Red Hat 8.1 Directory Server Configuration and Command Reference

Commonly-Used ldapsearch Options

•

•

Persistent Search Options

240

ldapsearch

•

SSL Options

•

Additional ldapsearch Options

•

Syntax ldapsearch -b basedn -s scope [ optional_options ] "(attribute=filter)" [ optional_list_of_attributes ]

For any value that contains a space ( ), the value should be enclosed in double quotation marks. For example:

-b "ou=groups, dc=example,dc=com"

Option optional_options

"(filter)" optional_list_of_attributes

Description

A series of command-line options. These must be specified before the search filter, if used.

An LDAP search filter as described in Directory

Server Administrator's Guide. Do not specify a search filter if search filters are supplied in a file using the -f option.

A list of space-separated attributes that reduce the scope of the attributes returned in the search results. This list of attributes must appear after the search filter. For a usage example, see the

Directory Server Administrator's Guide. If a list of attributes is not specified, the search returns values for all attributes permitted by the access control set in the directory with the exception of operational attributes.

Table 6.2. ldapsearch Syntax

To return operational attributes as a result of a search operation, they must be explicitly specified in the search command. To retrieve regular attributes along with explicitly-specified operational attributes, specify an asterisk (*) in addition to the operational attributes.

Commonly-Used ldapsearch Options

Table 6.3, “Commonly-Used ldapsearch Options”

lists the most commonly used ldapsearch command-line options.

The most common ldapsearch usage specifies the host and port number, bind DN and password, scope, base DN, and a filter that returns every entry under the search base: ldapsearch -b basedn -s sub -h host -p port -D binddn -w password "(objectclass=*)"

241

Chapter 6. Command-Line Utilities

Option

-b

-D

-g

-h

Description

Specifies the starting point for the search. The value specified here must be a distinguished name that currently exists in the database.

This option is optional if the LDAP_BASEDN environment variable has been set to a base DN.

The value specified in this option should be provided in double quotation marks. For example:

-b "cn=Barbara Jensen, ou=Product

Development, dc=example,dc=com"

The root DSE entry is a special entry that contains a list of all the suffixes supported by the local directory. To search this entry, supply a search base of "", a search scope of base, and a filter of "objectclass=*". For example:

-b "" -s base "objectclass=*"

Specifies the distinguished name with which to authenticate to the server. This option is optional if anonymous access is supported by the server. If specified, this value must be a DN recognized by the Directory Server, and it must also have the authority to search for the entries.

For example:

-D "uid=bjensen, dc=example,dc=com"

Specifies that the password policy request control not be sent with the bind request. By default, the new LDAP password policy request control is sent with bind requests.

The ldapsearch tool can parse and display information from the response control if it is returned by a server; that is, the tool will print an appropriate error or warning message when a server sends the password policy response control with the appropriate value.

The criticality of the request control is set to false to ensure that all LDAPv3 servers that do not understand the control can ignore it. To suppress sending of the request control with the bind request, include -g on the command-line.

Specifies the hostname or IP address of the machine on which the Directory Server is

242

-p

-s

Option

-l

-w ldapsearch

Description installed. If a host is not specified, ldapsearch uses the local host. For example:

-h mozilla

Specifies the maximum number of seconds to wait for a search request to complete. For example:

-l 300

Regardless of the value specified here, ldapsearch will never wait longer than is allowed by the server's nsslapd-timelimit attribute, unless the authenticated user is the Directory Manager. The default value for the nsslapd-timelimit attribute is 3600

seconds. See Section 2.3.1.106, “nsslapdtimelimit (Time Limit)” for more information.

Specifies the TCP port number that the Directory

Server uses. For example:

-p 1049

The default is 389. If -Z is used, the default is

636 .

Specifies the scope of the search. The scope can be one of the following:

• base searches only the entry specified in the

-b option or defined by the LDAP_BASEDN environment variable.

• one searches only the immediate children of the entry specified in the -b option. Only the children are searched; the actual entry specified in the -b option is not searched.

• sub searches the entry specified in the - b option and all of its descendants. That is, perform a subtree search starting at the point identified in the -b option. This is the default.

Specifies the password associated with the distinguished name that is specified in the -D option. For example:

-w diner892

If this option is not specified, anonymous access is used.

243

Chapter 6. Command-Line Utilities

Option

-x

-z

Description

If a dash (-) is used as the password value, the utility prompts for the password after the command is entered. This avoids having the password on the command line.

Specifies that the search results are sorted on the server rather than on the client. This is useful to sort according to a matching rule, as with an international search. In general, it is faster to sort on the server rather than on the client.

Specifies the maximum number of entries to return in response to a search request. For example:

-z 1000

Normally, regardless of the value specified here, ldapsearch never returns more entries than the number allowed by the server's nsslapd- sizelimit attribute, unless the authenticated user is the Directory Manager. However, this limitation can be overridden by binding as the root DN when using this commandline argument. This is because binding as the root DN causes this option to default to zero (0). The default value for the nsslapd- sizelimit attribute is 2000 entries. See

Section 2.3.1.103, “nsslapd-sizelimit (Size Limit)”

for more information.

Table 6.3. Commonly-Used ldapsearch Options

Persistent Search Options

A persistent search leaves the search operation open after the initial search results are returned.

This allows the entries returned in the search to remain in cache and updates to be transmitted and included as they occur. Persistent searches leave the ldapsearch open until the client closes the connection. Using persistent searches is described in the "Finding Directory Entries" appendix of the

Administrator's Guide 1 .

ldapsearch -r -C PS:changetype[:changesonly[:entrychgcontrols]] -b dc=example,dc=com

objectclass=*

In the access logs, a persistent search is identifies with the tag options=persistent.

Option

-C

-r

Description

Runs the ldapsearch as a persistent search.

Prints all of the output from the ldapsearch command from the buffer immediately. This

../../ag/persistent-search.html

244

ldapsearch

Option

PS:changetype changesonly entrychgcontrols

Description is useful with the -C for persistent searches because it prints any entry modifications without delay and without the search hanging. It can also be used with other ldapsearches, not only persistent searches.

Specifies which types of changes to entries allow the entry to be returned in the persistent search.

There are four options:

• add

• delete

• modify

• moddn (modrdn)

• all

Sets whether to return all existing entries which match the search filter (0) or only to return matching entries when the entry is modified (1).

The default is 1.

Sets whether to send entry change controls, additional information about the modification made to the entry. If the value is set to 0, then only the entry is returned. If the value is set to 1, then a line is added to the entry as it is returned to the persistent search that lists the changetype performed on the entry. The default is 1.

Table 6.4. Persistent Search Options

SSL Options

The following command-line options can be used to specify that ldapsearch use LDAPS when communicating with an SSL-enabled Directory Server or used for certificate-based authentication.

These options are valid only when LDAPS has been turned on and configured for the Directory Server.

For information on certificate-based authentication and creating a certificate database for use with

LDAP clients, see the "Managing SSL" chapter in the Directory Server Administrator's Guide.

In addition to the standard ldapsearch options such as the base (-b), scope (-s), and filter, the follow options are required to run an ldapsearch command using SSL:

• -p with the Directory Server secure port

• -Z to specify to use SSL (or, alternatively, -ZZ or -ZZZ to specify Start TLS)

• -P to give certificate database's filename and path

• -N to give the SSL certificate name

• -K to specify the private key database's filename and path

• -W to give the password to the private key database

245

Chapter 6. Command-Line Utilities

Option

-3

-I

-K

-m

-N

-P

Description

Specifies that hostnames should be checked in

SSL certificates.

Specifies the SSL key password file that contains the token:password pair.

Specifies the absolute path, including the filename, of the private key database of the client.

The -K option must be specified when the key database has a different name than key3.db or when the key database is not under the same directory as the certificate database, the cert8.db

file (the path which is specified with the -P option).

Specifies the path to the security module database, such as /etc/dirsrv/ slapd-instance_name/secmod.db

. This option only need to be given if the security module database is in a different directory than the certificate database itself.

Specifies the certificate name to use for certificate-based client authentication, such as -

N "Server-Cert" . If this option is specified, then the -Z, -P, and -W options are required.

Also, if this option is specified, then the -D and

-w options must not be specified, or certificatebased authentication will not occur, and the bind operation will use the authentication credentials specified on -D and -w.

Specifies the absolute path, including the option, of the certificate database of the client. This option is used only with the -Z option.

When used on a machine where an SSL-enabled web browser is configured, the path specified on this option can be that of the certificate database for the browser. For example:

-P /security/cert.db

The client security files can also be stored on the Directory Server in the /etc/dirsrv/ slapd-instance_name directory. In this case, the -P option would call out a path and filename similar to the following:

-P /etc/dirsrv/slapd-instance_name/clientcert.db

246

ldapsearch

Option

-Q

-W

-W -

-Z

-ZZ

-ZZZ

Description

Specifies the token and certificate name, which is separated by a semi-colon (:) for PKCS11.

Specifies the password for the private key database identified in the -P option. For example:

-W secret

If a dash (-) is used as the password value, the utility prompts for the password after the command is entered. This avoids having the password on the command line.

Prompts for the password for the token database.

Specifies that SSL is to be used for the search request.

Specifies the Start TLS request. Use this option to make a cleartext connection into a secure one. If the server does not support Start TLS, the command does not have to be aborted; it will continue in cleartext.

Enforces the Start TLS request. The server must respond that the request was successful.

If the server does not support Start TLS, such as Start TLS is not enabled or the certificate information is incorrect, the command is aborted immediately.

Table 6.5. Additional SSL ldapsearch Options

SASL Options

SASL mechanisms can be used to authenticate a user, using the -o the required SASL information.

To learn which SASL mechanisms are supported, search the root DSE. See the -b option in Table 6.3,

Table 6.7, “Description of CRAM-MD5 Mechanism Options”

Option

-o

Description

Specifies SASL options. The format is -o

saslOption=value. saslOption can have one of six values:

• mech, the SASL authentication mechanism

• authid, the user who is binding to the server

(Kerberos principal)

• authzid, a proxy authorization (ignored by the server since proxy authorization is not supported)

247

Chapter 6. Command-Line Utilities

Option Description

• secProp, the security properties

• realm, the Kerberos realm

• flags

The expected values depend on the supported mechanism. The -o can be used multiple times to pass all of the required SASL information for the mechanism. For example:

-o "mech=DIGEST-MD5" -o "authzid=test_user" o "authid=test_user"

Table 6.6. SASL Options

There are three SASL mechanisms supported in Red Hat Directory Server:

• CRAM-MD5, described in

• DIGEST-MD5, described in

Table 6.8, “Description of DIGEST-MD5 SASL Mechanism Options”

• GSSAPI, described in

Table 6.9, “Description of GSSAPI SASL Mechanism Options”

Required or Optional Option

Required mech=CRAM-MD5

Required

Optional authid=authid_value secprop=value

Description

Gives the SASL mechanism.

Gives the ID used to authenticate to the server. authid_value can be the following:

• UID. For example, msmith .

Example

-o “mech=CRAM-MD5”

-o

“authid=dn:uid=jsmith, ou=People, dc=example, dc=com"

• u: uid. For example, u: msmith .

• dn: dn_value. For example, dn: uid=msmith,ou=People,o=example.com

The secprop attribute sets the security properties for the connection. The secprop value can be any of the following:

• None

-o

"secprop=noplain,minssf=1,maxbufsize=512"

• noplain — Do not permit mechanisms susceptible to simple passive attack.

248

Required or Optional Option Description

• noactive — Do not permit mechanisms susceptible to active attacks.

• nodict — Do not permit mechanisms susceptible to passive dictionary attacks.

• forwardsec —

Require forward secrecy.

• passcred — Attempt to pass client credentials.

• noanonymous

— Do not permit mechanisms that allow anonymous access.

• minssf — Require a minimum security strength; this option needs a numeric value specifying bits of encryption. A value of - 1 means integrity is provided without privacy.

• maxssf — Require a maximum security strength; this option needs a numeric value specifying bits of encryption. A value of - 1 means integrity is provided without privacy.

• maxbufsize —

Set the maximum receive buffer size the client will accept

Example ldapsearch

249

Chapter 6. Command-Line Utilities

Required or Optional Option Description when using integrity or privacy settings.

Table 6.7. Description of CRAM-MD5 Mechanism Options

Example

Required or Optional Option

Required mech=DIGEST-MD5

Required authid=authid_value

Optional secprop=value

Description

Gives the SASL mechanism.

Gives the ID used to authenticate to the server. authid_value can be the following:

• UID. For example, msmith .

Example

-o “mech=DIGEST-

MD5”

-o

“authid=dn:uid=msmith,ou=People,o=example.com"

• u: uid. For example, u: msmith .

• dn: dn_value. For example, dn: uid=msmith,ou=People,o=example.com

The secprop attribute sets the security properties for the connection. The secprop value can be any of the following:

• None

-o

“secprop=noplain,noanonymous, maxssf=128,minssf=128”

• noplain — Do not permit mechanisms susceptible to simple passive attack.

• noanonymous

— Do not permit mechanisms that allow anonymous access.

• minssf — Require a minimum security strength; this option needs a numeric value specifying bits of encryption. A value of - 1 means integrity is provided without privacy.

250

ldapsearch

Required or Optional Option Description

• maxssf — Require a maximum security strength; this option needs a numeric value specifying bits of encryption. A value of - 1 means integrity is provided without privacy. The maximum value is

128 .

Table 6.8. Description of DIGEST-MD5 SASL Mechanism Options

Example

Required or Optional Option

Required mech=GSSAPI

Optional secprop=value

Description

Gives the SASL mechanism.

Example

-o “mech=GSSAPI”

NOTE

Have the

Kerberos ticket before issuing a

GSS-

API request.

The secprop attribute sets the security properties for the connection. The secprop value can be any of the following:

• None

• noplain — Do not permit mechanisms susceptible to simple passive attack.

• noanonymous

— Do not permit mechanisms that allow anonymous access.

-o

“secprop=noplain,noanonymous, maxssf=56,minssf=56”

251

Chapter 6. Command-Line Utilities

Required or Optional Option Description

• minssf — Require a minimum security strength; this option needs a numeric value specifying bits of encryption. A value of - 1 means integrity is provided without privacy.

56 .

Table 6.9. Description of GSSAPI SASL Mechanism Options

Example

Additional ldapsearch Options

-B

-c

Option

-1

-A

-a

-E

Description

Leaves out the opening version: 1 line from the LDIF output.

Specifies that the search retrieve the attributes only, not the attribute values. This option is useful to determine if an attribute is present for an entry and the value is not important.

Specifies how alias dereferencing is completed.

Values can be never, always, search, or find . The default value is never.

Print non-ASCII values using the old output format (attrName=attrValue).

Specifies the getEffectiveRights control authzid . For example: dn:uid=bjensen,dc=example,dc=com

A value of "" means the authorization ID for the operation. A value of dn: means anonymous

Reports the bind identity used for the search.

252

Option

-e

-F

-f

-G

-H

-i ldapsearch

Description

Minimizes the base-64 encoding for the values of returned entries.

Specifies a different separator. This option allows a separator other than a colon (:) to separate an attribute name from the corresponding value. For example:

-F +

Specifies the file containing the search filters to be used in the search. For example:

-f search_filters option to supply a search filter directly to the command line.

For more information about search filters, see

Appendix B, "Finding Directory Entries", in the

Directory Server Administrator's Guide.

Conducts a virtual list view search. This option can set the number of entries before or after the search target and the index or value of the first entry returned.

For example, a value operation that sorts by surname, -G 20:30:johnson, returns the first entry with a surname equal to or less than johnson , in addition to 20 entries that come before it and 30 entries that come after it. If there are fewer matching entries in the directory than the before or after number requested by the search, all available entries before/after the search target that match the search criteria are returned.

An index operation which sorts by surname, -

G 20:30:100:0 , returns from the 80th through

130th entries sorted by sn. Use 0 as the fourth value for the count number unless you know how many entries the VLV index has.

Prints the help information.

Specifies the characterset to use for commandline input. The default is the characterset specified in the LANG environment variable. Use this option to perform the conversion from the specified characterset to UTF8, thus overriding the environment variable setting.

253

-n

-O

Chapter 6. Command-Line Utilities

Option

-J

-j filename

-k

-M

Description

This argument can input the bind DN, base DN, and the search filter pattern in the specified characterset.

ldapsearch converts the input from these arguments before it processes the search request. For example, -i no indicates that the bind DN, base DN, and search filter are provided in Norwegian. This argument only affects the command-line input; that is, if a file containing a search filter (with the -f option) is specified, ldapsearch will not convert the data in the file.

Send an arbitrary control. This option can be used in the following format to retrieve access control information on a specific entry:

-J control OID:boolean criticality:dn:AuthID

• control OID is the OID for the get effective rights control,

1.3.6.1.4.1.42.2.27.9.5.2

• boolean criticality specifies whether the search operation should return an error if the server does not support this control (true) or if it should be ignored and let the search return as normal (false).

• AuthId is the DN of the user whose rights to check.

Contains the name of a file containing the password for the bind DN.

Bypasses converting the password to UTF8.

Manages smart referrals. This causes the server not to return the smart referral contained on the entry but, instead, to return the actual entry containing the referral. Use this option to search for entries that contain smart referrals. For more information about smart referrals, see the

"Configuring Directory Databases" chapter in the

Directory Server Administrator's Guide.

Specifies that the search is not actually to be performed, but that ldapsearch is to show what it would do with the specified input.

Specifies the maximum number of referral hops ldapsearch should automatically follow. For example:

254

-U

-u

-V

-T

-t

-v

-w -

-Y

Option

-R

-S ldapsearch

Description

-O 2

Specifies that referrals are not to be followed automatically. By default, referrals are followed automatically.

Specifies the attribute to use as the sort criteria.

For example:

-S sn

Use multiple -S arguments to further define the sort order. In the following example, the search results will be sorted first by surname and then by given name:

-S sn -S givenname

The default is not to sort the returned entries.

Specifies that no line breaks should be used within individual values in the search results.

Specifies that the results be written to a set of temporary files. With this option, each attribute value is placed in a separate file within the system temporary directory. No base-64 encoding is performed on the values, regardless of the content.

Creates file URLs for the files produced by the - t option.

Specifies that the user-friendly form of the distinguished name be used in the output.

Specifies the LDAP version number to be used on the search. For example:

-V 2

LDAPv3 is the default. An LDAPv3 search cannot be performed against a Directory Server that only supports LDAPv2.

Specifies that the utility is to run in verbose mode.

Prompts for the password for the bind DN.

Specifies the proxy DN to use for the search. This argument is provided for testing purposes. For more information about proxied authorization, see the "Managing Access

Control" chapter in the Directory Server

Administrator's Guide.

255

Chapter 6. Command-Line Utilities

Option

-X

Description

Specifies the getEffectiveRights control specific attribute list, where attributes are separated by spaces. For example:

"nsroledn userPassword"

Table 6.10. Additional ldapsearch Options

6.5. ldapmodify

ldapmodify makes changes to directory entries via LDAP.

•

Commonly-Used ldapmodify Options

•

•

SSL Options

•

Additional ldapmodify Options

•

Syntax ldapmodify optional_options ldapmodify [ -D binddn ] [ -w passwd ] [ -acmnrvFR ] [ -d debug_level ] [ -h host ] [ -p port ] [ -

M auth_mechanism ] [ -Z/ZZ/ZZZ ] [ -V version ] [ -f file ] [ -l number_of_ldap_connections ]

[ entryfile ]

Commonly-Used ldapmodify Options

Option

-a

-B

-D

Description

Adds LDIF entries to the directory without requiring the changetype:add LDIF update statement. This provides a simplified method of adding entries to the directory. This option also allows directly adding a file created by ldapmodify .

Specifies the suffix under which the new entries will be added.

Specifies the distinguished name with which to authenticate to the server. The value must be a DN recognized by the Directory Server, and it must also have the authority to modify the entries. For example:

256

Option

-f

-g

-h

-p

-q ldapmodify

Description

-D "uid=bjensen, dc=example,dc=com"

This option cannot be used with the -N option.

Option that specifies the file containing the LDIF update statements used to define the directory modifications. For example:

-f modify_statements

If this option is not supplied, the update statements are read from stdin.

