openldap backend_startup_one: bi_db_open failed! (-1)

啟動 openldap 時出現

bdb_db_open: alock package is unstable
backend_startup_one: bi_db_open failed! (-1)
slap_startup failed (test would succeed using the -u switch)

這通常是權限及alock的問題，要判斷哪種問題，首先將slapd.conf的loglevel
調整成1

shell># vim /etc/openldap/slapd.conf
loglevel 1
shell># service ldap restart
一些原本看不到的訊息就出現了
/var/lib/ldap/__db.003 is not owned by "ldap" [警告]
/var/lib/ldap/__db.002 is not owned by "ldap" [警告]
/var/lib/ldap/__db.004 is not owned by "ldap" [警告]
/var/lib/ldap/__db.001 is not owned by "ldap" [警告]
/var/lib/ldap/__db.006 is not owned by "ldap" [警告]
/var/lib/ldap/__db.005 is not owned by "ldap" [警告]
正在為 slapd 檢查設定檔案: bdb_db_open: alock package is unstable
backend_startup_one: bi_db_open failed! (-1)
slap_startup failed (test would succeed using the -u switch)

像上述的問題只要調整權限就可解決，若是alock的問題，參考slapd.conf裡的directory參數找到資料庫位置，然後把alock刪除即可。另外selinux也可能造成這樣的問題，你可以先setenforce 0測試是否為selinux造成

openldap non-error result code

在debug openldap時常看到類似這樣的訊息，但一直搞不懂tag和err所代表的意義

Dec 19 01:23:06 sso slapd[15299]: conn=4321 op=1 SRCH attr=mail
Dec 19 01:23:06 sso slapd[15299]: conn=4321 op=1 ENTRY dn="cn=user1,ou=staff,ou=people,dc=abc,dc=com.tw"
Dec 19 01:23:06 sso slapd[15299]: conn=4321 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
Dec 19 01:23:06 sso slapd[15299]: conn=4321 op=2 CMP dn="cn=user1,ou=staff,ou=people,dc=abc,dc=com.tw" attr="mail"
Dec 19 01:23:06 sso slapd[15299]: conn=4321 op=2 RESULT tag=111 err=6 text=
Dec 19 01:23:06 sso slapd[15299]: conn=4321 op=3 UNBIND

原來這在官方的手冊理已經有提到，這是非錯誤的結果代碼，例如比較的結果會回應5或6，若沒看手冊的話，直覺都認為是發生錯誤了，原來是代表結果狀態，下面的內容是擷取自OpenLDAP的管理者指南，完整的錯誤代碼可以參考RFC-4511

These result codes (called "non-error" result codes) do not indicate an error
condition:

       success (0),
       compareFalse (5),
       compareTrue (6),
       referral (10), and
       saslBindInProgress (14).

The success, compareTrue, and compareFalse result codes indicate successful
completion (and, hence, are referred to as "successful" result codes).

The referral and saslBindInProgress result codes indicate the client needs
to take additional action to complete the operation.

參考文獻
OpenLDAP administrator's guide
RFC-4511

OpenLDAP TLS： xxx is not readable by "ldap"

啟用OpenLDAP TLS功能時需要引入金鑰來傳輸加密，但啟動LDAP服務時卻發生如下錯誤訊息

[root@ldapslave CA]# service ldap restart
正在停止 slapd:                                            [失敗]
/etc/pki/CA/rootca.crt is not readable by "ldap"           [警告]
/etc/pki/CA/server.crt is not readable by "ldap"           [警告]
/etc/pki/CA/server.key is not readable by "ldap"           [警告]
正在為 slapd 檢查設定檔案:  config file testing success    [確定]
正在啟動 slapd:                                            [失敗]

這時請確認錯誤訊息所提及的檔案權限，特別容易疏忽的地方是目錄權限是否允許ldap這個帳號存取，以我的例子，/etc/pki/CA預設的權限是700，所以ldap這個帳號根本沒辦法進目錄讀取檔案 XD。