02b3acd441
OpenLDAP does not need using ldaps protocol for secure OpenLDAP unless the OpenLDAP certificate gets created. This commit removes the ldaps enablement for OpenLDAP at all times, currently done at bootstrap. The ldaps enablement will be done only when the OpenLDAP certificate creation gets detected. It will be done by puppet configuration applied using runtime manifest. Tests performed: PASS: Check slapd daemon status after system install and no OpenLDAP certificate created and it should not have ldaps enabled. PASS: Create OpenLDAP certificate and verify it was created successfully. PASS: Trigger OpenLDAP certificate installation by removing the OpenLDAP secret. PASS: System command "certificate-list" shows the OpenLDAP certificate has been installed. PASS: Verify that ldaps has been enable and port 636 has been opened after OpenLDAP certificate was installed. PASS: OpenLDAP certificate and key files have been added to schema file “/etc/openldap/schema/cn=config.ldif”. PASS: Deletion of OpenLDAP secret triggers the creation of a new secret. PASS: Add new OpenLDAP user PASS: List all OpenLDAP users Story: 2009834 Task: 45172 Signed-off-by: Carmen Rata <carmen.rata@windriver.com> Change-Id: I9c52dc1c2d95dff265ca79458e9d172f257f2e6a
115 lines
2.7 KiB
Bash
Executable File
115 lines
2.7 KiB
Bash
Executable File
#! /bin/sh
|
|
#
|
|
# This is an init script for openembedded
|
|
# Copy it to /etc/init.d/openldap and type
|
|
# > update-rc.d openldap defaults 60
|
|
#
|
|
. /etc/init.d/functions
|
|
|
|
PID_FILE='/var/run/slapd.pid'
|
|
MAX_FD_COUNT=4096
|
|
ALARM_THRESHOLD=3891 # 95 % MAX
|
|
EXIT_APPROACH_LIMIT=160
|
|
EXIT_LIMIT_REACHED=161
|
|
|
|
################################################################################
|
|
# Wait for a process to stop running.
|
|
#
|
|
################################################################################
|
|
function wait_for_proc_stop()
|
|
{
|
|
PROGNAME=$1
|
|
TIMEOUT=${2:-"5"}
|
|
|
|
for I in $(seq 1 $TIMEOUT); do
|
|
PID=$(pidof $PROGNAME 2> /dev/null)
|
|
if [ $? -ne 0 ]; then
|
|
## already dead
|
|
return 0
|
|
fi
|
|
sleep 1
|
|
done
|
|
|
|
return 1
|
|
}
|
|
|
|
|
|
slapd=/usr/sbin/slapd
|
|
test -x "$slapd" || exit 0
|
|
|
|
RETVAL=0
|
|
|
|
case "$1" in
|
|
start)
|
|
echo -n "Starting SLAPD: "
|
|
# Bump up the open file limit for created daemons
|
|
ulimit -n $MAX_FD_COUNT
|
|
if [ -f /etc/openldap/schema/cn=config.ldif ]; then
|
|
start-stop-daemon --start --oknodo --quiet --exec $slapd \
|
|
-- -h "ldap:///" -F /etc/openldap/schema/
|
|
RETVAL=$?
|
|
else
|
|
start-stop-daemon --start --oknodo --quiet --exec $slapd
|
|
RETVAL=$?
|
|
fi
|
|
if [ $RETVAL -ne 0 ]; then
|
|
echo "Failed to start SLAPD."
|
|
exit $RETVAL
|
|
fi
|
|
|
|
# we need to start nscd service as part of this openldap
|
|
# init.d script since SM manages this as a service and both
|
|
# daemons should be running on a controller host
|
|
systemctl status nscd.service
|
|
if [ $? -ne 0 ]; then
|
|
echo -n "Starting NSCD: "
|
|
systemctl start nscd.service
|
|
RETVAL=$?
|
|
if [ $RETVAL -ne 0 ]; then
|
|
echo "Failed to start NSCD."
|
|
exit $RETVAL
|
|
fi
|
|
fi
|
|
|
|
echo "."
|
|
;;
|
|
stop)
|
|
echo -n "Stopping NSCD: "
|
|
systemctl stop nscd.service
|
|
rm -f /var/run/nscd/nscd.pid
|
|
|
|
echo -n "Stopping SLAPD: "
|
|
start-stop-daemon --retry 60 --stop --oknodo --quiet --pidfile /var/run/slapd.pid
|
|
RETVAL=$?
|
|
wait_for_proc_stop $slapd 10
|
|
WRETVAL=$?
|
|
while [ $WRETVAL -eq 1 ]; do
|
|
killproc $slapd
|
|
wait_for_proc_stop $slapd 10
|
|
WRETVAL=$?
|
|
done
|
|
rm -f '$PID_FILE'
|
|
echo "."
|
|
;;
|
|
status)
|
|
status $slapd
|
|
[ $? -eq 0 ] || exit $?
|
|
systemctl status nscd.service
|
|
[ $? -eq 0 ] || exit $?
|
|
PID=`cat $PID_FILE`
|
|
FD_PATH="/proc/$PID/fd/"
|
|
FD_CNT=`ls $FD_PATH -l | wc -l`
|
|
[ "$FD_CNT" -lt "$MAX_FD_COUNT" ] || exit $EXIT_LIMIT_REACHED
|
|
[ "$FD_CNT" -lt "$ALARM_THRESHOLD" ] || exit $EXIT_APPROACH_LIMIT
|
|
;;
|
|
restart)
|
|
$0 stop
|
|
$0 start
|
|
;;
|
|
*)
|
|
echo "Usage: /etc/init.d/openldap {start|stop|status|restart}"
|
|
exit 1
|
|
esac
|
|
|
|
exit $RETVAL
|