From: ondra@mistotebe.net   
      
   On Thu, Feb 19, 2026 at 09:13:57PM +0530, Pirate Praveen wrote:   
   > On 2/19/26 6:57 PM, Ondřej Kuzník wrote:   
   >> It could be related to actual (TLS?) startup which doesn't happen for   
   >> slap* tool setup. If you start slapd by hand with `-d config` (or `-d   
   >> any` if you want full output) does anything new show up on stderr? If it   
   >> does start up just fine, then I'd look the way of how it's started   
   >> (selinux/apparmor/... interference) as well but let's start from the   
   >> bottom.   
   >   
   > Interestingly running slapd manually seems to work.   
   >   
   > These are the steps I did,   
   >   
   > 1. delete olcTLSCipherSuite: NORMAL   
   > 2. Set olcSecurity: tls=0   
   > 3. Remove ldaps:/// from slapd -h in systemd service file   
   > 4. Update source.list and install slapd from trixie   
   > 4. start with slapd -d config -h "ldap:/// ldapi:///"   
   > 5. Add olcTLSCipherSuite: HIGH   
   > 6. Remove olcSecurity: tls=0   
   >   
   > Still systemctl start slapd fails, but systemd still cannot start.   
   >   
   > Manually running this same command (after creating the directories and   
   > adjusting permissions) works fine, but somehow systemd is failing to start   
   > it.   
   >   
   > # cat /etc/systemd/system/slapd.service.d/override.conf   
   > [Service]   
   > ExecStart=   
   > ExecStartPre=/bin/mkdir -p /var/run/slapd   
   > ExecStartPre=/bin/chown openldap:openldap /var/run/slapd   
   > ExecStart=/usr/sbin/slapd -h "ldap:/// ldapi:///" -F /etc/ldap/slapd.d -u   
   > openldap -g openldap   
      
   If it starts up from the shell, then it definitely sounds like an issue   
   with how systemd sets up the environment. Likely sandboxing or something   
   similar. Add -d to the ExecStart invocation (and potentially olcLogFile:   
    to cn=config if you can't/don't want to read stderr) and see   
   where you get.   
      
   What does systemctl cat slapd.service say? Is there anything in the   
   kernel audit logs to indicate apparmor issues (and what does aa-status   
   say about slapd?)   
      
   Regards,   
      
   --   
   Ondřej Kuzník   
   Senior Software Engineer   
   Symas Corporation                       http://www.symas.com   
   Packaged, certified, and supported LDAP solutions powered by OpenLDAP   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)