- This topic has 1 reply, 2 voices, and was last updated 19 years ago by
.
-
Posts
-
I did something I shouldn’t have done.
First, from my understanding there are two groups with ID 80, right? One is local and the other is LDAP. I decided to change the LDAP group 80 shortname from “admin” to “dadmin” and it caused everyone who was a directory admin to lose their rights. I guess this is because the directory is looking for people in group “admin” and not “dadmin” regardless of the gid.
Now, no one can edit anything in the directory… not even root.
Question is: How can I fix this?
My next step is to boot the server in single-user mode to see if I can change “dadmin” back to “admin” using dscl because it sure won’t let me do it in regular mode. If that doesn’t work, I don’t know what I’m going to do next.
The last LDAP db backup I have is from Oct. 10, and I’d prefer not to use that backup. The other option is to backup what I have now, destroy the directory, set it up again and restore to that backup. But, I’m afraid “dadmin” from the backup will overwrite the new “admin” group.
Hello,
When your OD database was created, Apple ever so kindly left you a backdoor account should things go awry. The username is ‘root’ (not to be confused with system root) and the password was set to match the password of the first directory administrator (usually UID1000) at the time the directory was established. Subsequent password changes to UID1000 in the directory are not updated in this hidden account (located at /etc/openldap/slapd_macosxserver.conf).
You can try authenticating to your domain in Workgroup Manager using this account. You will be able to change your group RecordName back to admin. All else being equal, you will be back on track. (I have tested this with my own server and it worked a treat – but your mileage may vary).
If that fails, you need to take a few command line steps.
Firstly, get a new root password in your slapd_macosxserver.conf file by taking the following steps:
1. Run “slappasswd -h {SMD5}”. You will be prompted, twice, for your new password. Slappasswd will respond with “{SMD5}text string”.
2. Copy this text string, including {SMD5} to your clipboard.
3. Run “sudo cp /etc/openldap/slapd_macosxserver.conf /etc/openldap/slapd_macosxserver.conf.bak” for a backup.
4. Run “sudo pico /etc/openldap/slapd_macosxserver.conf”
5. Scroll down to the rootpw line. Remove the first {SMD5} string and paste the one you obtained from slappasswd.
6. Control-X to close, making sure you save the buffer.
7. Restart your server. You may be able to get away with just killing slapd, but I’d not take the risk.
8. Open a new command line. You don’t have to be sudo anymore. Run “pico modify.ldif”.
9. In this window, type the following four lines:dn: cn=dadmin,cn=groups,dc=server,dc=company,dc=com
changetype: modrdn
newrdn: admin
deleteoldrdn: 110. Note that the dn should reflect the correct LDAP search base, and the first cn is dadmin – the name of the group as it stands, before changes.
11. Run the following command:ldapmodify -x -D “uid=root,cn=users,dc=server,dc=company,dc=com” -W -f modify.ldif
-x specifies to use a simple authentication engine – that is, use the one in the slapd_macosxserver.conf file.
-D specifies the user to authenticate as. Note that, again, you should change your DCs to match your server’s search base.
-W specifies to ask the user for the new password that was specified with slappasswd.
-f specifies the LDIF file of changes to make to the database.Best of luck.
- You must be logged in to reply to this topic.