![OpenLDAP Migration Tutorial [Step-by-Step]](/openldap-migration-examples/openldap-migration.jpg)
OpenLDAP Migration - Overview
We can migrate the LDAP configurations from one machine to another using Backup and Restore method. As far as the LDAP server version is the same on both machines, it will not create any issues. The LDAP Migration scripts are available on RHEL/CentOS 7 or older OS default repositories. However, this is not available on the latest RHEL/CentOS 8 and Rocky Linux 8 operating systems. However, if it is necessary, we can still use the migrationtools packages from RHEL/CentOS 7 version.
This article is created for OpenLDAP users on Rocky Linux 8. Please refer to the following articles for installing and configuring OpenLDAP on Rocky Linux.
Configure OpenLDAP on Rocky Linux 8 [Step-by-Step]
Migrate LDAP from one machine to another
We can simply migrate OpenLDAP configurations from one machine to another by creating backups and restoring them on the other machine. In this section, we will discuss migration using backups. The following steps are to be followed on both the old server and the new server.
On the old server:
1. Stop the service
[root@ldapmaster ~]# systemctl stop slapd
2. Export all schema and cn=config
[root@ldapmaster ~]# slapcat -n 0 -l slapdbackup.conf
3. Export all user data that you keep in the LDAP server.
In my case, the DB number was 2 (-n 2)
[root@ldapmaster ~]# slapcat -n 2 -l configbackup.ldif
4. Copy the files slapdbackup.conf and configbackup.ldif to the new server.
On the new server:
Install the OpenLDAP packages. Please refer Configure OpenLDAP on Rocky Linux 8 to install. You just need to complete the installations Step 1. After the installation, follow the below steps to restore the backup files copied from the old server.
1. Stop the service
[root@ldapmasternew ~]# systemctl stop slapd
2. Remove all the files under the directory /etc/openldap/slapd.d/
[root@ldapmasternew ~]# rm -rfv /etc/openldap/slapd.d/*
3. Restore the backup files.
Using the slapadd command, we can restore the backup files
slapdbackup.confand configbackup.ldifas below:
[root@ldapmasternew ~]# slapadd -n 0 -F /etc/openldap/slapd.d -l slapdbackup.conf
_#################### 100.00% eta none elapsed none fast!
Closing DB...
[root@ldapmasternew ~]#
[root@ldapmasternew ~]# slapadd -n 2 -F /etc/openldap/slapd.d -l configbackup.ldif
_#################### 100.00% eta none elapsed none fast!
Closing DB...
[root@ldapmasternew ~]#
4. Fix file permissions and start the service
[root@ldapmasternew ~]# chown ldap. /etc/openldap/slapd.d/* -R
[root@ldapmasternew ~]# systemctl start slapd
Now, you can test the LDAP users on the new server using ldapsearch
[root@ldapmasternew ~]# ldapsearch -x cn=testuser -b dc=example,dc=com | head
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> with scope subtree
# filter: cn=testuser
# requesting: ALL
#
# testuser, People, example.com
dn: uid=testuser,ou=People,dc=example,dc=com
LDAP Migration Tools - Installation
The LDAP Migration Tools are a collection of Perl scripts. MigrationTools are used for migrating users, groups, aliases, hosts, netgroups, networks, protocols, RPCs, and services from existing name services. They are mainly used to convert configuration files to the LDIF format.
1. Perl Installation
The packagemigrationtools are a set of Perl scripts. So, we need to
install the package perl by using the following command:
[root@localhost1 ~]# dnf install perl
2. Install migrationtools by downloading the rpm
Once the perl package and its default modules are installed, Let us
install the migrationtools. As we have mentioned in the previous
section, we can install using
yum/dnf on RHEL
7 or older versions. The migrationtools are not available for RHEL 8/
Rocky Linux 8 versions. If we really need to use the migrationtools, we
can install them from CentOS 7 repository.
We can download the migrationtools from the below URLs:
http://mirror.centos.org/altarch/7/os/aarch64/Packages/migrationtools-47-15.el7.noarch.rpm
https://rpmfind.net/linux/centos/7.9.2009/os/x86_64/Packages/migrationtools-47-15.el7.noarch.rpm
Sample Output:
[root@localhost1 ~]# wget https://rpmfind.net/linux/centos/7.9.2009/os/x86_64/Packages/migrationtools-47-15.el7.noarch.rpm
Once the package is downloaded, install it using rpm as shown below:
[root@localhost1 ~]# rpm -ivh migrationtools-47-15.el7.noarch.rpm
warning: migrationtools-47-15.el7.noarch.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Verifying... ################################# [100%]
Preparing... ################################# [100%]
Updating / installing...
