Since 2.3, OpenLDAP uses a configuration engine called slapd-config. They said that use it make all LDAP configuration can be changed on fly.

This is the header of /etc/ldap/slapd.d/cn=config.ldif:


I've changed data in it and some other files which have that header, after restarting slapd, my changes took effects.

Is there anything else happen if I change those files manually? If I don't need 'change on fly', should I edit those file manually instead of using ldapmodify? Which application generated those files, and when?

NOTE: I'm using openldap-2.4.28 on Ubuntu 12.04

  • 2
    so... you see a file that says DO NOT EDIT and you...*edit it*? Tell me, when you see warnings on the chipper-shredder about keeping your hands away from the big spinning blade of death do you disregard those as well? – voretaq7 Apr 16 '13 at 15:22
  • 2
    if you see a book say you DO NOT BE a SYSADMIN, DO NOT BE A PROGRAMMER without saying why, tell me will you obey ? – HVNSweeting Apr 16 '13 at 15:28
  • 2
    The point - you are missing it. – voretaq7 Apr 16 '13 at 15:31

If you change the LDIF files in cn=config manually, their contents and checksums won't match, which is not fatal, but is annoying when using tools such as slapcat.

Modifying cn=config the proper way with ldapmodify is very painful, and you'll end up accumulating tons of carefully hand-crafted, single-purpose, disposable LDIF files. Compared to just editing slapd.conf it's a nightmare. Regardless, if you need to make runtime configuration changes, ldapmodify is your only option. However, if you can afford some downtime, you have two other poisons to choose from.

First, there's the highly unsupported but quick and dirty method which works fine for initial OpenLDAP configuration if you know what you're doing:

$ service slapd stop
$ cp -a /etc/ldap/slapd.d /etc/ldap/slapd.d.old
<edit the LDIF files in /etC/ldap/slapd.d>
$ service slapd start

If slapd starts, it should work ok, but it's always a good idea to tail /var/log/syslog when starting the service:

$ tail -n 0 -f /var/log/syslog|grep slapd

You can fix the checksum errors using slapcat and slapadd as described below.

Second, there's a less unsupported method which involves use of slapcat and slapadd (modified from these instructions):

$ slapcat -n0 -F /etc/ldap/slapd.d > config.ldif
<edit config.ldif>
$ mkdir /etc/ldap/slapd.d.new
$ slapadd -n0 -F /etc/ldap/slapd.d.new -l config.ldif

If slapadd succeeds without errors, you can migrate to the modified slapd.d directory. According to this thread slapadd only adds data, so overwriting the original slapd.d directory contents is not possible. Therefore we need to move the directories around a bit:

$ service slapd stop
$ mv /etc/ldap/slapd.d /etc/ldap/slapd.d.old
$ mv /etc/ldap/slapd.d.new /etc/ldap/slapd.d
$ chown -R openldap:openldap /etc/ldap/slapd.d
$ service slapd start

These two more or less unsupported methods make living with cn=config slightly more bearable.


When you see a file that says


you would do well to follow the instructions for how to properly change the contents of that file.

In this case, that means updating the OpenLDAP configuration by using the ldapmodify command in accordance with the OpenLDAP manual.
This allows you to apply changes to the OpenLDAP configuration on the fly, and will regenerate the slapd.conf file (used when starting the LDAP server as a bootstrap configuration)

In general, failure to follow instructions (like "DON'T EDIT THIS FILE BECAUSE IT'S AUTO-GENERATED!") will lead to pain and suffering.

In this particular case you may find that your changes to the file get been wiped out the next time someone does things The Right Way, and you will have to reconstruct your configuration (likely with no record of it, since the file you edited will be replaced).
The next time you fail to heed a warning like this you could render a system unbootable, or worse.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.