For information on supplying LDIF update statements from the command-line, see the

"Creating Directory Entries" chapter in the

Directory Server Administrator's Guide.

Specifies that the password policy request control not be sent with the bind request.

By default, the new LDAP password policy request control is sent with bind requests.

The ldapmodify tool can parse and display information from the response control if it is returned by a server; that is, the tool will print an appropriate error or warning message when a server sends the password policy response control with an appropriate value. The criticality of the request control is set to false to ensure that all LDAPv3 servers that do not understand the control can ignore it. To suppress sending of the request control with the bind request, include

-g on the command-line.

Specifies the name of the host on which the server is running. For example:

-h cyclops

Specifies the port number that the server uses.

For example:

-p 1049

The default is 389. If -Z is used, the default is

636 .

Causes each add to be performed silently as opposed to being echoed to the screen individually.

257

Chapter 6. Command-Line Utilities

Option

-w

Table 6.11. Commonly-Used ldapmodify Options

Description

Specifies the password associated with the distinguished name specified in the -D option.

For example:

-w mypassword

If a dash (-) is used as the password value, the utility prompts for the password after the command is entered. This avoids having the password on the command line.

SSL Options

Use the following command-line options to specify that ldapmodify is to use LDAP over SSL

(LDAPS) when communicating with the Directory Server. LDAPS encrypts data during transit. Also, use these options for certificate-based authentication. These options are valid only when SSL has been turned on and configured for the Directory Server. For more information on certificate-based authentication and on creating a certificate database for use with LDAP clients, see the "Managing

SSL" chapter in the Directory Server Administrator's Guide.

Ensure that the Directory Server's encrypted port is specified when using these options.

Option

-3

-I

-K

-N

Description

Specifies that hostnames should be checked in

SSL certificates.

Specifies the SSL key password file that contains the token:password pair.

Specifies the path, including the filename, of the private key database of the client. Either the absolute or relative (to the server root) path can be specified. The -K option must be used when the key database has a different name than key3.db

or when the key database is not under the same directory as the certificate database, the cert8.db file (the path for which is specified with the -P option).

Specifies the certificate name to use for certificate-based client authentication. For example:

-N Server-Cert

If this option is specified, then the -Z and -

W options are required. Also, if this option is specified, then the -D and -w options must not be specified, or certificate-based authentication will not occur, and the bind operation will use the

258

ldapmodify

Option

-P

-Q

-W

-Z

-ZZ

-ZZZ

Description authentication credentials specified on -D and - w .

Specifies the absolute path, including the filename, of the certificate database of the client.

This option is used only with the -Z option. When used on a machine where an SSL-enabled web browser is configured, the path specified on this option can be pointed to the certificate database for the web browser. For example:

-P /security/cert.db

The client security files can be stored on the Directory Server in the /etc/dirsrv/ slapd-instance_name directory. In this case, the -P option calls out a path and filename similar to the following:

-P /etc/dirsrv/slapd-instance_name/clientcert.db

Specifies the token and certificate name, which is separated by a semicolon (:) for PKCS11.

Specifies the password for the certificate database identified on the -P option. For example:

-W serverpassword

Specifies that SSL is to be used for the directory request.

Specifies the Start TLS request. Use this option to make a cleartext connection into a secure one. If the server does not support Start TLS, the command does not need aborted; it will continue in cleartext.

Enforces the Start TLS request. The server must respond that the request was successful.

If the server does not support Start TLS, such as Start TLS is not enabled or the certificate information is incorrect, the command is aborted immediately.

Table 6.12. ldapmodify SSL Options

SASL Options

SASL mechanisms can be used to authenticate a user, using the -o the required SASL information.

To learn which SASL mechanisms are supported, search the root DSE. See the -b option in Table 6.3,

SASL Options for ldapsearch for information on how to use SASL options with ldapmodify.

259

Chapter 6. Command-Line Utilities

Option

-o

Description

Specifies SASL options. The format is -o

saslOption=value. saslOption can have one of six values:

• mech, the SASL authentication mechanism

• authid, the user who is binding to the server

(Kerberos principal)

• authzid, a proxy authorization (ignored by the server since proxy authorization is not supported)

• secProp, the security properties

• realm, the Kerberos realm

• flags

The expected values depend on the supported mechanism. The -o can be used multiple times to pass all of the required SASL information for the mechanism. For example:

-o "mech=DIGEST-MD5" -o "authzid=test_user" o "authid=test_user"

Table 6.13. SASL Options

See

Additional ldapmodify Options

Option

-b

Description

Causes the utility to check every attribute value to determine whether the value is a valid file reference. If the value is a valid file reference, then the content of the referenced file is used as the attribute value. This is often used for specifying a path to a file containing binary data, such as JPEG.

For example, to add a jpegPhoto attribute, specify the -b option on the ldapmodify call. In the LDIF provided to ldapmodify, include a line like the following: jpegPhoto: /tmp/photo.jpeg

260

-c

-H

-M

-n

-O

Option ldapmodify

Description ldapmodify reads the contents of the photo.jpeg

file into the jpegPhoto attribute being added to the entry.

As an alternative to the -b option, use the :<

URL specifier notation, which is simpler. For example: jpegphoto:< file:///tmp/myphoto.jpg

Although the official notation requires three ///, the use of one / is accepted.

NOTE

The :< URL specifier notation only works if LDIF statement is version 1 or later, meaning version: 1 is inserted in the LDIF file. Otherwise, the file URL is appended as the attribute value rather than the contents of the file.

For further information on the LDIF format, see the "Managing Directory Entries" chapter in the

Directory Server Administrator's Guide.

Specifies that the utility run in continuous operation mode. Errors are reported, but the utility continues with modifications. The default is to quit after reporting an error.

Lists all available ldapmodify options.

Manages smart referrals. This causes the server not to return the smart referral contained on the entry but, instead, to apply the modification request directly to the entry. Use this option to add, change, or delete a directory entry that contains a smart referral. For more information about smart referrals, see the "Configuring

Directory Databases" chapter in the Directory

Server Administrator's Guide.

Specifies that the entries are not actually to be modified but that ldapmodify is to show what it would do with the specified input.

Specifies the maximum number of referral hops to follow. For example:

261

Chapter 6. Command-Line Utilities

Option

-R

-v

-V

-Y

Description

-O 2

Specifies that referrals are not to be followed automatically.

Specifies that the utility is to run in verbose mode.

Specifies the LDAP version number to be used on the operation. For example:

-V 2

LDAPv3 is the default. An LDAPv3 operation cannot be performed against a Directory Server that only supports LDAPv2.

Specifies the proxy DN to use for the modify operation. This argument is provided for testing purposes. For more information about proxied authorization, see the "Managing

Access Control" chapter in the Directory Server

Administrator's Guide.

Table 6.14. Additional ldapmodify Options

6.6. ldapdelete

ldapdelete performs delete operations on directory entries via LDAP.

•

Commonly-Used ldapdelete Options

•

•

SSL Options

•

Additional ldapdelete Options

•

Syntax ldapdelete [ optional_options ]

Commonly-Used ldapdelete Options

Option

-D

Description

Specifies the distinguished name with which to authenticate to the server. The value must be a DN recognized by the Directory Server, and it must also have the authority to delete the entries. For example:

262

ldapdelete

Option dn

-g

-h

-p

-w

Table 6.15. Commonly-Used ldapdelete Options

Description

-D "uid=bjensen, dc=example,dc=com"

For more information on access control, see the "Managing Access Control" chapter in the

Directory Server Administrator's Guide. The -D option cannot be used with the -N option.

Specifies the dn of the entry to delete.

Specifies that the password policy request control not be sent with the bind request.

By default, the new LDAP password policy request control is sent with bind requests.

The ldapdelete tool can parse and display information from the response control if it is returned by a server; that is, the tool will print an appropriate error or warning message when a server sends the password policy response control with the appropriate value. The criticality of the request control is set to false to ensure that all LDAPv3 servers that do not understand the control can ignore it. To suppress sending of the request control with the bind request, include

-g on the command-line.

Specifies the name of the host on which the server is running. For example:

-h cyclops

The default is localhost.

Specifies the port number that the server uses.

The default is 389. If -Z is used, the default is

636 .

Specifies the password associated with the distinguished name specified in the -D option.

For example:

-w mypassword

The default is "", or anonymous. If a password is not sent on the command line and the server requires one, the command prompts for one.

It is more secure not to provide a password on the command line so that it does not show up in clear text in a listing of commands.

263

Chapter 6. Command-Line Utilities

SSL Options

Use the following options to specify that ldapdelete use LDAPS when communicating with the

Directory Server or to use certificate-based authentication. These options are valid only when LDAPS has been turned on and configured for the Directory Server. For more information on certificate-based authentication and how to create a certificate database for use with LDAP clients, see the "Managing

SSL" and "Managing SASL" chapters in the Directory Server Administrator's Guide.

Ensure that the Directory Server's encrypted port is set when using these options.

Option

-3

-I

-K

-N

Description

Specifies that hostnames should be checked in

SSL certificates.

Specifies the SSL key password file that contains the token:password pair.

Specifies the path, including the filename, of the private key database of the client. Either the absolute or relative (to the server root) path can be used. The -K option must be used when the key database has a different name than key3.db

or when the key database is not under the same directory as the certificate database, the cert8.db file (the path for which is specified with the -P option).

Specifies the certificate name to use for certificate-based client authentication. For example:

-P

-N Server-Cert

If this option is specified, then the -Z and -

W options are required. Also, if this option is specified, then the -D and -w options must not be specified, or certificate-based authentication will not occur, and the bind operation will use the authentication credentials specified on -D and - w .

Specifies the absolute path, including the filename, of the certificate database of the client.

This option is used only with the -Z option.

When used on a machine where an SSL-enabled web browser is configured, the path specified on this option can be pointed to the certificate database for the web browser. For example:

-P /security/cert.db

The client security files can be stored on the Directory Server in the /etc/dirsrv/ slapd-instance_name directory. In this case,

264

ldapdelete

Option

-Q

-W

-Z

-ZZ

-ZZZ

Description the -P option calls out a path and filename similar to the following:

-P /etc/dirsrv/slapd-instance_name/clientcert.db

Specifies the token and certificate name, which is separated by a semicolon (:) for PKCS11.

Specifies the password for the certificate database identified on the -P option. For example:

-W serverpassword

Specifies that SSL is to be used for the delete request.

Specifies the Start TLS request. Use this option to make a cleartext connection into a secure one. If the server does not support Start TLS, the command does not need to be aborted; it will continue in plain text.

Enforces the Start TLS request. The server must respond that the request was successful.

If the server does not support Start TLS, such as Start TLS is not enabled or the certificate information is incorrect, the command is aborted immediately.

Table 6.16. ldapdelete SSL Options

SASL Options

SASL mechanisms can be used to authenticate a user, using the -o the required SASL information.

To learn which SASL mechanisms are supported, search the root DSE. See the -b option in Table 6.3,

SASL Options for ldapsearch for information on how to use SASL options with ldapdelete.

Option

-o

Description

Specifies SASL options. The format is -o

saslOption=value. saslOption can have one of six values:

• mech, the SASL authentication mechanism

• authid, the user who is binding to the server

(Kerberos principal)

• authzid, a proxy authorization (ignored by the server since proxy authorization is not supported)

• secProp, the security properties

265

Chapter 6. Command-Line Utilities

Option Description

• realm, the Kerberos realm

• flags

The expected values depend on the supported mechanism. The -o can be used multiple times to pass all of the required SASL information for the mechanism. For example:

-o "mech=DIGEST-MD5" -o "authzid=test_user" o "authid=test_user"

Table 6.17. SASL Options

See

Additional ldapdelete Options

Option

-c

-f

-H

-M

-n

-O

Description

Specifies that the utility must run in continuous operation mode. Errors are reported, but the utility continues with deletions. The default is to quit after reporting an error.

Specifies the file containing the distinguished names of entries to be deleted. For example:

-f modify_statements

Omit this option to supply the distinguished name of the entry to be deleted directly to the command-line.

Lists all available ldapdelete options.

Manages smart referrals. This causes the server not to return the smart referral contained on the entry but, instead, to delete the actual entry containing the smart referral. For more information about smart referrals, see the

"Configuring Directory Databases" chapter in the

Directory Server Administrator's Guide.

Specifies that the entries are not actually to be deleted, but that ldapdelete is to show what it would do with the specified input.

Specifies the maximum number of referral hops to follow. For example:

-O 2

There is no maximum number of referral hops.

266

ldappasswd

Option

-R

-v

-V

-Y

Description

Specifies that referrals are not to be followed automatically. By default, the server follows referrals.

Specifies that the utility is to run in verbose mode.

Specifies the LDAP version number to be used on the operation. For example:

-V 2

LDAPv3 is the default. An LDAPv3 operation cannot be performed against a Directory Server that only supports LDAPv2.

Specifies the proxy DN to use for the delete operation. This argument is provided for testing purposes. For more information about proxied authorization, see the "Managing

Access Control" chapter in the Directory Server

Administrator's Guide.

Table 6.18. Additional ldapdelete Options

6.7. ldappasswd

Use ldappasswd to set or change user passwords in Directory Server.

•

ldappasswd-specific Options

•

•

General ldappasswd Options

•

To learn which SASL mechanisms are supported, search the root DSE. See the -b option in Table 6.3,

•

Examples

Syntax ldappasswd [ options ] [ user ]

user is the authentication identity, typically a DN. If not specified, the distinguished name specified by the -D option (bind name) is used.

ldappasswd-specific Options

Option

-A

Description

Specifies that the command should prompt for the user's existing password.

267

Chapter 6. Command-Line Utilities

Option

-a

-S

-s

-T

-t

-w

Description

Specifies the user's existing password. For example:

-a old_password

Specifies that the command should prompt for a new password for the user.

Specifies a new password for the user. For example:

-S new_password

Specifies a file from which to read the new password. For example:

-T new_password.txt

Specifies a file from which to read the user's existing password. For example:

-t old_password.txt

Specifies the password associated with the distinguished name specified in the -D option.

For example:

-w mypassword

Table 6.19. ldappasswd-specific Options

General ldappasswd Options

NOTE

The ldappasswd utility requires confidentiality. If the messages are not encrypted with SSL, TLS, or an appropriate SASL mechanism, the server will not perform the request.

Option

-3

-D

Description

Specifies that hostnames should be checked in

SSL certificates.

Specifies the distinguished name with which to authenticate to the server. This value must be a DN recognized by the Directory Server, and it must also have the authority to delete the entries. For example:

-D "uid=bjensen, dc=example,dc=com"

268

-h

-I

-K

-N

Option

-g ldappasswd

Description

The -D option cannot be used with the -N option.

For more information on access control, see the "Managing Access Control" chapter in the

Directory Server Administrator's Guide.

Specifies that the password policy request control not be sent with the bind request. By default, the new LDAP password policy request control is sent with bind requests.

The ldappasswd tool can parse and display information from the response control if it is returned by a server; that is, the tool will print an appropriate error or warning message when a server sends the password policy response control with the appropriate value.

Specifies the name of the host on which the server is running. For example:

-h cyclops

The default is localhost.

Specifies the SSL key password file that contains the token:password pair.

Specifies the path, including the filename, of the private key database of the client. This can be the absolute or relative (to the server root) path.

The -K option must be used when the key database is not called key3.db or when the key database is not in the same directory as the certificate database (that is, the cert8.db file, the path for which is specified with the -P option).

Specifies the certificate name to use for certificate-based client authentication. For example:

-N Server-Cert

If this option is specified, then the -Z and -W options are required.

269

-p

-Q

-W

-w

Chapter 6. Command-Line Utilities

Option

-P

Description

If this option is specified, then the -D and -w options must not be specified, or certificatebased authentication will not occur, and the bind operation will use the authentication credentials specified by -D and -w.

Specifies the absolute path, including the filename, of the certificate database of the client.

This option is used only with the -Z option.

When used on a machine where an SSL-enabled web browser is configured, the path specified on this option can be that of the certificate database for the browser. For example:

-P /security/cert.db

-P /etc/dirsrv/slapd-instance_name/clientcert.db

Specifies the port number that the server uses.

The default is 389. If -Z is used, the default is

636 .

Specifies the token and certificate name, which is separated by a semicolon (:) for PKCS11.

Specifies the password for the certificate database identified on the -P option. For example:

-W serverpassword

Specifies the password associated with the distinguished name that is specified in the -D option. For example:

-w diner892

The default is "", or anonymous.

If a password is not sent on the command line and the server requires one, the command prompts for one. It is more secure not to provide a password on the command-line so that it does not show up in clear text in a listing of commands.

270

ldappasswd

Option

-Z

-ZZ

-ZZZ

Description

Specifies that SSL is to be used for the search request.

Enforces the Start TLS request. The server must respond that the request was successful.

If the server does not support Start TLS, such as Start TLS is not enabled or the certificate information is incorrect, the command is aborted immediately.

Table 6.20. General ldappasswd Options

SASL Options

SASL mechanisms can be used to authenticate a user, using the -o the required SASL information.

SASL Options for ldapsearch for information on how to use SASL options with ldappasswd.

Option

-o

Description

Specifies SASL options. The format is -o

saslOption=value. saslOption can have one of six values:

• mech, the SASL authentication mechanism

• authid, the user who is binding to the server

(Kerberos principal)

• authzid, a proxy authorization (ignored by the server since proxy authorization is not supported)

• secProp, the security properties

• realm, the Kerberos realm

• flags

The expected values depend on the supported mechanism. The -o can be used multiple times to pass all of the required SASL information for the mechanism. For example:

-o "mech=DIGEST-MD5" -o "authzid=test_user" o "authid=test_user"

Table 6.21. SASL Options

See

271

Chapter 6. Command-Line Utilities

Examples

The following examples provide show how to perform various tasks using the ldappasswd command.

The Directory Manager changes the password of the user uid=tuser1,ou=People,dc=example,dc=com to new_password over SSL.

ldappasswd -Z -h myhost -P /etc/dirsrv/slapd-instance_name/cert8.db -D "cn=Directory Manager"

-w admpassword -s new_password "uid=tuser1,ou=People,dc=example,dc=com"

Example 6.1. Directory Manager Changing a User's Password Over SSL

The Directory Manager generates the password of the user uid=tuser2,ou=People,dc=example,dc=com over SSL.

ldappasswd -Z -h myhost -P /etc/dirsrv/slapd-instance_name/cert8.db -D "cn=Directory Manager"

-w admpassword "uid=tuser2,ou=People,dc=example,dc=com"

Example 6.2. Directory Manager Generating a User's Password

NOTE

For more information on newly-generated passwords, see the "Managing the

Password Policy" section of the Directory Server Administrator's Guide.

A user, tuser3, changes the password from old_newpassword to new_password over SSL.

ldappasswd -Z -h myhost -P /etc/dirsrv/slapd-instance_name/cert8.db -D

"uid=tuser3,ou=People,dc=example,dc=com"

-w old_password -a old_password -s new_password

Example 6.3. User Changing His Own Password

A user, tuser4, authenticates with the user certificate and changes the password to new_password over SSL.

ldappasswd -Z -h myhost -P /etc/dirsrv/slapd-instance_name/cert8.db -W dbpassword -N

"uid=tuser4"

-K /etc/dirsrv/slapd-instance_name/key3.db -s new_password

Example 6.4. User Authenticating With a User Certificate and Changing His Password

A user, tuser5, authenticates with DIGEST-MD5 and changes the password to new_password.

ldappasswd -h myhost -o “mech=DIGEST-MD5” -o

“authid=dn:uid=tuser5,ou=People,dc=example,dc=com”

-w old_password -s new_password

Example 6.5. User Authenticating with DIGEST_MD5 and Changing His Password

A user, who has already authenticated by Kerberos, prompts for the new password. This is not performed over SSL.

272

ldif ldappasswd -h myhost -o "mech=GSSAPI" -S

Example 6.6. User Already Authenticating by Kerberos Prompts for a New Password

6.8. ldif

ldif automatically formats LDIF files and creates base-64 encoded attribute values. Base-64 encoding makes it possible to represent binary data, such as a JPEG image, in LDIF. Base-64 encoded data is represented using a double colon (::) symbol. For example: jpegPhoto:: encoded data

In addition to binary data, other values that must be base-64 encoded can identified with other symbols, including the following:

• Any value that begins with a space.

