Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to automate the installation of my OpenLDAP servers.

Currently packages get installed (openldap-clients, openldap-servers) and started with their default configurations.

I have a LDIF file, that is supposed to modify the cn=config database.

I would like to know how can I use ldapmodify to apply my modifications without having to change anything in the configuration first (enable nsldapi, olcRootPW, etc...).

Is it possible to striclty rely on the fact that my user is root ? When I see this line I guess it's possible, but I didn't find the way to do it yet

olcAccess: {0}to *  by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage  by * none

I think what I am looking for is called AutoBind, but it seems like it stil requires LDAPI to be enabled first.

share|improve this question

By default, when installing OpenLDAP packages on CentOS, the ldapi is not enabled.

You can verify that by looking at the /var/run/openldap/slapd.args, output looks like this

/usr/bin/slapd -h ldap:/// -u ldap

thus ldapapp -Y EXTERNAL -H ldapi:/// -f xxx.ldif failing.

One need to enable ldapi for its openldap servers. To so so simply edit /etc/sysconfig/ldap and set SLAPD_LDAPI=yes.

Restart the OpenLDAP server and rerun the command. It should work fine.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.