Optimizar OpenLDAP (Indexación)

Para agilizar las búsquedas, debes de crear índices para los atributos comúnmente buscados, En OpenLDAP, no solo puedes elegir que atributos indexar, si no que también puedes elegir que tipo de búsquedas indexar, por ejemplo, si indexas el campo "mail", tienes la opción de crear índices para búsquedas de "precense (press), equiality (eq), approximate, y/o substrings (sub)".

Nota:
"The index directive of slapd.conf (or olcDbIndex in cn=config configurations) is only effective on initial load of the directory (using ldapadd). If indexes are subsequently changed the directory needs to be re-indexed using slapindex (caution: must stop slapd first)."

index objectClass,uidNumber,gidNumber eq
index member,mail eq,pres
index cn,displayname,uid,sn,givenname sub,eq,pres
index SuSEMailClient,SUSEMailAcceptAddress,zoneName eq
index SuSEMailDomainMasquerading,relativeDomainName,suseMailDomainType eq
index suseTLSPerSitePeer,SuSEMailTransportDestination eq
index sambaSID eq
index sambaPrimaryGroupSID eq
index sambaDomainName eq

SAMBA Integrado con OpenLDAP

al final de la config en smb.conf
ldap admin dn = cn=Administrator,dc=dominio,dc=com
ldap delete dn = No
ldap group suffix = ou=group
ldap passwd sync = No
ldap replication sleep = 1000
#ldap ssl = Start_tls
ldap suffix = dc=dominio,dc=com
ldap timeout = 5
ldap user suffix = ou=people
passdb backend = ldapsam:ldap://ldap.dominio


fichero entero:

[global]
workgroup = dynamics
#Impresores
printing = cups
printcap name = cups
printcap cache time = 750
cups options = raw
load printers = yes
use client driver = yes
map to guest = Bad User
logon path = \\%L\profiles\.msprofile
logon home = \\%L\%U\.9xprofile
logon drive = P:
usershare allow guests = Yes
add machine script = /usr/sbin/useradd -c Machine -d /var/lib/nobody -s /bin/false %m$
domain logons = Yes
domain master = Yes
local master = Yes
os level = 65
preferred master = Yes

#FSM - Seguretat i LDAP
security = user
ldap admin dn = cn=Administrator,dc=dynamics-research,dc=com
ldap delete dn = No
ldap group suffix = ou=group
ldap passwd sync = No
ldap replication sleep = 1000
#ldap ssl = Start_tls
ldap suffix = dc=dynamics-research,dc=com
ldap timeout = 5
ldap user suffix = ou=people
passdb backend = ldapsam:ldap://ldap.dynamics-research.com
wins proxy = No
wins support = Yes
netbios name = dynamics

#FSM - PARAMETRES ADDICIONALS
server string = dynamics-PDC
log level = 2
max log size = 50

#Castellanitzacio
dos charset = 850
unix charset = iso-8859-15


[homes]

comment = Home Directories
valid users = %S, %D%w%S
browseable = No
read only = No
inherit acls = Yes
[profiles]
comment = Network Profiles Service
path = %H
read only = No
store dos attributes = Yes
create mask = 0600
directory mask = 0700
[users]
comment = All users
path = /home
read only = No
inherit acls = Yes
veto files = /aquota.user/groups/shares/
[grups]
comment = grups
inherit acls = Yes
path = /srv/samba/departaments
read only = No
[soft]
comment = software
inherit acls = Yes
path = /srv/samba/software
read only = No


Le pasamos el password del admin

smbpasswd -w 

Replicación OpenLdap Master -> Slave

Master:

index ...
replogfile /var/lib/ldap/openldap-master-replog
replica host=IP_SLAVE:389 binddn=cn=Administrator,dc=midominio,dc=com bindmethod=simple credentials=password

Tiene que estar arrancado el servicio slurpd

SLAVE:
database bdb
suffix ".."
rootdn ".."
rootpw ".."
updatedn "cn=Administrator,dc=midominio,dc=com"
updateref "ldap://172.26.0.90"

Migrar un servidor LDAP en 2 pasos

En el antiguo server
slapcat -l /tmp/somefilename.ldif

En el nuevo "As root" y con openldap parado.

slapadd -c -l /tmp/somefilename.ldif