• Any value that begins with a single colon (:).

• Any value that contains non-ASCII data, including newlines.

The ldif command-line utility will take any input and format it with the correct line continuation and appropriate attribute information. The ldif utility also senses whether the input requires base-64 encoding.

•

Section 4.4, “Database Files”

•

Options

Syntax

The ldif command has the following format: ldif [ -b ] [ attrtypes ] [ optional_options ]

Options

Option

-b

Description

Specifies that the ldif utility should interpret the entire input as a single binary value. If -b is not present, each line is considered to be a separate input value.

As an alternative to the -b option, use the :<

URL specifier notation. For example: jpegphoto:< file:///tmp/myphoto.jpg

Although the official notation requires three ///, the use of one / is accepted.

273

Chapter 6. Command-Line Utilities

Option Description

NOTE

Table 6.22. ldif Options

6.9. dbscan

The dbscan tool analyzes and extracts information from a Directory Server database file. See

for more information on database files.

Database files use the .db2, .db3, and .db4 extensions in their filename, depending on the version of Directory Server.

•

The options listed in Table 6.24, “Entry File Options”

•

Options

Syntax dbscan -f filename [ options ]

Options

Option

-f

Parameter filename

-R

-t

Table 6.23. Common Options size

Description

Specifies the name of the database file, the contents of which are to be analyzed and extracted. This option is required.

Dump the database as raw data.

Specifies the entry truncate size (in bytes).

NOTE

are meaningful only when the database file is id2entry.db4.

274

dbscan

Option

-K

Table 6.24. Entry File Options

Parameter entry_id

Description

Specifies the entry to ID to look up.

NOTE

The index file options, listed in

Table 6.25, “Index File Options ”

, are meaningful only when the database file is the secondary index file.

Option

-k

-l

-G

-n

-r

-s

Table 6.25. Index File Options

Parameter key size n

Description

Specifies the key to look up in the secondary index file.

Sets the maximum length of the dumped ID list. The valid range is from 40 to 1048576 bytes.

The default value is 4096.

Sets only to display those index entries with ID lists exceeding the specified length.

Sets only to display the length of the ID list.

Sets to display the contents of the ID list.

Gives the summary of index counts.

Examples

The following are command-line examples of different situations using dbscan to examine the

Directory Server databases.

dbscan -f /var/lib/dirsrv/slapd-instance_name/db/userRoot/id2entry.db4

Example 6.7. Dumping the Entry File dbscan -f /var/lib/dirsrv/slapd-instance_name/db/userRoot/cn.db4

Example 6.8. Displaying the Index Keys in cn.db4

dbscan -r -f /var/lib/dirsrv/slapd-instance_name/db/userRoot/mail.db4

Example 6.9. Displaying the Index Keys and the Count of Entries with the Key in mail.db4

dbscan -r -G 20 -f /var/lib/dirsrv/slapd-instance_name/db/userRoot/sn.db4

Example 6.10. Displaying the Index Keys and the All IDs with More Than 20 IDs in sn.db4

275

Chapter 6. Command-Line Utilities dbscan -s -f /var/lib/dirsrv/slapd-instance_name/db/userRoot/objectclass.db4

Example 6.11. Displaying the Summary of objectclass.db4

dbscan -r -f /var/lib/dirsrv/slapd-instance_name/db/userRoot/ vlv#bymccoupeopledcpeopledccom.db4

Example 6.12. Displaying VLV Index File Contents dbscan -f /var/lib/dirsrv/slapd-instance_name/changelogdb/c1a2fc02-1d11b2-8018afa7fdce000_424c8a000f00.db4

Example 6.13. Displaying the Changelog File Contents dbscan -R -f /var/lib/dirsrv/slapd-instance_name/db/userRoot/uid.db4

Example 6.14. Dumping the Index File uid.db4 with Raw Mode

In this example, the common name key is =hr managers, and the equals sign (=) means the key is an equality index.

dbscan -k "=hr managers" -r -f /var/lib/dirsrv/slapd-instance_name/db/userRoot/cn.db4 =hr

%20managers 7

Example 6.15. Displaying the entryID with the Common Name Key "=hr managers" dbscan -K 7 -f id2entry.db4 id 7 dn: cn=HR Managers,ou=groups,dc=example,dc=com objectClass: top objectClass: groupOfUniqueNames cn: HR Manager ou: groups description: People who can manage HR entries creatorsName: cn=directory manager modifiersName: cn=directory manager createTimestamp: 20050408230424Z modifyTimestamp: 20050408230424Z nsUniqueId: 8b465f73-1dd211b2-807fd340-d7f40000 parentid: 3 entryid: 7 entrydn: cn=hr managers,ou=groups,dc=example,dc=com

Example 6.16. Displaying an Entry with the entry ID of 7

276

Shell Script bak2db db2bak db2ldif db2index dbverify ldif2db ldif2ldap monitor restart-slapd restoreconfig saveconfig

Chapter 7.

Command-Line Scripts

This chapter provides information on the scripts for managing Red Hat Directory Server, such as backing-up and restoring the database. Scripts are a shortcut way of executing the ns-slapd

interface commands that are documented in Appendix A, Using the ns-slapd Command-Line Utilities .

7.1. Finding and Executing Command-Line Scripts

Most Directory Server-related scripts are located in the /usr/lib/dirsrv/ slapd-instance_name directory for Red Hat Enterprise Linux 5 (32-bit) (and in /usr/lib64/ dirsrv/slapd-instance_name on Red Hat Enterprise Linux 64-bit systems). A few are located in the /usr/bin directory. The exact locations are listed in

Section 7.2, “Command-Line Scripts Quick

Reference” .

When scripts request either a directory name or a filename, always provide the absolute path.

The scripts assume the dse.ldif file is located in the /etc/dirsrv/slapd-instance_name directory.

7.2. Command-Line Scripts Quick Reference

The following shell and Perl scripts are located in either the /usr/lib/dirsrv/ slapd-instance_name (for 32-bit Red Hat Enterprise Linux) or /usr/lib64/dirsrv/ slapd-instance_name (for 64-bit Red Hat Enterprise Linux) directory.

Description

Restores the database from the most recent archived backup.

Creates a backup of the current database contents.

Exports the contents of the database to LDIF.

Reindexes the database index files.

Checks backend database files.

Imports LDIF files to the database. Runs the ns-slapd command-line utility with the ldif2db keyword.

Performs an import operation over LDAP to the

Directory Server.

Retrieves performance monitoring information using the ldapsearch command-line utility.

Restarts Directory Server.

Restores by default the most recently saved

Administration Server configuration to

NetscapeRoot partition.

Saves Administration Server configuration stored in the NetscapeRoot database to the /var/

277

Chapter 7. Command-Line Scripts

Shell Script Description lib/dirsrv/slapd-instance_name/bak directory.

Starts Directory Server.

start-slapd stop-slapd suffix2instance

Stops Directory Server.

Maps a suffix to a backend name.

verify-db.pl

Checks backend database files.

vlvindex Creates and generates virtual list view (VLV) indexes.

Table 7.1. Shell Scripts in /usr/lib/dirsrv/slapd-instance_name or /usr/lib64/dirsrv/ slapd-instance_name

Perl Script bak2db.pl

db2bak.pl

Description

Restores the database from the most recent archived backup.

Creates a backup of the current database contents.

Creates and regenerates indexes.

db2index.pl

db2ldif.pl

fixup-memberof.pl

ldif2db.pl

ns-accountstatus.pl

ns-activate.pl

Exports the contents of the database to LDIF.

Regenerates the memberOf on user entries to reflect changes in group membership.

Imports LDIF files to a database and runs the ns-slapd command-line utility with the ldif2db keyword.

Provides account status information to establish whether an entry or group of entries is locked.

Activates an entry or a group of entries by unlocking them.

Deactivates an entry or a group of entries.

ns-inactivate.pl

ns-newpwpolicy.pl

schema-reload.pl

Adds relevant entries required for the finegrained (user- and subtree-level) password policy.

Reloads schema dynamically into the server instance.

verify-db.pl

Checks backend database files.

Table 7.2. Perl Scripts in /usr/lib/dirsrv/slapd-instance_name or /usr/lib64/dirsrv/ slapd-instance_name

Script Name cl-dump

Description

Dumps and decodes the changelog.

Perl or Shell Script

Shell

278

Script Name cl-dump.pl

ds_removal logconv.pl

migrate-ds-admin.pl

pwdhash register-ds-admin.pl

remove-ds.pl

repl-monitor repl-monitor.pl

setup-ds.pl

setup-ds-admin.pl

Description

Dumps and decodes the changelog.

Removes a server instance.

Analyzes the access logs of a Directory Server to extract usage statistics and count the occurrences of significant events.

Migrates a Directory Server 7.1

instance to Directory Server

8.1.

Prints the encrypted form of a password using one of the server's encryption algorithms.

If a user cannot log in, use this script to compare the user's password to the password stored in the directory.

Re-registers a Directory

Server instance with the local

Administration Server.

Removes a Directory Server instance.

Provides in-progress status of replication.

Creates or recreates a

Directory Server instance.

Creates a new Directory

Server instance and local

Administration Server instance.

Perl or Shell Script

Perl

Shell

Perl

Shell

Perl

Shell

Perl

Table 7.3. Scripts in /usr/bin

7.3. Shell Scripts

This section covers the following scripts:

•

Section 7.3.1, “bak2db (Restores a Database from Backup)”

•

Section 7.3.2, “cl-dump (Dumps and Decodes the Changelog)”

•

Section 7.3.3, “db2bak (Creates a Backup of a Database)”

•

Section 7.3.4, “db2ldif (Exports Database Contents to LDIF)”

•

Section 7.3.5, “db2index (Reindexes Database Index Files)”

Shell Scripts

279

Chapter 7. Command-Line Scripts

•

Section 7.3.6, “dbverify (Checks for Corrupt Databases)”

•

Section 7.3.7, “ds_removal”

•

Section 7.3.8, “ldif2db (Import)”

•

Section 7.3.9, “ldif2ldap (Performs Import Operation over LDAP)”

•

Section 7.3.10, “monitor (Retrieves Monitoring Information)”

•

Section 7.3.12, “pwdhash (Prints Encrypted Passwords)”

•

Section 7.3.11, “repl-monitor (Monitors Replication Status)”

•

Section 7.3.13, “restart-slapd (Restarts the Directory Server)”

•

Section 7.3.14, “restoreconfig (Restores Administration Server Configuration)”

•

Section 7.3.15, “saveconfig (Saves Administration Server Configuration)”

•

Section 7.3.16, “start-slapd (Starts the Directory Server)”

•

Section 7.3.17, “stop-slapd (Stops the Directory Server)”

•

Section 7.3.18, “suffix2instance (Maps a Suffix to a Backend Name)”

•

Section 7.3.19, “vlvindex (Creates Virtual List View Indexes)”

Some of the shell scripts can be executed while the server is running. For others, the server must be stopped. The description of each script below indicates whether the server must be stopped or if it can continue to run while executing the script.

When a shell script has a Perl equivalent, there is a cross-reference to the section describing the equivalent Perl script.

7.3.1. bak2db (Restores a Database from Backup)

Restores the database from the most recent archived backup. To run this script, the server must be stopped.

Syntax bak2db [ backupDirectory ] [ -n backend ]

Options

Option backupDirectory

-n backendInstance

Description

Gives the backup directory path.

Optional. Specifies the backend name, such as userRoot , which is being restored. This option is only used for filesystem replica initialization or

280

cl-dump (Dumps and Decodes the Changelog)

Option Description to restore a single database; it is not necessary to use the n option to restore the entire directory.

Table 7.4. bak2db Options

For information on the equivalent Perl script, see Section 7.4.1, “bak2db.pl (Restores a Database from

Backup)” . For more information on restoring databases, see the "Populating Directory Databases"

chapter in the Red Hat Directory Server Administrator's Guide. For more information on using filesystem replica initialization, see the "Managing Replication" chapter in the Red Hat Directory Server

Administrator's Guide.

7.3.2. cl-dump (Dumps and Decodes the Changelog)

Troubleshoots replication-related problems. cl-dump is a shell script wrapper of cl-dump.pl to set the appropriate library path.

Syntax cl-dump [ -h host ] [ -p port ] [ -D bindDn ] [[ -w bindPassword ] | [ -P bindCert ]] [ -r replicaRoots ] [ -o outputFile ] [ -c ] [ -v ] cl-dump [ -i changelogFile ] [ -o outputFile ] [ -c ]

Options

Without the -i option, the script must be run when the Directory Server is running from a location from which the server's changelog directory is accessible.

Option

-c

-D bindDn

-h host

-i changelogFile

-o outputFile

-p port

-P bindCert

-r replicaRoots

Description

Dumps and interprets CSN only. This option can be used with or without the -i option.

Specifies the Directory Server's bind DN.

Defaults to cn=Directory Manager if the option is omitted.

Specifies the Directory Server's host. This defaults to the server where the script is running.

Specifies the path to the changelog file. If there is a changelog file and if certain changes in that file are base-64 encoded, use this option to decode that changelog.

Specifies the path, including the filename, for the final result. Defaults to STDOUT if omitted.

Specifies the Directory Server's port. The default value is 389.

Specifies the path, including the filename, to the certificate database that contains the certificate used for binding.

Specifies the replica-roots whose changelog to dump. When specifying multiple roots, use

281

Chapter 7. Command-Line Scripts

Option

-v

-w bindPassword

Table 7.5. cl-dump Options

Description commas to separate roots. If the option is omitted, all the replica roots will be dumped.

Prints the version of the script.

Specifies the password for the bind DN.

For information on the equivalent Perl script, see Section 7.4.2, “cl-dump.pl (Dumps and Decodes the

Changelog)”

7.3.3. db2bak (Creates a Backup of a Database)

Creates a backup of the current database contents. This script can be executed while the server is still running.

Syntax db2bak [ backupDirectory ]

For information on the equivalent Perl script, see Section 7.4.3, “db2bak.pl (Creates a Backup of a

Database)” .

7.3.4. db2ldif (Exports Database Contents to LDIF)

Exports the contents of the database to LDIF. This script can be executed while the server is still running, except with the -r option. To export the replication state information, shut down the server first, then run db2ldif with -r.

For information on the equivalent Perl script, see Section 7.4.5, “db2ldif.pl (Exports Database Contents to LDIF)” .

For the shell scripts, the script runs the ns-slapd command-line utility with the db2ldif keyword.

Ellipses (...) indicate that multiple occurrences are allowed.

Syntax db2ldif [[ -n backendInstance ] | [ -s includeSuffix ]] [ [ -x excludeSuffix ] ] [ -r ] [ -C ] [ -u ]

[ -U ] [ -m ] [ M ] [ -a outputFile ] [ -1 ] [ -N ] [ -E ]

Options

Either the -n or the -s option must be specified. By default, the output LDIF will be stored in one file.

To specify the use of several files, use the option -M.

Option

-1

Description

Deletes, for reasons of backward compatibility, the first line of the LDIF file which gives the version of the LDIF standard.

282

db2index (Reindexes Database Index Files)

Option

-a outputFile

-C

-E

-m

-M

-n backendInstance

-N

-r

-s suffix_name

-u

-U

-x suffix_name

Table 7.6. db2ldif Options

Description

Gives the name of the output LDIF file.

Uses only the main database file.

Decrypts encrypted data during export. This option is used only if database encryption is enabled.

Sets minimal base-64 encoding.

Uses multiple files for storing the output LDIF, with each instance stored in instance filename

(where filename is the filename specified for -a option).

Gives the instance to be exported.

Specifies that the entry IDs are not to be included in the LDIF output. The entry IDs are necessary only if the db2ldif output is to be used as input to db2index.

Exports the information required to initialize a replica when the LDIF is imported. Using this option requires that the server be stopped first, then run the db2ldif command.

The LDIF file which is created with db2ldif can be imported using ldif2db. When it is imported, if the -r option was used, than the database is automatically initialized as a replica.

See Section 7.3.8, “ldif2db (Import)” for

information on importing an LDIF file.

Names the suffixes to be included or the subtrees to be included if -n has been used.

Requests that the unique ID is not exported.

Requests that the output LDIF is not folded.

Names the suffixes to be excluded.

7.3.5. db2index (Reindexes Database Index Files)

Reindexes the database index files. Ellipses indicate that multiple occurrences are allowed.

For information on the equivalent Perl script, see Section 7.4.4, “db2index.pl (Creates and Generates

Indexes)”

Syntax db2index [[ -n backendInstance ] | [ -s includeSuffix ]] [ -t

[attributeName{:indextypes(:mathingrules)}] ] [ -T vlvAttribute ]

283

Chapter 7. Command-Line Scripts

Usage

Here are a few sample commands:

• Reindex all the database index files: db2index

• Reindex cn and givenname in the database instance userRoot: db2index -n userRoot -t cn -t givenname

• Reindex cn in the database where the root suffix is dc=example,dc=com: db2index -s "dc=example,dc=com" -t cn

Options

Option

-n backendInstance

-s includeSuffix

-t attributeName{:indextypes(:mathingrules)}

-T vlvAttributeName

Description

Gives the name of the instance to be reindexed.

Gives suffixes to be included or the subtrees to be included if -n has been used.

Names of the attributes to be reindexed.

Optionally, this can include the index type (eq, pres , sub, approx) and a matching rule OID.

Gives the names of the VLV attributes to be reindexed. The name is the VLV index object's common name in cn=config.

Table 7.7. db2index Options

7.3.6. dbverify (Checks for Corrupt Databases)

Verifies the backend database files. If the server crashes because of a corrupted database, this command can be used to verify the integrity of the different database files to help isolate any problems.

284

ds_removal

IMPORTANT

Never run dbverify when a modify operation is in progress. This command calls the BerkeleyDB utility db_verify and does not perform any locking. This can lead to data corruption if the script is run at the same time as a modify. If that occurs, an entry will be recorded in the error log:

DB ERROR: db_verify: Page 3527: out-of-order key at entry 42

DB ERROR: db_verify: DB->verify: db/mstest2/uid.db4: DB_VERIFY_BAD: Database verification failed

Secondary index file uid.db4 in db/mstest2 is corrupted.

Please run db2index(.pl) for reindexing.

Run db2index -t uid to avoid rebuilding all of the indexes or export and reimport all of the databases using db2ldif and ldif2db.

dbverify is a shell script wrapper of verify-db.pl to set the appropriate library path.

Syntax dbverify [ -a /path/to/database_directory ]

Options

Option

-a path

Description

Gives the path to the database directory. If this option is not passed with the verify- db.pl

command, then it uses the default database directory, /var/lib/dirsrv/ slapd-instance_name/db .

Table 7.8. dbverify Options

For information on the equivalent Perl script, see Section 7.4.21, “verify-db.pl (Check for Corrupt

Databases)”

7.3.7. ds_removal

The ds_removal tool removes a single instance of Directory Server. The server instance usually must be running when this script is run so that the script can bind to the instance. It is also possible to force the script to run, which may be necessary if there was an interrupted installation process or the instance is corrupted or broken so that it cannot run.

When the instance is removed, it is shutdown and all of its configuration files are removed. Certificate database files, like cert8.db and key3.db, are not removed, so the remaining instance directory is renamed removed.slapd-instance.

Syntax ds_removal [ -f ] -s instance_name -w manager_password

285

Chapter 7. Command-Line Scripts

Options

Option

-f

-s

-w

Parameter instance_name manager_password

Description

Forces the removal of the instance. This can be useful if the instance is not running but must be removed anyway.

The name of the instance to remove.

The Directory Manager password to use to bind to the instance.

7.3.8. ldif2db (Import)

Runs the ns-slapd command-line utility with the ldif2db keyword. To run this script, the server must be stopped. Ellipses indicate that multiple occurrences are allowed.

For information on the equivalent Perl script, see Section 7.4.7, “ldif2db.pl (Import)” .

