nss_ldap: could not search LDAP server - Server is unavailable

Question

I have an OpenLDAP server installed on FreeBSD 8.x. I am getting this error:
Mar 25 16:11:45 ldap2 slapd[1268]: nss_ldap: could not search LDAP server - Server is unavailable

I have included my LDAP configuration information below. In addition the pam_ldap PAM module is enabled for both the sshd and system service.

---

ldap.conf:

#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE   dc=example,dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never
base      dc=albiruni,dc=com
uri       ldap://localhost/
rootbinddn cn=admin,dc=albiruni,dc=com
#bind_policy soft
ssl start_tls
TLS_REQCERT allow
pam_login_attribute uid

---

nsswitch.conf

# nsswitch.conf(5) - name service switch configuration file
# $FreeBSD: src/etc/nsswitch.conf,v 1.1.10.1.6.1 2010/12/21 17:09:25 kensmith Exp $
#

group: files cache ldap
passwd: files cache ldap
sudoers: files cache ldap


#group: compat
#group_compat: nis
hosts: files dns
networks: files
#passwd: compat
#passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files

Answer 1

As @ChrisS said, this appears to be a case of your LDAP server trying to query itself before it's started up.

Some solutions:

1. Point ldap2 at ldap1 and vice-versa in /etc/ldap.conf
   Your system's hostname is ldap2, so I assume there's also an ldap1 around.
   If you configure the systems to query each other then as long as you only reboot one at a time you'll always have at least one server up to bootstrap the other.

2. Make sure you have nss_initgroups_ignoreusers set correctly in /etc/ldap.conf
   This is a good general practice anyway -- Users referenced during startup (e.g. the LDAP server user) should not need LDAP to be up and running, and shouldn't initiate LDAP queries to look up group memberships. The nss_initgroups_ignoreusers option suppresses LDAP group membership queries for specified users -- typically system/service accounts.
   This usually eliminates the "server unavailable" situation as the LDAP server (and other core system services) can start up without having to query the LDAP server. By the time things that do need the LDAP server are querying it the LDAP server should already be up and running.