Installing and Configuring OpenLDAP on

What we are configuring and why

In today's IT landscape, where organizations use many different services and applications, managing user accounts becomes a challenging task. Each service requires its own user database and passwords, leading to data fragmentation, security issues, and high administrative overhead. Centralized directory services exist precisely to solve this problem, and OpenLDAP is one of the most popular and powerful among them.

OpenLDAP (Lightweight Directory Access Protocol) is an open-source implementation of the LDAP protocol, providing a flexible and scalable system for storing and accessing information about users, groups, devices, and other network resources. By installing OpenLDAP on your VPS, you will create a single point of authentication and authorization for all your internal and external services: from mail servers and VPNs to version control systems (GitLab) and corporate messengers (Mattermost).

Ultimately, you will get a unified user database where each employee will have one account and one password to access all necessary resources. This will significantly simplify access management, enhance security through centralized control, and reduce the burden on administrators. The reader will be able to integrate their OpenLDAP server with systems such as FreeIPA, Samba (for Windows compatibility), Nextcloud, Jenkins, Grafana, and many others that support LDAP authentication.

What alternatives exist and why self-hosted on a VPS

There are various approaches to centralized identity management:

• Cloud-managed solutions: Google Workspace, Microsoft Azure Active Directory, Okta, Auth0. They offer high availability, scalability, and minimal maintenance overhead, but often come with higher costs, less configuration flexibility, and may raise questions about data privacy as data is stored with a third-party provider.
• Self-hosted solutions: OpenLDAP, FreeIPA (based on OpenLDAP and Kerberos), Samba Active Directory. These solutions provide full control over data, maximum flexibility, and potentially lower long-term costs.

Choosing self-hosted OpenLDAP on a VPS is ideal for those who value full control over their infrastructure, data, and budget. This is especially relevant for solo founders of SaaS projects, developers who need to quickly set up a test environment, or privacy-conscious users who want to avoid dependence on cloud providers. A VPS provides sufficient performance and flexibility at a reasonable price, allowing you to deploy a full-fledged LDAP server without the need to invest in your own hardware or pay for expensive cloud subscriptions.

What VPS configuration is needed for this task

VPS requirements for OpenLDAP depend on the scale of use: the number of users, query frequency, and volume of stored data. For most small to medium-sized projects (up to several hundred users), OpenLDAP is quite economical.

Minimum Requirements

• CPU: 1 vCPU (modern processor, e.g., Intel Xeon E3/E5 or AMD EPYC).
• RAM: 1 GB (for basic installation and `slapd` daemon operation).
• Disk: 20-40 GB SSD (fast disk is critical for LDAP database performance).
• Network: 100 Mbps (sufficient for most scenarios if there are no constant intensive queries).

Recommended VPS plan for most cases (up to 1000 users)

For stable operation with growth potential and integration with multiple services, the following configuration is recommended:

• CPU: 2 vCPU
• RAM: 2-4 GB
• Disk: 80-160 GB SSD (more users and attributes will require more space)
• Network: 1 Gbps

Such a VPS with the specified characteristics can be obtained from various providers. For example, a VPS with the specified characteristics will be suitable for most centralized user management tasks.

When a dedicated server is needed, not a VPS

A dedicated server should be considered if:

• Very large number of users: Thousands and tens of thousands of users, intensive queries, high database load.
• Critical applications: OpenLDAP is the central authentication hub for mission-critical business applications, requiring maximum performance and resource guarantees.
• Security and isolation requirements: Complete isolation from "neighbors" and the ability to fully control hardware.
• Complex integrations: When OpenLDAP is used as part of a large infrastructure with FreeIPA, Kerberos, Samba AD, and other services that require significant resources.

For such scenarios, a suitable dedicated server may be required.

Location: what it affects

The choice of VPS location has several important aspects:

• Latency: The closer the server is to the main users and integrated services, the lower the latency. This is critical for authentication speed and overall user experience.
• Legislation: The server's location can affect applicable data storage and privacy laws (e.g., GDPR in Europe).
• Availability: Some regions may be more stable or have better connectivity to your target audience.

Typically, a location geographically close to most consumers of the LDAP service is chosen to minimize network latency.

