0

I would like to know your opinions and experience while setting-up a centralized authentication server using OpenLDAP.

Currently a have a few hosted servers running a few services (email, webapps, database etc). and a low budged :P

What are the recommended or the best practices when deploying a LDAP server in therms of network security?

What are the hardware requirements on CPU/Memory for a 500-800 user directory? Is it better to have a good hardware single server, or may I go for cheap virtual servers and have a redundant scenario? I know it would be better in therms of HA, but since I am going for a low budget, I also need performance to keep in mind.

If not going for the virtual server option. May the LDAP service run alone on a single server? Or may I share the server with something else... let's say MySQL database? I am just thinking on how make the best use of my resources and not having a too idle server with out adding a security risk on it.

Thank you!

1
  • please make this question answerable, I am trying to find out how the hardware requirements for an LDAP server will scale as a service grows and the single data point I have been able to find is from a 13 year old email chain.
    – sgfit
    Sep 15, 2019 at 18:00

1 Answer 1

2

Performance isn't usually an issue with OpenLDAP, it can run on really small hardware, but I would strongly recommend running a replicated database with at least two instances.

Being lightweight as it is, running it along other services also shouldn't be a problem, but of course it depends a lot on what the other services are and how active they are. A heavy-use MySQL database might be a real bad companion, but if it's mostly idle, all is fine. However, in this case I would consider using virtualization anyway and just put the different services into different VMs.

Regarding the network architecture, this depends a lot on your existent servers/services and how they are organized, but I would make sure that the LDAP server is in an internal network without outside access.

3
  • 1
    A word of warning: unless things have recently changed, OpenLDAP + VMware ESX = a bad combination. slapd heavily relies on accurate and fast system clock and gettimeofday() with VMware is not performant or reliable as with real hardware. This mostly hurts in very busy environments, but you have been warned (or Matias :-)). Jun 18, 2014 at 10:29
  • @JannePikkarainen: Thanks for the hint, do you have any more infos on that? In my primary infrastructure, I run OpenLDAP on top of KVM without issues, but I am currently pushing for its adaption in a part of the system that runs on ESXi and would hate to face issues due to something like that.
    – Sven
    Jun 18, 2014 at 10:39
  • If you have a large LDIF file you can try to import to your ESX environment, try to do that. In my case under ESX slapd imported the file total of 8 hours, whereas under physical server it took 15 minutes. I tried to debug this for a couple of weeks and finally gave up. Anyway, I also shortly tried that thing in production and very quicky found out that it was not good. The setup was a multi-master slapd with lots of reads and semi-active write activity, too. Jun 18, 2014 at 10:47

Not the answer you're looking for? Browse other questions tagged .