[RESOLU] Réplication de deux serveurs ldap ne marche pas

[darkukai]

Bonjour à tous(tes)

Je test une solution de réplication entre deux serveur OpenLdap sous debian,
J'ai commencer a utilisé le démon de réplication slurpd sur le serveur maitre avec toute la config adéquate au niveau du slapd.conf du serveur maitre et du serveur esclave et malheureusement rien de marchait, aucune sortie dans mes logs, pas de réplication, nada

Je me suis donc tourné vers la deuxième solution qui consiste a utilisé syncrepl, donc rebelote mais beaucoup plus rapide cette fois si car apparement la config ne se fait qu'au niveau du slapd.conf du serveur esclave dans lequel on rajoute :

Code: Tout sélectionner

syncrepl rid=007 provider=@ip du serveur maitre
type=refreshOnly
interval=00:00:03:00
searchbase="dc=domain,dc=com"
filter="(objectClass==*)"
scope=sub
schemachecking=off
updatedn="cn=replica,dc=domain,dc=com"
bindmethod=simple
binddn="cn=replica,dc=domain,dc=com"
credentials=pass en clair


Et tout ce que j'obtiens dans me logs c'est un vague :
tail -f /var/log/ldaplog

Code: Tout sélectionner

Mar 22 (..) localhost slapd[1446]: do_syncrep1: ldap_initialize failed (@ip serveur maitre)


et aucun trace de connexion sur mes logs du serveur maitre
de plus un ldapsearch -x -h @ipserveur_maitre -b "dc=domain,dc=com" fonctionne super bien

Je pédale dans la semoule avec cette réplication qui ne se fait pas si quelqu'un a une petite idée qui pourrait me venir en aide je lui en serait reconnaissant


D'avance Merci
Thomas

[darkukai]

Rebonjour tout le monde

Alors j'apporte un peu d'eau a mon moulin ( mon moulin avait soif ---->[] )

J'ai oublié un truc apparement super important sur le serveur maitre (provider) c'est la directive sessionlog dans mon slapd.conf, c'est tout moi çà

m'enfin je rajoute donc

Code: Tout sélectionner

sessionlog 123 500


ou 123 est mon <sid> et 500 ma limite

je rajoute aussi coter slave dans mon slapd.conf

Code: Tout sélectionner

syncrepl ...
provider=ldap://10.203.195.1:389
...


pour etre sur qu'il ne lui manque rien pour papoter avec son copain.

Je fais aussi un truc stupide ( j'ai lu sur un howto qui avait l'air sérieux qu'il vallait mieux partir avec des bases strictement identiques)
donc je copie innocement tout le dossier /var/lib/ldap de mon provider sur le /var/lib/ldap/ de mon slave

je fais un /etc/init.d/slapd restart sur le slave pour voir ce qui se passe et là : çà papote
j'ai même la trace de ma connec sur mon maitre génialllllll .... mais normal en fait

le truc c'est que je pense qu'il a pas apprécié la copie de dossier puisque dans les logs de mon slave j'ai un truc comme çà :

Code: Tout sélectionner

sldap starting
<= bdb_equality_candidates: (entryUUID) index_param failed (18)
last message repeated 5 times
null_callback: error code 0x32
bdb_db_inbit: Initializing BDB database


n'aurait t'il pas apprécié ma sauvage copie de dossier ????

une solution simple de réplication ne saurait t'elle pas alors de faire un script qui copie tout le dossier /var/lib a intervalle régulier


M'enfin encore des questions soulevées qui attendront qu'une ame charitable ou mon compagnon google m'aide a trouver les réponses.

[darkukai]

Bonjour,
Finalement je me prend d'affection pour mon problème je pense que l'on va vivre une longue histoire

Après quelques recherche j'ai entrapreçu le faites qu'il fallait index l'entrée EntryUUID pour que çà marche et ce sur les deux serveurs donc ni une ni d'hirondelle je fait la manip sur mes deux serveurs :

vi /etc/slapd.conf

...
Index EntryUUID eq
....

et effectivement çà semble apporté sont petit plus puisque je n'ai plus lors de la tentative de réplication de message sur le slave :

Code: Tout sélectionner

<= bdb_equality_candidates: (entryUUID) index_param failed (18)


cependant j'ai du coup :

Code: Tout sélectionner

syncrepl_entry : be_modify failed (50)
null callback
be_add failed (50)


Il me semble que l'erreur 50 dans ldap signifie un problème de droit d'accès mais je peux me tromper,
je vérifie mes ACL mais elles semblent bonne dans le doute je remplace l'utilisateur replica que j'utilise pour le bind et la MAJ par l'admin de la base mais sans plus de succès.

