Red Hat DirectoryServer 8.1Configuration andCommand Reference Ella Deon LackeyPublication date: April 28, 2009, updated on February 11, 2010
About This Referencexmozldap directory on Red Hat Enterprise Linux 5 (32-bit) (or /usr/lib64/mozldap for 64-bitsystems).However, Red Hat Enterprise Li
Chapter 2. Core Server Configuration Reference86empty if certificate-based authentication is used, in which case the DN used is the subject DN of thec
Replication Attributes under cn=ReplicationAgreementName, cn=replica, cn="suffixName", cn=mapping tree, cn=config87Parameter DescriptionVali
Chapter 2. Core Server Configuration Reference88Parameter DescriptionValid Values Any valid host server nameDefault ValueSyntax DirectoryStringExample
Replication Attributes under cn=ReplicationAgreementName, cn=replica, cn="suffixName", cn=mapping tree, cn=config89Parameter DescriptionEntr
Chapter 2. Core Server Configuration Reference902.3.8.14. nsDS5ReplicaLastUpdateStatusThis read-only attribute provides the status for the most recent
Replication Attributes under cn=ReplicationAgreementName, cn=replica, cn="suffixName", cn=mapping tree, cn=config912.3.8.17. nsDS5BeginRepli
Chapter 2. Core Server Configuration Reference92When setting the values, ensure that the nsDS5ReplicaSessionPauseTime interval is at least 1second lon
Replication Attributes under cn=ReplicationAgreementName, cn=replica, cn="suffixName", cn=mapping tree, cn=config93Parameter DescriptionVali
Chapter 2. Core Server Configuration Reference94Parameter DescriptionValid Range Time schedule presented as XXXX-YYYY0123456, where XXXX is the starti
Synchronization Attributes under cn=syncAgreementName, cn=WindowsReplica,cn="suffixName", cn=mapping tree, cn=config952.3.9.1. nsds7Director
Additional Readingxi3. Additional ReadingThe Directory Server Administrator's Guide describes how to set up, configure, and administer RedHat Dir
Chapter 2. Core Server Configuration Reference96Parameter DescriptionEntry DN cn=syncAgreementName, cn=replica,cn=suffixDN, cn=mapping tree, cn=config
cn=monitor97Parameter DescriptionValid Values 1 to the maximum 32-bit integer value(2147483647)Default Value 300Syntax IntegerExample winSyncInterval:
Chapter 2. Core Server Configuration Reference98• E this is the bind DN. This may be empty or have value of NULLDN for anonymous connections.currentCo
cn=replication99threadsThis attribute shows the number of threads used by the Directory Server. This should correspond tonsslapd-threadnumber in cn=co
Chapter 2. Core Server Configuration Reference1002.3.12.2. nsSaslMapFilterTemplateThis attribute contains the search filter template used in SASL iden
cn=SNMP101Parameter DescriptionEntry DN cn=SNMP, cn=configValid Values Organization nameDefault ValueSyntax DirectoryStringExample nssnmporganization:
Chapter 2. Core Server Configuration Reference102Parameter DescriptionEntry DN cn=SNMP, cn=configValid Values machine hostname or localhostDefault Val
SNMP Statistic Attributes103Attribute DescriptionSimpleAuthBinds This shows the number of LDAP simple bindrequests (DN and password).StrongAuthBinds T
Chapter 2. Core Server Configuration Reference104Attribute DescriptionReferralsReturned This provides information on referrals returnedas search resul
cn=tasks105The common attributes for these tasks are listed in Section 2.3.15.1, “Task Invocation Attributes forEntries under cn=tasks”.The cn=tasks e
About This Referencexii4. Giving FeedbackIf there is any error in this Configuration, Command, and File Reference or there is any way to improvethe do
Chapter 2. Core Server Configuration Reference106Parameter DescriptionExample nsTaskStatus: Loading entries...nsTaskLogThis entry contains all of the
cn=tasks107progress bar. When the nsTaskCurrentItem attribute has the same value as nsTaskTotalItems,then the task is completed.This attribute value i
Chapter 2. Core Server Configuration Reference108information without missing the exit code. Setting the ttl attribute to 0 means that the entry is not
cn=tasks109nsFilenameThe nsFilename attribute contains the path and filenames of the LDIF files to import into theDirectory Server instance. To import
Chapter 2. Core Server Configuration Reference110Parameter DescriptionValid Values Any DNDefault ValueSyntax DN, multi-valuedExample nsExcludeSuffix:o
cn=tasks111nsUniqueIdGeneratorNamespaceThis attributes defines how to generate name-based IDs; the attribute sets the namespace to use togenerate the
Chapter 2. Core Server Configuration Reference112• nsUseId2Entry, analogous to the -C option, to set whether to use only the main index, id2entry,to l
cn=tasks113Parameter DescriptionEntry DN cn=task_name, cn=export, cn=tasks, cn=configValid Values Any DNDefault ValueSyntax DN, multi-valuedExample ns
Chapter 2. Core Server Configuration Reference114nsUseId2EntryThe nsUseId2Entry attribute uses the main database index, id2entry, to define the export
cn=tasks115dn: cn=example backup, cn=backup, cn=tasks, cn=configobjectclass: extensibleObjectcn: example backupnsArchiveDir: /export/backups/nsDatabas
Documentation HistoryxiiiRevision 8.1.5 September 9, 2009 Ella Deon Lackey Removing any references to the Directory Server Gateway or Org Chart.Revis
Chapter 2. Core Server Configuration Reference116A restore task entry under cn=restore must contain the location of the directory from which toretriev
cn=tasks117Alternatively, the index task can be used to generate virtual list view (VLV) indexes for an attributeusing the nsIndexVLVAttribute attribu
Chapter 2. Core Server Configuration Reference118Parameter DescriptionDefault ValueSyntax Case-insensitive string, multi-valuedExample nsIndexAttribut
cn=tasks119Parameter DescriptionExample cn: example reload task IDschemadirThis contains the full path to the directory containing the custom schema f
Chapter 2. Core Server Configuration Reference120Parameter DescriptionValid Values Any DNDefault ValueSyntax DNExample basedn: ou=people, dc=example,
directoryServerFeature (Object Class)121To configure Directory Server to maintain a changelog that is compatible with the changelogimplemented in Dire
Chapter 2. Core Server Configuration Reference122Required AttributesAttribute DefinitionobjectClass Gives the object classes assigned to the entry.All
nsContainer (Object Class)123Allowed AttributesAttribute Definitioncn (common Name) Gives the common name of the entry.2.4.5. nsContainer (Object Clas
Chapter 2. Core Server Configuration Reference124nsDS5ReplicaId Specifies the unique ID for suppliers in areplication environment.nsDS5ReplicaRoot Spe
nsDS5ReplicationAgreement (Object Class)125OID2.16.840.1.113730.3.2.103Required AttributesobjectClass Defines the object classes for the entry.cn Used
Chapter 2. Core Server Configuration Reference126nsDS5ReplicatedAttributeList Specifies any attributes that will not be replicatedto a consumer server
nsDSWindowsReplicationAgreement (Object Class)127nsDS5ReplicaBindMethod Specifies the method (SSL or simpleauthentication) to use for binding.nsDS5Rep
Chapter 2. Core Server Configuration Reference128nsds7DirsyncCookie Contains a cookie set by the sync service thatfunctions as an RUV.nsds7NewWinGroup
nsslapdConfig (Object Class)129Superior ClasstopOID2.16.840.1.113730.3.2.317Required AttributesobjectClass Defines the object classes for the entry.cn
