F17->F18: upgrade OpenLDAP database?

[Braden McDaniel]

After upgrading from F17 to F18, I get this message when trying to  
start slapd:

Mar 15 11:24:13 knock.endoframe.net slapd[8210]: hdb_db_open: database  
"dc=endoframe,dc=net" cannot be opened, err -30969. Restore from backup!
Mar 15 11:24:13 knock.endoframe.net slapd[8210]:  
bdb(dc=endoframe,dc=net): BDB1566 txn_checkpoint interface requires an  
environment configured for the transaction subsystem
Mar 15 11:24:13 knock.endoframe.net slapd[8210]: bdb_db_close:  
database "dc=endoframe,dc=net": txn_checkpoint failed: Invalid  
argument (22).
Mar 15 11:24:13 knock.endoframe.net slapd[8210]: backend_startup_one  
(type=hdb, suffix="dc=endoframe,dc=net"): bi_db_open failed! (-30969)
Mar 15 11:24:13 knock.endoframe.net slapd[8210]: bdb_db_close:  
database "dc=endoframe,dc=net": alock_close failed
Mar 15 11:24:13 knock.endoframe.net slapd[8210]: slapd stopped.
Mar 15 11:24:13 knock.endoframe.net systemd[1]: slapd.service: control  
process exited, code=exited status=1
Mar 15 11:24:13 knock.endoframe.net systemd[1]: Failed to start  
OpenLDAP Server Daemon.

Can the database be upgraded? I tried this in /var/lib/ldap:

# db_upgrade cn.bdb
db_upgrade: BDB1538 Program version 5.3 doesn't match environment version 5.2
db_upgrade: DB_ENV->open: BDB0091 DB_VERSION_MISMATCH: Database  
environment version mismatch

[Brian Millett]

On Fri, 15 Mar 2013 11:35:02 -0400
Braden McDaniel  wrote:
> After upgrading from F17 to F18, I get this message when trying to  
> start slapd:
>
> Mar 15 11:24:13 knock.endoframe.net slapd[8210]: hdb_db_open: database  
> "dc=endoframe,dc=net" cannot be opened, err -30969. Restore from backup!
> Mar 15 11:24:13 knock.endoframe.net slapd[8210]:  
> bdb(dc=endoframe,dc=net): BDB1566 txn_checkpoint interface requires an  
> environment configured for the transaction subsystem
> Mar 15 11:24:13 knock.endoframe.net slapd[8210]: bdb_db_close:  
> database "dc=endoframe,dc=net": txn_checkpoint failed: Invalid  
> argument (22).
> Mar 15 11:24:13 knock.endoframe.net slapd[8210]: backend_startup_one  
> (type=hdb, suffix="dc=endoframe,dc=net"): bi_db_open failed! (-30969)
> Mar 15 11:24:13 knock.endoframe.net slapd[8210]: bdb_db_close:  
> database "dc=endoframe,dc=net": alock_close failed
> Mar 15 11:24:13 knock.endoframe.net slapd[8210]: slapd stopped.
> Mar 15 11:24:13 knock.endoframe.net systemd[1]: slapd.service: control  
> process exited, code=exited status=1
> Mar 15 11:24:13 knock.endoframe.net systemd[1]: Failed to start  
> OpenLDAP Server Daemon.
>
> Can the database be upgraded? I tried this in /var/lib/ldap:
>
> # db_upgrade cn.bdb
> db_upgrade: BDB1538 Program version 5.3 doesn't match environment version 5.2
> db_upgrade: DB_ENV->open: BDB0091 DB_VERSION_MISMATCH: Database  
> environment version mismatch

what you want to do is to 'recover' the db, so in /var/lib/ldap, do

db_recover

then make sure that all files are owned ldap:ldap

[Braden McDaniel]

Brian Millett <bmillett <at> gmail.com> writes:

[snip]
> what you want to do is to 'recover' the db, so in /var/lib/ldap, do
>
> db_recover
>
> then make sure that all files are owned ldap:ldap

Hm... When I do that, I get:

# db_recover
  db_recover: BDB1538 Program version 5.3 doesn't match environment version 5.2

Braden

[Brian Millett]