Je suis désormais la piste de la version trop vieille, j'ai lu en effet qu'une bonne 15aine de bugs était réferencé concernant syncrepl entre la version 2.2 distribué sur sarge et la toute dernière version, je vais donc tenter ce matin de mettre a jours mes deux openldap ( fait $%#&! quand même.. ouuuh pardon )

EDIT / Bon bein je viens d'essayer de mettre a jour mon slapd en 2.3.30-5 en modifiant mon sources.list pour récupérer la version de la testing mais un gros message d'alerte ( en gros : ' Pour satisfaire toute les dépendances nous allons devoir viré votre kernell image version 2.4 .... ce qui est somme toute déplaisant pour la bonne marche du système, je repète çà craint vraiment de le faire si tu le fait c'est que t'est vraiment un #*$$@ !)
Bon du coup je me suis calmé je crois que j'ai une galette de la testing dans un coin je vais me refaire mes install sur mes serveurs test en testing mais çà me fais bien §<*$# = ! car le serveur en prod est sur sarge

Donc si quelqu'un a trouvé une astuce pour passer sur sarge de slapd 2.2 a la 2.3 qu'il me fasse un petit coucou

[darkukai]

Bon alors mise en place de deux serveurs sous Etch pour avoir openldap 2.3

Config serveur maitre :
vi /etc/ldap/slapd.conf

Code: Tout sélectionner

...
moduleload syncprov
...
index entryUUID,entryCSN eq
...
rootdn    "cn=admin,dc=mondomain,dc=net
...
overlay syncprov
           syncprov-checkpoint 50 5
           syncprov-sessionlog 50


Config serveur esclave

vi /etc/ldap/slapd.conf

Code: Tout sélectionner

rootdn      "cn=admin,dc=mondomain,dc=net"
...
index   entryUUID,entryCSN eq
...
syncrepl rid=123
             provider=ldap://@ipduserveurmaitre:389
             type=refreshOnly
             interval=00:00:05:00
             searchbase="dc=mondomain,dc=net"
             filter="(objectClasse=*)"
             scope=sub
             schemachecking=off
             bindmethod=simple
             binddn="cn=admin,dc=mondomain,dc=net"
             credentials=motdepasseenclair


Et çà marche !!!!! normal meuh direz vous c'est quand même fait pour çà

Bon j'ai sur les deux serveurs des erreurs : rootdn have already superprivilege on database mais sinon çà marche.

La seul ombre au tableau c'est que je veut implémenter cette solution entre mon serveur de mail déjà en production qui serait le serveur maitre et un backupMX qui serait en slave mais mon serveur mail est sous sarge et est hypra stable donc je pensais pas le migrer sous etch avant un bon moment

[Scilot]

Bonjour,

J'ai appliqué à la lettre ta configuration dans mes fichiers de conf et j'ai un souci avec mon serveur réplica (esclave).
Je m'explique:
A chaque fois que je fais une modification de mon annuaire qui se trouve sur le serveur maître, par exemple la création d'une unité organisationnelle, le serveur maître fait cette modif mais rien ne se passe du coté de mon serveur réplica!!!
Cependant, il suffit que je redémarre mon serveur réplica pour que je puisse voir les modifications apportés à l'annuaire du serveur maître!!
Aussi, losque je redémarre le service slapd sur le serveur réplica, dans le syslog il affiche :

slapd[2565]: do_syncrep1: ldap_sasl_bind_s failed (-1)

Je joins les slapd.conf des 2 serveurs:
-------------------------------SERVEUR MAITRE----------------------------
# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.

#######################################################################
# Global Directives:

# Features to permit
#allow bind_v2

# Schema and objectClass definitions
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/inetorgperson.schema

# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile /var/run/slapd/slapd.pid

# List of arguments that were passed to the server
argsfile /var/run/slapd/slapd.args

# Read slapd.conf(5) for possible values
loglevel 256

# Where the dynamically loaded modules are stored
modulepath /usr/lib/ldap
moduleload back_bdb

# The maximum number of entries that is returned for a search operation
sizelimit 500

# The tool-threads parameter sets the actual amount of cpu's that is used
# for indexing.
tool-threads 1

#######################################################################
# Specific Backend Directives for bdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend bdb
checkpoint 512 30

