for specified users -- typically system/service accounts.
    This usually eliminates the "server unavailable" situation as the LDAP server (and other core system services) can start up without having to query the LDAP server. By the time things that do need the LDAP server are querying it the LDAP server should already be up and running.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.