Backup-Restore OpenLDAP
If we have OpenLDAP running just the way we want, it is time to ensure we can save all of our work and restore it as needed.
What we need is a way to backup the directory database(s), specifically the configuration backend (cn=config) and the DIT (dc=example,dc=com). If we are going to backup those databases into, say, /export/backup
, we could use slapcat as shown in the following script, called /usr/local/bin/ldapbackup
:
#!/bin/bash
set -e
BACKUP_PATH=/export/backup
SLAPCAT=/usr/sbin/slapcat
nice ${SLAPCAT} -b cn=config > ${BACKUP_PATH}/config.ldif
nice ${SLAPCAT} -b dc=example,dc=com > ${BACKUP_PATH}/example.com.ldif
chown root:root ${BACKUP_PATH}/*
chmod 600 ${BACKUP_PATH}/*.ldif
Note
These files are uncompressed text files containing everything in your directory including the tree layout, usernames, and every password. So, you might want to consider making
/export/backup
an encrypted partition and even having the script encrypt those files as it creates them. Ideally you should do both, but that depends on your security requirements.
Then, it is just a matter of having a cron script to run this program as often as you feel comfortable with. For many, once a day suffices. For others, more often is required. Here is an example of a cron script called /etc/cron.d/ldapbackup
that is run every night at 22:45h:
MAILTO=backup-emails@domain.com
45 22 * * * root /usr/local/bin/ldapbackup
Now the files are created, they should be copied to a backup server.
Assuming we did a fresh reinstall of ldap, the restore process could be something like this:
#!/bin/bash
set -e
BACKUP_PATH=/export/backup
SLAPADD=/usr/sbin/slapadd
if [ -n "$(ls -l /var/lib/ldap/* 2>/dev/null)" -o -n "$(ls -l /etc/ldap/slapd.d/* 2>/dev/null)" ]; then
echo Run the following to remove the existing db:
echo sudo systemctl stop slapd.service
echo sudo rm -rf /etc/ldap/slapd.d/* /var/lib/ldap/*
exit 1
fi
sudo systemctl stop slapd.service || :
sudo slapadd -F /etc/ldap/slapd.d -b cn=config -l /export/backup/config.ldif
sudo slapadd -F /etc/ldap/slapd.d -b dc=example,dc=com -l /export/backup/example.com.ldif
sudo chown -R openldap:openldap /etc/ldap/slapd.d/
sudo chown -R openldap:openldap /var/lib/ldap/
sudo systemctl start slapd.service
Original text found here: https://ubuntu.com/server/docs/service-ldap-backup-restore