Server Preparation

Before installing OpenLDAP, you need to perform basic setup and strengthen the security of your VPS. We will use Ubuntu 24.04 LTS as a stable and up-to-date operating system for 2026.

1. SSH Connection and User Creation

It is assumed that you have already connected to the server as the `root` user. First, we will create a new user with limited privileges and configure SSH keys for secure access.

# Create a new user (replace 'youruser' with your desired name)
adduser youruser

# Add the user to the sudo group to execute commands with elevated privileges
usermod -aG sudo youruser

# Switch to the new user
su - youruser

Now let's configure SSH keys. If you don't have them, generate them on your local machine: `ssh-keygen -t rsa -b 4096`. Then copy the public key to the server:

# On your local machine
ssh-copy-id youruser@your_vps_ip

# After this, you can disconnect from root and connect as 'youruser'
exit # Exit su - youruser
exit # Exit root
ssh youruser@your_vps_ip

After successfully connecting via SSH key, it is recommended to disable password authentication for `root` and other users in the `/etc/ssh/sshd_config` file to enhance security. Find the `PermitRootLogin` and `PasswordAuthentication` lines and change them:

# Open the SSH daemon configuration file
sudo nano /etc/ssh/sshd_config

Change or add the following lines:

# ...
PermitRootLogin no
# ...
PasswordAuthentication no
# ...

Save changes (`Ctrl+O`, `Enter`) and exit (`Ctrl+X`). Then restart the SSH daemon:

# Restart the SSH service to apply changes
sudo systemctl restart sshd

2. System Update and Installation of Basic Utilities

Always start by updating the package list and installed packages.

# Update the package list
sudo apt update

# Upgrade all installed packages to the latest versions
sudo apt upgrade -y

# Install useful utilities if they are not present
sudo apt install -y curl wget git nano htop unzip

3. Firewall Configuration (UFW)

Let's configure a basic firewall to allow only necessary connections: SSH, HTTP, HTTPS, and, of course, LDAP.

# Enable UFW (Uncomplicated Firewall)
sudo ufw enable

# Allow SSH connection (default port 22)
sudo ufw allow ssh

# Allow HTTP and HTTPS (for web server, if needed, and for Certbot)
sudo ufw allow http
sudo ufw allow https

# Allow standard OpenLDAP ports (389 for LDAP, 636 for LDAPS)
sudo ufw allow 389/tcp
sudo ufw allow 636/tcp

# Check firewall status
sudo ufw status verbose

Make sure SSH is allowed before enabling UFW, otherwise you might lose access to the server.

4. Fail2ban Installation

Fail2ban protects the server from brute-force attacks by blocking IP addresses that have too many failed login attempts.

# Install Fail2ban
sudo apt install -y fail2ban

# Start and enable it for autostart
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# Check Fail2ban status
sudo systemctl status fail2ban

Fail2ban is configured by default to protect SSH. You can configure it to protect other services, including OpenLDAP, by creating or modifying configuration files in `/etc/fail2ban/jail.d/`.

Software Installation — Step-by-step

Software Installation — Step-by-Step

Now that the server is prepared, let's proceed with OpenLDAP installation. We will install the server daemon slapd and client utilities ldap-utils.

1. Installing OpenLDAP Server and Utilities

In Ubuntu 24.04 LTS (current for 2026), OpenLDAP is available in the repositories. We will install the packages slapd (server) and ldap-utils (client utilities).

# Install OpenLDAP daemon (slapd) and client utilities
sudo apt install -y slapd ldap-utils

During installation, the system may ask for a password for the LDAP database administrator. Enter a strong password and remember it. This password will be used for the account cn=admin,dc=example,dc=org (or your domain).

# Reconfigure slapd if you need to change settings after installation
# This will allow changing the domain, admin password, and other parameters
sudo dpkg-reconfigure slapd

When reconfiguring slapd, you will be asked the following questions:

• Omit OpenLDAP server configuration? Select "No".
• DNS domain name: Enter your domain, for example, example.org. This will be converted into the database dc=example,dc=org.
• Organization name: Enter your organization's name, for example, My Company.
• Administrator password: Enter and confirm a strong password for the LDAP administrator.
• Database backend: Select MDB (Modern Database) as the most efficient and recommended backend.
• Remove old database? If this is a new installation, select "Yes".
• Move old database? Select "No".
• Allow LDAPv2 protocol? Select "No", as LDAPv2 is deprecated and insecure.