Chapter 2. Core Server Configuration Reference130OID2.16.840.1.113730.3.2.13Required AttributesAttribute DefinitionobjectClass Gives the object classe
Legacy Attributes131Attribute DefinitionpasswordMustChange29Identifies whether or not to change theirpasswords when they first login to the directoryo
Chapter 2. Core Server Configuration Reference1322.5.1. Legacy Server AttributesThese attributes were originally used to configure the server instance
Legacy Server Attributes1332.5.1.3. changeLogMaximumConcurrentWritesThis attribute sets the maximum number of concurrent writes that can be written to
Chapter 2. Core Server Configuration Reference1342.5.2. Legacy Replication AttributesThese attributes were originally used to configure replication fo
Legacy Replication Attributes135Attribute DefinitioncirUpdateFailedAt Stores the timestamp of the last failed updateattempt.cirBeginORC Sets whether t
Chapter 1.1IntroductionDirectory Server is based on an open-systems server protocol called the Lightweight Directory AccessProtocol (LDAP). The Direct
Chapter 2. Core Server Configuration Reference136Multi- or Single-Valued Multi-valuedDefined in Directory Server2.5.2.6. cirLastUpdateAppliedFor consu
Legacy Replication Attributes137Multi- or Single-Valued Multi-valuedDefined in Directory Server2.5.2.11. cirUpdateScheduleFor consumer-initiated repli
Chapter 2. Core Server Configuration Reference138Attribute Definitioncn Specifies the common name of the entry.Allowed AttributesAttribute Definitiond
Legacy Replication Attributes139Defined in Directory Server2.5.2.16. replicaBeginOrcFor online replication creation (ORC), the consumer server can dum
Chapter 2. Core Server Configuration Reference140Multi- or Single-Valued Multi-valuedDefined in Directory Server2.5.2.21. replicaEntryFilterThis attri
Legacy Replication Attributes141Defined in Directory Server2.5.2.26. replicaRootThis attribute sets the DN at the root of a replicated area. This attr
Chapter 2. Core Server Configuration Reference142Defined in Directory Server2.5.2.31. replicaUseSSLThis attribute sets whether to use a secure connect
Chapter 3.143Plug-in Implemented ServerFunctionality ReferenceThis chapter contains reference information on Red Hat Directory Server plug-ins.The con
Chapter 3. Plug-in Implemented Server Functionality Reference144Plug-in Parameter DescriptionConfigurable Arguments List of attributes (uid mail userP
Attribute Uniqueness Plug-in1453.1.4. Attribute Uniqueness Plug-inPlug-in Parameter DescriptionPlug-in Name Attribute Uniqueness Plug-inDN of Configur
2
Chapter 3. Plug-in Implemented Server Functionality Reference146Plug-in Parameter DescriptionDN of Configuration Entry cn=Binary Syntax, cn=plugins, c
Case Ignore String Syntax Plug-in147Plug-in Parameter DescriptionFurther Information3.1.8. Case Ignore String Syntax Plug-inPlug-in Parameter Descript
Chapter 3. Plug-in Implemented Server Functionality Reference148Plug-in Parameter DescriptionDN of Configuration Entry cn=Class of Service, cn=plugins
Distributed Numeric Assignment Plug-in149Plug-in Parameter DescriptionFurther Information3.1.13. Distributed Numeric Assignment Plug-inPlug-in Informa
Chapter 3. Plug-in Implemented Server Functionality Reference1503.1.15. HTTP Client Plug-inPlug-in Parameter DescriptionPlug-in Name HTTP ClientDN of
JPEG Syntax Plug-in151Plug-in Parameter Descriptionspecifies the location of the /etc/dirsrv/config/slapd-collations.conf file. Thisfile stores the co
Chapter 3. Plug-in Implemented Server Functionality Reference152Plug-in Parameter DescriptionFurther Information See the "Configuring Directory D
Multi-master Replication Plug-in1533.1.22. Multi-master Replication Plug-inPlug-in Parameter DescriptionPlug-in Name Multi-master Replication Plug-inD
Chapter 3. Plug-in Implemented Server Functionality Reference154Plug-in Parameter DescriptionDefault Setting onConfigurable Arguments NoneDependencies
Postal Address String Syntax Plug-in155Storage Scheme Name Usage Notescompatibility for any entries stored in thedirectory with passwords encrypted wi
Chapter 2.3Core Server Configuration ReferenceThe configuration information for Red Hat Directory Server is stored as LDAP entries within thedirectory
Chapter 3. Plug-in Implemented Server Functionality Reference156Plug-in Parameter DescriptionFurther Information3.1.27. PTA Plug-inPlug-in Parameter D
Retro Changelog Plug-in157Plug-in Parameter Description-1= no check for referential integrity0= check for referential integrity is performedimmediatel
Chapter 3. Plug-in Implemented Server Functionality Reference158Plug-in Parameter Descriptionso that clients can use this suffix with or withoutpersis
Space Insensitive String Syntax Plug-in159Plug-in Information DescriptionFurther InformationTable 3.4. Details of Schema Reload Plug-in3.1.32. Space I
Chapter 3. Plug-in Implemented Server Functionality Reference160Plug-in Parameter DescriptionPerformance Related InformationFurther Information3.1.34.
List of Attributes Common to All Plug-ins161Plug-in Parameter DescriptionDescription Enables the use of views in the Directory Serverdatabases.Configu
Chapter 3. Plug-in Implemented Server Functionality Reference1623.2.2. nsslapd-pluginPathThis attribute specifies the full path to the plug-in.Plug-in
nsslapd-pluginId163Plug-in Parameter DescriptionExample nsslapd-pluginEnabled: on3.2.6. nsslapd-pluginIdThis attribute specifies the plug-in ID.Plug-i
Chapter 3. Plug-in Implemented Server Functionality Reference164Plug-in Parameter DescriptionSyntax DirectoryStringExample nsslapd-pluginDescription:
nsslapd-plugin-depends-on-named165Plug-in Parameter DescriptionSyntax DirectoryStringExample nsslapd-plugin-depends-on-type: database3.3.4. nsslapd-pl
Chapter 2. Core Server Configuration Reference4if a server identifier is phonebook, then for a Directory Server on Red Hat Enterprise Linux 5 (32-bit)
Chapter 3. Plug-in Implemented Server Functionality Reference1663.4.1.1. nsLookThroughLimitThis performance-related attribute specifies the maximum nu
Database Attributes under cn=config, cn=ldbm database, cn=plugins, cn=config167NOTEIf the nsslapd-cache-autosize attribute and nsslapd-cache-autosize-
Chapter 3. Plug-in Implemented Server Functionality Reference1683.4.1.5. nsslapd-dbcachesizeThis performance tuning-related attribute specifies the da
Database Attributes under cn=config, cn=ldbm database, cn=plugins, cn=config169Parameter DescriptionDefault Value 60Syntax IntegerExample nsslapd-db-c
Chapter 3. Plug-in Implemented Server Functionality Reference170This attribute is provided only for system modification/diagnostics and should be chan
Database Attributes under cn=config, cn=ldbm database, cn=plugins, cn=config171The use of this attribute causes internal Directory Server database fil
Chapter 3. Plug-in Implemented Server Functionality Reference172The nsslapd-db-logbuf-size attribute is only valid if the nsslapd-db-durable-transacti
Database Attributes under cn=config, cn=ldbm database, cn=plugins, cn=config1733.4.1.15. nsslapd-db-page-sizeThis attribute specifies the size of the
Chapter 3. Plug-in Implemented Server Functionality Reference174WARNINGSetting this value will reduce data consistency and may lead to loss of data. T
Database Attributes under cn=config, cn=ldbm database, cn=plugins, cn=config175Parameter DescriptionExample nsslapd-db-trickle-percentage: 403.4.1.19.