NOTE ldif2db supports LDIF version 1 specifications. An attribute can also be loaded using the :< URL specifier notation; for example: jpegphoto:< file:///tmp/myphoto.jpg

Although the official notation requires three ///, the use of one / is accepted. For further information on the LDIF format, see the "Managing Directory Entries" chapter in the Red Hat Directory Server Administrator's Guide.

Syntax ldif2db [[ -n backendInstance ] | [ [ -s includeSuffix ] ...]] [ -x excludeSuffix ] [ [ -i ldifFile ] ] [ -O ] [ -g string ] [ -G namespaceId ] [ -E ]

Options

Option

-c

-E

-g string

Description

Merges chunk size.

Encrypts data during import. This option is used only if database encryption is enabled.

Generates a unique ID. Type none for no unique

ID to be generated and deterministic for the generated unique ID to be name-based.

286

ldif2ldap (Performs Import Operation over LDAP)

Option

-G namespaceId

-i ldifFile

-n backendInstance

-O

-s includeSuffix

-x excludeSuffix

Table 7.9. ldif2db Options

Description

By default, a time-based unique ID is generated.

When using the deterministic generation to have a name-based unique ID, it is also possible to specify the namespace for the server to use, as follows:

-g deterministic namespace_id

namespace_id is a string of characters in the format 00-xxxxxxxx-xxxxxxxx-xxxxxxxx- xxxxxxxx .

Use this option to import the same LDIF file into two different Directory Servers and the contents of both directories should have the same set of unique IDs. If unique IDs already exist in the

LDIF file being imported, then the existing IDs are imported to the server, regardless of the options specified.

Generates a namespace ID as a name-based unique ID. This is the same as specifying the -g deterministic option.

Gives the names of the input LDIF files. When multiple files are imported, they are imported in the order they are specified on the command line.

Gives the instance to be imported. Ensure that the specified instance corresponds to the suffix contained by the LDIF file; otherwise, the data contained by the database is deleted, and the import fails.

Requests that only the core database is created, without attribute indexes.

Gives the suffixes to be included or to specify the subtrees to be included if -n has been used.

Gives the suffixes to be excluded.

7.3.9. ldif2ldap (Performs Import Operation over LDAP)

Performs an import operation over LDAP to the Directory Server. To run this script, the server must be running.

Syntax ldif2ldap [ -D rootdn ] [ -w password ] [ -f filename ]

287

Chapter 7. Command-Line Scripts

Options

Option

-D rootdn

-f filename

Description

Gives a user DN with root permissions, such as

Directory Manager.

Gives the name of the file to be imported. When importing multiple files, the files are imported in the order they are specified on the command line.

Gives the password associated with the user DN.

-w password

Table 7.10. ldif2ldap Options

7.3.10. monitor (Retrieves Monitoring Information)

Retrieves performance monitoring information using the ldapsearch command-line utility.

Syntax monitor monitor Options

There are no options for this script.

For more information on the ldapsearch command-line utility, see Section 6.8, “ldif” .

7.3.11. repl-monitor (Monitors Replication Status)

Shows in-progress status of replication. repl-monitor is a shell script wrapper of repl- monitor.pl

to set the appropriate library path.

For more information on the Perl script, see Section 7.4.17, “repl-monitor.pl (Monitors Replication

Status)”

Syntax repl-monitor [ -h host ] [ -p port ] [ -f configFile ] [ -u refreshUrl ] [ -t refreshInterval ]

[ -r ] [ -v ]

Options

Option

-h host

-f configFile

Description

Specifies the initial replication supplier's host.

The default value is the current hostname.

Specifies the absolute path to the configuration file, which defines the connection parameters used to connect to LDAP servers to get

288

repl-monitor (Monitors Replication Status)

Option

-p port

-r

-t refreshInterval

-u refreshUrl

Description replication information. For more information about the configuration file, see

Configuration

File Format

Specifies the initial replication supplier's port.

The default value is 389.

If specified, causes the routine to be entered without printing the HTML header information.

This is suitable when making multiple calls to this routine — such as specifying multiple, different, unrelated supplier servers — and expecting a single HTML output.

Specifies the refresh interval in seconds. The default value is 300 seconds. This option must be used with the -u option.

Specifies the refresh URL. The output HTML file may invoke a CGI program periodically. If this

CGI program in turn calls this script, the effect is that the output HTML file would automatically refresh itself. This is useful for continuous monitoring. See also the -t option. The script has been integrated into Red Hat Administration

Express, so that the replication status can be monitored through a web browser.

Prints the version of this script.

-v

Table 7.11. repl-monitor Options

Configuration File Format

The configuration file defines the following:

• The connection parameters for connecting to the LDAP servers to get replication information; specifying this information is mandatory.

• The server alias for more readable server names; specifying this information is optional.

• The color thresholds for time lags; specifying this information is optional.

The format for the configuration file is shown below.

[connection] host:port:binddn:bindpwd:bindcert host:port:binddn:bindpwd:bindcert

...

[alias] alias = host:port alias = host:port

...

[color] lowmark = color

289

Chapter 7. Command-Line Scripts lowmark = color

The connection section defines how this tool may connect to each LDAP server in the replication topology to get the replication-agreement information. The default binddn is cn=Directory

Manager . Simple bind will be used unless bindcert is specified with the path of a certificate database.

A server may have a dedicated or shared entry in the connection section. The script will find out the most matched entry for a given server. For example, if all the LDAP servers except host1 share the same binddn and bindpassword, the connection section will need to contain just two entries:

[connection]

*:*:binddn:bindpassword: host1:*:binddn1:bindpassword1:

In the optional alias section, use aliases such as Supplier1, Supplier2, and Hub1, to identify the servers in the replication topology. If used, the output shows these aliases, instead of http(s):// hostname:port.

The CSN time lags between suppliers and consumers can be displayed in different colors based on their range. The default color set is green for 0-5 minutes lag, yellow for 5-60 minutes lag, and pink for a lag of 60 minutes or more.

The connection parameters for all the servers in a replication topology must be specified within one configuration file. One configuration file, however, may contain information for multiple replication topologies.

Because of the connection parameters, the replication monitoring tool does not need to perform DES decryption of the credentials stored in the Directory Server. Each line in this file could either be a comment started with the # character or a connection entry of the format: host:port:binddn:bindpwd:bindcert

• host, port, and binddn can be replaced with relevant values or *, or omitted altogether. If host is null or *, the entry may apply to any host that does not have a dedicated entry in the file. If port is null or

* , the port will default to the port stored in the current replication agreement. If binddn is null or *, it defaults to cn=Directory Manager.

• bindcert can be replaced with the full path to the certificate database, null, or *. If bindcert is omitted or replaced with *, the connection will be a simple bind.

For example, the configuration file may appear as follows:

#Configuration File for Monitoring Replication Via Admin Express

[connection]

*:*:*:mypassword

[alias]

M1 = host1.example.com:10011

C1 = host4.example.com:10021

C2 = host2.example.com:10022

[color]

0 = #ccffcc

5 = #FFFFCC

290

pwdhash (Prints Encrypted Passwords)

60 = #FFCCCC

A shadow port can be set in the replication monitor configuration file. For example:

host:port=shadowport:binddn:bindpwd:bindcert

When the replication monitor finds a replication agreement that uses the specified port, it will use the shadow port to connect to retrieve statistics.

7.3.12. pwdhash (Prints Encrypted Passwords)

Prints the encrypted form of a password using one of the server's encryption algorithms. If a user cannot log in, use this script to compare the user's password to the password stored in the directory.

Syntax pwdhash [ -D config_directory ] [ -H ] [[ -s scheme ] | [ -c comparepwd ]] [ password ]

Options

Option

-D config_directory

-c password

-s scheme

-H

Table 7.12. pwdhash Options

Description

Gives the full path to the configuration directory.

Gives the hashed password string to which to compare the user's password.

Gives the scheme to hash the given password.

Shows the help.

For more information on the different storage schemes, such as SSHA, SHA, CRYPT, and CLEAR, see the Directory Server Administrator's Guide.

7.3.13. restart-slapd (Restarts the Directory Server)

Restarts the Directory Server.

Syntax restart-slapd

Options

There are no options for this script.

Exit Status

Exit Code

Description

Server restarted successfully.

Server could not be started.

Server restarted successfully but was already stopped.

291

Chapter 7. Command-Line Scripts

Exit Code

Table 7.13. restart-slapd Exit Status Codes

Description

Server could not be stopped.

7.3.14. restoreconfig (Restores Administration Server

Configuration)

Restores, by default, the most recently saved Administration Server configuration information to the

NetscapeRoot partition under the /etc/dirsrv/slapd-instance_name/ directory.

To restore the Administration Server configuration, do the following:

1. Stop the Directory Server.

2. Run the restoreconfig script.

3. Restart the Directory Server.

4. Restart the Administration Server for the changes to be taken into account.

Syntax restoreconfig

Options

There are no options for this script.

7.3.15. saveconfig (Saves Administration Server Configuration)

Saves Administration Server configuration information to /var/lib/dirsrv/ slapd-instance_name/bak directory.

This script will only run if the server is running.

Syntax saveconfig

Options

There are no options for this script.

7.3.16. start-slapd (Starts the Directory Server)

Starts the Directory Server. It might be a good idea to check whether the server has been effectively started using the ps command because it could sometimes be that the script returned while the startup process was still on-going, resulting in a confusing message.

Syntax start-slapd

292

stop-slapd (Stops the Directory Server)

Options

There are no options for this script.

Exit Status Codes

Exit Code

Table 7.14. start-slapd Exit Status Codes

Description

Server started successfully.

Server could not be started.

Server was already started.

7.3.17. stop-slapd (Stops the Directory Server)

Stops the Directory Server. It might be a good idea to check whether the server has been effectively stopped using the ps command because it could sometimes be that the script returned while the shutdown process was still on-going, resulting in a confusing message.

Syntax stop-slapd

Options

There are no options for this script.

Exit Status

Exit Code

Table 7.15. stop-slapd Exit Status Codes

Description

Server stopped successfully.

Server could not be stopped.

Server was already stopped.

7.3.18. suffix2instance (Maps a Suffix to a Backend Name)

Maps a suffix to a backend name.

Syntax suffix2instance [ -s suffix ]

Options

Option

-s

Table 7.16. suffix2instance Options

Description

Suffix to be mapped to the backend.

293

Chapter 7. Command-Line Scripts

7.3.19. vlvindex (Creates Virtual List View Indexes)

To run the vlvindex script, the server must be stopped. The vlvindex script creates virtual list view (VLV) indexes, known in the Directory Server Console as browsing indexes. VLV indexes introduce flexibility in the way search results are viewed. VLV indexes can organize search results alphabetically or in reverse alphabetical order, making it easy to scroll through the list of results. VLV index configuration must already exist prior to running this script.

Syntax vlvindex [ -d debugLevel ] [[ -n backendInstance ] | [ -s suffix ]] [ -T vlvTag ]

Options

Either the -n or the -s option must be specified.

Option

-d debugLevel

-n backendInstance

-s suffix

-T vlvTag

Description

Specifies the debug level to use during index creation. Debug levels are defined in

Section 2.3.1.44, “nsslapd-errorlog-level (Error

Log Level)”

Gives the name of the database containing the entries to index.

Gives the name of the suffix containing the entries to index.

VLV index identifier to use to create VLV indexes.

The Console can specify VLV index identifier for each database supporting the directory tree, as described in the Directory Server Administrator's

Guide. Define additional VLV tags by creating them in LDIF and adding them to Directory

Server's configuration, as described in the Red

Hat Directory Server Administrator's Guide. Red

Hat recommends using the DN of the entry for which to accelerate the search sorting.

Table 7.17. vlvindex Options

7.4. Perl Scripts

This section describes the following Perl scripts:

•

Section 7.4.1, “bak2db.pl (Restores a Database from Backup)”

•

Section 7.4.2, “cl-dump.pl (Dumps and Decodes the Changelog)”

•

Section 7.4.3, “db2bak.pl (Creates a Backup of a Database)”

•

Section 7.4.4, “db2index.pl (Creates and Generates Indexes)”

•

Section 7.4.5, “db2ldif.pl (Exports Database Contents to LDIF)”

•

Section 7.4.6, “fixup-memberof.pl (Regenerate memberOf Attributes)”

294

bak2db.pl (Restores a Database from Backup)

•

Section 7.4.10, “migrate-ds-admin.pl”

•

Section 7.4.7, “ldif2db.pl (Import)”

•

Section 7.4.8, “logconv.pl (Log Converter)”

•

Section 7.4.11, “ns-accountstatus.pl (Establishes Account Status)”

•

Section 7.4.12, “ns-activate.pl (Activates an Entry or Group of Entries)”

•

Section 7.4.13, “ns-inactivate.pl (Inactivates an Entry or Group of Entries)”

•

Section 7.4.14, “ns-newpwpolicy.pl (Adds Attributes for Fine-Grained Password Policy)”

•

Section 7.4.16, “remove-ds.pl”

•

Section 7.4.17, “repl-monitor.pl (Monitors Replication Status)”

•

Section 7.4.18, “schema-reload.pl (Reload Schema Files Dynamically)”

•

Section 7.4.19, “setup-ds.pl”

•

Section 7.4.20, “setup-ds-admin.pl”

•

Section 7.4.21, “verify-db.pl (Check for Corrupt Databases)”

7.4.1. bak2db.pl (Restores a Database from Backup)

Restores a database from a backup.

Syntax bak2db.pl

[ -v ] -D rootdn { -w password | -w - | -j filename } -a backupDirectory [ -t databaseType ] [ -n backend ]

Options

The script bak2db.pl creates an entry in the directory that launches this dynamic task. The entry is generated based upon the values provided for each option.

Option

-a backupDirectory

-D rootdn

-j filename

-n backendInstance

Description

The directory of the backup files.

Gives the user DN with root permissions, such as Directory Manager. The default is the DN of the Directory Manager, which is read from the nsslapd-root attribute under cn=config.

The name of the file containing the password.

Specifies the backend name, such as userRoot , which is being restored. This option is only used for filesystem replica initialization or to restore a single database; it is not necessary to use the -n option to restore the entire directory.

295

Chapter 7. Command-Line Scripts

Option

-t databaseType

-v

-w password

-w -

Table 7.18. bak2db.pl Options

Description

The database type. The only possible database type is ldbm.

Verbose mode.

The password associated with the user DN.

Prompts for the password associated with the user DN.

7.4.2. cl-dump.pl (Dumps and Decodes the Changelog)

Troubleshoots replication-related problems.

NOTE cl-dump.pl

is in the /usr/bin directory.

Syntax cl-dump.pl

[ -h host ] [ -p port ] [ -D bindDn ] [ -w bindPassword | -P bindCert ] [ -r replicaRoots ] [ -o outputFile ] [ -c ] [ -v ] cl-dump.pl

-i changelogFile [ -o outputFile ] [ -c ] [ -v ]

Options

Without the -i option, the script must be run when the Directory Server is running from a location from which the server's changelog directory is accessible.

Option

-c

-D bindDn

-h host

-i changelogFile

-o outputFile

-p port

Description

Dumps and interprets change sequence numbers (CSN) only. This option can be used with or without the -i option.

Specifies the Directory Server's bind DN.

Defaults to cn=Directory Manager if the option is omitted.

Specifies the Directory Server's host. Defaults to the server where the script is running.

Specifies the path to the changelog file. If there is a changelog file and if certain changes in that file are base-64 encoded, use this option to decode that changelog.

Specifies the path, including the filename, for the final result. Defaults to STDOUT if omitted.

Specifies the Directory Server's port. The default value is 389.

296

db2bak.pl (Creates a Backup of a Database)

Option

-P bindCert

-r replicaRoots

Description

Specifies the path, including the filename, to the certificate database that contains the certificate used for binding.

Specifies the replica-roots whose changelog to dump. When specifying multiple roots, use commas to separate roots. If the option is omitted, all the replica roots will be dumped.

Prints the version of the script.

Specifies the password for the bind DN.

-v

-w bindPassword

Table 7.19. cl-dump.pl command options

7.4.3. db2bak.pl (Creates a Backup of a Database)

Creates a backup of the database.

Syntax db2bak.pl

[ -v ] -D rootdn { -w password | -w - | -j filename } [ -a dirName ] [ -t db_type ]

Options

The script db2bak.pl creates an entry in the directory that launches this dynamic task. The entry is generated based upon the values provided for each option. Currently, the only possible database type is ldbm.

Option

-a dirName

-D rootdn

-j filename

-t

-v

-w password

-w -

Description

The directory where the backup files will be stored. The /var/lib/dirsrv/ slapd-instance_name/bak directory is used by default. The backup file is named according to the year-month-day-hour format

(YYYY_MM_DD_hhmmss).

The user DN with root permissions, such as

Directory Manager. The default is the DN of the Directory Manager, which is read from the nsslapd-root attribute under cn=config.

The name of the file containing the password.

The database type. Currently, the only possible database type is ldbm.

Verbose mode.

The password associated with the user DN.

Prompts for the password associated with the user DN.

Table 7.20. db2bak.pl Options

297

Chapter 7. Command-Line Scripts

7.4.4. db2index.pl (Creates and Generates Indexes)

Creates and generates the new set of indexes to be maintained following the modification of indexing entries in the cn=config configuration file.

Syntax db2index.pl

[ -v ] -D rootdn { -w password | -w - | -j filename } -n backendInstance [ -t attributeName(:indextypes(:mathingrules)) ] [ -T vlvAttributeName ]

Options

The script db2index.pl creates an entry in the directory that launches this dynamic task. The entry is generated based upon the values provided for each option.

Option

-D rootdn

-j filename

-n backendInstance

-t attributeName{:indextypes(:mathingrules)}

-T vlvAttributeName

-v

-w password

-w -

Description

Gives the user DN with root permissions, such as Directory Manager.

The name of the file containing the password.

Gives the instance to be indexed. If the instance is not specified, the script reindexes all instances.

Gives the name of the attribute to be indexed. If omitted, all the indexes defined for the specified instance are generated. Optionally, this can include the index type (eq, pres, sub, approx) and a matching rule OID.

Gives the names of the VLV attributes to be reindexed. The name is the VLV index object's common name in cn=config.

Verbose mode.

Gives the password associated with the user DN.

Prompts for the password associated with the user DN.

Table 7.21. db2index.pl Options

7.4.5. db2ldif.pl (Exports Database Contents to LDIF)

Exports the contents of the database to LDIF. This script creates an entry in the directory that launches this dynamic task. The entry is generated based upon the values provided for each option. Ellipses indicate that multiple occurrences are allowed.

Syntax db2ldif.pl

[ -v ] -D rootdn { -w password | -w - | -j filename } { -n backendInstance | -s includeSuffix ... } [ -x excludeSuffix ... ] [ -a outputFile ] [ -N ] [ -r ] [ -C ] [ -u ] [ -U ] [ -m ] [ -

E ] [ -1 ] [ M ]

298

db2ldif.pl (Exports Database Contents to LDIF)

Options

To run this script, the server must be running, and either the -n or -s option is required.

Option

-1

-a outputFile

-C

-D rootdn

-E

-j filename

-m

-M

-n backendInstance

-N

-r

-s includeSuffix

-u

-U

-v

-w password

-w -

-x excludeSuffix

Table 7.22. db2ldif.pl Options

Description

Deletes, for reasons of backward compatibility, the first line of the LDIF file that gives the version of the LDIF standard.

Gives the filename of the output LDIF file.

Uses only the main database file.

Gives the user DN with root permissions, such as Directory Manager.

Decrypts encrypted data during export. This option is used only if database encryption is enabled.

The name of the file containing the password.

Sets minimal base-64 encoding.

Uses multiple files for storing the output LDIF, with each instance stored in instance filename

(where filename is the filename specified for -a option).

Gives the instance to be exported.

Suppresses printing sequential numbers.

Exports the information required to initialize a replica when the LDIF is imported.

The LDIF file which is created with db2ldif.pl can be imported using ldif2db.pl. When it is imported, if the -r option was used, than the database is automatically initialized as a replica.

See Section 7.4.7, “ldif2db.pl (Import)” for

information on importing an LDIF file.

Gives suffixes to be included or the subtrees to be included if -n has been used.

Requests that the unique ID is not exported.