#######################################################################
# Specific Backend Directives for 'other':
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
#backend <other>

#######################################################################
# Specific Directives for database #1, of type bdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database bdb

# The base of your directory in database #1
suffix "dc=sysnet,dc=cfg"

moduleload syncprov

# Indexing options for database #1
index objectClass,entryCSN,entryUUID eq

# rootdn directive for specifying a superuser on the database. This is needed
# for syncrepl.
rootdn "cn=Manager,dc=sysnet,dc=cfg"
rootpw {CRYPT}24iCIUkDmSIaE

# Where the database file are physically stored for database #1
directory "/var/lib/ldap"

password-hash {crypt}
password-crypt-salt-format "$1$%.8s"

overlay syncprov
syncprov-checkpoint 50 5
syncprov-sessionlog 50

# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0

# Sven Hartge reported that he had to set this value incredibly high
# to get slapd running at all. See http://bugs.debian.org/303057
# for more information.

# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500
# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500
# Number of lockers
dbconfig set_lk_max_lockers 1500

# Save the time that the entry gets modified, for database #1
lastmod on

# Where to store the replica logs for database #1
# replogfile /var/lib/ldap/replog

# ACL REPLICATION
access to * by dn="cn=Replicator,dc=sysnet,dc=cfg" read
by dn="cn=Manager,dc=sysnet,dc=cfg" write
by * auth

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,shadowLastChange
by dn="cn=Manager,dc=sysnet,dc=cfg" write
by anonymous auth
by self write
by * none

# Ensure read access to the base for things like
# supportedSASLMechanisms. Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work
# happily.
access to dn.base="" by * read

# The admin dn has full write access, everyone else
# can read everything.
access to *
by dn="cn=Manager,dc=sysnet,dc=cfg" write
by * read

# For Netscape Roaming support, each user gets a roaming
# profile for which they have write access to
#access to dn=".*,ou=Roaming,o=morsnet"
# by dn="cn=Manager,dc=sysnet,dc=cfg" write
# by dnattr=owner write

#######################################################################
# Specific Directives for database #2, of type 'other' (can be bdb too):
# Database specific directives apply to this databasse until another
# 'database' directive occurs
#database <other>

# The base of your directory for database #2
#suffix "dc=debian,dc=org"

--------------------------------------------SERVEUR REPLICA-----------------------------------------

# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.

#######################################################################
# Global Directives:

# Features to permit
#allow bind_v2

# Schema and objectClass definitions
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/inetorgperson.schema

# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile /var/run/slapd/slapd.pid

# List of arguments that were passed to the server
argsfile /var/run/slapd/slapd.args

# Read slapd.conf(5) for possible values
loglevel 256

# Where the dynamically loaded modules are stored
modulepath /usr/lib/ldap
moduleload back_bdb

# The maximum number of entries that is returned for a search operation
sizelimit 500

# The tool-threads parameter sets the actual amount of cpu's that is used
# for indexing.
tool-threads 1

#######################################################################
# Specific Backend Directives for bdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend bdb
checkpoint 512 30

#######################################################################
# Specific Backend Directives for 'other':
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
#backend <other>

#######################################################################
# Specific Directives for database #1, of type bdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database bdb

# The base of your directory in database #1
suffix "dc=sysnet,dc=cfg"

# rootdn directive for specifying a superuser on the database. This is needed
# for syncrepl.
rootdn "cn=Manager,dc=sysnet,dc=cfg"
rootpw {CRYPT}24iCIUkDmSIaE

# Where the database file are physically stored for database #1
directory "/var/lib/ldap"

password-hash {crypt}
password-crypt-salt-format "$1$%.8s"

# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0

# Sven Hartge reported that he had to set this value incredibly high
# to get slapd running at all. See http://bugs.debian.org/303057
# for more information.

# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500
# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500
# Number of lockers
dbconfig set_lk_max_lockers 1500

# Indexing options for database #1
index objectClass,entryUUID,entryCSN eq

syncrepl rid=123
provider=ldap://192.168.0.50:389
type=refreshOnly
interval=00:00:00:00
searchbase="dc=sysnet,dc=cfg"
filter="(objectClass=*)"
scope=sub
schemachecking=off
bindmethod=simple
binddn="cn=Replicator,dc=sysnet,dc=cfg"
credentials=replication

# Save the time that the entry gets modified, for database #1
lastmod on

# Where to store the replica logs for database #1
# replogfile /var/lib/ldap/replog

# ACL REPLICATION
access to * by dn="cn=Replicator,dc=sysnet,dc=cfg" write
by dn="cn=Manager,dc=sysnet,dc=cfg" write
by * auth