2. Checking OpenLDAP Service Status

After installation and basic configuration, let's ensure that the slapd daemon is running correctly.

# Check OpenLDAP service status
sudo systemctl status slapd

The output should show that the slapd.service is active (active (running)).

3. Checking Basic Configuration

We can use ldapsearch to check the basic configuration and availability of the LDAP server.

# Perform an anonymous search on the root DSE (Directory Service Agent Specific Entry)
ldapsearch -x -LLL -H ldap:/// -b "" -s base namingContexts

In the output, you should see the line namingContexts: dc=example,dc=org (or your domain), which confirms the basic directory configuration.

4. Obtaining the Administrator Password Hash

To create LDIF files with passwords, we will need the administrator password hash. OpenLDAP uses the SSHA (Salted SHA) algorithm.

# Generate password hash. Replace 'YourAdminPassword' with your actual password.
slappasswd -s YourAdminPassword

Copy the resulting hash (for example, {SSHA}h64hjsd...). It will be needed for further configuration.

5. Creating a File for the Administrative Account

Let's create an LDIF file to update the administrator password. This can be useful if you want to change the password or ensure it is set correctly.

# Create an LDIF file to update the administrator password
nano admin_password.ldif

Insert the following content, replacing dc=example,dc=org with your domain and {SSHA}YOUR_PASSWORD_HASH with the hash obtained in the previous step:

dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {SSHA}YOUR_PASSWORD_HASH

Save the file and apply the changes:

# Apply changes to OpenLDAP configuration
ldapmodify -Y EXTERNAL -H ldapi:/// -f admin_password.ldif

If the command executes without errors, the administrator password has been successfully updated. Note that we use -Y EXTERNAL -H ldapi:/// for authentication via a local socket, which requires root privileges or membership in the openldap group.

6. Adding Essential Schemas

OpenLDAP uses schemas to define object types and attributes that can be stored in the directory. To work with users and groups, we will need the cosine, inetorgperson, and nis schemas.

# Add cosine schema
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif

# Add inetorgperson schema
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif

# Add nis schema (for UNIX groups and users)
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif

These commands load the standard schemas required for most OpenLDAP use cases. They might already be loaded by default, but explicitly adding them won't hurt.

Configuration

After installing and loading the basic schemas, let's move on to more detailed configuration, including creating Organizational Units (OUs), users, groups, and setting up TLS/SSL.

1. Creating the Basic Directory Structure

Let's create an LDIF file to add root Organizational Units (OUs) for users and groups. Replace dc=example,dc=org with your domain.

# Create an LDIF file for the basic structure
nano base_structure.ldif

Contents of base_structure.ldif:

dn: dc=example,dc=org
objectClass: top
objectClass: dcObject
objectClass: organization
o: My Company
dc: example

dn: ou=people,dc=example,dc=org
objectClass: top
objectClass: organizationalUnit
ou: people

dn: ou=groups,dc=example,dc=org
objectClass: top
objectClass: organizationalUnit
ou: groups

Apply the LDIF file:

# Add the basic directory structure
ldapadd -x -D "cn=admin,dc=example,dc=org" -w YourAdminPassword -f base_structure.ldif

Here, -x means simple authentication, -D specifies the administrator's DN, and -w is their password. Replace YourAdminPassword with your actual password.

2. Adding a User

Let's create an LDIF file to add a new user. Replace the domain and user data with your own.

# Create an LDIF file for the new user
nano user_john_doe.ldif

Contents of user_john_doe.ldif:

dn: uid=johndoe,ou=people,dc=example,dc=org
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
uid: johndoe
cn: John Doe
sn: Doe
givenName: John
mail: [email protected]
userPassword: {SSHA}YOUR_USER_PASSWORD_HASH # Generate with slappasswd -s YourUserPassword
uidNumber: 10001
gidNumber: 10001
homeDirectory: /home/johndoe
loginShell: /bin/bash

Don't forget to generate a hash for the user's password using slappasswd -s YourUserPassword.

# Add the user to the directory
ldapadd -x -D "cn=admin,dc=example,dc=org" -w YourAdminPassword -f user_john_doe.ldif

3. Adding a Group

Let's create an LDIF file to add a new group.