On Fri, 15 Mar 2013 17:14:40 +0000 (UTC)
Braden McDaniel  wrote:
> Brian Millett <bmillett <at> gmail.com> writes:
>
> [snip]
> > what you want to do is to 'recover' the db, so in /var/lib/ldap, do
> >
> > db_recover
> >
> > then make sure that all files are owned ldap:ldap
>
> Hm... When I do that, I get:
>
> # db_recover
>   db_recover: BDB1538 Program version 5.3 doesn't match environment version
> 5.2
>
> Braden

Bummer.  Lets see.  In the scripts for the openldap-servers, there is this:

# upgrade the database
if [ -f /var/lib/ldap/rpm_upgrade_openldap ]; then
    if /usr/bin/systemctl --quiet is-active slapd.service; then
    	/usr/bin/systemctl stop slapd.service
    	start_slapd=1
    fi

/usr/libexec/openldap/upgrade-db.sh &>/dev/null
    rm -f /var/lib/ldap/rpm_upgrade_openldap
fi

So, if the database needs upgrading, then the pre-install script touches
the /var/lib/ldap/rpm_upgrade_openldap file.  Do you have that, then see if
the above works.

Also, what is the contents of the /var/lib/ldap dir?  Please include the
results from

ls -l of /var/lib/ldap

thanks.

[Braden McDaniel]

Quoting Brian Millett :
> On Fri, 15 Mar 2013 17:14:40 +0000 (UTC)
> Braden McDaniel  wrote:
> > Brian Millett <bmillett <at> gmail.com> writes:
> >
> > [snip]
> > > what you want to do is to 'recover' the db, so in /var/lib/ldap, do
> > >
> > > db_recover
> > >
> > > then make sure that all files are owned ldap:ldap
> >
> > Hm... When I do that, I get:
> >
> > # db_recover
> >   db_recover: BDB1538 Program version 5.3 doesn't match environment version
> > 5.2
>
> Bummer.  Lets see.  In the scripts for the openldap-servers, there is this:
>
> # upgrade the database
> if [ -f /var/lib/ldap/rpm_upgrade_openldap ]; then
>    if /usr/bin/systemctl --quiet is-active slapd.service; then
>    	/usr/bin/systemctl stop slapd.service
>    	start_slapd=1
>    fi
>
> /usr/libexec/openldap/upgrade-db.sh &>/dev/null
>    rm -f /var/lib/ldap/rpm_upgrade_openldap
> fi
>
> So, if the database needs upgrading, then the pre-install script touches
> the /var/lib/ldap/rpm_upgrade_openldap file.  Do you have that, then see if
> the above works.

No, I don't have the file "/var/lib/ldap/rpm_upgrade_openldap".

I tried running upgrade-db.sh anyway:

# /usr/libexec/openldap/upgrade-db.sh
/usr/libexec/openldap/upgrade-db.sh: line 19: [: missing `]'

Okay, so, next I inspected that script to see what it wanted to do.   
This looks like the important part:

"/usr/bin/db_recover -v -h "$dbdir"" \
    	"/usr/bin/db_upgrade -v -h "$dbdir" $bdb_files" \
    	"/usr/bin/db_checkpoint -v -h "$dbdir" -1" \

So, I did the upgrade; and the results looked promising:

# db_upgrade -v -h . *.bdb
BDB5019 db_upgrade: cn.bdb upgraded successfully
BDB5019 db_upgrade: dn2id.bdb upgraded successfully
BDB5019 db_upgrade: gidNumber.bdb upgraded successfully
BDB5019 db_upgrade: givenName.bdb upgraded successfully
BDB5019 db_upgrade: id2entry.bdb upgraded successfully
BDB5019 db_upgrade: krbPrincipalName.bdb upgraded successfully
BDB5019 db_upgrade: loginShell.bdb upgraded successfully
BDB5019 db_upgrade: mail.bdb upgraded successfully
BDB5019 db_upgrade: memberUid.bdb upgraded successfully
BDB5019 db_upgrade: objectClass.bdb upgraded successfully
BDB5019 db_upgrade: ou.bdb upgraded successfully
BDB5019 db_upgrade: sn.bdb upgraded successfully
BDB5019 db_upgrade: uid.bdb upgraded successfully
BDB5019 db_upgrade: uidNumber.bdb upgraded successfully

