Learn LDAP - OpenLDAP Server Installation

#Introduction

In episode 4 you learned DNs and LDAP URLs — the groundwork for pointing at entries and servers precisely. Now it's time to build. Episode 5 walks you through installing the OpenLDAP server on Debian or Ubuntu, doing the initial configuration with dpkg-reconfigure, understanding the configuration and database directory structure, getting to know cn=config along with its olc* attributes, and finally starting the slapd service until port 389 is ready to accept connections.

#OpenLDAP Installation

On Debian and Ubuntu, the LDAP server ships in two main packages:

Installing slapd and ldap-utils

sudo apt update
sudo apt install slapd ldap-utils

slapd — the OpenLDAP LDAP server daemon.
ldap-utils — the collection of client tools: ldapsearch, ldapadd, ldapmodify, ldapdelete, and more (used from episode 6 on).

During installation, Debian asks for the admin password for the root DN. Enter a secure one and note it down — this password will be used over and over. After installation, slapd runs immediately with a default database named dc=hostname (derived from the machine's hostname), which you'll change later.

#Distribution Differences

The commands above are specific to Debian and Ubuntu. The Red Hat family (CentOS, RHEL, Fedora) differs:

Aspect	Debian/Ubuntu	CentOS/RHEL/Fedora
Packages	`slapd`, `ldap-utils`	`openldap-servers`, `openldap-clients`
Package manager	`apt`	`dnf` or `yum`
Initial config	`dpkg-reconfigure slapd`	Manual via config file
Default suffix	Taken from hostname	Not set automatically

This series focuses on Debian/Ubuntu, but the cn=config concept and the directory structure learned below apply the same on all distributions.

#Initial Configuration

To reset the configuration the installation created, run:

Reconfiguring slapd

sudo dpkg-reconfigure slapd

This interactive wizard asks several important questions:

Database selection — choose the database backend. Modern Debian uses mdb (Memory-Mapped Database) as its default and recommended option; bdb and hdb are the older Berkeley DB backends. For this series, choose mdb.
Admin password — the password for the admin DN, default cn=admin,dc=example,dc=com.
Domain configuration — the organization's DNS domain, e.g. example.com, which determines the suffix dc=example,dc=com.
Organization name — the organization name that fills the o attribute on the root entry.

This dc=example,dc=com suffix is what you'll use as the base for all subsequent practice.

#Directory Structure

Once installed, OpenLDAP uses several important directories:

Path	Contents
`/etc/ldap/slapd.d/`	Dynamic `cn=config` configuration
`/var/lib/ldap/`	Database files (holding directory data)
`/etc/ldap/schema/`	Standard schema files (covered in episode 3)
`/var/log/syslog`	`slapd` logs (Debian uses syslog)

The /etc/ldap/slapd.d/ structure is a directory of LDIF files reflecting the active configuration. Don't edit these files manually while the server is running — configuration changes are made through LDAP operations against cn=config, or by stopping the server and using slapcat and slapadd.

#slapd Configuration

Modern OpenLDAP configuration is stored dynamically in cn=config, not in a static slapd.conf. Inside it:

olc attributes* — OpenLDAP Configuration attributes, such as olcSuffix, olcRootDN, olcRootPW, and olcAccess. The olc prefix marks configuration attributes.
olcDatabase — each database backend is represented as an olcDatabase entry under cn=config, with olcSuffix as the domain it serves.
Schema configuration — schemas are registered as olcSchemaConfig and loaded from /etc/ldap/schema/.
Access control — access control rules are stored in the olcAccess attribute on the database entry.

The snippet above is the essence of the configuration: an mdb backend serving suffix dc=example,dc=com with an admin named cn=admin,dc=example,dc=com. The olcRootPW value is stored as a hash — best practice, not a plain password. How to read and change the configuration through LDAP operations will be covered in episode 10.

Warning

slapd.conf is still recognized by OpenLDAP as a legacy configuration mode, but modern distributions default to cn=config. Don't mix the two: a server using cn=config ignores the slapd.conf file unless told otherwise.

#Running the Service

Once the configuration is in order, enable the service and make sure it's alive:

Starting and enabling slapd

sudo systemctl enable slapd
sudo systemctl start slapd
sudo systemctl status slapd

systemctl enable makes slapd start at boot.
systemctl start starts it now.
systemctl status shows the status, including the active line.

The final verification is making sure the server listens on the right port:

Checking the listening port

sudo ss -tlnp | grep :389

An output line containing :389 proves slapd is ready to accept connections. If desired, you can test the server connection with a simple ldapsearch against the Root DSE — a technique covered in depth in episode 6.

#Closing

Episode 5 moves you from theory to practice: installing slapd and ldap-utils, running dpkg-reconfigure to set up the mdb database, admin password, and domain, understanding the /etc/ldap/slapd.d/ structure with its olc* attributes, and starting and verifying the service on port 389.

Key takeaways:

sudo apt install slapd ldap-utils is the way into OpenLDAP on Debian/Ubuntu.
Choose the mdb backend, set suffix dc=example,dc=com, and save the admin password.
Configuration lives in /etc/ldap/slapd.d/, data in /var/lib/ldap/.
systemctl enable makes slapd start automatically; ss -tlnp verifies port 389.

In the next episode, episode 6, your server is alive and ready to be populated: you'll get to know all the client tools, run your first search, and understand the LDIF format, the language of directory data exchange.