LDIF and Schema Configuration Files5Configuration Filename Purpose10rfc2307.ldif Schema from RFC 2307, "An Approach for UsingLDAP as a Network In
Chapter 3. Plug-in Implemented Server Functionality Reference1763.4.1.21. nsslapd-directoryThis attribute specifies absolute path to database instance
Database Attributes under cn=config, cn=ldbm database, cn=plugins, cn=config177In Directory Server, the import operation can be run as a server task o
Chapter 3. Plug-in Implemented Server Functionality Reference1783.4.1.24. nsslapd-modeThis attribute specifies the permissions used for newly created
Database Attributes under cn=NetscapeRoot, cn=ldbm database, cn=plugins, cn=config and cn=userRoot, cn=ldbm database, cn=plugins, cn=config1793.4.3. D
Chapter 3. Plug-in Implemented Server Functionality Reference1803.4.3.2. nsslapd-cachememsizeThis performance tuning-related attribute specifies the s
Database Attributes under cn=NetscapeRoot, cn=ldbm database, cn=plugins, cn=config and cn=userRoot, cn=ldbm database, cn=plugins, cn=config181Paramete
Chapter 3. Plug-in Implemented Server Functionality Reference182Parameter DescriptionEntry DN cn=database_name, cn=ldbm database,cn=plugins, cn=config
Database Attributes under cn=NetscapeRoot, cn=ldbm database, cn=plugins, cn=config and cn=userRoot, cn=ldbm database, cn=plugins, cn=config183Paramete
Chapter 3. Plug-in Implemented Server Functionality Reference184Allowed AttributesAttribute DefinitionvlvEnabled11Stores the availability of the brows
Database Attributes under cn=NetscapeRoot, cn=ldbm database, cn=plugins, cn=config and cn=userRoot, cn=ldbm database, cn=plugins, cn=config185Attribut
Configuration and Command ReferenceRed Hat Directory Server 8.1 Configuration and CommandReference Edition 8.1.10Author Ella Deon LackeyCopyright ©
Chapter 2. Core Server Configuration Reference62.1.2. How the Server Configuration Is OrganizedThe dse.ldif file contains all configuration informatio
Chapter 3. Plug-in Implemented Server Functionality Reference186Parameter DescriptionEntry DN cn=index_name, cn=userRoot, cn=ldbmdatabase, cn=plugins,
Database Attributes under cn=database, cn=monitor, cn=ldbm database, cn=plugins, cn=config187nsslapd-db-clean-pagesThis attribute shows the clean page
Chapter 3. Plug-in Implemented Server Functionality Reference188nsslapd-db-log-write-rateThis attribute shows the number of megabytes and bytes writte
Database Attributes under cn=default indexes, cn=config, cn=ldbm database, cn=plugins, cn=config189Parameter DescriptionEntry DN cn=default indexes, c
Chapter 3. Plug-in Implemented Server Functionality Reference190Attribute DefinitionnsMatchingRule17Identifies the matching rule.3.4.5.4. nsIndexTypeT
Database Attributes under cn=monitor, cn=NetscapeRoot, cn=ldbm database, cn=plugins, cn=config191Parameter DescriptionValid Values Any valid collation
Chapter 3. Plug-in Implemented Server Functionality Reference192dbfilepageoutThis attribute gives the number of pages for this file written from cache
Database Attributes under cn=index, cn=NetscapeRoot, cn=ldbm database, cn=plugins, cn=config and cn=index, cn=UserRoot, cn=ldbm database, cn=plugins,
Chapter 3. Plug-in Implemented Server Functionality Reference194Parameter DescriptionEntry DN cn=attribute_name, cn=index,cn=database_name, cn=ldbm da
Database Link Plug-in Attributes (Chaining Attributes)1953.4.8.1. nsAttributeEncryption (Object Class)This object class is used for core configuration
Accessing and Modifying Server Configuration7Some of these attributes are common to all plug-ins, and some may be particular to a specific plug-in.Che
Chapter 3. Plug-in Implemented Server Functionality Reference196Figure 3.4. Database Link Plug-inAll plug-in technology used by the database link inst
Database Link Attributes under cn=config, cn=chaining database, cn=plugins, cn=config197Parameter DescriptionEntry DN cn=config, cn=chaining database,
Chapter 3. Plug-in Implemented Server Functionality Reference1983.5.2. Database Link Attributes under cn=default instance config,cn=chaining database,
Database Link Attributes under cn=default instance config, cn=chaining database, cn=plugins, cn=config199Parameter DescriptionValid Range 0 to 5Defaul
Chapter 3. Plug-in Implemented Server Functionality Reference2003.5.2.7. nsConcurrentOperationsLimitThis attribute specifies the maximum number of con
Database Link Attributes under cn=default instance config, cn=chaining database, cn=plugins, cn=config201Parameter DescriptionEntry DN cn=default inst
Chapter 3. Plug-in Implemented Server Functionality Reference202Parameter DescriptionSyntax IntegerExample nsslapd-timelimit: 36003.5.3. Database Link
Database Link Attributes under cn=database_link_name, cn=chaining database, cn=plugins, cn=config2033.5.3.2. nsFarmServerURLThis attribute gives the L
Chapter 3. Plug-in Implemented Server Functionality Reference2043.5.3.5. nshoplimitThis attribute specifies the maximum number of times a database is
Retro Changelog Plug-in Attributes205nsRenameCountThis attribute gives the number of rename operations received.nsSearchBaseCountThis attribute gives
Chapter 2. Core Server Configuration Reference8aci: (targetattr = "*")(version 3.0; acl "SIE Group"; allow(all) groupdn = &quo
Chapter 3. Plug-in Implemented Server Functionality Reference206• The modification action; that is, exactly how the directory was modified.It is throu
Distributed Numeric Assignment Plug-in Attributes207Parameter DescriptionSyntax DirectoryString Integer AgeIDAgeID is s for seconds, m for minutes, h
Chapter 3. Plug-in Implemented Server Functionality Reference208Parameter DescriptionExample dnaMagicRegen: magic3.7.3. dnaMaxValueThis attribute sets
dnaNextValue209Parameter DescriptionDefault Value NoneSyntax DirectoryStringExample dnaNextRange: 100-5003.7.5. dnaNextValueThis attribute gives the n
Chapter 3. Plug-in Implemented Server Functionality Reference210Parameter DescriptionEntry DN cn=Distributed Numeric Assignment Plugin,cn=plugins, cn=
dnaThreshold211Parameter DescriptionSyntax DNExample dnaSharedCfgDN: cn=range transfer user,cn=config3.7.10. dnaThresholdOne potential situation with
Chapter 3. Plug-in Implemented Server Functionality Reference212membership is not reflected in the member's user entry, so it is impossible to te
Chapter 4.213Server Instance File ReferenceThis chapter provides an overview of the files that are specific to an instance of Red Hat DirectoryServer
Chapter 4. Server Instance File Reference214File or Directory LocationLog files /var/log/dirsrv/slapd-instance_namePID /var/run/dirsrvTools /usr/bin/u
Database Files215__db.001 __db.003 __db.005 NetscapeRoot/__db.002 __db.004 DBVERSION log.0000000007 userRoot/Example 4.1. Database Directory C
Changing Configuration Attributes9The entire configuration, including attributes that always take default values, can be viewed byperforming an ldapse
Chapter 4. Server Instance File Reference2164.5. LDIF FilesSample LDIF files are stored in the /var/lib/dirsrv/slapd-instance_name/ldif directory fors
Log Files217For more information on using LDAP utilities, see the Directory Server Administrator's Guide.4.7. Log FilesEach Directory Server inst
Chapter 4. Server Instance File Reference218ldapcompare ldapdelete-bin ldappasswd ldapsearch-binExample 4.8. LDAP Tool Directory Contents4.10.