# db_checkpoint -v -h . -1
db_checkpoint: BDB5123 checkpoint begin: Fri Mar 15 15:20:18 2013

db_checkpoint: BDB5124 checkpoint complete: Fri Mar 15 15:20:18 2013

Even thought I ran this as root, the files still appear to be owned by ldap:

# ls -l
total 10440
-rw-r--r--. 1 ldap ldap     2048 Mar 15 11:24 alock
-rw-------. 1 ldap ldap     8192 May  6  2012 cn.bdb
-rw-------. 1 ldap ldap      845 Apr  8  2012 DB_CONFIG
-rw-------. 1 ldap ldap    12288 Nov 28 08:55 dn2id.bdb
-rw-------. 1 ldap ldap     8192 May  6  2012 gidNumber.bdb
-rw-------. 1 ldap ldap     8192 May  2  2012 givenName.bdb
-rw-------. 1 ldap ldap    65536 Jan 27 11:26 id2entry.bdb
-rw-------. 1 ldap ldap    20480 Nov 28 08:55 krbPrincipalName.bdb
-rw-------. 1 ldap ldap 10485760 Mar 15 13:04 log.0000000001
-rw-r-----. 1 root root 10485760 Mar 15 15:20 log.0000000002
-rw-------. 1 ldap ldap     8192 May  2  2012 loginShell.bdb
-rw-------. 1 ldap ldap     8192 May  3  2012 mail.bdb
-rw-------. 1 ldap ldap     8192 May  7  2012 memberUid.bdb
-rw-------. 1 ldap ldap     8192 Nov 28 08:55 objectClass.bdb
-rw-------. 1 ldap ldap     8192 May  2  2012 ou.bdb
-rw-------. 1 ldap ldap     8192 May  2  2012 sn.bdb
-rw-------. 1 ldap ldap     8192 May  2  2012 uid.bdb
-rw-------. 1 ldap ldap     8192 May  2  2012 uidNumber.bdb

Unfortunately, slapd is still failing to start.  I'm getting a  
different error message now, though:

Mar 15 15:20:27 knock.endoframe.net runuser[9280]:  
pam_unix(runuser:session): session closed for user ldap
Mar 15 15:20:27 knock.endoframe.net runuser[9282]:  
pam_unix(runuser:session): session opened for user ldap by (uid=0)
Mar 15 15:20:27 knock.endoframe.net runuser[9282]:  
pam_unix(runuser:session): session closed for user ldap
Mar 15 15:20:27 knock.endoframe.net runuser[9284]:  
pam_unix(runuser:session): session opened for user ldap by (uid=0)
Mar 15 15:20:27 knock.endoframe.net runuser[9284]:  
pam_unix(runuser:session): session closed for user ldap
Mar 15 15:20:27 knock.endoframe.net runuser[9286]:  
pam_unix(runuser:session): session opened for user ldap by (uid=0)
Mar 15 15:20:27 knock.endoframe.net runuser[9286]:  
pam_unix(runuser:session): session closed for user ldap
Mar 15 15:20:27 knock.endoframe.net systemd[1]: slapd.service: control  
process exited, code=exited status=1
Mar 15 15:20:27 knock.endoframe.net systemd[1]: Failed to start  
OpenLDAP Server Daemon.

[Brian Millett]

On Fri, 15 Mar 2013 15:35:10 -0400
Braden McDaniel  wrote:
> root root 10485760 Mar 15 15:20 log.0000000002

Fix this and all other files to be ldap:ldap

Looks promising!

[Braden McDaniel]

On Mar 15, 2013, at 3:40 PM, Brian Millett  wrote:
> On Fri, 15 Mar 2013 15:35:10 -0400
> Braden McDaniel  wrote:
> > root root 10485760 Mar 15 15:20 log.0000000002
>
> Fix this and all other files to be ldap:ldap

Success!

That file was owned by root the first time I saw it; that and the fact that it wasn't a *.bdb file made me think that it was as it was supposed to be.  But sure enough, changing it to ldap:ldap fixed the problem.

Thanks for your help!