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,shadowLastChange
by dn="cn=Manager,dc=sysnet,dc=cfg" write
by anonymous auth
by self write
by * none

# Ensure read access to the base for things like
# supportedSASLMechanisms. Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work
# happily.
access to dn.base="" by * read

# The admin dn has full write access, everyone else
# can read everything.
access to *
by dn="cn=Manager,dc=sysnet,dc=cfg" write
by * read

# For Netscape Roaming support, each user gets a roaming
# profile for which they have write access to
#access to dn=".*,ou=Roaming,o=morsnet"
# by dn="cn=admin,dc=nodomain" write
# by dnattr=owner write

#######################################################################
# Specific Directives for database #2, of type 'other' (can be bdb too):
# Database specific directives apply to this databasse until another
# 'database' directive occurs
#database <other>

# The base of your directory for database #2
#suffix "dc=debian,dc=org"

Merci pour votre aide!

[Scilot]

Bonjour,

J'ai appliqué à la lettre ta configuration dans mes fichiers de conf et j'ai un souci avec mon serveur réplica (esclave).
Je m'explique:
A chaque fois que je fais une modification de mon annuaire qui se trouve sur le serveur maître, par exemple la création d'une unité organisationnelle, le serveur maître fait cette modif mais rien ne se passe du coté de mon serveur réplica!!!
Cependant, il suffit que je redémarre mon serveur réplica pour que je puisse voir les modifications apportés à l'annuaire du serveur maître!!
Aussi, losque je redémarre le service slapd sur le serveur réplica, dans le syslog il affiche :

slapd[2565]: do_syncrep1: ldap_sasl_bind_s failed (-1)

Je joins les slapd.conf des 2 serveurs:
-------------------------------SERVEUR MAITRE----------------------------
# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.

#######################################################################
# Global Directives:

# Features to permit
#allow bind_v2

# Schema and objectClass definitions
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/inetorgperson.schema

# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile /var/run/slapd/slapd.pid

# List of arguments that were passed to the server
argsfile /var/run/slapd/slapd.args

# Read slapd.conf(5) for possible values
loglevel 256

# Where the dynamically loaded modules are stored
modulepath /usr/lib/ldap
moduleload back_bdb

# The maximum number of entries that is returned for a search operation
sizelimit 500

# The tool-threads parameter sets the actual amount of cpu's that is used
# for indexing.
tool-threads 1

#######################################################################
# Specific Backend Directives for bdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend bdb
checkpoint 512 30

#######################################################################
# Specific Backend Directives for 'other':
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
#backend <other>

#######################################################################
# Specific Directives for database #1, of type bdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database bdb

# The base of your directory in database #1
suffix "dc=sysnet,dc=cfg"

moduleload syncprov

# Indexing options for database #1
index objectClass,entryCSN,entryUUID eq

# rootdn directive for specifying a superuser on the database. This is needed
# for syncrepl.
rootdn "cn=Manager,dc=sysnet,dc=cfg"
rootpw {CRYPT}24iCIUkDmSIaE

# Where the database file are physically stored for database #1
directory "/var/lib/ldap"

password-hash {crypt}
password-crypt-salt-format "$1$%.8s"

overlay syncprov
syncprov-checkpoint 50 5
syncprov-sessionlog 50

# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0

# Sven Hartge reported that he had to set this value incredibly high
# to get slapd running at all. See http://bugs.debian.org/303057
# for more information.

# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500
# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500
# Number of lockers
dbconfig set_lk_max_lockers 1500

# Save the time that the entry gets modified, for database #1
lastmod on

# Where to store the replica logs for database #1
# replogfile /var/lib/ldap/replog

# ACL REPLICATION
access to * by dn="cn=Replicator,dc=sysnet,dc=cfg" read
by dn="cn=Manager,dc=sysnet,dc=cfg" write
by * auth

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,shadowLastChange
by dn="cn=Manager,dc=sysnet,dc=cfg" write
by anonymous auth
by self write
by * none

# Ensure read access to the base for things like
# supportedSASLMechanisms. Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work
# happily.
access to dn.base="" by * read

# The admin dn has full write access, everyone else
# can read everything.
access to *
by dn="cn=Manager,dc=sysnet,dc=cfg" write
by * read

# For Netscape Roaming support, each user gets a roaming
# profile for which they have write access to
#access to dn=".*,ou=Roaming,o=morsnet"
# by dn="cn=Manager,dc=sysnet,dc=cfg" write
# by dnattr=owner write

#######################################################################
# Specific Directives for database #2, of type 'other' (can be bdb too):
# Database specific directives apply to this databasse until another
# 'database' directive occurs
#database <other>

# The base of your directory for database #2
#suffix "dc=debian,dc=org"

--------------------------------------------SERVEUR REPLICA-----------------------------------------

# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.