# Create an LDIF file for the new group
nano group_devs.ldif

Contents of group_devs.ldif:

dn: cn=developers,ou=groups,dc=example,dc=org
objectClass: top
objectClass: posixGroup
cn: developers
gidNumber: 10001
memberUid: johndoe # Add user johndoe to the group

# Add the group to the directory
ldapadd -x -D "cn=admin,dc=example,dc=org" -w YourAdminPassword -f group_devs.ldif

4. Configuring TLS/HTTPS via Certbot

It is crucial to secure the connection to OpenLDAP using TLS (LDAPS). We will obtain free Let's Encrypt certificates via Certbot.

Installing Certbot

# Install Certbot
sudo snap install core
sudo snap refresh core
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

Obtaining a Certificate

To obtain a certificate, Certbot must be able to verify domain ownership. The easiest way to do this is with the --standalone plugin, which temporarily runs a web server, or --webroot if you already have a web server (e.g., Nginx or Apache) on the same VPS. If you don't have a web server, use --standalone. Make sure ports 80 and 443 are free at the time of the request.

# Obtain a certificate for your domain (replace your.domain.com)
# Ensure that the DNS record for your.domain.com points to your VPS's IP
sudo certbot certonly --standalone -d your.domain.com

Follow Certbot's instructions (enter email, agree to terms). After successful acquisition, certificates will be saved in /etc/letsencrypt/live/your.domain.com/.

Configuring OpenLDAP to use TLS

To configure TLS in OpenLDAP, you need to create an LDIF file specifying the path to the Let's Encrypt certificates.

# Create an LDIF file for TLS configuration
nano tls_config.ldif

Contents of tls_config.ldif:

dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/letsencrypt/live/your.domain.com/chain.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/letsencrypt/live/your.domain.com/fullchain.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/letsencrypt/live/your.domain.com/privkey.pem

Important: Ensure that the paths to the certificate files are correct and match your domain. You also need to make sure that the openldap user has read permissions for these files. By default, Certbot sets strict permissions. Let's create symbolic links to the certificates in a directory accessible to the openldap user.

# Create a directory for certificate copies
sudo mkdir -p /etc/ssl/ldap
sudo chown openldap:openldap /etc/ssl/ldap
sudo chmod 700 /etc/ssl/ldap

# Copy certificates and key so slapd can read them
sudo cp /etc/letsencrypt/live/your.domain.com/fullchain.pem /etc/ssl/ldap/ldap-fullchain.pem
sudo cp /etc/letsencrypt/live/your.domain.com/privkey.pem /etc/ssl/ldap/ldap-privkey.pem
sudo cp /etc/letsencrypt/live/your.domain.com/chain.pem /etc/ssl/ldap/ldap-chain.pem

# Set correct permissions
sudo chown openldap:openldap /etc/ssl/ldap/ldap-fullchain.pem
sudo chown openldap:openldap /etc/ssl/ldap/ldap-privkey.pem
sudo chown openldap:openldap /etc/ssl/ldap/ldap-chain.pem
sudo chmod 640 /etc/ssl/ldap/ldap-fullchain.pem
sudo chmod 640 /etc/ssl/ldap/ldap-privkey.pem
sudo chmod 640 /etc/ssl/ldap/ldap-chain.pem

Now, let's update tls_config.ldif to point to these new paths:

dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/ldap/ldap-chain.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/ldap/ldap-fullchain.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/ldap/ldap-privkey.pem

Apply the TLS configuration:

# Apply TLS configuration
ldapmodify -Y EXTERNAL -H ldapi:/// -f tls_config.ldif

Restart slapd to ensure the new TLS settings are applied:

# Restart slapd service
sudo systemctl restart slapd

Automatic Certificate Renewal: Certbot will automatically configure a cron job for certificate renewal. However, you will need to add a script that copies the renewed certificates to /etc/ssl/ldap and restarts slapd. Create the file /etc/letsencrypt/renewal-hooks/deploy/slapd_cert_renew.sh:

