系统d，重写，slapd守护进程失败

Question

我试图用systemd覆盖标准slapd (OpenLDAP)守护进程启动参数，但是一旦重写了ExecStart，守护进程就无法启动。我的问题是为什么会失败，以及如何更改守护进程的开始参数？

我用以下内容覆盖了systemd slapd.service文件：

root@debian:~ $ systemctl edit slapd
[Service]
ExecStart=
ExecStart=/usr/sbin/slapd -h "ldap:/// ldaps:/// ldapi:///" -g openldap -u openldap -F /etc/ldap/slapd.d

这里只需要调试几件事情：

root@debian:~ $ systemctl cat slapd
# /run/systemd/generator.late/slapd.service
# Automatically generated by systemd-sysv-generator

[Unit]
Documentation=man:systemd-sysv-generator(8)
SourcePath=/etc/init.d/slapd
Description=LSB: OpenLDAP standalone server (Lightweight Directory Access Protoc
Before=multi-user.target
Before=multi-user.target
Before=multi-user.target
Before=graphical.target
After=remote-fs.target
After=network-online.target
Wants=network-online.target

[Service]
Type=forking
Restart=no
TimeoutSec=5min
IgnoreSIGPIPE=no
KillMode=process
GuessMainPID=no
RemainAfterExit=yes
SuccessExitStatus=5 6
ExecStart=/etc/init.d/slapd start
ExecStop=/etc/init.d/slapd stop

运行守护进程而不覆盖显示：

root@debian:~ $ systemctl status slapd
● slapd.service - LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol)
   Loaded: loaded (/etc/init.d/slapd; generated; vendor preset: enabled)
   Active: active (running) since Mon 2018-07-30 11:33:40 CEST; 1h 20min ago
     Docs: man:systemd-sysv-generator(8)
  Process: 429 ExecStart=/etc/init.d/slapd start (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/slapd.service
           └─509 /usr/sbin/slapd -h ldap:/// ldapi:/// -g openldap -u openldap -F /etc/ldap/slapd.d

在"systemctl守护进程-重新加载“和"systemctl重新启动slapd”之后，通过重载运行守护进程将引发以下错误：

root@debian:~ $ sudo systemctl status slapd
● slapd.service - LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol)
   Loaded: loaded (/etc/init.d/slapd; generated; vendor preset: enabled)
  Drop-In: /etc/systemd/system/slapd.service.d
           └─override.conf
   Active: failed (Result: exit-code) since Mon 2018-07-30 13:50:13 CEST; 37s ago
     Docs: man:systemd-sysv-generator(8)

Jul 30 13:50:11 udamc systemd[1]: Starting LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol)...
Jul 30 13:50:13 udamc slapd[438]: @(#) $OpenLDAP: slapd  (Aug 10 2017 19:12:46) $
                                          Debian OpenLDAP Maintainers 
Jul 30 13:50:13 udamc slapd[438]: daemon: bind(9) failed errno=2 (No such file or directory)
Jul 30 13:50:13 udamc slapd[438]: slapd stopped.
Jul 30 13:50:13 udamc slapd[438]: connections_destroy: nothing to destroy.
Jul 30 13:50:13 udamc systemd[1]: slapd.service: Control process exited, code=exited status=1
Jul 30 13:50:13 udamc systemd[1]: Failed to start LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol).
Jul 30 13:50:13 udamc systemd[1]: slapd.service: Unit entered failed state.
Jul 30 13:50:13 udamc systemd[1]: slapd.service: Failed with result 'exit-code'.

Answer 1

您的Debian系统实际上并没有使用真正的system d单元作为slapd。相反，它使用的是位于/etc/init.d目录中的古样式init脚本D1。systemd单元是一个生成的单元，它只是尝试调用init脚本。

如果您不能升级到Debian稳定版本，那么将您的自定义设置为旧的init脚本。

Answer 2

斯拉普真的在重新开始之前停下来了吗？我怀疑ExecStop缺少了什么东西。

由于这是Debian，可能是包装了一个旧的SysV init脚本，所以我还建议使用一个单独的单元文件，存储在/etc/systemd/system/中，名称不同。并确保服务slapd被禁用并停止。这还允许您使用其他与安全相关的配置选项，并确保升级后不会出现故障，以防Debian更改单元文件。

看下面我用了什么。systemd以非特权用户的身份启动slapd。还请注意type=simple和PIDFile=。当然是YMMV

#-----------------------------------------------------------------------
# initiate:   systemctl enable ae-slapd.service
# start:      systemctl start ae-slapd.service
# get status: systemctl status ae-slapd.service
#-----------------------------------------------------------------------

[Unit]
Description=AE-DIR OpenLDAP server
Requires=network.target
After=network.target

[Service]
Type=simple
Environment=LDAPNOINIT=1
PIDFile=/opt/ae-dir/run/slapd/slapd.pid
ExecStart=/usr/lib64/slapd -n ae-slapd -l LOCAL4 -s 7 -f /opt/ae-dir/etc/openldap/slapd.conf -h 'ldapi://%%2Fopt%%2Fae-dir%%2Frun%%2Fslapd%%2Fldapi ldap://*:389 ldaps://*:636' -o slp=off
User=ae-dir-slapd
Group=ae-dir-slapd
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
MemoryDenyWriteExecute=yes
# various hardening options
PrivateTmp=yes
ProtectSystem=full
ProtectHome=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes
NoNewPrivileges=yes
MountFlags=private
SystemCallArchitectures=native
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
PrivateDevices=yes

[Install]
WantedBy=multi-user.target