Symas OpenLDAP Knowledge Base

LDAP Database Backup

INTRODUCTION

The only supported method of backing up an OpenLDAP database is via the slapcat utility.  It is important to only use slapcat because:

  • The backup is a full snapshot of the database that includes critical operational attributes
  • The format of the backup file, LDIF, is automatically compatible with the slapadd utility that is used to restore databases.
  • The backup is portable with both servers and OpenLDAP backends (MDB, BDB, HDB, etc.)

Backups should not be taken using the ldapsearch utility for several reasons:

  • The LDIF it creates may not be compatible with the slapadd utility
  • Some critical operational attributes may be left out, making restoration impossible
  • Add/modify timestamps may not be preserved
  • The values of dynamic attributes, which don’t actually exist in a database, could be written to the LDIF.  If these values are present, restoration may not be possible.

Additionally, backups should not be taken by directly copying the database files or database directory in the filesystem.  This can lead to instability and/or make the backup impossible to recover.

BACKUP TYPES

SINGLE BACKEND DATABASE

If your OpenLDAP server uses only one backend database, backups are very straightforward:

Single Backend Backup

/opt/symas/sbin/slapcat -b <rootdn> -l backupName.ldif

This executes the slapcat command and writes the output to the file backupName.ldif.

MULTIPLE BACKEND DATABASES

The slapcat utility can back up only one database suffix at a time.  if your OpenLDAP server uses more than one database, you will need to run slapcat once for each suffix, specifying each suffix.

Multiple Backend Backups

/opt/symas/sbin/slapcat -b "dc=example,dc=com" -l dc-example_dc=com_Backup.ldif
/opt/symas/sbin/slapcat -b "dc=demo,dc=com" -l dc-demo_dc=com_Backup.ldif

CONFIGURATION DATABASE (cn=config)

The cn=config database is the database that contains the configuration for the OpenLDAP server.  To backup the cn=config database, simply specify the database number as 0.

Configuration Database Backup

/opt/symas/sbin/slapcat -F /opt/symas/etc/openldap/slapd.d -n 0 -l cn-config_Backup.ldif