#!/bin/bash
# Script for OpenLDAP certificate renewal after Certbot
DOMAIN=$1

if [ "$DOMAIN" = "your.domain.com" ]; then
    echo "Deploying new certificates for $DOMAIN to OpenLDAP..."
    sudo cp /etc/letsencrypt/live/$DOMAIN/fullchain.pem /etc/ssl/ldap/ldap-fullchain.pem
    sudo cp /etc/letsencrypt/live/$DOMAIN/privkey.pem /etc/ssl/ldap/ldap-privkey.pem
    sudo cp /etc/letsencrypt/live/$DOMAIN/chain.pem /etc/ssl/ldap/ldap-chain.pem
    sudo chown openldap:openldap /etc/ssl/ldap/ldap-fullchain.pem
    sudo chown openldap:openldap /etc/ssl/ldap/ldap-privkey.pem
    sudo chown openldap:openldap /etc/ssl/ldap/ldap-chain.pem
    sudo chmod 640 /etc/ssl/ldap/ldap-fullchain.pem
    sudo chmod 640 /etc/ssl/ldap/ldap-privkey.pem
    sudo chmod 640 /etc/ssl/ldap/ldap-chain.pem
    sudo systemctl restart slapd
    echo "OpenLDAP certificates updated and slapd restarted."
fi

# Make the script executable
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/slapd_cert_renew.sh

Now Certbot will automatically call this script after successful certificate renewal.

5. Verifying LDAPS Functionality

Let's verify that LDAPS is working correctly using ldapsearch with the secure port 636 specified.

# Verify LDAPS connection
ldapsearch -x -LLL -H ldaps://your.domain.com -b "dc=example,dc=org" -D "cn=admin,dc=example,dc=org" -w YourAdminPassword

If everything is configured correctly, you should see the contents of your LDAP directory. Also, try authenticating as the new user:

# Verify user authentication
ldapsearch -x -LLL -H ldaps://your.domain.com -b "dc=example,dc=org" -D "uid=johndoe,ou=people,dc=example,dc=org" -w YourUserPassword

This confirms that OpenLDAP is working, authentication is successful, and the connection is secured with TLS.

Backups and Maintenance

Backups are a critically important part of any server infrastructure. OpenLDAP is no exception. Regular backups will help restore data in case of failure, corruption, or accidental deletion.

What to Back Up

• OpenLDAP Database: Core directory data (users, groups, attributes).
• OpenLDAP Configuration Files: slapd configuration files (stored in /etc/ldap/slapd.d/) and any custom LDIF files you used for setup.
• SSL/TLS Certificates: Let's Encrypt certificates and keys, if you copied them to another location (/etc/letsencrypt/live/your.domain.com/ and /etc/ssl/ldap/).

Simple Auto-Backup Script

We will create a script that will export the LDAP database to LDIF format and archive important configuration files. For storing backups, you can use rsync to copy them to a remote server or S3-compatible storage.

# Create backup directory
sudo mkdir -p /var/backups/ldap
sudo chown -R openldap:openldap /var/backups/ldap

# Create backup script
sudo nano /usr/local/bin/backup_ldap.sh

Contents of /usr/local/bin/backup_ldap.sh:

#!/bin/bash

# Backup directory
BACKUP_DIR="/var/backups/ldap"
TIMESTAMP=$(date +%Y%m%d%H%M%S)
LDIF_FILE="$BACKUP_DIR/ldap_data_$TIMESTAMP.ldif"
CONFIG_ARCHIVE="$BACKUP_DIR/ldap_config_$TIMESTAMP.tar.gz"
DOMAIN_BASE="dc=example,dc=org" # Replace with your base DN
ADMIN_DN="cn=admin,$DOMAIN_BASE"
ADMIN_PASSWORD="YourAdminPassword" # Use environment variables or a password file in production

echo "Starting OpenLDAP backup at $TIMESTAMP..."