1:migrationtools-47-15.el7 ################################# [100%]
[root@localhost1 ~]#
The installed scripts will be under the folder
/usr/share/migrationtools/
[root@localhost1 ~]# ls /usr/share/migrationtools/
migrate_aliases.pl migrate_all_nisplus_offline.sh migrate_base.pl migrate_netgroup_byhost.pl migrate_profile.pl
migrate_all_netinfo_offline.sh migrate_all_nisplus_online.sh migrate_common.ph migrate_netgroup_byuser.pl migrate_protocols.pl
migrate_all_netinfo_online.sh migrate_all_offline.sh migrate_fstab.pl migrate_netgroup.pl migrate_rpc.pl
migrate_all_nis_offline.sh migrate_all_online.sh migrate_group.pl migrate_networks.pl migrate_services.pl
migrate_all_nis_online.sh migrate_automount.pl migrate_hosts.pl migrate_passwd.pl migrate_slapd_conf.pl
[root@localhost1 ~]#
In the next section, we will learn to migrate local users to LDAP using
scriptsmigrate_passwd.pl ``migrate_group.pl. You can read the text
file /usr/share/doc/migrationtools-47/migration-tools.txt on the
server for more information about the uses of all other scripts.
Different scripts exist to translate each system file into LDIF records.
The information in each file is stored in a different organizational
unit directly beneath the base suffix (defined inmigrate_common.ph) in
the directory. Eachoulisted next is used by convention.
Thenss_ldap library can be configured to pull information from other
locations, as we will see later. Currently, themigration scripts
support translating:
/etc/fstab(stored inou=Mounts)/etc/hosts(stored inou=Hosts)/etc/passwdand/etc/shadow(stored inou=People)/etc/group(stored inou=Group)/etc/protocols(stored inou=Protocols)/etc/rpc(stored inou=Rpc)/etc/services(stored inou=Services)/etc/networks(stored inou=Networks)netgroups(stored inou=Netgroups)
Migrate local users to OpenLDAD server
In this section, let us learn how to migrate the local users to OpenLDAP
server using migrationtools.
1. Create users and set the password
Create users using useradd command and set the password with
chpasswdcommand. You can also migrate the existing users. If so, jump
to the next step.
[root@localhost1 ~]# useradd testldapuser1
[root@localhost1 ~]# useradd testldapuser2
[root@localhost1 ~]# echo testldapuser1:test_password | chpasswd
[root@localhost1 ~]# echo testldapuser2:test_password | chpasswd
2. Export users and groups
In this step, let us copy only the users that need to be moved to the
LDAP server. In the example, we have created testldapuserX, and we are
going to use this in the article. We need to copy both the entries
frompasswd and group file.
[root@localhost1 ~]# grep "testldapuser" /etc/group > /root/groups
[root@localhost1 ~]# grep "testldapuser" /etc/passwd > /root/users
3. Convert users and groups
Now, we need to create an LDIF file from the user entries. The
shadow file entries will be automatically pulled by the
migratetoolsscript. The following example will create both
users.ldif and groups.ldif from the copied files.
[root@localhost1 ~]# /usr/share/migrationtools/migrate_passwd.pl /root/users /root/users.ldif
[root@localhost1 ~]# /usr/share/migrationtools/migrate_group.pl /root/groups /root/groups.ldif
4. Import the users and groups to OpenLDAP server
We have already created the LDIF files for users and groups. We can
manually edit the LDIF files if you need any changes such as UID, GID,
etc. In the below example, we import the creation user configurations
using ldapadd command. This has created the users testldapuser1 and
testldapuser2.
[root@localhost1 ~]# ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f /root/users.ldif
Enter LDAP Password:
adding new entry "uid=testldapuser1,ou=People,dc=example,dc=com"
adding new entry "uid=testldapuser2,ou=People,dc=example,dc=com"
[root@localhost1 ~]# ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f /root/groups.ldif
Enter LDAP Password:
adding new entry "cn=testldapuser1,ou=Group,dc=example,dc=com"
adding new entry "cn=testldapuser2,ou=Group,dc=example,dc=com"
5. Search users in LDAP server
We can test the above changes using ldapsearch command. The command
will search the users from OpenLDAP server with domain example.com
[root@localhost1 ~]# ldapsearch -x cn=testldapuser1 -b dc=example,dc=com | head
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> with scope subtree
# filter: cn=testldapuser1
# requesting: ALL
#
# testldapuser1, People, example.com
dn: uid=testldapuser1,ou=People,dc=example,dc=com
[root@localhost1 ~]#
Summary
In this article, we have learned to migrate LDAP configurations from one machine to another using Backup and Restore method. Also, we have installed migration tools by downloading the rpm and migrated local users to LDAP server.
