Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION 04-08-2006 Installation Manual page 869

By default, the LDAP server slapd runs as user and group ldap, while the keytab file
is readable by root only. Therefore, either change the LDAP configuration so the
server runs as root or make the keytab file readable by the group ldap. The latter is
done automatically by the OpenLDAP start script (/etc/init.d/ldap) if the keytab
file has been specified in the OPENLDAP_KRB5_KEYTAB variable in /etc/
sysconfig/openldap and the OPENLDAP_CHOWN_DIRS variable is set to yes,
which is the default setting. If OPENLDAP_KRB5_KEYTAB is left empty, the default
keytab under /etc/krb5.keytab is used and you must adjust the privileges yourself
as described below.
To run slapd as root, edit /etc/sysconfig/openldap. Disable the
OPENLDAP_USER and OPENLDAP_GROUP variables by putting a comment character
in front of them.
To make the keytab file readable by group LDAP, execute
chgrp ldap /etc/krb5.keytab
chmod 640 /etc/krb5.keytab
A third, and maybe the best solution, is to tell OpenLDAP to use a special keytab file.
To do this, start kadmin, and enter the following command after you have added the
principal ldap/earth.example.com:
ktadd -k /etc/openldap/ldap.keytab ldap/earth.example.com@EXAMPLE.COM
Then, on the shell, run:
chown ldap.ldap /etc/openldap/ldap.keytab
chmod 600 /etc/openldap/ldap.keytab
To tell OpenLDAP to use a different keytab file, change the following variable in
/etc/sysconfig/openldap:
OPENLDAP_KRB5_KEYTAB="/etc/openldap/ldap.keytab"
Finally, restart the LDAP server using rcldap restart.
Installing and Administering Kerberos 869