# 1. Back up OpenLDAP database to LDIF file
# Use slapcat to export the entire database
sudo -u openldap slapcat -b "$DOMAIN_BASE" -l "$LDIF_FILE"
if [ $? -eq 0 ]; then
    echo "LDAP database exported to $LDIF_FILE"
else
    echo "Error exporting LDAP database!"
    exit 1
fi

# 2. Back up OpenLDAP configuration files and certificates
tar -czf "$CONFIG_ARCHIVE" /etc/ldap/slapd.d /etc/letsencrypt/live/your.domain.com /etc/ssl/ldap
if [ $? -eq 0 ]; then
    echo "LDAP configuration and certificates archived to $CONFIG_ARCHIVE"
else
    echo "Error archiving configuration files!"
    exit 1
fi

# 3. Delete old backups (e.g., older than 7 days)
find "$BACKUP_DIR" -type f -name "ldap_data_*.ldif" -mtime +7 -delete
find "$BACKUP_DIR" -type f -name "ldap_config_*.tar.gz" -mtime +7 -delete
echo "Old backups cleaned up."

echo "OpenLDAP backup finished."

# Optional: Send backups to remote storage
# rsync -avzh "$BACKUP_DIR" user@remote_host:/path/to/remote/backups/
# aws s3 sync "$BACKUP_DIR" s3://your-s3-bucket/ldap-backups/

# Make the script executable
sudo chmod +x /usr/local/bin/backup_ldap.sh

IMPORTANT: Never store passwords in plain text in production scripts. Use environment variables, HashiCorp Vault, or other secure methods for secret storage. For this guide, we use a direct password for simplicity, but this is unacceptable in a real environment.

Setting up Cron for Automatic Execution

We will add the script to cron for daily execution.

# Open crontab for the root user
sudo crontab -e

Add the following line to run the backup every day at 3:00 AM:

0 3 * * * /usr/local/bin/backup_ldap.sh > /dev/null 2>&1

Where to Store Backups

Local backups are good, but they don't protect against a complete VPS failure. It is critically important to store backups off-server:

• External S3-compatible object storage: AWS S3, DigitalOcean Spaces, Backblaze B2. This is a reliable and inexpensive way to store large volumes of data.
• Separate VPS: You can rent a small VPS specifically for storing backups and use rsync or scp to transfer them.
• NAS/Network Storage: For local networks.

Integrate the chosen method into your backup script.

Restoring from Backup

To restore, you will need:

1. A clean OpenLDAP installation (or a stopped slapd on an existing server).
2. Delete the current database (sudo rm -rf /var/lib/ldap/*) and configuration (sudo rm -rf /etc/ldap/slapd.d/*).
3. Unpack the configuration archive (ldap_config_*.tar.gz) into /etc/ldap/slapd.d/.
4. Copy the certificates into place.
5. Start slapd in read-only mode or without a database.
6. Import the database LDIF file (ldap_data_*.ldif) using slapadd:

   
   sudo -u openldap slapadd -b "dc=example,dc=org" -l "$LDIF_FILE"
   

7. Restart slapd.

Updates: rolling vs maintenance window

Software updates, including OpenLDAP and the operating system, are important for security and performance. Approaches:

• Rolling updates: Applicable in clustered configurations with multiple servers, where nodes can be updated one by one without service downtime. Not applicable for a single VPS.
• Maintenance window: The most suitable approach for a single OpenLDAP VPS. A time of lowest load is chosen (e.g., late night), and users are warned about possible brief downtime.

  
  # Stop the service
  sudo systemctl stop slapd
  
  # Update the system
  sudo apt update && sudo apt upgrade -y
  
  # Start the service
  sudo systemctl start slapd
  

  Always perform a full backup before major updates!

Troubleshooting and FAQ

How to check OpenLDAP status?

To check the status of the slapd daemon, use the command sudo systemctl status slapd. It will show if the service is running and the last lines of the logs. If the service is not active, check the logs with the command sudo journalctl -u slapd for more detailed error information.

Cannot connect to LDAP server. What to check?

If you cannot connect to the LDAP server, check the following:

1. Firewall (UFW): Ensure that ports 389 (LDAP) and 636 (LDAPS) are open. Use sudo ufw status verbose.
2. slapd status: Make sure the slapd service is running (sudo systemctl status slapd).
3. slapd configuration: Check the /etc/default/slapd file or slapd configuration (olcArgsFile in cn=config) for correct IP address bindings (-h option). By default, slapd should listen on all interfaces.
4. Network accessibility: Try telnet your_vps_ip 389 or telnet your_vps_ip 636 from your local machine. If the connection is not established, the problem might be with the network or the VPS/provider firewall.

Why isn't user authentication working?