Requests that the output LDIF is not folded.

Verbose mode.

Gives the password associated with the user DN.

Prompts for the password associated with the user DN.

Gives suffixes to be excluded.

299

Chapter 7. Command-Line Scripts

7.4.6. fixup-memberof.pl (Regenerate memberOf Attributes)

Regenerates and updates memberOf on user entries to coordinate changes in group membership.

To run this script, the server must be running. The script creates an entry in the directory that launches this dynamic task.

Syntax fixup-memberof.pl

-D rootdn { -w password | -w - | -j filename } -b baseDN [ -f filter ] [ -v ]

Options

Option

-b baseDN

-D rootdn

-f filter

-j filename

-v

-w password

-w -

Table 7.23. fixup-memberof.pl Options

Description

The DN of the subtree containing the entries to update.

Gives the user DN with root permissions, such as Directory Manager. The default is the DN of the Directory Manager, which is read from the nsslapd-root attribute under cn=config.

An LDAP query filter to use to select the entries within the subtree to update. If there is no filter set, then the memberOf attribute is regenerated for every entry in the subtree.

The name of the file containing the password.

Verbose mode.

The password associated with the user DN.

Prompts for the password associated with the user DN.

7.4.7. ldif2db.pl (Import)

To run this script, the server must be running. The script creates an entry in the directory that launches this dynamic task. The entry is generated based upon the values provided for each option. Ellipses indicate that multiple occurrences are allowed.

Syntax ldif2db.pl

[ -v ] -D rootdn { -w password | -w - | -j filename } { -n backendInstance |

-s includeSuffix } [ -x excludeSuffix ] [ -O ] [ -c ] [ -g string ] [ -G namespaceId ] [ -i filename ] [ -E ]

Options

300

Option

-c

-D rootdn

-E

-g string

-G namespaceId

-i filename

-j filename

-n backendInstance

-O

-s includeSuffix

-v ldif2db.pl (Import)

Description

Merges chunk size.

Specifies the user DN with root permissions, such as Directory Manager.

Decrypts encrypted data during export. This option is used only if database encryption is enabled.

Generates a unique ID. Type none for no unique

ID to be generated and deterministic for the generated unique ID to be name-based. By default, a time-based unique ID is generated.

When using the deterministic generation to have a name-based unique ID, it is also possible to specify the namespace for the server to use, as follows:

-g deterministic namespaceId

namespaceId is a string of characters in the format 00-xxxxxxxx-xxxxxxxx-xxxxxxxx- xxxxxxxx .

Use this option to import the same LDIF file into two different Directory Servers and the contents of both directories should have the same set of unique IDs. If unique IDs already exist in the

LDIF file being imported, then the existing IDs are imported to the server, regardless of the options specified.

Generates a namespace ID as a name-based unique ID. This is the same as specifying the -g deterministic option.

Specifies the filename of the input LDIF files.

When multiple files are imported, they are imported in the order they are specified on the command line.

Specifies the path, including the filename, to the file that contains the password associated with the user DN.

Specifies the instance to be imported.

Requests that only the core database is created without attribute indexes.

Specifies the suffixes to be included or specifies the subtrees to be included if -n has been used.

Specifies verbose mode.

301

Chapter 7. Command-Line Scripts

Option

-w password

-w -

Description

Specifies the password associated with the user

DN.

Prompts for the password associated with the user DN.

Specifies the suffixes to be excluded.

-x excludeSuffix

Table 7.24. ldif2db.pl Options

7.4.8. logconv.pl (Log Converter)

Analyzes the access logs of a Directory Server to extract usage statistics and count the occurrences of significant events. It is compatible with log formats from previous releases of Directory Server. For information on access logs, see

Section 5.1, “Access Log Reference”

NOTE logconv.pl

is in the /usr/bin directory.

The tool will extract the following information from access logs:

• Number of restarts

• Total number of connections

• Total operations requested

• Total results returned

• Results to requests ratio

• Number of searches

• Number of modifications

• Number of adds

• Number of deletes

• Number of modified RDNs

• Persistent searches

• Internal operations (with verbose logs)

• Entry operations (with verbose logs)

• Extended operations

• Abandoned requests

• Smart referrals received (verbose logs)

• VLV (virtual list view) operations

• VLV unindexed searches

• Server-side sorting operations

• SSL connections

• Performance lowering operations:

• Entire database searches

• Unindexed searches (details optional)

Table 7.25. Information Extracted from Access Logs

• FDs (file descriptors) taken

• FDs returned

• Highest FD taken

• Disruptions:

• Broken pipes

• Connections reset by peer

• Unavailable resources (and detail)

• Total binds and types of binds

• Most frequent occurrence lists (optional)

• Error and return codes

• Failed logins

• Connection codes

• Client IP addresses and connection codes

• Bind DNs

• Base DNs for searching

• Search filters

• Etimes (elapsed operation time)

• Longest etimes

• Nentries (number of entries in result)

• Largest Nentries

• Extended operations

• Most requested attributes

• Recommendations (optional)

The logconv.pl tool displays two types of statistics useful for monitoring and optimizing directory usage:

• Simple counts of events such as the total number of binds and the total number of searches provide overall usage information. This is the basic information that the tool will always print.

302

logconv.pl (Log Converter)

• Lists of the most frequently occurring parameters in LDAP requests provide insight into how the directory information is being accessed. For example, lists of the top ten bind DNs, base DNs, filter strings, and attributes returned can help administrators optimize the directory for its users. These lists are optional because they are computation intensive: specify only the command-line options

required (see Options ).

Some information that is extracted by the logconv.pl script is available only in logs from current releases of Directory Server; the corresponding values will be zero when analyzing logs from older versions. In addition, some information will only be present in the logs if verbose logging is enabled in

the Directory Server. For more information, see Section 2.3.1.2, “nsslapd-accesslog-level (Access Log

Level)” .

The following issues will affect the output and performance of this tool:

• Some data extracted from logs depend on connection and operation numbers that are reset and no longer unique after a server restarts. Therefore, to obtain the most accurate counts, the logs to be analyzed should not span the restart of the Directory Server.

• Due to changes in access log format in current releases of Directory Server that affected operation numbers, the tool will be more accurate logs from current versions when processing large amounts of access logs.

• For performance reasons, it is not recommended to run more than one gigabyte of access logs through the script at any one time.

Syntax logconv.pl

[ -S startTimestamp ] [ -E endTimestamp ] [ -d mgrDN ] [ -X ipAddress ] [ -v ] [ -h ]

[ -s size_limit ] [ -V ] [ -efcibaltnxgjuyp ] [ accessLog ]

Options

Table 7.26, “logconv.pl Options” describes the logconv.pl command-line options.

Option

-d mgrDN

-E endTimestamp

-h

-s number

Description

Specifies the distinguished name (DN) of the

Directory Manger in the logs being analyzed.

This allows the tool to collect statistics for this special user. The mgrDN parameter should be given in double quotes ("") for the shell. When this parameter is omitted, logconv.pl will use the default manager DN of the Directory Server,

"cn=Directory Manager" .

Specifies the end timestamp; the timestamp must follow the exact format as specified in the access log.

Displays the usage help text that briefly describes all options.

Specifies the number of items in each of the list options below. The default is 20 when this parameter is omitted. For example, -s 10 -i

303

Chapter 7. Command-Line Scripts

Option

-S startTimestamp

-v

-V

-X ipAddress accessLog

Description will list the ten client machines that access the

Directory Server most often. This parameter will apply to all lists that are enabled, and it will have no effect if none are displayed.

Specifies the start timestamp; the timestamp must follow the exact format as specified in the access log.

Displays the version number of the logconv.pl script.

Enables verbose output. With this option, logconv.pl

will compute and display all of the

optional lists described in Table 7.27, “logconv.pl

Options to Display Occurrences”

Specifies the IP address of a client to exclude from the statistics. This client will not appear in lists of IP addresses (the i flag), and the connection codes it generates will not be tallied in the total connections (default statistic) nor in the connection code details (the c flag).

For example, an administrator may want the server to ignore the effect of a load balancer that connects to the Directory Server at regular intervals. This option may be repeated to exclude multiple IP addresses.

The name of a file that contains the access log of the Directory Server. Wildcards can be used in the filename. It is also possible to specify multiple filenames. However, the statistics are computed over the set of all logs, so all logs should pertain to the same Directory

Server. The tool ignores any file with the name access.rotationinfo

Table 7.26. logconv.pl Options

Table 7.27, “logconv.pl Options to Display Occurrences” describes the options that enable the optional

lists of occurrences. Specify only those required; specifying a large number of options can produce excessive output and affect execution speed. These parameters can be specified in any number and in any order, but they must all be given together as a single option on the command line, such as - abcefg .

The lists are always output in the order in which they appear in the following table, regardless of the order in which they are given on the command line.

Option f e

Description

Lists the most frequent error and return codes.

Lists the bind DNs with the most failed logins

(invalid password).

304

migrate-ds.pl

l i

Option c b a

Description

Lists the number of occurrences for each type of connection code.

Lists the IP addresses and connection codes of the clients with the most connections, which detects clients that may be trying to compromise security.

Lists the most frequently used bind DNs.

Lists the most frequent base DNs when performing operations.

Lists the most frequently used filter strings for searches.

r j g t n x u

Lists the longest and most frequent etimes

(elapsed operation time).

Lists the largest and most frequent nentries

(entries per result).

Lists the number and OID of all extended operations.

Lists the names of the most requested attributes.

Lists the details of all abandoned operations.

Gives recommendations based on data collected from the log file.

Gives operation details about unindexed searches.

y Lists connection latency details, which indicates the overall connection latency.

p Lists open connection ID statistics, which indicates the FDs that are not yet closed.

Table 7.27. logconv.pl Options to Display Occurrences

7.4.9. migrate-ds.pl

The migrate-ds.pl script is used to migrate a Directory Server 7.1 instance to Directory Server

8.1. Migration can happen between instances on on the same machine, on different machines, or on different platforms.

IMPORTANT

Do not run setup-ds-admin.pl for the new Directory Server 8.1 instance before running the migration script if you are migrating from a 7.1 server.

If you are upgrading from a Directory Server 8.0 server, do not run migrate-ds.pl.

Run setup-ds-admin.pl -u instead.

305

Chapter 7. Command-Line Scripts

NOTE

This script only migrates a Directory Server instance, not an Administration Server.

Information can be passed with the script or in an .inf file, same as the setup scripts.

Both the .inf parameters and command-line arguments are described in the silent configuration section of the Installation Guide.

Syntax migrate-ds.pl

--oldsroot=server_directory [ --actualsroot=server_directory

] [ --instance=instance_name ] [ --file=name ] [ --cross ] [ --debug ] [ --log=name ]

General.ConfigDirectoryAdminPwd=password

Options

Option Alternate Options

General.ConfigDirectoryAdminPwd=password

--oldsroot

--actualsroot

-o

-a

Description

Required. This is the password for the configuration directory administrator of the old

Directory Server (the default username is admin).

Required. This is the path to the server root directory in the old 7.1 Directory Server installation. The default path in

7.1 servers is /opt/redhat- ds/ .

This is used for migrating between two machines to specify the real path to the current server root directory in the old 7.1 Directory Server installation if that directory is mounted on a networked drive or tarballed and moved to a relative directory. In that case, the oldsroot parameter sets the directory from which the migration is run (such as machine_new:/migrate/ opt/redhat-ds/ ), while the actualsroot parameter sets the server root, (/opt/ redhat-ds/ ).

306

Option

--instance

--file=name

--cross

--debug

--logfile name

Alternate Options

-i

-f name

-c or -x

-d[dddd]

-l migrate-ds.pl

Description

This parameter specifies a specific instance to migrate.

This parameter can be used multiple time to migrate several instances simultaneously. By default, the migration script migrates all Directory Server instances on the machine.

This sets the path and name of the .inf file provided with the migration script.

The only parameter is the

General.ConfigDirectoryAdminPwd

parameter, which is the configuration directory administrator's password. Any other configuration setting is ignored by the migration script.

This parameter is used when the Directory Server is being migrated from one machine to another with a different architecture. For crossplatform migrations, only certain data are migrated.

This migration action takes database information exported to LDIF and imports into the new 8.1 databases. Changelog information is not migrated. If a supplier or hub is migrated, then all its replicas must be reinitialized.

This parameter turns on debugging information. For the

-d flag, increasing the number of d's increases the debug level.

This parameter specifies a log file to which to write the output.

If this is not set, then the migration information is written to a temporary file, named / tmp/migrate XXXXX.log.

To disable logging, set /dev/ null as the logfile.

307

Chapter 7. Command-Line Scripts

7.4.10. migrate-ds-admin.pl

The migrate-ds-admin.pl script is used to migrate a Directory Server 7.1 instance to Directory

Server 8.1. Migration can happen between instances on on the same machine, on different machines, or on different platforms. This script migrates both the Directory Server instances and the

Administration Server for the 7.1 deployment.

IMPORTANT

Do not run setup-ds-admin.pl for the new Directory Server 8.1 instance before running the migration script if you are migrating from a 7.1 server.

If you are upgrading from a Directory Server 8.0 server, do not run migrate-ds- admin.pl

. Run setup-ds-admin.pl -u instead.

Information can be passed with the script or in an .inf file, same as the setup scripts.

Both the .inf parameters and command-line arguments are described in the silent configuration section of the Installation Guide.

Syntax migrate-ds-admin.pl

--oldsroot=server_directory [ --actualsroot=server_directory

] [ --instance=instance_name ] [ --file=name ] [ --cross ] [ --debug ] [ --log=name ]

General.ConfigDirectoryAdminPwd=password

Options

Option Alternate Options

General.ConfigDirectoryAdminPwd=password

--oldsroot

--actualsroot

-o

-a

Description

Required. This is the password for the configuration directory administrator of the old

Directory Server (the default username is admin).

Required. This is the path to the server root directory in the old 7.1 Directory Server installation. The default path in

7.1 servers is /opt/redhat- ds/ .

308

Option

--instance

--file=name

--cross

--debug

--logfile name

Alternate Options

-i

-f name

-c or -x

-d[dddd]

-l migrate-ds-admin.pl

Description case, the oldsroot parameter sets the directory from which the migration is run (such as machine_new:/migrate/ opt/redhat-ds/ ), while the actualsroot parameter sets the server root, (/opt/ redhat-ds/ ).

This parameter specifies a specific instance to migrate.

This parameter can be used multiple time to migrate several instances simultaneously. By default, the migration script migrates all Directory Server instances on the machine.

This sets the path and name of the .inf file provided with the migration script.

The only parameter is the

General.ConfigDirectoryAdminPwd

parameter, which is the configuration directory administrator's password. Any other configuration setting is ignored by the migration script.

This parameter is used when the Directory Server is being migrated from one machine to another with a different architecture. For crossplatform migrations, only certain data are migrated.

This parameter turns on debugging information. For the

-d flag, increasing the number of d's increases the debug level.

This parameter specifies a log file to which to write the output.

309

Chapter 7. Command-Line Scripts

Option Alternate Options Description

If this is not set, then the migration information is written to a temporary file, named / tmp/migrate XXXXX.log.

To disable logging, set /dev/ null as the logfile.

7.4.11. ns-accountstatus.pl (Establishes Account Status)

Provides account status information to establish whether an entry or group of entries is inactivated.

Syntax ns-accountstatus.pl

[ -D rootdn ] [ -w password | -w - | -j filename ] [ -p port ] [ -h host ] -I

DN [ -? ]

Options

Option

-D rootdn

-h host

-I DN

-j filename

-p port

-w password

-w -

Table 7.28. ns-accountstatus.pl Options

Description

Specifies the Directory Server user DN with root permissions, such as Directory Manager.

Specifies the hostname of the Directory Server.

The default value is the full hostname of the machine where Directory Server is installed.

Specifies the entry DN or role DN whose status is required.

Specifies the path, including the filename, to the file that contains the password associated with the user DN.

Specifies the Directory Server's port. The default value is the LDAP port of Directory Server specified at installation time.

Specifies the password associated with the user

DN.

Prompts for the password associated with the user DN.

Opens the help page.

7.4.12. ns-activate.pl (Activates an Entry or Group of Entries)

Activates an entry or group of entries.

310

ns-inactivate.pl (Inactivates an Entry or Group of Entries)

Syntax ns-activate.pl

[ -D rootdn ] [ -w password | -w - | -j filename ] [ -p port ] [ -h host ] -I DN

[ -? ]

Options

Option

-D rootdn

-h host

-I DN

-j filename

-p port

-w password

-w -

Table 7.29. ns-activate.pl Options

Description

Specifies the Directory Server user DN with root permissions, such as Directory Manager.

Specifies the hostname of the Directory Server.

The default value is the full hostname of the machine where Directory Server is installed.

Specifies the entry DN or role DN to activate.

Specifies the path, including the filename, to the file that contains the password associated with the user DN.

Specifies the Directory Server's port. The default value is the LDAP port of Directory Server specified at installation time.

Specifies the password associated with the user

DN.

Prompts for the password associated with the user DN.

Opens the help page.

7.4.13. ns-inactivate.pl (Inactivates an Entry or Group of Entries)

Inactivates, and consequently locks, an entry or group of entries.

Syntax ns-inactivate.pl

[ -D rootdn ] [ -w password | -w - | -j filename ] [ -p port ] [ -h host ] -I DN

[ -? ]

Options

Option

-D rootdn

-h host

-I DN

Description

Specifies the Directory Server user DN with root permissions, such as Directory Manager.

Specifies the hostname of the Directory Server.

The default value is the full hostname of the machine where Directory Server is installed.

Specifies the entry DN or role DN to deactivate.

311

Chapter 7. Command-Line Scripts

Option

-j filename

-p port

-w password

-w -

Description

Specifies the path, including the filename, to the file that contains the password associated with the user DN.

Specifies the Directory Server's port. The default value is the LDAP port of Directory Server specified at installation time.

Specifies the password associated with the user

DN.

Prompts for the password associated with the user DN.

Opens the help page.

Table 7.30. ns-inactivate.pl Options

7.4.14. ns-newpwpolicy.pl (Adds Attributes for Fine-Grained

Password Policy)

Adds entries required for implementing the user- and subtree-level password policy. For instructions on how to enable this feature, see the Red Hat Directory Server Administrator's Guide.

Syntax ns-newpwpolicy.pl

[ -D rootdn ] [ -w password | -j filename ] [ -p port ] [ -h host ] -U userDN -S suffixDN [ -v ] [ -? ]

Options

Option

-D rootdn

-h host

-j filename

-p port

-S suffixDN

-U userDN

Description

Specifies the Directory Server user DN with root permissions, such as Directory Manager.

The default value is cn=directory manager.

Specifies the hostname of the Directory Server.

The default value is localhost or the full hostname of the machine where Directory Server is installed.

Specifies the path, including the filename, to the file that contains the password associated with the user DN.

Specifies the Directory Server's port. The default value is 389 or the LDAP port of Directory Server specified at installation time.

Specifies the DN of the suffix entry that needs to be updated with subtree-level password policy attributes.

Specifies the DN of the user entry that needs to be updated with user-level password policy attributes.

312

Option

-v

-w password

Table 7.31. ns-newpwpolicy.pl Options

Description

Verbose mode.

Specifies the password associated with the user

DN.

Opens the help page.

7.4.15. register-ds-admin.pl

The register-ds-admin.pl script can be used for two things:

• Registering an existing Directory Server instance with a different Administration Server or

Configuration Directory Server.

• Creating a new, local Administration Server when only a Directory Server was installed previously.

IMPORTANT

The register-ds-admin.pl script does not support external LDAP URLs, so the

Directory Server instance must be registered against a local Administration Server.

Syntax register-ds-admin.pl.pl

[ --debug ] [ --log=name ]

Options

Option

--debug

Alternate Options

-d[dddd]

--logfile name -l

Description

This parameter turns on debugging information. For the

-d flag, increasing the number of d's increases the debug level.

This parameter specifies a log file to which to write the output. If this is not set, then the setup information is written to a temporary file. To not use a log file, set the file name to / dev/null .