Chapter 5.219Log File ReferenceRed Hat Directory Server (Directory Server) provides logs to help monitor directory activity. Monitoringhelps quickly d
Chapter 5. Log File Reference2205.1.1. Access Logging LevelsDifferent levels of access logging generate different amounts of detail and record differe
Default Access Logging Content221[21/Apr/2009:11:39:53 -0700] conn=13 op=3 RESULT err=0 tag=120 nentries=0 etime=0[21/Apr/2009:11:39:53 -0700] conn=13
Chapter 5. Log File Reference222[21/Apr/2009:11:39:51 -0700] conn=11 op=0 RESULT err=0 tag=97 nentries=0 etime=0In Section 5.1.2, “Default Access Logg
Default Access Logging Content223Tag Descriptiontag=107 A result from a delete operation.tag=109 A result from a moddn operation.tag=111 A result from
Chapter 5. Log File Reference224• ABANDON for abandon operationIf the LDAP request resulted in sorting of entries, then the message SORT serialno will
Default Access Logging Content225targetPosition:contentCount (resultCode)The example below highlights the VLV-specific entries:[07/May/2009:11:43:29 -
Chapter 2. Core Server Configuration Reference10nsslapd-tmpdir nsSSL2nsSSL3 nsSSLclientauthnsSSLSessionTimeout nsslapd-conntablesizensslapd-lockdir ns
Chapter 5. Log File Reference226Extended Operation Name Description OIDDirectory Server EndReplication RequestSent to indicate that areplication sessi
Access Log Content for Additional Access Logging Levels227[21/Apr/2009:11:39:52 -0700] conn=12 op=2 ABANDON targetop=NOTFOUND msgid=2NOTEThe Directory
Chapter 5. Log File Reference228[12/Jul/2009:16:45:46 +0200] conn=Internal op=-1 SRCH base="cn=\22dc=example,dc=com\22,cn=mapping tree,cn=config&
Common Connection Codes2295.1.4. Common Connection CodesA connection code is a code that is added to the closed log message to provide additionalinfor
Chapter 5. Log File Reference2305.2.1. Error Log Logging LevelsThe error log can record different amounts of detail for operations, as well as differe
Error Log Content231Setting Console Name Description4096 Housekeeping Housekeeping threaddebugging.8192 Replication Logs detailed informationabout eve
Chapter 5. Log File Reference232• The plug-in being called, for internal operations.• Functions called by the plug-in, for internal operations.• Messa
Error Log Content for Other Log Levels233[timestamp] NSMMReplicationPlugin - agmt="name" (consumer_host:consumer_port): current_taskFor exam
Chapter 5. Log File Reference234[09/Jan/2009:13:44:48 -0500] NSMMReplicationPlugin - agmt="cn=example2" (alt:13864): replay_update: Consumer
Audit Log Reference235NOTEExample 5.5, “Example ACL Plug-in Error Log Entry with Plug-in Logging” shows bothplug-in logging and search filter processi
cn=config112.3.1.1. nsslapd-accesslog (Access Log)This attribute specifies the path and filename of the log used to record each LDAP access. Thefollow
Chapter 5. Log File Reference236 timestamp: date dn: modified_entry changetype: action action:attribute attribute:new_value - replace: modif
LDAP Result Codes237 - replace: modifytimestamp modifytimestamp: 20090109181810Z -Example 5.8. Audit Log ContentThe audit log does not have any other
Chapter 5. Log File Reference238Result Code Defined Value Result Code Defined Value36 ALIAS_DEREFERENCING_PROBLEMTable 5.5. LDAP Result Codes
Chapter 6.239Command-Line UtilitiesThis chapter contains reference information on command-line utilities used with Red Hat DirectoryServer (Directory
Chapter 6. Command-Line Utilities240-D "cn=Patricia Fuentes, ou=people, dc=example,dc=Bolivia\, S.A."6.3. Command-Line Utilities Quick Refer
ldapsearch241• SSL Options• SASL Options• Additional ldapsearch OptionsSyntax ldapsearch -b basedn -s scope [ optional_options ] "(attribute=filt
Chapter 6. Command-Line Utilities242Option Description-b Specifies the starting point for the search. Thevalue specified here must be a distinguishedn
ldapsearch243Option Descriptioninstalled. If a host is not specified, ldapsearchuses the local host. For example:-h mozilla-l Specifies the maximum nu
Chapter 6. Command-Line Utilities244Option DescriptionIf a dash (-) is used as the password value,the utility prompts for the password after thecomman
ldapsearch245Option Descriptionis useful with the -C for persistent searchesbecause it prints any entry modifications withoutdelay and without the sea
Chapter 2. Core Server Configuration Reference12Parameter DescriptionEntry DN cn=configValid Values • 0 - No access logging• 4 - Logging for internal
Chapter 6. Command-Line Utilities246Option Description-3 Specifies that hostnames should be checked inSSL certificates.-I Specifies the SSL key passwo
ldapsearch247Option Description-Q Specifies the token and certificate name, whichis separated by a semi-colon (:) for PKCS11.-W Specifies the password
Chapter 6. Command-Line Utilities248Option Description• secProp, the security properties• realm, the Kerberos realm• flagsThe expected values depend o
ldapsearch249Required or Optional Option Description Example• noactive — Do notpermit mechanismssusceptible to activeattacks.• nodict — Do notpermit m
Chapter 6. Command-Line Utilities250Required or Optional Option Description Examplewhen using integrityor privacy settings.Table 6.7. Description of C
ldapsearch251Required or Optional Option Description Example• maxssf — Requirea maximum securitystrength; this optionneeds a numericvalue specifyingbi
Chapter 6. Command-Line Utilities252Required or Optional Option Description Example• minssf — Requirea minimum securitystrength; this optionneeds a nu
ldapsearch253Option Description-e Minimizes the base-64 encoding for the values ofreturned entries.-F Specifies a different separator. This option all
Chapter 6. Command-Line Utilities254Option DescriptionThis argument can input the bind DN, base DN,and the search filter pattern in the specifiedchara
ldapsearch255Option Description-O 2-R Specifies that referrals are not to be followedautomatically. By default, referrals are followedautomatically.-S
cn=config13Parameter DescriptionSyntax DirectoryStringExample nsslapd-accesslog-logbuffering: off2.3.1.5. nsslapd-accesslog-logexpirationtime (Access
Chapter 6. Command-Line Utilities256Option Description-X Specifies the getEffectiveRights controlspecific attribute list, where attributes areseparate
ldapmodify257Option Description-D "uid=bjensen, dc=example,dc=com"This option cannot be used with the -N option.-f Option that specifies the
Chapter 6. Command-Line Utilities258Option Description-w Specifies the password associated with thedistinguished name specified in the -D option.For e
ldapmodify259Option Descriptionauthentication credentials specified on -D and -w.-P Specifies the absolute path, including thefilename, of the certifi