#######################################################################
# Global Directives:

# Features to permit
#allow bind_v2

# Schema and objectClass definitions
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/inetorgperson.schema

# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile /var/run/slapd/slapd.pid

# List of arguments that were passed to the server
argsfile /var/run/slapd/slapd.args

# Read slapd.conf(5) for possible values
loglevel 256

# Where the dynamically loaded modules are stored
modulepath /usr/lib/ldap
moduleload back_bdb

# The maximum number of entries that is returned for a search operation
sizelimit 500

# The tool-threads parameter sets the actual amount of cpu's that is used
# for indexing.
tool-threads 1

#######################################################################
# Specific Backend Directives for bdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend bdb
checkpoint 512 30

#######################################################################
# Specific Backend Directives for 'other':
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
#backend <other>

#######################################################################
# Specific Directives for database #1, of type bdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database bdb

# The base of your directory in database #1
suffix "dc=sysnet,dc=cfg"

# rootdn directive for specifying a superuser on the database. This is needed
# for syncrepl.
rootdn "cn=Manager,dc=sysnet,dc=cfg"
rootpw {CRYPT}24iCIUkDmSIaE

# Where the database file are physically stored for database #1
directory "/var/lib/ldap"

password-hash {crypt}
password-crypt-salt-format "$1$%.8s"

# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0

# Sven Hartge reported that he had to set this value incredibly high
# to get slapd running at all. See http://bugs.debian.org/303057
# for more information.

# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500
# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500
# Number of lockers
dbconfig set_lk_max_lockers 1500

# Indexing options for database #1
index objectClass,entryUUID,entryCSN eq

syncrepl rid=123
provider=ldap://192.168.0.50:389
type=refreshOnly
interval=00:00:00:00
searchbase="dc=sysnet,dc=cfg"
filter="(objectClass=*)"
scope=sub
schemachecking=off
bindmethod=simple
binddn="cn=Replicator,dc=sysnet,dc=cfg"
credentials=replication

# Save the time that the entry gets modified, for database #1
lastmod on

# Where to store the replica logs for database #1
# replogfile /var/lib/ldap/replog

# ACL REPLICATION
access to * by dn="cn=Replicator,dc=sysnet,dc=cfg" write
by dn="cn=Manager,dc=sysnet,dc=cfg" write
by * auth

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,shadowLastChange
by dn="cn=Manager,dc=sysnet,dc=cfg" write
by anonymous auth
by self write
by * none

# Ensure read access to the base for things like
# supportedSASLMechanisms. Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work
# happily.
access to dn.base="" by * read

# The admin dn has full write access, everyone else
# can read everything.
access to *
by dn="cn=Manager,dc=sysnet,dc=cfg" write
by * read

# For Netscape Roaming support, each user gets a roaming
# profile for which they have write access to
#access to dn=".*,ou=Roaming,o=morsnet"
# by dn="cn=admin,dc=nodomain" write
# by dnattr=owner write

#######################################################################
# Specific Directives for database #2, of type 'other' (can be bdb too):
# Database specific directives apply to this databasse until another
# 'database' directive occurs
#database <other>

# The base of your directory for database #2
#suffix "dc=debian,dc=org"

Merci pour votre aide!

[Scilot]

Bonsoir,

J'ai résolu mes problèmes:
- l'erreur "do_syncrep1: ldap_sasl_bind_s failed (-1)" signifie que soit le service slapd n'est pas démarré, soit le serveur est inaccéssible.
- mon autre souci concernait la commande retry qui ne faisait pas ce quelle devait faire

Merci

[Scilot]

Bonsoir,

J'ai encore un petit souci avec votre solution.
Elle me permet bien de modifier l'ainnuaire maître mais par contre elle ne me permet pas de modifier l'annuaire esclave. (modification effectuée directement sur le serveur esclave avec ldapadd / ldapdelete / ldapmodify).
Ce qui fait qu'il se retrouve en lecture seule!
Or moi je voudrais pourvoir modifier cet annuaire esclave.

Merci