7.4.16. remove-ds.pl

The remove-ds.pl script removes a single instance of Directory Server. The server instance usually must be running when this script is run so that the script can bind to the instance. It is also possible to force the script to run, which may be necessary if there was an interrupted installation process or the instance is corrupted or broken so that it cannot run.

313

Chapter 7. Command-Line Scripts

Syntax remove-ds.pl

[ -f ] -i instance_name

Options

Option

-f

-i

Parameter instance_name

Description

Forces the removal of the instance. This can be useful if the instance is not running but must be removed anyway.

The name of the instance to remove.

7.4.17. repl-monitor.pl (Monitors Replication Status)

Shows in-progress status of replication.

NOTE repl-monitor.pl

is in the /usr/bin directory.

Syntax repl-monitor.pl

[ -h host ] [ -p port ] [ -f configFile ] [ -u refreshUrl ] [ -t refreshInterval ] [ -r ] [ -v ]

Options

Option

-f configFile

-h host

-p port

Description

Specifies the absolute path to the configuration file, which defines the connection parameters used to connect to LDAP servers to get replication information. For more information about the configuration file, see

Configuration

File Format

Specifies the initial replication supplier's host.

The default value is the current hostname.

Specifies the initial replication supplier's port.

The default value is 389.

314

repl-monitor.pl (Monitors Replication Status)

Option

-r

-t refreshInterval

-u refreshUrl

Description

If specified, causes the routine to be entered without printing the HTML header information.

This is suitable when making multiple calls to this routine — such as specifying multiple, different, unrelated supplier servers — and expecting a single HTML output.

Specifies the refresh interval in seconds. The default value is 300 seconds. This option must be used with the -u option.

Specifies the refresh URL. The output HTML file may invoke a CGI program periodically. If this

Express, so that the replication status can be monitored through a web browser.

Prints the version of this script.

-v

Table 7.32. repl-monitor.pl Options

Configuration File Format

The configuration file defines the following:

• The connection parameters for connecting to the LDAP servers to get replication information; specifying this information is mandatory.

• The server alias for more readable server names; specifying this information is optional.

• The color thresholds for time lags; specifying this information is optional.

The format for the configuration file is shown below.

[connection] host:port:binddn:bindpwd:bindcert host:port:binddn:bindpwd:bindcert

...

[alias] alias = host:port alias = host:port

...

[color] lowmark = color lowmark = color

The connection section defines how this tool may connect to each LDAP server in the replication topology to get the replication-agreement information. The default binddn is cn=Directory

Manager . Simple bind will be used unless bindcert is specified with the path of a certificate database.

315

Chapter 7. Command-Line Scripts

[connection]

*:*:binddn:bindpassword: host1:*:binddn1:bindpassword1:

host:port:binddn:bindpwd:bindcert

* , the port will default to the port stored in the current replication agreement. If binddn is null or *, it defaults to cn=Directory Manager.

• bindcert can be replaced with the full path to the certificate database, null, or *. If bindcert is omitted or replaced with *, the connection will be a simple bind.

For example, the configuration file may appear as follows:

#Configuration File for Monitoring Replication Via Admin Express

[connection]

*:*:*:mypassword

[alias]

M1 = host1.example.com:10011

C1 = host4.example.com:10021

C2 = host2.example.com:10022

[color]

0 = #ccffcc

5 = #FFFFCC

60 = #FFCCCC

A shadow port can be set in the replication monitor configuration file. For example:

host:port=shadowport:binddn:bindpwd:bindcert

316

schema-reload.pl (Reload Schema Files Dynamically)

When the replication monitor finds a replication agreement that uses the specified port, it will use the shadow port to connect to retrieve statistics.

7.4.18. schema-reload.pl (Reload Schema Files Dynamically)

Manually reloads the schema files used by the Red Hat Directory Server instance either in the default location or in user-specified locations.

To run this script, the server must be running. The script creates an entry in the directory that launches this dynamic task.

Syntax schema-reload.pl

-D rootdn { -w password | -w - | -j filename } [ -d schema_directory ] [ v ]

Options

Option

-d schema_directory

Description

Gives the full path to the directory where the schema file is located. If this is not specified, the script uses the default schema directory, /etc/ dirsrv/slapd-instance_name/schema .

-D rootdn

-j filename

-v

-w password

-w -

Table 7.33. schema-reload.pl Options

IMPORTANT

If schema files are not in the default directory, then Directory

Server will not use them the next time it restarts unless schema-reload.pl

is run again.

Gives the user DN with root permissions, such as Directory Manager. The default is the DN of the Directory Manager, which is read from the nsslapd-root attribute under cn=config.

The name of the file containing the password.

Verbose mode.

The password associated with the user DN.

Prompts for the password associated with the user DN.

7.4.19. setup-ds.pl

The setup-ds.pl script is used to create a Directory Server instance. Running this script with the -u option after the instances are configured updates the configuration with the latest installed packages.

317

Chapter 7. Command-Line Scripts

NOTE

This script only creates a Directory Server instance, not an Administration Server. For the new instance to work, there has to be an Administration Server and Configuration

Directory Server installed on another machine.

Information can be passed with the script or in an .inf file. If no options are used, the setup-ds.pl launches an interactive configuration program.

Both the .inf parameters and command-line arguments are described in the silent configuration section of the Installation Guide.

Syntax setup-ds.pl

[ --debug ] [ --silent ] [ --file=name ] [ --keepcache ] [ --log=name ] [ --update ]

Options

Option

--silent

Alternate Options

-s

--file=name

--debug

--keepcache

-f name

-d[dddd]

-k

Description

This runs the register script in silent mode, drawing the configuration information from a file (set with the --file parameter) or from arguments passed in the command line rather than interactively.

This sets the path and name of the file which contains the configuration settings for the new Directory Server instance.

This can be used with the -- silent parameter; if used alone, it sets the default values for the setup prompts.

This parameter turns on debugging information. For the

-d flag, increasing the number of d's increases the debug level.

This saves the temporary installation file (.inf) that is created when the register script is run. This file can then be reused for a silent setup. This file is always generated, but is usually deleted once the install is complete. The file is created as a log file named /

318

setup-ds-admin.pl

Option

--logfile name

--update

Alternate Options

-l

-u

Description tmp/setup random.inf, like

/tmp/setuplGCZ8H.inf

WARNING

The cache file contains the cleartext passwords supplied during setup. Use appropriate caution and protection with this file.

This parameter updates existing Directory Server instances. If an installation is broken in some way, this option can be used to update or replace missing packages and then re-register all of the local instances with the

Configuration Directory.

7.4.20. setup-ds-admin.pl

The setup-ds-admin.pl script is used to create a Directory Server instance and a new

Administration Server instance. Running this script with the -u option after the instances are configured updates the configuration with the latest installed packages.

Information can be passed with the script or in an .inf file. If no options are used, the setup-ds- admin.pl

launches an interactive configuration program.

Both the .inf parameters and command-line arguments are described in the silent configuration section of the Installation Guide.

Syntax setup-ds-admin.pl

[ --debug ] [ --silent ] [ --file=name ] [ --keepcache ] [ --log=name ] [ --update ]

319

Chapter 7. Command-Line Scripts

Options

Option

--silent

Alternate Options

-s

--file=name

--debug

--keepcache

-f name

-d[dddd]

-k

Description

This sets the path and name of the file which contains the configuration settings for the new Directory Server instance.

This can be used with the -- silent parameter; if used alone, it sets the default values for the setup prompts.

This parameter turns on debugging information. For the

-d flag, increasing the number of d's increases the debug level.

/tmp/setuplGCZ8H.inf

WARNING

The cache file contains the cleartext passwords supplied during setup. Use appropriate caution and protection with this file.

320

verify-db.pl (Check for Corrupt Databases)

Option

--logfile name

--update

Alternate Options

-l

-u

Description

Configuration Directory.

7.4.21. verify-db.pl (Check for Corrupt Databases)

Verifies the backend database files. If the server crashes because of a corrupted database, this script can be used to verify the integrity of the different database files to help isolate any problems.

IMPORTANT

Never run verify-db.pl when a modify operation is in progress. This command calls the BerkeleyDB utility db_verify and does not perform any locking. This can lead to data corruption if the script is run at the same time as a modify. If that occurs, an entry will be recorded in the error log:

DB ERROR: db_verify: Page 3527: out-of-order key at entry 42

DB ERROR: db_verify: DB->verify: db/mstest2/uid.db4: DB_VERIFY_BAD: Database verification failed

Secondary index file uid.db4 in db/mstest2 is corrupted.

Please run db2index(.pl) for reindexing.

Run db2index -t uid to avoid rebuilding all of the indexes or export and reimport all of the databases using db2ldif and ldif2db.

Syntax verify-db.pl

[ -a /path/to/database_directory ] [ -? ]

Options

Option

-a path

Description

Gives the path to the database directory. If this option is not passed with the verify-

321

Chapter 7. Command-Line Scripts

Option

Table 7.34. verify-db.pl Options

Description db.pl

command, then it uses the default database directory, /var/lib/dirsrv/ slapd-instance_name/db .

Opens the help page.

322

Appendix A. Using the ns-slapd

Command-Line Utilities

Chapter 7, Command-Line Scripts

discussed the scripts for performing routine administration tasks on the Red Hat Directory Server (Directory Server). This appendix discusses the ns-slapd commandline utilities that can be used to perform the same tasks.

The ns-slapd command-line utilities all perform server administration tasks, and, while it can be argued that they allow a greater degree of flexibility for users, Red Hat recommends using the command-line scripts described in

Chapter 7, Command-Line Scripts

A.1. Overview of ns-slapd

ns-slapd is used to start the Directory Server process, to build a directory database from an LDIF file, or to convert an existing database to an LDIF file. For more information on starting and stopping the Directory Server, importing from LDIF using the command-line, and exporting to LDIF using the command-line, refer to the "Populating Directory Databases" chapter in the Red Hat Directory Server

Administrator's Guide.

A.2. Finding and Executing the ns-slapd Command-Line

Utilities

The ns-slapd command-line utilities are stored in /etc/dirsrv/slapd-instance_name

NOTE

In order to execute the command-line utilities, set the library paths set in the command-line scripts.

A.3. Utilities for Exporting Databases: db2ldif

Exports the contents of the database to LDIF.

Syntax ns-slapd db2ldif -D configDir -a outputFile [ -d debugLevel ] [ -n backendInstance ] [ r ] [ -s includeSuffix ] [ -x excludeSuffix ] [ -N ] [ -u ] [ -U ] [ -m ] [ -M ] [ -E ]

With this command, enter the full path to the configuration directory, /etc/dirsrv/ slapd-instance_name . Either the -n or the -s option must be specified.

Options

Option

-a outputFile

Description

Defines the output file in which the server saves the exported LDIF. This file is stored by default in the directory where the command-line utility resides.

323

Appendix A. Using the ns-slapd Command-Line Utilities

Option

-d debugLevel

-D configDir

-E

-m

-M

-n backendInstance

-N

-r

-s includeSuffix

-u

-U

-x excludeSuffix

Description

Specifies the debug level to use during the db2ldif runtime. For further information, refer

to Section 2.3.1.44, “nsslapd-errorlog-level (Error

Log Level)”

Specifies the location of the server configuration directory that contains the configuration information for the export process. This must be the full path to the configuration directory, /etc/ dirsrv/slapd-instance_name .

Decrypts an encrypted database during export.

This option is used only if database encryption is enabled.

Sets minimal base-64 encoding.

Uses several files to store the output LDIF, with each instance stored in instance filename, where

filename is the filename specified in option -a.

Specifies the name of the backend instance to be exported.

Specifies that entry IDs are not to be included in the LDIF output. The entry IDs are necessary only if the db2ldif output is to be used as input to db2index.

Exports replication state information. The server

must be shut down before exporting using this option.

Specifies the suffix or suffixes to include in the export. There can be multiple -s arguments.

Specifies that the unique ID will not be included in the LDIF output. By default, the server includes the unique ID for all entries with a unique ID in the exported LDIF file. Only use this option to use the exported LDIF to initialize a 4.x

consumer server; otherwise, this option does not cause the server to create a unique ID for entries but simply takes what already exists in the database.

Outputs the contents of the database without wrapping lines.

Specifies a suffix or suffixes to exclude in the export. There can be multiple -x arguments.

If neither -s or -x is not specified, the server exports all suffixes within the database. When using both -x and -s options with the same suffix, the -x operation takes precedence.

Exclusion always takes precedence over inclusion. If the LDIF file will be imported into

324

Utilities for Restoring and Backing up Databases: ldif2db

Option Description the configuration directory, do not exclude o=NetscapeRoot .

Table A.1. db2ldif Options

A.4. Utilities for Restoring and Backing up Databases: ldif2db

Imports LDIF files to the database.

Syntax ns-slapd ldif2db -D configDir -i ldifFile [ -d debugLevel ] [ -g string ] [ -n backendInstance ] [ -O ] [ -s includeSuffix ] [ -x excludeSuffix ] [ -E ]

Enter the full path to the server configuration directory (configdir). ldifFile is the name of the file containing the LDIF to be imported. There is an example LDIF file under the /var/lib/dirsrv/ slapd-instance_name/ldif directory. Either the -n or the -s option must be specified.

Options

Option

-d debugLevel

-D configDir

-E

-g string

Description

Specifies the debug level to use during runtime.

For further information, refer to

Section 2.3.1.44,

“nsslapd-errorlog-level (Error Log Level)”

Specifies the location of the server configuration directory that contains the configuration information for the import process. This must be the full path to the configuration directory, /etc/ dirsrv/slapd-instance_name .

Decrypts an encrypted database during export.

This option is used only if database encryption is enabled.

Generates a unique ID. Type none for no unique

ID to be generated and deterministic for the generated unique ID to be name-based. By default, a time-based unique ID is generated.

When using the deterministic generation to have a name-based unique ID, it is also possible to specify the namespace for the server to use, as follows:

-g deterministic namespaceId

namespaceId is a string of characters in the format 00-xxxxxxxx-xxxxxxxx-xxxxxxxx- xxxxxxxx .

325

Appendix A. Using the ns-slapd Command-Line Utilities

Option

-i ldifFile

-n backendInstance

-O

-s includeSuffix

-x excludeSuffix

Description

Use this option to import the same LDIF file into two different Directory Servers and the contents of both directories should have the same set of unique IDs. If unique IDs already exist in the

LDIF file being imported, then the existing IDs are imported to the server, regardless of the options specified.

Specifies the LDIF file to be imported. This option is required. There can be multiple -i arguments to import more than one LDIF file at a time. When importing multiple files, the server imports the LDIF files in the order they are specified on the command line.

Specifies the name of the backend to be imported.

Specifies that no attribute indexes are created for the imported database. If this option is specified and the indexes need to be restored later, the indexes have to be recreated by hand. See the

Directory Server Administrator's Guide for further information.

Specifies the suffix or suffixes within the LDIF file to import.

Specifies suffixes within the LDIF file to exclude during the import. There can be multiple -x arguments. This option can selectively import portions of the LDIF file. If both -x and -s are used with the same suffix, -x takes precedence.

Exclusion always takes precedence over inclusion. If -x or -s are not specified, then all available suffixes will be imported from the LDIF file. To import the LDIF file into the configuration directory, do not exclude o=NetscapeRoot.

Table A.2. ldif2db Options

A.5. Utilities for Restoring and Backing up Databases: archive2db

Restores database from the archives.

Syntax ns-slapd archive2db -D configDir -a archiveDir

326

Utilities for Restoring and Backing up Databases: db2archive

Options

Option

-D configDir

Description

Specifies the location of the server configuration directory that contains the configuration information for the index creation process. This must be the full path to the configuration directory, /etc/dirsrv/ slapd-instance_name .

Specifies the archive directory.

-a archiveDir

Table A.3. archive2db Options

A.6. Utilities for Restoring and Backing up Databases: db2archive

Backs up all databases to the archives.

Syntax ns-slapd db2archive -D configDir -a archiveDir

Options

Option

-D configDir

Description

Specifies the archive directory.

-a archiveDir

Table A.4. db2archive Options

A.7. Utilities for Creating and Regenerating Indexes: db2index

Creates and regenerates indexes.

Syntax ns-slapd db2index -D configDir [ -d debugLevel ] -n backendName -t attributeName[:indexTypes{:matchingRules}] [ -T vlvTag ]

Options

Option

-d debugLevel

Description

Specifies the debug level to use during index creation. For further information, refer to

327

Appendix A. Using the ns-slapd Command-Line Utilities

Option

-D configDir

-n backendName

-t attributeName[:indextypes(:mathingrules)]

-T vlvTag

Description

Section 2.3.1.44, “nsslapd-errorlog-level (Error

Log Level)”

Specifies the name of the backend containing the entries to index.

Specifies the attribute to be indexed as well as the types of indexes to create and matching rules to apply, if any. If the matching rule is specified, an index type must be specified. This option cannot be used with -T. indexTypes specifies a comma-separated list of indexes to be created for the attributes. matchingRules is an optional, comma-separated list of the OIDs for the languages in which the attribute will be indexed.

This option is used to create international indexes. For information on supported locales and collation order OIDs, see the Appendix

"Internationalization" in the Directory Server

Administrator's Guide.

Specifies the VLV tag to use to create VLV indexes. The Console can be used to specify

VLV tags for each database supporting the directory tree, as described in the Directory

Server Administrator's Guide. Additional

VLV tags can be defined by creating them in

LDIF and adding them in the Directory Server configuration. This options cannot be used with - t .

Table A.5. db2index Options

328

Glossary

A access control instruction access control list access rights account inactivation

ACI

ACL

All IDs Threshold

All IDs token anonymous access approximate index attribute attribute list authenticating directory server

See

ACI .

See

ACL .

In the context of access control, specify the level of access granted or denied. Access rights are related to the type of operation that can be performed on the directory. The following rights can be granted or denied: read, write, add, delete, search, compare, selfwrite, proxy and all.

Disables a user account, group of accounts, or an entire domain so that all authentication attempts are automatically rejected.

An instruction that grants or denies permissions to entries in the directory.

See Also

access control instruction

The mechanism for controlling access to your directory.

See Also

access control list

Replaced with the ID list scan limit in Directory Server version 7.1.

A size limit which is globally applied to every index key managed by the server. When the size of an individual ID list reaches this limit, the server replaces that ID list with an All IDs token.

See Also

ID list scan limit

A mechanism which causes the server to assume that all directory entries match the index key. In effect, the All IDs token causes the server to behave as if no index was available for the search request.

When granted, allows anyone to access directory information without providing credentials, and regardless of the conditions of the bind.

Allows for efficient approximate or "sounds-like" searches.

Holds descriptive information about an entry. Attributes have a label and a value. Each attribute also follows a standard syntax for the type of information that can be stored as the attribute value.

A list of required and optional attributes for a given entry type or object class.

In pass-through authentication (PTA), the authenticating Directory

Server is the Directory Server that contains the authentication credentials of the requesting client. The PTA-enabled host sends PTA requests it receives from clients to the host.

329

Glossary authentication authentication certificate

(1) Process of proving the identity of the client user to the Directory

Server. Users must provide a bind DN and either the corresponding password or certificate in order to be granted access to the directory.

Directory Server allows the user to perform functions or access files and directories based on the permissions granted to that user by the directory administrator.

(2) Allows a client

to make sure they are connected to a secure server, preventing another computer from impersonating the server or attempting to appear secure when it is not.

Digital file that is not transferable and not forgeable and is issued by a third party. Authentication certificates are sent from server to client or client to server in order to verify and authenticate the other party.

B base distinguished name base DN bind distinguished name bind DN bind rule branch entry browser browsing index

See

base DN .

Base distinguished name. A search operation is performed on the base DN, the DN of the entry and all entries below it in the directory tree.

See

bind DN .

Distinguished name used to authenticate to Directory Server when performing an operation.

In the context of access control, the bind rule specifies the credentials and conditions that a particular user or client must satisfy in order to get access to directory information.

An entry that represents the top of a subtree in the directory.

Software, such as Mozilla Firefox, used to request and view World

Wide Web material stored as HTML files. The browser uses the HTTP protocol to communicate with the host server.

Speeds up the display of entries in the Directory Server Console.

Browsing indexes can be created on any branch point in the directory tree to improve display performance.