Chapter 6. Command-Line Utilities260Option Description-o Specifies SASL options. The format is -osaslOption=value. saslOption can have one ofsix value
ldapmodify261Option Descriptionldapmodify reads the contents of thephoto.jpeg file into the jpegPhoto attributebeing added to the entry.As an alternat
Chapter 6. Command-Line Utilities262Option Description-O 2-R Specifies that referrals are not to be followedautomatically.-v Specifies that the utilit
ldapdelete263Option Description-D "uid=bjensen, dc=example,dc=com"For more information on access control, seethe "Managing Access Contr
Chapter 6. Command-Line Utilities264SSL OptionsUse the following options to specify that ldapdelete use LDAPS when communicating with theDirectory Ser
ldapdelete265Option Descriptionthe -P option calls out a path and filenamesimilar to the following:-P /etc/dirsrv/slapd-instance_name/client-cert.db-Q
Chapter 2. Core Server Configuration Reference14Attribute Value Logging Enabled or Disablednsslapd-accesslog-logging-enablednsslapd-accesslogonempty s
Chapter 6. Command-Line Utilities266Option Description• realm, the Kerberos realm• flagsThe expected values depend on the supportedmechanism. The -o c
ldappasswd267Option Description-R Specifies that referrals are not to be followedautomatically. By default, the server followsreferrals.-v Specifies t
Chapter 6. Command-Line Utilities268Option Description-a Specifies the user's existing password. Forexample:-a old_password-S Specifies that the
ldappasswd269Option DescriptionThe -D option cannot be used with the -N option.For more information on access control, seethe "Managing Access Co
Chapter 6. Command-Line Utilities270Option DescriptionIf this option is specified, then the -D and -woptions must not be specified, or certificate-bas
ldappasswd271Option Description-Z Specifies that SSL is to be used for the searchrequest.-ZZ Specifies the Start TLS request. Use this optionto make a
Chapter 6. Command-Line Utilities272ExamplesThe following examples provide show how to perform various tasks using the ldappasswd command.The Director
ldif273ldappasswd -h myhost -o "mech=GSSAPI" -SExample 6.6. User Already Authenticating by Kerberos Prompts for a New Password6.8. ldifldif
Chapter 6. Command-Line Utilities274Option DescriptionNOTEThe :< URL specifier notationonly works if LDIF statementis version 1 or later, meaningve
dbscan275Option Parameter Description-K entry_id Specifies the entry to ID to lookup.Table 6.24. Entry File OptionsNOTEThe index file options, listed
cn=config152.3.1.9. nsslapd-accesslog-logminfreediskspace (Access Log MinimumFree Disk Space)This attribute sets the minimum allowed free disk space i
Chapter 6. Command-Line Utilities276dbscan -s -f /var/lib/dirsrv/slapd-instance_name/db/userRoot/objectclass.db4Example 6.11. Displaying the Summary o
Chapter 7.277Command-Line ScriptsThis chapter provides information on the scripts for managing Red Hat Directory Server, such asbacking-up and restori
Chapter 7. Command-Line Scripts278Shell Script Descriptionlib/dirsrv/slapd-instance_name/bakdirectory.start-slapd Starts Directory Server.stop-slapd S
Shell Scripts279Script Name Description Perl or Shell Scriptcl-dump.pl Dumps and decodes thechangelog.Perlds_removal Removes a server instance. Shelll
Chapter 7. Command-Line Scripts280• Section 7.3.6, “dbverify (Checks for Corrupt Databases)”• Section 7.3.7, “ds_removal”• Section 7.3.8, “ldif2db (Im
cl-dump (Dumps and Decodes the Changelog)281Option Descriptionto restore a single database; it is not necessaryto use the n option to restore the enti
Chapter 7. Command-Line Scripts282Option Descriptioncommas to separate roots. If the option isomitted, all the replica roots will be dumped.-v Prints
db2index (Reindexes Database Index Files)283Option Description-a outputFile Gives the name of the output LDIF file.-C Uses only the main database file
Chapter 7. Command-Line Scripts284UsageHere are a few sample commands:• Reindex all the database index files:db2index• Reindex cn and givenname in the
ds_removal285IMPORTANTNever run dbverify when a modify operation is in progress. This command callsthe BerkeleyDB utility db_verify and does not perfo
iiiAbout This Reference ix1. Director
Chapter 2. Core Server Configuration Reference16Parameter DescriptionValid Range 0 through 23Default Value 0Syntax IntegerExample nsslapd-accesslog-lo
Chapter 7. Command-Line Scripts286Options Option Parameter Description-f Forces the removal of theinstance. This can be useful ifthe instance is not r
ldif2ldap (Performs Import Operation over LDAP)287Option DescriptionBy default, a time-based unique ID is generated.When using the deterministic gener
Chapter 7. Command-Line Scripts288OptionsOption Description-D rootdn Gives a user DN with root permissions, such asDirectory Manager.-f filename Gives
repl-monitor (Monitors Replication Status)289Option Descriptionreplication information. For more informationabout the configuration file, see Configur
Chapter 7. Command-Line Scripts290lowmark = colorThe connection section defines how this tool may connect to each LDAP server in the replicationtopolo
pwdhash (Prints Encrypted Passwords)29160 = #FFCCCCA shadow port can be set in the replication monitor configuration file. For example:host:port=shado
Chapter 7. Command-Line Scripts292Exit Code Description3 Server could not be stopped.Table 7.13. restart-slapd Exit Status Codes7.3.14. restoreconfig
stop-slapd (Stops the Directory Server)293OptionsThere are no options for this script.Exit Status CodesExit Code Description0 Server started successfu
Chapter 7. Command-Line Scripts2947.3.19. vlvindex (Creates Virtual List View Indexes)To run the vlvindex script, the server must be stopped. The vlvi
bak2db.pl (Restores a Database from Backup)295• Section 7.4.10, “migrate-ds-admin.pl”• Section 7.4.7, “ldif2db.pl (Import)”• Section 7.4.8, “logconv.p
cn=config172.3.1.14. nsslapd-accesslog-logrotationtimeunit (Access Log RotationTime Unit)This attribute sets the units for the nsslapd-accesslog-logro
Chapter 7. Command-Line Scripts296Option Description-t databaseType The database type. The only possible databasetype is ldbm.-v Verbose mode.-w passw
db2bak.pl (Creates a Backup of a Database)297Option Description-P bindCert Specifies the path, including the filename, to thecertificate database that
Chapter 7. Command-Line Scripts2987.4.4. db2index.pl (Creates and Generates Indexes)Creates and generates the new set of indexes to be maintained foll
db2ldif.pl (Exports Database Contents to LDIF)299OptionsTo run this script, the server must be running, and either the -n or -s option is required.Opt
Chapter 7. Command-Line Scripts3007.4.6. fixup-memberof.pl (Regenerate memberOf Attributes)Regenerates and updates memberOf on user entries to coordin
ldif2db.pl (Import)301Option Description-c Merges chunk size.-D rootdn Specifies the user DN with root permissions,such as Directory Manager.-E Decryp
Chapter 7. Command-Line Scripts302Option Description-w password Specifies the password associated with the userDN.-w - Prompts for the password associ
logconv.pl (Log Converter)303• Lists of the most frequently occurring parameters in LDAP requests provide insight into how thedirectory information is
Chapter 7. Command-Line Scripts304Option Descriptionwill list the ten client machines that access theDirectory Server most often. This parameter willa
migrate-ds.pl305Option Descriptionc Lists the number of occurrences for each type ofconnection code.i Lists the IP addresses and connection codesof th
Chapter 2. Core Server Configuration Reference18Parameter DescriptionEntry DN cn=configValid Range 1 to the maximum 32 bit integer value(2147483647)De
Chapter 7. Command-Line Scripts306NOTEThis script only migrates a Directory Server instance, not an Administration Server.Information can be passed wi
migrate-ds.pl307Option Alternate Options Description--instance -i This parameter specifies aspecific instance to migrate.This parameter can be usedmul
Chapter 7. Command-Line Scripts3087.4.10. migrate-ds-admin.plThe migrate-ds-admin.pl script is used to migrate a Directory Server 7.1 instance to Dire
migrate-ds-admin.pl309Option Alternate Options Descriptioncase, the oldsroot parametersets the directory from whichthe migration is run (such asmachin
Chapter 7. Command-Line Scripts310Option Alternate Options DescriptionIf this is not set, then themigration information is writtento a temporary file,
ns-inactivate.pl (Inactivates an Entry or Group of Entries)311Syntaxns-activate.pl [ -D rootdn ] [ -w password | -w - | -j filename ] [ -p port ] [ -h
Chapter 7. Command-Line Scripts312Option Description-j filename Specifies the path, including the filename, to thefile that contains the password asso
register-ds-admin.pl313Option Description-v Verbose mode.-w password Specifies the password associated with the userDN.-? Opens the help page.Table 7.
Chapter 7. Command-Line Scripts314When the instance is removed, it is shutdown and all of its configuration files are removed. Certificatedatabase fil
repl-monitor.pl (Monitors Replication Status)315Option Description-r If specified, causes the routine to be enteredwithout printing the HTML header in
cn=config19/usr/lib/mozldap/ldapsearch -D "cn=directory manager" -b "dc=example,dc=com" -s sub "(objectclass=*)"When una
Chapter 7. Command-Line Scripts316A server may have a dedicated or shared entry in the connection section. The script will find out themost matched en
schema-reload.pl (Reload Schema Files Dynamically)317When the replication monitor finds a replication agreement that uses the specified port, it will
Chapter 7. Command-Line Scripts318NOTEThis script only creates a Directory Server instance, not an Administration Server. Forthe new instance to work,
setup-ds-admin.pl319Option Alternate Options Descriptiontmp/setuprandom.inf, like/tmp/setuplGCZ8H.inf.WARNINGThe cachefile containsthe cleartextpasswo
Chapter 7. Command-Line Scripts320Options Option Alternate Options Description--silent -s This runs the register scriptin silent mode, drawing theconf
verify-db.pl (Check for Corrupt Databases)321Option Alternate Options Description--logfile name -l This parameter specifies alog file to which to writ
Chapter 7. Command-Line Scripts322Option Descriptiondb.pl command, then it uses the defaultdatabase directory, /var/lib/dirsrv/slapd-instance_name/db.
323Appendix A. Using the ns-slapdCommand-Line UtilitiesChapter 7, Command-Line Scripts discussed the scripts for performing routine administration tas
Appendix A. Using the ns-slapd Command-Line Utilities324Option Description-d debugLevel Specifies the debug level to use during thedb2ldif runtime. Fo
Utilities for Restoring and Backing up Databases: ldif2db325Option Descriptionthe configuration directory, do not excludeo=NetscapeRoot.Table A.1. db2
Chapter 2. Core Server Configuration Reference20Attributes in dse.ldif Value Logging enabled or disablednsslapd-auditlog-logging-enablednsslapd-auditl
Appendix A. Using the ns-slapd Command-Line Utilities326Option DescriptionUse this option to import the same LDIF file intotwo different Directory Ser
Utilities for Restoring and Backing up Databases: db2archive327OptionsOption Description-D configDir Specifies the location of the serverconfiguration
Appendix A. Using the ns-slapd Command-Line Utilities328Option DescriptionSection 2.3.1.44, “nsslapd-errorlog-level (ErrorLog Level)”.-D configDir Spe
329GlossaryAaccess control instruction See ACI.access control list See ACL.access rights In the context of access control, specify the level of access
Glossary330authentication (1) Process of proving the identity of the client user to the DirectoryServer. Users must provide a bind DN and either the c
331certificate A collection of data that associates the public keys of a network userwith their DN in the directory. The certificate is stored in the
Glossary332CoS A method for sharing attributes between entries in a way that isinvisible to applications.CoS definition entry Identifies the type of C
333IP address for a hostname from a DNS server, or they look it up intables maintained on their systems.DNS alias A DNS alias is a hostname that the D
Glossary334Hhostname A name for a machine in the form machine.domain.dom, which istranslated into an IP address. For example, www.example.com isthe ma
335LLDAP Lightweight Directory Access Protocol. Directory service protocoldesigned to run over TCP/IP and across multiple platforms.LDAP client Softwa
cn=config212.3.1.23. nsslapd-auditlog-logexpirationtimeunit (Audit Log ExpirationTime Unit)This attribute sets the units for the nsslapd-auditlog-loge
Glossary336master See supplier.master agent See SNMP master agent.matching rule Provides guidelines for how the server compares strings during asearch
337NIS Network Information Service. A system of programs and datafiles that Unix machines use to collect, collate, and share specificinformation about
Glossary338permission In the context of access control, permission states whether access tothe directory information is granted or denied and the leve
339referential integrity Mechanism that ensures that relationships between related entriesare maintained within the directory.referral (1) When a serv
Glossary340schema checking Ensures that entries added or modified in the directory conform to thedefined schema. Schema checking is on by default, and
341SSL A software library establishing a secure connection between twoparties (client and server) used to implement HTTPS, the secureversion of HTTP.
