Server Configuration
- <strong>Hostname</strong>: ldap.lab.bitsmasher.net (alias: bbb1)
- <strong>IP</strong>: 10.10.13.1
- <strong>Software</strong>: OpenLDAP (slapd)
- <strong>Status</strong>: SSH reachable as root, but slapd service has been <strong>failed since December 2025</strong>
Outage Details
The slapd failure manifests as:
\begin{lstlisting}[style=mystyle]
TLS init def ctx failed (-1)
\end{lstlisting}
This indicates a TLS certificate configuration issue -- likely an expired, missing, or misconfigured CA certificate. The server is listening on its network interface (SSH works for root), but the LDAP daemon itself has not recovered since December 2025.
Monitoring Approach
Franklin maintains /home/franklin/status.sh} which checks:
- slapd service status on bbb1/ldap
- ldapsearch queries for franklin and sly DN lookups -- both fail because the directory is down
The script provides a simple pass/fail indicator for LDAP health without requiring complex monitoring infrastructure.
Recovery Steps
To restore the LDAP server:
- SSH to ldap.lab.bitsmasher.net as root (ed25519 key)
- Check slapd logs: \texttt{journalctl -u slapd --since "2025-12-13"}
- Verify TLS certificate chain in /etc/ssl or the configured cert path
- Update or regenerate the CA-signed certificate if expired
- Restart slapd: \texttt{systemctl restart slapd}
- Verify with ldapsearch for franklin and sly DNs
Directory Structure (Expected)
The OpenLDAP directory should contain entries for:
- User entries for franklin, Sly (slyborg), and other lab members
- Group/organizational unit entries for lab access control
- Service accounts for LDAP-authorized services (Kerberos integration, web auth)
Once restored, the LDAP directory serves as the central authentication source for the lab, complementing Kerberos for identity management.