See Also

virtual list view index .

CA cascading replication

See

Certificate Authority

In a cascading replication scenario, one server, often called the hub supplier, acts both as a consumer and a supplier for a particular replica. It holds a read-only replica and maintains a changelog. It receives updates from the supplier server that holds the master copy of the data and in turn supplies those updates to the consumer.

330

chaining changelog character type ciphertext class definition class of service classic CoS client code page collation order consumer consumer server certificate

Certificate Authority

CGI

A collection of data that associates the public keys of a network user with their DN in the directory. The certificate is stored in the directory as user object attributes.

Company or organization that sells and issues authentication certificates. You may purchase an authentication certificate from a

Certification Authority that you trust. Also known as a

Common Gateway Interface. An interface for external programs to communicate with the HTTP server. Programs written to use CGI are called CGI programs or CGI scripts and can be written in many of the common programming languages. CGI programs handle forms or perform output parsing that is not done by the server itself.

A method for relaying requests to another server. Results for the request are collected, compiled, and then returned to the client.

A changelog is a record that describes the modifications that have occurred on a replica. The supplier server then replays these modifications on the replicas stored on replica servers or on other masters, in the case of multi-master replication.

Distinguishes alphabetic characters from numeric or other characters and the mapping of upper-case to lower-case letters.

Encrypted information that cannot be read by anyone without the proper key to decrypt the information.

Specifies the information needed to create an instance of a particular object and determines how the object works in relation to other objects in the directory.

See

CoS .

A classic CoS identifies the template entry by both its DN and the value of one of the target entry's attributes.

See

LDAP client .

An internal table used by a locale in the context of the internationalization plug-in that the operating system uses to relate keyboard keys to character font screen displays.

Provides language and cultural-specific information about how the characters of a given language are to be sorted. This information might include the sequence of letters in the alphabet or how to compare letters with accents to letters without accents.

Server containing replicated directory trees or subtrees from a supplier server.

In the context of replication, a server that holds a replica that is copied from a different server is called a consumer for that replica.

331

Glossary

CoS

CoS definition entry

CoS template entry

D daemon

A method for sharing attributes between entries in a way that is invisible to applications.

Identifies the type of CoS you are using. It is stored as an LDAP subentry below the branch it affects.

Contains a list of the shared attribute values.

See Also

template entry .

332

DNS alias

E entry entry distribution entry ID list equality index

F file extension file type filter filtered role

G general access

GSS-API

IP address for a hostname from a DNS server, or they look it up in tables maintained on their systems.

A DNS alias is a hostname that the DNS server knows points to a different host�specifically a DNS CNAME record. Machines always have one real name, but they can have one or more aliases. For example, an alias such as www.yourdomain.domain might point to a real machine called realthing.yourdomain.domain where the server currently exists.

A group of lines in the LDIF file that contains information about an object.

Method of distributing directory entries across more than one server in order to scale to support large numbers of entries.

Each index that the directory uses is composed of a table of index keys and matching entry ID lists. The entry ID list is used by the directory to build a list of candidate entries that may match the client application's search request.

Allows you to search efficiently for entries containing a specific attribute value.

The section of a filename after the period or dot (.) that typically defines the type of file (for example, .GIF and .HTML). In the filename index.html

the file extension is html.

The format of a given file. For example, graphics files are often saved in GIF format, while a text file is usually saved as ASCII text format. File types are usually identified by the file extension (for example, .GIF or .HTML).

A constraint applied to a directory query that restricts the information returned.

Allows you to assign entries to the role depending upon the attribute contained by each entry. You do this by specifying an LDAP filter.

Entries that match the filter are said to possess the role.

When granted, indicates that all authenticated users can access directory information.

Generic Security Services. The generic access protocol that is the native way for UNIX-based systems to access and authenticate

Kerberos services; also supports session encryption.

333

Glossary

H hostname

HTML

HTTP

HTTPD

HTTPS hub

A name for a machine in the form machine.domain.dom, which is translated into an IP address. For example, www.example.com is the machine www in the subdomain example and com domain.

Hypertext Markup Language. The formatting language used for documents on the World Wide Web. HTML files are plain text files with formatting codes that tell browsers such as the Mozilla Firefox how to display text, position graphics, and form items and to display links to other pages.

Hypertext Transfer Protocol. The method for exchanging information between HTTP servers and clients.

An abbreviation for the HTTP daemon or service, a program that serves information using the HTTP protocol. The daemon or service is often called an httpd.

A secure version of HTTP, implemented using the Secure Sockets

Layer, SSL.

In the context of replication, a server that holds a replica that is copied from a different server, and, in turn, replicates it to a third server.

See Also

cascading replication .

ID list scan limit index key indirect CoS international index

International Standards

Organization

IP address

ISO

K knowledge reference

A size limit which is globally applied to any indexed search operation.

When the size of an individual ID list reaches this limit, the server replaces that ID list with an all IDs token.

Each index that the directory uses is composed of a table of index keys and matching entry ID lists.

An indirect CoS identifies the template entry using the value of one of the target entry's attributes.

Speeds up searches for information in international directories.

See

ISO

Also Internet Protocol address. A set of numbers, separated by dots, that specifies the actual location of a machine on the Internet (for example, 198.93.93.10).

International Standards Organization.

Pointers to directory information stored in different databases.

334

LDAP

LDAP client

LDAP Data Interchange

Format

LDAP URL

LDAPv3

LDBM database

LDIF leaf entry

Lightweight Directory

Access Protocol locale

Lightweight Directory Access Protocol. Directory service protocol designed to run over TCP/IP and across multiple platforms.

Software used to request and view LDAP entries from an LDAP

Directory Server.

See Also

browser

See

LDAP Data Interchange Format .

Provides the means of locating Directory Servers using DNS and then completing the query via LDAP. A sample LDAP URL is ldap:// ldap.example.com

Version 3 of the LDAP protocol, upon which Directory Server bases its schema format.

A high-performance, disk-based database consisting of a set of large files that contain all of the data assigned to it. The primary data store in Directory Server.

LDAP Data Interchange Format. Format used to represent Directory

Server entries in text form.

An entry under which there are no other entries. A leaf entry cannot be a branch point in a directory tree.

See

LDAP .

Identifies the collation order, character type, monetary format and time / date format used to present data for users of a specific region, culture, and/or custom. This includes information on how data of a given language is interpreted, stored, or collated. The locale also indicates which code page should be used to represent a given language.

M managed object managed role management information base mapping tree

A standard value which the SNMP agent can access and send to the

NMS. Each managed object is identified with an official name and a numeric identifier expressed in dot-notation.

Allows creation of an explicit enumerated list of members.

See

MIB

A data structure that associates the names of suffixes (subtrees) with databases.

335

Glossary master master agent matching rule

MD5

MD5 signature

MIB

MIB namespace monetary format multi-master replication

See

supplier

See

SNMP master agent .

Provides guidelines for how the server compares strings during a search operation. In an international search, the matching rule tells the server what collation order and operator to use.

A message digest algorithm by RSA Data Security, Inc., which can be used to produce a short digest of data that is unique with high probability and is mathematically extremely hard to produce; a piece of data that will produce the same message digest.

A message digest produced by the MD5 algorithm.

Management Information Base. All data, or any portion thereof, associated with the SNMP network. We can think of the MIB as a database which contains the definitions of all SNMP managed objects. The MIB has a tree-like hierarchy, where the top level contains the most general information about the network and lower levels deal with specific, separate network areas.

Management Information Base namespace. The means for directory

data to be named and referenced. Also called the directory tree .

Specifies the monetary symbol used by specific region, whether the symbol goes before or after its value, and how monetary units are represented.

An advanced replication scenario in which two servers each hold a copy of the same read-write replica. Each server maintains a changelog for the replica. Modifications made on one server are automatically replicated to the other server. In case of conflict, a time stamp is used to determine which server holds the most recent version.

The server containing the database link that communicates with the remote server.

multiplexor

N n + 1 directory problem name collisions nested role network management application network management station

The problem of managing multiple instances of the same information in different directories, resulting in increased hardware and personnel costs.

Multiple entries with the same distinguished name.

Allows the creation of roles that contain other roles.

Network Management Station component that graphically displays information about SNMP managed devices, such as which device is up or down and which and how many error messages were received.

See

NMS .

336

NIS

NMS ns-slapd

Network Information Service. A system of programs and data files that Unix machines use to collect, collate, and share specific information about machines, users, filesystems, and network parameters throughout a network of computers.

Powerful workstation with one or more network management applications installed. Also

network management station

Red Hat's LDAP Directory Server daemon or service that is responsible for all actions of the Directory Server.

See Also

slapd .

O object class object identifier

OID operational attribute

Defines an entry type in the directory by defining which attributes are contained in the entry.

A string, usually of decimal numbers, that uniquely identifies a schema element, such as an object class or an attribute, in an objectoriented system. Object identifiers are assigned by ANSI, IETF or similar organizations.

See Also

OID .

See

object identifier

Contains information used internally by the directory to keep track of modifications and subtree properties. Operational attributes are not returned in response to a search unless explicitly requested.

P parent access pass-through authentication pass-through subtree password file password policy

PDU

When granted, indicates that users have access to entries below their own in the directory tree if the bind DN is the parent of the targeted entry.

See

PTA .

In pass-through authentication, the

PTA directory server

will pass through bind requests to the

authenticating directory server

from all clients whose DN is contained in this subtree.

A file on Unix machines that stores Unix user login names, passwords, and user ID numbers. It is also known as /etc/passwd because of where it is kept.

A set of rules that governs how passwords are used in a given directory.

Encoded messages which form the basis of data exchanges between

SNMP devices. Also

protocol data unit .

337

Glossary permission pointer CoS presence index protocol protocol data unit proxy authentication proxy DN

PTA

PTA directory server

PTA LDAP URL

RAM rc.local

RDN read-only replica read-write replica

In the context of access control, permission states whether access to the directory information is granted or denied and the level of access that is granted or denied.

See Also

access rights

A pointer CoS identifies the template entry using the template DN only.

Allows searches for entries that contain a specific indexed attribute.

A set of rules that describes how devices on a network exchange information.

See

PDU

A special form of authentication where the user requesting access to the directory does not bind with its own DN but with a proxy DN.

Used with proxied authorization. The proxy DN is the DN of an entry that has access permissions to the target on which the clientapplication is attempting to perform an operation.

Mechanism by which one Directory Server consults another to check

bind credentials. Also pass-through authentication

In pass-through authentication (

PTA ), the PTA Directory Server is the

server that sends (passes through) bind requests it receives to the

authenticating directory server .

In pass-through authentication, the URL that defines the

authenticating directory server , pass-through subtree(s), and optional

parameters.

Random access memory. The physical semiconductor-based memory in a computer. Information stored in RAM is lost when the computer is shut down.

A file on Unix machines that describes programs that are run when the machine starts. It is also called /etc/rc.local because of its location.

The name of the actual entry itself, before the entry's ancestors have been appended to the string to form the full distinguished name. Also

relative distinguished name

A replica that refers all update operations to read-write replicas. A server can hold any number of read-only replicas.

A replica that contains a master copy of directory information and can be updated. A server can hold any number of read-write replicas.

338

referential integrity referral relative distinguished name replica replica-initiated replication replication replication agreement

RFC role role-based attributes root

Mechanism that ensures that relationships between related entries are maintained within the directory.

(1) When a server receives a search or update request from an LDAP client that it cannot process, it usually sends back to the client a pointer to the LDAP sever that can process the request.

(2) In the context of replication, when a read-only replica receives an update request, it forwards it to the server that holds the corresponding read-write replica. This forwarding process is called a referral.

See

RDN

A database that participates in replication.

Replication configuration where replica servers, either hub or consumer servers, pull directory data from supplier servers. This method is available only for legacy replication.

Act of copying directory trees or subtrees from supplier servers to replica servers.

Set of configuration parameters that are stored on the supplier server and identify the databases to replicate, the replica servers to which the data is pushed, the times during which replication can occur, the

DN and credentials used by the supplier to bind to the consumer, and how the connection is secured.

Request for Comments. Procedures or standards documents submitted to the Internet community. People can send comments on the technologies before they become accepted standards.

An entry grouping mechanism. Each role has members, which are the entries that possess the role.

Attributes that appear on an entry because it possesses a particular role within an associated CoS template.

The most privileged user available on Unix machines. The root user has complete access privileges to all files on the machine.

The parent of one or more sub suffixes. A directory tree can contain more than one root suffix.

root suffix

SASL schema

An authentication framework for clients as they attempt to bind to a directory. Also

Simple Authentication and Security Layer

Definitions describing what types of information can be stored as entries in the directory. When information that does not match the schema is stored in the directory, clients attempting to access the directory may be unable to display the proper results.

339

Glossary schema checking

Secure Sockets Layer self access

Server Console server daemon

Server Selector server service service

SIE

Simple Authentication and

Security Layer

Simple Network

Management Protocol single-master replication

SIR slapd

SNMP

SNMP master agent

SNMP subagent

Ensures that entries added or modified in the directory conform to the defined schema. Schema checking is on by default, and users will receive an error if they try to save an entry that does not conform to the schema.

See

SSL .

When granted, indicates that users have access to their own entries if the bind DN matches the targeted entry.

Java-based application that allows you to perform administrative management of your Directory Server from a GUI.

The server daemon is a process that, once running, listens for and accepts requests from clients.

Interface that allows you select and configure servers using a browser.

A process on Windows that, once running, listens for and accepts requests from clients. It is the SMB server on Windows NT.

A background process on a Windows machine that is responsible for a particular system task. Service processes do not need human intervention to continue functioning.

Server Instance Entry. The ID assigned to an instance of Directory

Server during installation.

See

SASL .

See

SNMP .

The most basic replication scenario in which multiple servers, up to four, each hold a copy of the same read-write replicas to replica servers. In a single-master replication scenario, the supplier server maintains a changelog.

See

supplier-initiated replication

LDAP Directory Server daemon or service that is responsible for most functions of a directory except replication.

See Also

ns-slapd .

Used to monitor and manage application processes running on the servers by exchanging data about network activity. Also

Simple

Network Management Protocol .

Software that exchanges information between the various subagents and the NMS.

Software that gathers information about the managed device and

passes the information to the master agent. Also called a subagent

340

SSL standard index sub suffix subagent substring index suffix superuser supplier supplier server supplier-initiated replication symmetric encryption

A software library establishing a secure connection between two parties (client and server) used to implement HTTPS, the secure

version of HTTP. Also called Secure Sockets Layer .

index maintained by default.

A branch underneath a root suffix.

See

SNMP subagent .

Allows for efficient searching against substrings within entries.

Substring indexes are limited to a minimum of two characters for each entry.

The name of the entry at the top of the directory tree, below which data is stored. Multiple suffixes are possible within the same directory.

Each database only has one suffix.

The most privileged user available on Unix machines. The superuser has complete access privileges to all files on the machine. Also called

root .

Server containing the master copy of directory trees or subtrees that are replicated to replica servers.

In the context of replication, a server that holds a replica that is copied to a different server is called a supplier for that replica.

Replication configuration where supplier servers replicate directory

data to any replica servers.

Encryption that uses the same key for both encrypting and decrypting.

DES is an example of a symmetric encryption algorithm.

Cannot be deleted or modified as it is essential to Directory Server operations.

system index

T target target entry

TCP/IP template entry time/date format

TLS

In the context of access control, the target identifies the directory information to which a particular ACI applies.

The entries within the scope of a CoS.

Transmission Control Protocol/Internet Protocol. The main network protocol for the Internet and for enterprise (company) networks.

See

CoS template entry .

Indicates the customary formatting for times and dates in a specific region.

The new standard for secure socket layers; a public key based protocol. Also

Transport Layer Security .

341

Glossary topology

Transport Layer Security

U uid

URL

The way a directory tree is divided among physical servers and how these servers link with one another.

See

TLS

A unique number associated with each user on a Unix system.

Uniform Resource Locater. The addressing system used by the server and the client to request documents. It is often called a location. The format of a URL is protocol://machine:port/document.

The port number is necessary only on selected servers, and it is often assigned by the server, freeing the user of having to place it in the

URL.

V virtual list view index Speeds up the display of entries in the Directory Server Console.

Virtual list view indexes can be created on any branch point in the directory tree to improve display performance.

See Also

browsing index .

X.500 standard The set of ISO/ITU-T documents outlining the recommended information model, object classes and attributes used by directory server implementation.

