Linux 如何克隆 OpenLDAP 数据库
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/792563/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How do I clone an OpenLDAP database
提问by elzapp
I know this is more like a serverfault question than a stackoverflow question, but since serverfault isn't up yet, here I go:
我知道这更像是一个 serverfault 问题而不是一个 stackoverflow 问题，但由于 serverfault 还没有启动，我开始：
I'm supposed to move an application from one redhat server to another, and without very good knowledge of the internal workings of the application, how would I move the OpenLDAP database from the one machine to the other, with schemas and all.
我应该将应用程序从一台 redhat 服务器移动到另一台服务器，并且对应用程序的内部工作原理没有很好的了解，我将如何将 OpenLDAP 数据库从一台机器移动到另一台机器，以及所有架构。
What files would I need to copy over? I believe the setup is pretty standard.
我需要复制哪些文件？我相信设置非常标准。
采纳答案by sberder
The problem with SourceRebelsanswer is that slapcat(8)does not guarantee that the data is ordered for ldapadd(1)/ldapmodify(1). From the man page :
SourceRebels答案的问题在于slapcat(8)不能保证数据是为ldapadd(1)/排序的ldapmodify(1)。从手册页：
The LDIF generated by this tool is suitable for use with slapadd(8). As the entries are in database order, not superior first order, they cannot be loaded with ldapadd(1) without first being reordered.
Plus using a tool that uses the backend files to dump the database and then using a tool that loads the ldif through the ldap protocol is not very consistent.
加上使用使用后端文件转储数据库的工具，然后使用通过 ldap 协议加载 ldif 的工具不是很一致。
I'd suggest to use a combination of slapcat(8)/slapadd(8)ORldapsearch(1)/ldapmodify(1). My preference would go to the latter as it does not need shell access to the ldap server or moving files around.
我建议使用slapcat(8)/ slapadd(8)ORldapsearch(1)/的组合ldapmodify(1)。我更喜欢后者，因为它不需要对 ldap 服务器的 shell 访问或移动文件。
For example, dump database from a master server under dc=master,dc=com and load it in a backup server
例如，从 dc=master,dc=com 下的主服务器转储数据库并将其加载到备份服务器中
$ ldapsearch -Wx -D "cn=admin_master,dc=master,dc=com" -b "dc=master,dc=com" -H ldap://my.master.host -LLL > ldap_dump-20100525-1.ldif $ ldapadd -Wx -D "cn=admin_backup,dc=backup,dc=com" -H ldap://my.backup.host -f ldap_dump-20100525-1.ldif
The -W flag above prompts for ldap admin_master password however since we are redirecting output to a file you wont see the prompt - just an empty line. Go ahead and type your ldap admin_master password and and it will work. First line of your output file will need to be removed (Enter LDAP Password:) before running ldapadd.
上面的 -W 标志提示输入 ldap admin_master 密码，但是由于我们将输出重定向到一个文件，您不会看到提示 - 只是一个空行。继续并输入您的 ldap admin_master 密码，它将起作用。在运行 ldapadd 之前，需要删除输出文件的第一行（输入 LDAP 密码：）。
Last hint, ldapadd(1)is a hard link to ldapmodify(1)with the -a(add) flag turned on.
最后提示，ldapadd(1)是一个硬链接ldapmodify(1)与-a（ADD）标志开启。
回答by sourcerebels
Some appointments:
一些约会：
Save your personalized schemas and objectclasses definitions on your new server. You can look for your included files at slapd.conf to obtain it, for example (this is a part of my slapd.conf):
include /etc/ldap/schema/core.schema
Include your personalized schemas and objectclasses in your new openLDAP installation.
Use slapcatcommand to export your full LDAP tree to a single/various ldiffiles.
Use ldapaddto import the ldif files on to your new LDAP installation.
回答by Vish
I prefer copy the database through the protocol:
我更喜欢通过协议复制数据库：
first of all be sure you have the same schemas on both servers.
首先，请确保您在两台服务器上拥有相同的架构。
-dump the database with ldapsearch:
ldapsearch -LLL -Wx -D "cn=admin,dc=domain" -b "dc=domain" > domain.ldif
- 使用
ldapsearch 转储数据库：ldapsearch -LLL -Wx -D "cn=admin,dc=domain" -b "dc=domain" > domain.ldif
-and import it in the new server:
ldapmodify -Wx -D "cn=admin,dc=domain" -a -f domain.ldif
- 并将其导入新服务器：
ldapmodify -Wx -D "cn=admin,dc=domain" -a -f domain.ldif
in oneline:
ldapsearch -LLL -Wx -D "cn=admin,dc=domain" -b "dc=domain" | ldapmodify -w pass -x -D "cn=admin,dc=domain" -a
在
一行中：ldapsearch -LLL -Wx -D "cn=admin,dc=domain" -b "dc=domain" | ldapmodify -w pass -x -D "cn=admin,dc=domain" -a
By using the bin/ldap* commands you are talking directly with the server while using bin/slap* commands you are dealing with the backend files
通过使用 bin/ldap* 命令，您直接与服务器对话，而使用 bin/slap* 命令处理后端文件
回答by Joel
ldapsearch and ldapadd are not necessarily the best tools to clone your LDAP DB. slapcat and slapadd are much better options.
ldapsearch 和 ldapadd 不一定是克隆 LDAP 数据库的最佳工具。slapcat 和 slapadd 是更好的选择。
Export your DB with slapcat:
使用 slapcat 导出您的数据库：
slapcat > ldif
Import the DB with slapadd (make sure the LDAP server is stopped):
使用 slapadd 导入数据库（确保 LDAP 服务器已停止）：
slapadd -l ldif
回答by Natan
Thanks, Vish. Worked like a charm! I edited the command:
谢谢，维什。像魅力一样工作！我编辑了命令：
ldapsearch -z max -LLL -Wx -D "cn=Manager,dc=domain,dc=fr" -b "dc=domain,dc=fr" >/tmp/save.ldif
ldapmodify -c -Wx -D "cn=Manager,dc=domain,dc=fr" -a -f /tmp/save.ldif
Just added the -z maxto avoid the size limitation and the -cto go on even if the target domain already exists (my case).
只是添加了-z max以避免大小限制，-c即使目标域已经存在（我的情况）也可以继续。
回答by O.Colombo
(Not enough reputation to write a comment...)
（没有足够的声誉来写评论......）
Ldapsearch opens a connection to the LDAP server. Slapcat instead accesses the database directly, and this means that ACLs, time and size limits, and other byproducts of the LDAP connection are not evaluated, and hence will not alter the data. (Matt Butcher, "Mastering OpenLDAP")
Ldapsearch 打开到 LDAP 服务器的连接。Slapcat 而是直接访问数据库，这意味着不会评估 ACL、时间和大小限制以及 LDAP 连接的其他副产品，因此不会更改数据。（马特·布彻，“掌握 OpenLDAP”）
