Skip to content

Instantly share code, notes, and snippets.

@Shaltz
Created September 16, 2015 09:02
Show Gist options
  • Save Shaltz/1d65a07a0901a36fb7f1 to your computer and use it in GitHub Desktop.
Save Shaltz/1d65a07a0901a36fb7f1 to your computer and use it in GitHub Desktop.
HOW TO fix openLDAP checksum error on config files
(source : http://injustfiveminutes.com/category/openldap)
How to fix “ldif_read_file: checksum error”
Posted on October 28, 2014
15
Well, in spite of you did read a banner saying “# AUTO-GENERATED FILE – DO NOT EDIT!! Use ldapmodify.” you ignored it and made some manual modifications in any of the LDIF files in /etc/ldap/slapd.d/.
Don’t worry it happened to me too :) When you need to quickly setup an openLDAP server for development it is pretty much easier to tweak these files although the recommended way is to use ldapmodify tool. But if you change the LDIF files in cn=config manually, their contents and checksums won’t match, which is not fatal, but is annoying when using tools such as slapcat:
544f7291 ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif"
544f7291 ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif"
To fix it you have to recalculate their checksums, please follow the following steps:
1. Copy the errant file to an temporary directory (for example olcDatabase={2}hdb.ldif).
# cp /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif /tmp
2. Remove the first two lines of that file where it is included the old checksum value
# tail -n +3 /tmp/olcDatabase={2}hdb.ldif > fixed.ldif
3. Download the Check CRC tool from http://freecode.com/projects/checkcrc/
4. Extract the downloaded file
# tar xvfz check-4.3-src.tgz
5. Install the zlib development RPM package (or use APT on Debian based systems)
# yum install zlib-dev
6. Compile the check CRC tool:
# cd check-4.3
check4-3# gcc -O3 -Wall -DUSE_ZLIB -I/usr/include -o check check.c -L/usr/lib64 -lz
7. Calculate the new checksum
check-4.3# ./check /tmp/fixed.ldif
fixed.ldif CRC-32 = 61e6182a, size = 582 bytes
8. Replace the new CRC-32 value into the original file using your favourite editor
# vi /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif
AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
CRC32 61e6182a
@nikosfcbk
Copy link

hi

have you tried dumping the 'cn=config' or database 0 and restore it back? must take about 10 to 20 seconds, seeking radio stations included :)

@eduardolucioac
Copy link

eduardolucioac commented May 7, 2018

Automated process example in CentOS 7:

# Install dependencies!
yum install perl-Archive-Zip

# Update CRC32's!
CONFIG_LDIF_CRC32=$(crc32 <(cat /etc/openldap/slapd.d/cn=config.ldif | tail -n +3))
CONFIG_LDIF_CRC32="# CRC32 $CONFIG_LDIF_CRC32"

BDB_LDIF_CRC32=$(crc32 <(cat /etc/openldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif | tail -n +3))
BDB_LDIF_CRC32="# CRC32 $BDB_LDIF_CRC32"

SED_RPL="'0,/# CRC32 .*/s//$CONFIG_LDIF_CRC32/g'"
eval "sed -i $SED_RPL /etc/openldap/slapd.d/cn=config.ldif"

SED_RPL="'0,/# CRC32 .*/s//$BDB_LDIF_CRC32/g'"
eval "sed -i $SED_RPL /etc/openldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif"

Thanks! =D

@unrealTomas
Copy link

OMG :(

@atlanmatrix
Copy link

Thanks!!!

@beetroot-dev
Copy link

Another option, that does not require compilation:

Steps 1-2: as above (copy LDIF file to /tmp, strip top two lines)
3: yum install perl-Archive-Zip
4: crc32 /tmp/*ldif
5: replace top two lines in LDIF file with new CRC (step 8 above)

On a Debian-based system, step 3 could be

apt install libarchive-zip-perl

@PaulSD
Copy link

PaulSD commented May 25, 2023

No dependencies:

LDIF='/etc/openldap/slapd.d/cn=config.ldif'
NEW_CRC32="$(tail -n +3 "$LDIF" | python3 -c 'import sys;import zlib;print("%08x"%(zlib.crc32(sys.stdin.buffer.read())))')"
sed -i "0,/# CRC32 .*/ s//# CRC32 ${NEW_CRC32,,}/g" "$LDIF"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment