Ldap kdb5_util dump提供服务器错误

我一直试图使用kdb5_util dump（文件名）转储Kerberos数据库（ldap后端），但我得到：

kdb5_util load_dump version 6
kdb5_util: error performing Kerberos version 5 release 1.8 dump (Server error)
policy  default    0       0       1       1       1       0       0       0       0

Kerberos KDC和Kadmin日志没有任何内容，ldap.log提供 5月31日12:40:17 kdc slapd[28020]：连接输入：conn=1091延迟操作：绑定

其他一切都很好，创建、删除、主体身份验证都没有问题。仅转储数据库失败。据我所知，后端不应该对转储有任何影响

有没有办法调试或修复这个问题？我错过了什么

/etc/krb5.conf

[libdefaults]
        default_realm   = REALM.EXAMPLE.COM
        kdc_timesync    = 1
        ccache_type     = 4
        forwardable     = true
        proxiable       = true

[realms]
        REALM.EXAMPLE.COM = {
                kdc             = kdc.realm.example.com
                admin_server    = kdc.realm.example.com
                kpasswd_server  = kdc.realm.example.com
        }

[domain_realm]
        .realm.example.com  = REALM.EXAMPLE.COM

/etc/krb5kdc/kdc.conf

[realms]
    REALM.EXAMPLE.COM = {
        default_domain  = realm.example.com
        database_module = ldapconf

        acl_file        = /etc/krb5kdc/kadm5.acl
        key_stash_file  = /etc/krb5kdc/.master

       max_life        = 10h 0m 0s
       max_renewable_life = 7d 0h 0m 0s

        master_key_type         = aes256-cts
        supported_enctypes      = aes256-cts-hmac-sha1-96:normal
#aes128-cts-hmac-sha1-96:normal arcfour-hmac:normal
        default_principal_flags = +preauth

        pkinit_identity = FILE:/etc/krb5kdc/kdc-cert.pem,/etc/krb5kdc/.kdc-key.pem
        pkinit_anchors  = FILE:/etc/krb5kdc/ca-cert.pem

        dict_file       = /root/bad_passwords.dict
    }

[dbmodules]
        ldapconf = {
                db_library                 = kldap
                ldap_kerberos_container_dn = "cn=kerberos,dc=realm,dc=example,dc=com"
                ldap_kdc_dn                = "cn=kerberos-kdc,dc=realm,dc=example,dc=com"
                ldap_kadmind_dn            = "cn=kerberos-admin,dc=realm,dc=example,dc=com"
                ldap_servers               = ldapi:///
                ldap_service_password_file = /etc/krb5kdc/.service
    }
[logging]
kdc          = FILE:/var/log/kerberos/kdc.log
admin_server = FILE:/var/log/kerberos/kadmin.log
default      = FILE:/var/log/kerberos/kerberos.log

---

最后调试后发现问题：

LDAP后端对搜索请求的硬大小限制为500。有501个用户在背后咬我

修正：

---

应用、重新启动slapd并将其转储

终于找到了问题：LDAP后端对搜索请求的硬大小限制为500。有501个用户在背后咬我！修正：

#
# remove sizelimit for ldap search
#
# apply with ldapmodify -Y EXTERNAL -H ldapi:/// -f sizelimit.ldif
#
dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcLimits
olcLimits:  dn.exact="cn=kerberos-admin,dc=realm,dc=example,dc=com" size=unlimited