Glossary342topology The way a directory tree is divided among physical servers and howthese servers link with one another.Transport Layer Security See
343IndexSymbols00core.ldifldif files, 401common.ldifldif files, 405rfc2247.ldifldif files, 405rfc2927.ldifldif files, 410presence.ldifldif files, 410r
Index344Cchangelogmulti-master replication changelog, 71changeLog, 73changelog configuration attributeschangelogmaxentries, 72nsslapd-changelogdir, 71
345nsTaskCurrentItem, 106nsTaskExitCode, 106nsTaskLog, 106nsTaskStatus, 105, 107ttl, 107entries, 104task invocation configuration entries, 104cn=backu
Chapter 2. Core Server Configuration Reference222.3.1.25. nsslapd-auditlog-logmaxdiskspace (Audit Log Maximum DiskSpace)This attribute sets the maximu
Index346retro changelog plug-in configurationattributes, 205SASL configuration attributes, 99SNMP configuration attributes, 100suffix configuration at
347nsslapd-accesslog-logexpirationtime, 13nsslapd-accesslog-logexpirationtimeunit, 13nsslapd-accesslog-logging-enabled, 13nsslapd-accesslog-logmaxdisk
Index348nssnmpdescription, 101nssnmpenabled, 100nssnmplocation, 101nssnmpmasterhost, 101nssnmpmasterport, 102nssnmporganization, 100nsSSL2 attribute,
349dbcachetries, 178dbfilecachehit, 191dbfilecachemiss, 191dbfilenamenumber, 191dbfilepagein, 191dbfilepageout, 192description, 189nsIndexType, 190nsL
Index350dbcachepageout attribute, 178dbcacheroevict attribute, 178dbcacherwevict attribute, 178dbcachetries attribute, 178dbfilecachehit attribute, 19
351additional options, 266commonly used options, 262SASL options, 265ssl options, 264syntax, 262ldapmodify command-line utilityadditional options, 260
Index352command-line perl script, 310quick reference, 278ns-inactivate.plcommand-line perl script, 311quick reference, 278ns-newpolicy.plquick referen
353nsOperationConnectionCount attribute, 205nsOperationConnectionsLimit attribute, 200nsPrintKey, 113nsProxiedAuthorization attribute, 200nsReferralOn
Index354nsslapd-db-page-rw-evict-rate attribute, 188nsslapd-db-page-size attribute, 173nsslapd-db-page-trickle-rate attribute, 188nsslapd-db-page-writ
355nssnmpenabled attribute, 100nssnmplocation attribute, 101nssnmpmasterhost attribute, 101nssnmpmasterport attribute, 102nssnmporganization attribute
cn=config23For example, to rotate audit log files every day at midnight, enable this attribute by setting its value toon, and then set the values of t
Index356nsAbandonedSearchCheckInterval, 198nsActiveChainingComponents, 196nsAddCount, 204nsBindConnectionCount, 205nsBindConnectionsLimit, 198nsBindCo
357nsslapd-require-index, 181nsslapd-suffix, 181nsSubStrBegin, 192nsSubStrEnd, 193nsSubStrMiddle, 193nsSystemIndex, 191nsTimeLimit, 201nsTransmittedCo
Index358nsState, 85object classes, 79restart, 291restart-slapdcommand-line shell script, 291quick reference, 277restarting serverrequirement for certa
359nsds7DirectoryReplicaSubtree, 95nsds7DirsyncCookie, 95nsds7NewWinGroupSyncEnabled, 95nsds7NewWinUserSyncEnabled, 95nsds7WindowsDomain, 96nsds7Windo
Chapter 2. Core Server Configuration Reference24number of units. The units (day, week, month, and so forth) are given by the nsslapd-auditlog-logrotat
cn=config25Parameter DescriptionValid Range -1 | 1 to the maximum 32 bit integer value(2147483647), where a value of -1 means thelog file is unlimited
Configuration and Command Referenceiv2.4.8. nsDSWindowsReplicationAgreement (Object Class) ... 1262.4.9. nsMapp
Chapter 2. Core Server Configuration Reference26• 7 - Read, write, and executeIn the 3-digit number, the first digit represents the owner's permi
cn=config272.3.1.37. nsslapd-configThis read-only attribute is the config DN.Parameter DescriptionEntry DN cn=configValid Values Any valid configurati
Chapter 2. Core Server Configuration Reference28Parameter DescriptionEntry DN cn=configValid Values on | offDefault Value onSyntax DirectoryStringExam
cn=config29Parameter DescriptionDefault Value offSyntax DirectoryStringExample nsslapd-enquote-sup-oc: off2.3.1.43. nsslapd-errorlog (Error Log)This a
Chapter 2. Core Server Configuration Reference302.3.1.44. nsslapd-errorlog-level (Error Log Level)This attribute sets the level of logging for the Dir
cn=config31Parameter Descriptionneeded. Use 128 for very detailed processingmessages.Default Value 16384Syntax IntegerExample nsslapd-errorlog-level:
Chapter 2. Core Server Configuration Reference32Parameter DescriptionSyntax DirectoryStringExample nsslapd-errorlog-logexpirationtimeunit: week2.3.1.4
cn=config33Parameter DescriptionValid Range -1 (unlimited) | 1 to the maximum 32 bit integervalue (2147483647)Default Value -1Syntax IntegerExample ns
Chapter 2. Core Server Configuration Reference342.3.1.53. nsslapd-errorlog-logrotationsyncmin (Error Log Rotation SyncMinute)This attribute sets the m
cn=config35Parameter DescriptionValid Values month | week | day | hour | minuteDefault Value weekSyntax DirectoryStringExample nsslapd-errorlog-logrot
v3.2.5. nsslapd-pluginEnabled ... 1623.2.6. nsslapd-pluginId ...
Chapter 2. Core Server Configuration Reference362.3.1.58. nsslapd-errorlog-mode (Error Log File Permission)This attribute sets the access mode or file
cn=config37Parameter DescriptionExample nsslapd-groupevalnestlevel: 52.3.1.60. nsslapd-idletimeout (Default Idle Timeout)This attribute sets the amoun
Chapter 2. Core Server Configuration Reference38Parameter DescriptionSyntax IntegerExample nsslapd-ioblocktimeout: 18000002.3.1.63. nsslapd-lastmod (T
cn=config39Parameter DescriptionEntry DN cn=configValid Values on | offDefault Value offSyntax DirectoryStringExample nsslapd-ldapiautobind: off2.3.1.