If users cannot log in, check:

1. User DN: Make sure you are using the correct user DN (e.g., uid=johndoe,ou=people,dc=example,dc=org).
2. Password: Verify that the password is entered correctly. You might have used an incorrect hash when creating the user.
3. ACLs (Access Control Lists): Check the ACLs configuration in OpenLDAP. The user might not have rights to read their data or authenticate. Use ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=config" olcAccess to view ACLs.
4. Schema: Ensure that all necessary schemas (inetorgperson, posixAccount, etc.) are loaded and user attributes conform to them.

How to reset the OpenLDAP administrator password?

If you forgot the OpenLDAP administrator password, you can reset it:

1. Generate a new password hash: slappasswd -s NewAdminPassword.
2. Create an LDIF file, as we did in the "Software Installation" section, with the new hash:

   
   dn: olcDatabase={1}mdb,cn=config
   changetype: modify
   replace: olcRootPW
   olcRootPW: {SSHA}NEW_PASSWORD_HASH
   

3. Apply it: ldapmodify -Y EXTERNAL -H ldapi:/// -f admin_new_password.ldif.

What is the minimum suitable VPS configuration?

For a basic OpenLDAP installation and use with a small number of users (up to 50-100), a VPS with 1 vCPU, 1 GB RAM, and 20-40 GB SSD will be minimally suitable. This is sufficient for running the service and handling low load. However, if integration with many services is planned or an increase in the number of users is expected, 2 vCPU, 2-4 GB RAM, and 80 GB SSD are recommended for stable operation.

What to choose — VPS or dedicated for this task?

The choice between a VPS and a dedicated server depends on the scale, performance requirements, security, and budget:

• VPS: Ideal for most small to medium projects (up to several thousand users), startups, test environments, personal projects. It is economical, flexible, and easy to scale resources.
• Dedicated server: Necessary for very large organizations with tens of thousands of users, mission-critical systems requiring maximum performance, complete isolation, and strict compliance with security regulations. Dedicated servers are more expensive but provide exclusive access to all hardware resources.

To start, a VPS is an excellent choice, and as needs grow, you can always migrate to a dedicated server.

How to add a new user or group after setup?

To add new users or groups, follow the same procedure as in the "Configuration" section. Create a new LDIF file with the user or group data, generate a password hash (if it's a user), and use the command ldapadd -x -D "cn=admin,dc=example,dc=org" -w YourAdminPassword -f new_user.ldif to add it to the directory.

How to configure OpenLDAP logging?

By default, OpenLDAP logs messages via rsyslog to system logs. You can configure the logging detail level by changing the olcLogLevel parameter in the cn=config configuration. For example, for more detailed logging:

# Create an LDIF file to change the logging level
nano loglevel.ldif

dn: cn=config
changetype: modify
replace: olcLogLevel
olcLogLevel: stats requests args

# Apply the change
ldapmodify -Y EXTERNAL -H ldapi:/// -f loglevel.ldif

# Restart slapd for changes to take effect
sudo systemctl restart slapd

This will allow you to track requests, arguments, and statistics, which is useful for debugging.

Conclusions and Next Steps

You have successfully installed and configured an OpenLDAP server on your VPS, creating a centralized user and group management system. You now have a secure and scalable foundation for authentication and authorization, which will significantly simplify the administration of your infrastructure. You have learned to work with basic LDAP commands, configure schemas, create entries, and secure connections using TLS.

Now that OpenLDAP is ready, you can move forward by integrating it with other services and extending its functionality:

1. Application Integration: Configure LDAP authentication in your web applications (Nextcloud, GitLab, Jenkins, Grafana), VPN servers (OpenVPN, WireGuard), mail servers, or other services that support LDAP authentication.
2. Advanced ACLs: Study and configure more complex Access Control List (ACL) rules for different organizational units to precisely delineate user and administrator access rights to various parts of the directory.
3. Replication and High Availability: For mission-critical systems, consider setting up OpenLDAP replication across multiple VPS instances. This will ensure high availability and fault tolerance, preventing a single point of failure.
4. Integration with FreeIPA/Samba AD: If you need a more comprehensive identity management system with Kerberos, DNS, CA, and Windows domain support, consider integrating with FreeIPA or Samba Active Directory, which use OpenLDAP as a core component.