Chapter 2. Core Server Configuration Reference402.3.1.67. nsslapd-ldapigidnumbertype (Attribute Mapping for SystemGUID Number)Autobind can be used to
cn=config41Parameter DescriptionExample nsslapd-ldapimaprootdn: cn=Directory Manager2.3.1.70. nsslapd-ldapimaptoentries (Enable Autobind Mapping forRe
Chapter 2. Core Server Configuration Reference422.3.1.72. nsslapd-listenhost (Listen to IP Address)This attribute allows multiple Directory Server ins
cn=config43Parameter DescriptionEntry DN cn=configValid Values Any valid userDefault ValueSyntax DirectoryStringExample nsslapd-localuser: nobody2.3.1
Chapter 2. Core Server Configuration Reference442.3.1.77. nsslapd-maxdescriptors (Maximum File Descriptors)This attribute sets the maximum, platform-d
cn=config45Parameter DescriptionExample nsslapd-maxdescriptors: 10242.3.1.78. nsslapd-maxsasliosize (Maximum SASL Packet Size)When a user is authentic
Configuration and Command Referencevi3.7.11. dnaType ...
Chapter 2. Core Server Configuration Reference462.3.1.80. nsslapd-nagleWhen the value of this attribute is off, the TCP_NODELAY option is set so that
cn=config47Parameter DescriptionDefault Value 389Syntax IntegerExample nsslapd-port: 389NOTESet the port number to zero (0) to disable the LDAP port i
Chapter 2. Core Server Configuration Reference48Parameter DescriptionEntry DN cn=configValid Values on | offDefault Value offSyntax DirectoryStringExa
cn=config49Parameter DescriptionEntry DN cn=configValid Values Any valid LDAP URL in the form>ldap://server-locationDefault ValueSyntax DirectorySt
Chapter 2. Core Server Configuration Reference50• ChainingBackendDescriptors is NchainingBackend times the nsOperationConnectionsLimit (achaining or d
cn=config51For information on changing the root DN, see the "Creating Directory Entries" chapter in the DirectoryServer Administrator's
Chapter 2. Core Server Configuration Reference52Parameter DescriptionValid Values Any encryption method as described inSection 2.3.1.142, “passwordSto
cn=config53Parameter DescriptionValid Values on | offDefault Value offSyntax DirectoryStringExample nsslapd-schema-ignore-trailing-spaces: on2.3.1.97.
Chapter 2. Core Server Configuration Reference54be owned by the server user ID, and that user must have read and write permissions to the directory.Th
cn=config55The server has to be restarted for the port number change to be taken into account.Parameter DescriptionEntry DN cn=configValid Range 1 to
vii7.3.9. ldif2ldap (Performs Import Operation over LDAP) ... 2877.3.10. monitor (Retrieves Monitoring Infor
Chapter 2. Core Server Configuration Reference56Parameter DescriptionExample nsslapd-sizelimit: 20002.3.1.104. nsslapd-ssl-check-hostname (Verify Host
cn=config57Parameter DescriptionEntry DN cn=configValid Range 1 to the maximum number of threads supportedby the systemDefault Value 30Syntax IntegerE
Chapter 2. Core Server Configuration Reference58Parameter DescriptionEntry DN cn=configValid Values Any valid server version number.Default ValueSynta
cn=config592.3.1.112. passwordChange (Password Change)Indicates whether users may change their passwords.This can be abbreviated to pwdAllowUserChange
Chapter 2. Core Server Configuration Reference60Parameter DescriptionSyntax DirectoryStringExample passwordCheckSyntax off2.3.1.114. passwordExp (Pass
cn=config61a grace login. The server allows only a certain number of attempts before completely locking out theuser. This attribute is the number of g
Chapter 2. Core Server Configuration Reference62the Directory Server does not store any old passwords, and so users can reuse passwords. Enablepasswor
cn=config63This can be abbreviated to pwdLockOut.For more information on password policies, see the "Managing Users and Passwords" chapter i
Chapter 2. Core Server Configuration Reference64Parameter DescriptionExample passwordMaxAge: 1002.3.1.126. passwordMaxFailure (Maximum Password Failur
cn=config65Parameter DescriptionDefault Value 0Syntax IntegerExample passwordMin8Bit: 02.3.1.129. passwordMinAge (Password Minimum Age)Indicates the n
viii
Chapter 2. Core Server Configuration Reference66Parameter DescriptionValid Range 0 to 5Default Value 0Syntax IntegerExample passwordMinCategories: 22.
cn=config67Parameter DescriptionExample passwordMinLowers: 12.3.1.135. PasswordMinSpecials (Password Syntax)This attribute sets the minimum number of
Chapter 2. Core Server Configuration Reference68For more information on password policies, see the "Managing Users and Passwords" chapter in
cn=config69Parameter DescriptionExample passwordResetFailureCount: 6002.3.1.141. passwordRetryCountThis attribute counts the number of consecutive fai
Chapter 2. Core Server Configuration Reference70against hackers who try to break into the directory by repeatedly trying to guess a user's passwo
cn=changelog5712.3.2. cn=changelog5Multi-master replication changelog configuration entries are stored under the cn=changelog5 entry.The changelog beh
Chapter 2. Core Server Configuration Reference72Parameter DescriptionValid Values Any valid path to the directory storing thechangelogDefault Value No
cn=changelog5732.3.2.4. changesThis attribute contains the changes made to the entry for add and modify operations in LDIF format.OID 2.16.840.1.11373
Chapter 2. Core Server Configuration Reference74Multi- or Single-Valued Multi-valuedDefined in Changelog Internet Draft2.3.2.9. deleteOldRdnIn the cas
cn=encryption75Multi- or Single-Valued Multi-valuedDefined in Changelog Internet Draft2.3.3. cn=encryptionEncryption related attributes are stored und
ixAbout This ReferenceRed Hat Directory Server (Directory Server) is a powerful and scalable distributed directory serverbased on the industry-standar
Chapter 2. Core Server Configuration Reference76Parameter DescriptionEntry DN cn=encryption, cn=configValid Values on | offDefault Value offSyntax Dir
cn=features77Parameter Description• tls_rsa_export1024_with_des_cbc_shaDefault ValueSyntax DirectoryStringUse the plus (+) symbol to enable or minus (
Chapter 2. Core Server Configuration Reference782.3.5. cn=mapping tree• Configuration attributes for suffixes, replication, and Windows synchronizatio
Replication Attributes under cn=replica, cn="suffixDN", cn=mapping tree, cn=config79Parameter DescriptionExample nsslapd-state: backend2.3.6
Chapter 2. Core Server Configuration Reference802.3.7.2. nsds5DebugReplicaTimeoutThis attribute gives an alternate timeout period to use when the repl
Replication Attributes under cn=replica, cn="suffixDN", cn=mapping tree, cn=config81Each value should be the DN of a local entry on the cons
Chapter 2. Core Server Configuration Reference82Parameter DescriptionEntry DN cn=replica, cn=suffixDN, cn=mapping tree,cn=configValid Values true | fa
Replication Attributes under cn=replica, cn="suffixDN", cn=mapping tree, cn=config83This attribute specifies the interval, in seconds, to pe
Chapter 2. Core Server Configuration Reference84Periodically, the server runs an internal housekeeping operation to purge old updateand state informat
Replication Attributes under cn=ReplicationAgreementName, cn=replica, cn="suffixName", cn=mapping tree, cn=config852.3.7.16. nsds5TaskThis a
Comments to this Manuals