342

Index

Symbols

00core.ldif

01common.ldif

05rfc2247.ldif

05rfc2927.ldif

10presence.ldif

10rfc2307.ldif

20subscriber.ldif

25java-object.ldif

28pilot.ldif

30ns-common.ldif

50ns-admin.ldif

50ns-certificate.ldif

50ns-directory.ldif

50ns-mail.ldif

50ns-value.ldif

50ns-web.ldif

99user.ldif

::, in LDIF statements, 273

A access log

abandon message (ABANDON) , 226 change sequence number (csn) , 226

connection description (conn) , 228

connection number (conn) , 221

elapsed time (etime) , 223

error number (err) , 222

extended operation OID (oid) , 225

file descriptor (fd) , 221

format , 219

LDAP request type , 223

LDAP response type , 224

message ID (msgid) , 226

method type (method) , 222

number of entries (nentries) , 223

operation number (op) , 221

options description (options) , 228

SASL multi-stage binds , 227

scope of the search (scope) , 225

slot number (slot) , 221

sort (SORT) , 224

tag number (tag) , 222

unindexed search indicator (notes=U) , 224

version number (version) , 222

VLV-related entries , 224

LDAP result codes, 237

levels, 220, 227

sample 1 (level 256) , 220

statistics for monitoring and optimizing

directory usage, 302

alias dereferencing, 252

ancestorid.db4 file, 215

backendMonitorDN attribute, 99

backup files, 214

bak2db

command-line shell script, 280

command-line perl script, 295

bak2db.pl

base, 273 base 64 encoding, 273

basedn, 119

binary data, LDIF and, 273

Browsing Indexes, 294

bytessent attribute, 98

343

Index

C changelog

multi-master replication changelog, 71

changeLog, 73

changelog configuration attributes

changelogmaxentries, 72

nsslapd-changelogdir, 71

nsslapd-changelogmaxage, 72

changelog configuration entries

cn=changelog5, 71

changeLogEntry, 120

changeNumber, 73 changes, 73 changeTime, 73 changeType, 73

cl-dump

command-line shell script, 281

command-line perl script, 296

cl-dump.pl

nsArchiveDir, 115 nsDatabaseTypes, 115

cn, 105

cn attribute, 85

cn=backup attributes

configuration entry, 114

cn=changelog5

changelog configuration entries, 71 object classes, 71

cn=config

general, 3

general configuration entries, 10 object classes, 10

cn=config Directory Information Tree

configuration data, 3

cn=encrypted attributes, 194 attribute, 194 object class, 194

cn=encryption

encryption configuration entries, 75 object classes, 75

cn=export attributes

nsDumpUniqId, 114

nsExcludeSuffix, 112

nsExportReplica, 113

nsFilename, 112 nsIncludeSuffix, 112 nsInstance, 112

344

configuration entry, 111

cn=import attributes

nsExcludeSuffix, 109 nsFilename, 109

nsImportChunkSize, 110 nsImportIndexAttrs, 110

nsIncludeSuffix, 109 nsInstance, 109

nsUniqueIdGenerator, 110

nsUniqueIdGeneratorNamespace, 111

configuration entry, 105, 108

cn=index attributes

nsIndexAttribute, 117 nsIndexVLVAttribute, 117

configuration entry, 116

cn=mapping tree

object classes, 78 suffix and replication configuration entries, 78

cn=memberof task attributes

basedn, 119

filter, 120

configuration entry, 119

cn=monitor

object classes, 97 read-only monitoring configuration entries, 97

cn=restore attributes

nsArchiveDir, 116 nsDatabaseTypes, 116

configuration entry, 115

cn=sasl

object classes, 99

SASL configuration entries, 99

cn=schema reload task attributes

schemadir, 119

configuration entry, 118

cn=SNMP

object classes, 100

SNMP configuration entries, 100

cn=tasks attributes

cn, 105

nsTaskCancel, 107

nsTaskCurrentItem, 106 nsTaskExitCode, 106 nsTaskLog, 106

nsTaskStatus, 105, 107 ttl, 107

entries, 104 task invocation configuration entries, 104

cn=uniqueid generator

object classes, 120 uniqueid generator configuration entries, 120

cn=UserRoot

configuration, 7

command-line scripts, 277 finding and executing, 277

location of perl scripts, 278

location of shell scripts, 277

migrate-ds-admin.pl, 308

db2index.pl , 298 db2ldif.pl , 298

fixup-memberof.pl, 300 ldif2db.pl , 300

ns-accountstatus.pl , 310 ns-activate.pl , 310

ns-inactivate.pl , 311

ns-newpwpolicy.pl , 312

repl-monitor.pl , 314

schema-reload.pl , 317

verify-db.pl , 321

restoreconfg , 292 saveconfig , 292 start-slapd , 292

setup-ds-admin.pl, 319

stop-slapd, 293 suffix2instance , 293

vlvindex , 294

command-line utilities

dbscan, 274

ds_removal, 285

finding and executing, 239

configuration

access control, 7 accessing and modifying, 7

changing attributes, 8

plug-in functionality, 6

configuration attributes

changelog5 configuration attributes, 71

changing, 8

core server configuration attributes, 10

database link plug-in configuration attributes,

195

database plug-in configuration attributes, 165

encryption configuration attributes, 75

mapping tree configuration attributes, 78

monitoring configuration attributes, 97

overview, 6

plug-in functionality configuration attributes,

161

plug-in functionality configuration attributes

allowed by certain plug-ins, 164

plug-in functionality configuration attributes

common to all plug-ins, 161

replication agreement configuration attributes,

replication configuration attributes, 79

restrictions to modifying, 9

345

Index retro changelog plug-in configuration

attributes, 205

SASL configuration attributes, 99

SNMP configuration attributes, 100

suffix configuration attributes, 78

synchronization agreement attributes, 94

task configuration attributes, 104

cn=memberof task, 119

cn=restore, 115

cn=schema reload task, 118

uniqueid generator configuration attributes,

120

configuration changes

requiring server restart, 9

configuration entries

modifying using LDAP, 8

restrictions to modifying, 9

configuration files, 214

location of, 7

configuration information tree

dse.ldif file, 10

connection attribute, 97

connection code, 229

core configuration attributes

passwordAllowChangeTime, 58

passwordExpirationTime, 60 passwordExpWarned, 60

passwordGraceUserTime, 61

retryCountResetTime, 70

core server configuration attributes

current connection, 98 currenttime, 98

description, 85

dTableSize, 98 entriessent, 98

filter, 120

nbackends, 99

nsArchiveDir, 115, 116 nsDatabaseTypes, 115, 116

nsDS50ruv, 94

nsDS5BeginReplicaRefresh, 91

nsDS5Flags, 79

nsDS5ReplConflict, 80 nsDS5ReplicaBindDN, 80

nsDS5ReplicaBindMethod, 86 nsDS5ReplicaBusyWaitTime, 86

nsDS5ReplicaChangeCount, 81

nsDS5ReplicaChangesSentSinceStartup, 87 nsDS5ReplicaCredentials, 87 nsDS5ReplicaHost, 87

nsDS5ReplicaID, 81

nsDS5ReplicaLastInitEnd, 88 nsDS5ReplicaLastInitStart, 88 nsDS5ReplicaLastInitStatus, 88

nsDS5ReplicaLastUpdateEnd, 89 nsDS5ReplicaLastUpdateStart, 89

nsDS5ReplicaLastUpdateStatus, 90

nsDS5ReplicaLegacyConsumer, 81

nsDS5ReplicaName, 82

nsDS5ReplicaPort, 90

nsDS5ReplicaPurgeDelay, 82

nsDS5ReplicaReapActive, 90

nsDS5ReplicaReferral, 83 nsDS5ReplicaRoot, 83

nsDS5ReplicaSessionPauseTime, 91

nsDS5ReplicatedAttributeList, 92 nsDS5ReplicaTimeout, 92

nsDS5ReplicaTombstonePurgeInterval, 83

nsDS5ReplicaTransportInfo, 93

nsDS5ReplicaType, 84

nsDS5ReplicaUpdateInProgress, 93 nsDS5ReplicaUpdateSchedule, 93

nsds5Task, 85

nsDumpUniqId, 114

nsExcludeSuffix, 109, 112

nsExportReplica, 113

nsFilename, 109, 112

nsImportChunkSize, 110 nsImportIndexAttrs, 110

nsIncludeSuffix, 109, 112

nsIndexAttribute, 117 nsIndexVLVAttribute, 117

nsInstance, 109, 112

nsNoWrap, 114

nsPrintKey, 113

nsruvReplicaLastModified, 94

nsSaslMapBaseDNTemplate, 99

nsSaslMapFilterTemplate, 100 nsSaslMapRegexString, 100

nsslapd-accesslog, 11 nsslapd-accesslog-level, 11

nsslapd-accesslog-list, 12 nsslapd-accesslog-logbuffering, 12

346

nsslapd-accesslog-logexpirationtime, 13 nsslapd-accesslog-logexpirationtimeunit, 13 nsslapd-accesslog-logging-enabled, 13

nsslapd-accesslog-logmaxdiskspace, 14

nsslapd-accesslog-logminfreediskspace, 15 nsslapd-accesslog-logrotationsync-enabled, 15 nsslapd-accesslog-logrotationsynchour, 15

nsslapd-accesslog-logrotationsyncmin, 16 nsslapd-accesslog-logrotationtime, 16

nsslapd-accesslog-maxlogsize, 17 nsslapd-accesslog-maxlogsperdir, 17

nsslapd-accesslog-mode, 18 nsslapd-allow-unauthenticated-binds, 18

nsslapd-attribute-name-exceptions, 19

nsslapd-auditlog-list, 20 nsslapd-auditlog-logexpirationtime, 20

nsslapd-auditlog-logexpirationtimeunit, 21 nsslapd-auditlog-logging-enabled, 21

nsslapd-auditlog-logmaxsdiskspace, 22 nsslapd-auditlog-logminfreediskspace, 22 nsslapd-auditlog-logrotationsync-enabled, 22

nsslapd-auditlog-logrotationsynchour, 23 nsslapd-auditlog-logrotationsyncmin, 23 nsslapd-auditlog-logrotationtime, 23

nsslapd-auditlog-logrotationtimeunit, 24 nsslapd-auditlog-maxlogsize, 24

nsslapd-auditlog-maxlogsperdir, 25 nsslapd-auditlog-mode, 25

nsslapd-backend, 79

nsslapd-certmap-basedn, 26

nsslapd-changelogdir, 71

nsslapd-changelogmaxage, 72 nsslapd-changelogmaxentries, 72

nsslapd-config, 27 nsslapd-conntablesize, 27 nsslapd-counters, 27

nsslapd-csnlogging, 28 nsslapd-ds4-compatible-schema, 28

nsslapd-errorlog, 29

nsslapd-errorlog-level, 30

nsslapd-errorlog-list, 31 nsslapd-errorlog-logexpirationtime, 31 nsslapd-errorlog-logexpirationtimeunit, 31

nsslapd-errorlog-logging-enabled, 32 nsslapd-errorlog-logmaxdiskspace, 32 nsslapd-errorlog-logminfreediskspace, 32

nsslapd-errorlog-logrotationsync-enabled, 33 nsslapd-errorlog-logrotationsynchour, 33

nsslapd-errorlog-logrotationsyncmin, 34 nsslapd-errorlog-logrotationtime, 34 nsslapd-errorlog-logrotationtimeunit, 34

nsslapd-errorlog-maxlogsize, 35 nsslapd-errorlog-maxlogsperdir, 35

nsslapd-errorlog-mode, 36 nsslapd-groupvalnestlevel, 36

nsslapd-idletimeout, 37 nsslapd-instancedir, 37 nsslapd-ioblocktimeout, 37

nsslapd-lastmod, 38 nsslapd-ldapiautobind, 38

nsslapd-ldapientrysearchbase, 39 nsslapd-ldapifilepath, 39

nsslapd-ldapigidnumbertype, 40 nsslapd-ldapilisten, 40 nsslapd-ldapimaprootdn, 40

nsslapd-ldapimaptoentries, 41 nsslapd-ldapiuidnumbertype, 41

nsslapd-listenhost, 42 nsslapd-localhost, 42 nsslapd-localuser, 42

nsslapd-maxbersize, 43

nsslapd-maxdescriptors, 44

nsslapd-maxsasliosize, 45 nsslapd-maxthreadsperconn, 45

nsslapd-nagle, 46 nsslapd-outbound-ldap-io-timeout, 46 nsslapd-plug-in, 46 nsslapd-port, 46

nsslapd-privatenamespaces, 47 nsslapd-pwpolicy-local, 47 nsslapd-readonly, 47

nsslapd-referral, 48 nsslapd-referralmode, 48

nsslapd-reservedescriptors, 49

nsslapd-return-exact-case, 50 nsslapd-rootdn, 50

nsslapd-rootpw, 51 nsslapd-rootpwstoragescheme, 51

nsslapd-saslpath, 52 nsslapd-schema-ignore-trailing-spaces, 52

nsslapd-schemacheck, 53

nsslapd-schemareplace, 54 nsslapd-securelistenhost, 54 nsslapd-securePort, 54

nsslapd-security, 55 nsslapd-sizelimit, 55

nsslapd-ssl-check-hostname, 56, 56

nsslapd-state, 78

nsslapd-timelimit, 57 nsslapd-versionstring, 57

nsslapd-workingdir, 58

nssnmpcontact, 101

347

Index

nssnmpdescription, 101

nssnmpenabled, 100

nssnmplocation, 101 nssnmpmasterhost, 101

nssnmpmasterport, 102

nssnmporganization, 100

nsSSL2 attribute, 75

nsSSL3 attribute, 76 nsSSL3ciphers attribute, 76

nsSSLclientauth, 58

nsSSLclientauth attribute, 75 nsSSLSessionTimeout attribute, 75

nsState, 85, 120

nsTaskCancel, 107

nsTaskCurrentItem, 106 nsTaskExitCode, 106 nsTaskLog, 106

nsTaskStatus, 105, 107

nsUniqueIdGenerator, 110

nsUniqueIdGeneratorNamespace, 111

nsUseId2Entry, 114

nsUseOneFile, 113

opscompleted, 98 opsinitiated, 98

passwordCheckSyntax, 59

passwordExp, 60

passwordHistory, 61 passwordInHistory, 61

passwordLockout, 62

passwordLockoutDuration, 63 passwordMaxAge, 63

passwordMaxFailure, 64

passwordMinAge, 65

passwordMinLength, 66

passwordMustChange, 67

passwordResetDuration, 68 passwordResetFailureCount, 68

passwordStorageScheme, 69 passwordUnlock, 69

passwordWarning, 70

readWaiters, 98

schemadir, 119

startTime, 98 totalConnections, 98

ttl, 107

currentConnections attribute, 98 currenttime attribute, 98

D database

exporting, 282

348

reindexing index files, 283

database encryption

nsAttributeEncryption, 194 nsEncryptionAlgorithm, 194

database files, 214

database link plug-in configuration attributes

nsAbandonCount, 205

nsAbandonedSearchCheckInterval, 198

nsActiveChainingComponents, 196

nsAddCount, 204

nsBindConnectionCount, 205

nsBindConnectionsLimit, 198

nsBindCount, 205

nsBindMechanism, 202

nsBindRetryLimit, 198

nsBindTimeout, 199 nsCheckLocalACI, 199

nsCompareCount, 205

nsConcurrentBindLimit, 199

nsConcurrentOperationsLimit, 200 nsConnectionLife, 200

nsDeleteCount, 204

nsFarmServerURL, 203

nshoplimit, 204

nsMaxResponseDelay, 196

nsMaxTestResponseDelay, 197

nsModifyCount, 204

nsMultiplexorBindDn, 203 nsMultiplexorCredentials, 203

nsOperationConnectionCount, 205

nsOperationConnectionsLimit, 200 nsProxiedAuthorization, 200

nsReferralOnScopedSearch, 201

nsRenameCount, 205 nsSearchBaseCount, 205 nsSearchOneLevelCount, 205 nsSearchSubtreeCount, 205

nsSizeLimit, 201

nsslapd-changelogmaxage, 206

nsTimeLimit, 201

nsTransmittedControls, 197

nsUnbindCount, 205

nsUseStartTLS, 204

database plug-in configuration attributes

cn, 188

dbcachehitratio, 178 dbcachehits, 178 dbcachepagein, 178 dbcachepageout, 178 dbcacheroevict, 178 dbcacherwevict, 178

dbcachetries, 178

dbfilecachehit, 191 dbfilecachemiss, 191 dbfilenamenumber, 191 dbfilepagein, 191

dbfilepageout, 192

description, 189

nsIndexType, 190

nsLookThroughLimit, 166

nsMatchingRule, 190

nsslapd-cache-autosize, 166

nsslapd-cache-autosize-split, 167

nsslapd-cachememsize, 180

nsslapd-cachesize, 179

nsslapd-db-abort-rate, 186 nsslapd-db-active-txns, 186 nsslapd-db-cache-hit, 186 nsslapd-db-cache-region-wait-rate, 186 nsslapd-db-cache-size-bytes, 186 nsslapd-db-cache-try, 186

nsslapd-db-checkpoint-interval, 168

nsslapd-db-circular-logging, 169

nsslapd-db-clean-pages, 187 nsslapd-db-commit-rate, 187 nsslapd-db-deadlock-rate, 187

nsslapd-db-debug, 169

nsslapd-db-dirty-pages, 187

nsslapd-db-durable-transactions, 169

nsslapd-db-hash-buckets, 187 nsslapd-db-hash-elements-examine-rate, 187 nsslapd-db-hash-search-rate, 187

nsslapd-db-home-directory, 170

nsslapd-db-idl-divisor, 171

nsslapd-db-lock-conflicts, 187 nsslapd-db-lock-region-wait-rate, 187 nsslapd-db-lock-request-rate, 187 nsslapd-db-lockers, 187 nsslapd-db-log-bytes-since-checkpoint, 187 nsslapd-db-log-region-wait-rate, 187

nsslapd-db-log-write-rate, 188

nsslapd-db-logbuf-size, 171

nsslapd-db-logdirectory, 172 nsslapd-db-logfile-size, 172

nsslapd-db-longest-chain-length, 188 nsslapd-db-page-create-rate, 188 nsslapd-db-page-ro-evict-rate, 188 nsslapd-db-page-rw-evict-rate, 188

nsslapd-db-page-size, 173

nsslapd-db-page-trickle-rate, 188 nsslapd-db-page-write-rate, 188 nsslapd-db-pages-in-use, 188

nsslapd-db-spin-count, 173 nsslapd-db-transaction-batch-val, 173

nsslapd-db-trickle-percentage, 174

nsslapd-db-txn-region-wait-rate, 188

nsslapd-db-verbose, 175

nsslapd-dbcachesize, 168

nsslapd-dbncache, 175

nsslapd-directory, 176, 180

nsslapd-idlistscanlimit, 166

nsslapd-import-cache-autosize, 176 nsslapd-import-cachesize, 176

nsslapd-mode, 178

nsslapd-readonly, 181 nsslapd-require-index, 181 nsslapd-suffix, 181

nsSubStrBegin, 192

nsSubStrEnd, 193 nsSubStrMiddle, 193

nsSystemIndex, 191

vlvBase, 182 vlvEnabled, 182

vlvFilter, 183

vlvScope, 184

vlvSort, 185 vlvUses, 185

database schema

defined, 53

database-specific configuration

location of, 3

db.00x files, 215

db2bak

command-line shell script, 282

command-line perl script, 297

db2bak.pl

command-line shell script, 283

db2index, 327

command-line perl script, 298

db2index.pl

command-line shell script, 282

db2ldif

command-line perl script, 298

db2ldif.pl

dbcachehitratio attribute, 178 dbcachehits attribute, 178 dbcachepagein attribute, 178

349

Index

dbcachepageout attribute, 178 dbcacheroevict attribute, 178 dbcacherwevict attribute, 178 dbcachetries attribute, 178

dbfilecachehit attribute, 191 dbfilecachemiss attribute, 191 dbfilenamenumber attribute, 191 dbfilepagein attribute, 191

dbfilepageout attribute, 192

dbscan command-line utility

examples, 275

options, 274 syntax, 274

dbverify

command-line shell script, 284

description attribute, 85

deleteOldRdn, 74

distinguished names

root, 50

distributed numeric assignment plug-in configuration attributes

dnaFilter, 207 dnaMagicRegen, 207

dnaMaxValue, 208 dnaNextRange, 208

dnaNextValue, 209 dnaPrefix, 209 dnaRangeRequestTimeout, 209

dnaScope, 210 dnaSharedCfgDN, 210

dnaThreshold, 211 dnaType, 211

dse.ldif

configuration information tree, 10

contents of, 3

editing, 9

ldif files, 4

dse.ldif.bak file, 3 dse.ldif.startOK file, 3

ds_removal

specifying password storage scheme, 69

ds_removal command-line utility

options, 286

syntax, 285

dTableSize attribute, 98

E editing

dse.ldif file, 9

encryption

350

root password, 51

encryption configuration attributes

nsSSL2, 75

nsSSL3, 76 nsSSL3ciphers, 76

nsSSLclientauth, 75 nsSSLSessionTimeout, 75

encryption configuration entries

cn=encryption, 75

encryption method, for root password, 51

entriessent attribute, 98

entrydn.db4 file, 215

error log contents

format, 232

LDAP result codes, 237

F files

ancestorid.db4, 215

containing search filters, 252

entrydn.db4, 215 id2entry.db4, 215

locating configuration, 7

nsuniqueid.db4, 215 numsubordinates.db4, 215 objectclass.db4, 215 parentid.db4, 215

filter, 120

fixup-memberof.pl

related configuration entry, 119

fixup-memberof.pl.pl

command-line perl script, 300

id2entry.db4 file, 215

Indexes

configuration of, 7

jpeg images, 273

LDAP

modifying configuration entries, 8

LDAP Data Interchange Format (LDIF)

binary data, 273

LDAP result codes, 237

ldapdelete command-line utility

additional options, 266

commonly used options, 262

SASL options, 265

ssl options, 264

syntax, 262

ldapmodify command-line utility

additional options, 260

commonly used options, 256 options, 256

SASL options, 259

ssl options, 258

syntax, 256

ldappasswd command-line utility

changing user password, 272, 272, 272, 272 examples, 272 generating user password, 272

options, 267

prompting for new password, 272

SASL options, 271

syntax, 267

ldapsearch command-line utility

additional options, 252

commonly used options, 241

persistent search options, 244

SASL options, 247

ssl options, 245

ldif command-line utility

options, 273 syntax, 273

LDIF configuration files

contents of, 6

detailed contents of, 4

LDIF entries

ldif files

25java-object.ldif, 5

28pilot.ldif, 5

30ns-common.ldif, 5

50ns-admin.ldif, 5

50ns-certificate.ldif, 5

50ns-directory.ldif, 5

ldif2db

command-line shell script, 286

command-line perl script, 300

ldif2db.pl

command-line shell script, 287

ldif2ldap

log.xxxxxxxxxx files, 215

logconv.pl

memberofattr, 212 memberofgroupattr, 212

logconv.pl script, 302

options, 303

M memberOf plug-in configuration attributes

Meta Directory changelog

retro changelog, 71

migrate-ds-admin.pl

command-line shell script, 288

migrate-ds-admin.pl command-line script

options, 308 syntax, 308

migrate-ds.pl command-line script

options, 306 syntax, 306

monitor

newRdn, 74 newSuperior, 74

multi-master replication changelog

changelog, 71

nbackends attribute, 99

ns-accountstatus.pl

command-line perl script, 310

command-line perl script, 310

ns-activate.pl

351

Index

command-line perl script, 311

ns-inactivate.pl

ns-newpolicy.pl

command-line perl script, 312

ns-newpwpolicy.pl

ns-slapd command-line utilities

archive2db, 326

db2archive, 327 db2index, 327

db2ldif, 323 finding and executing, 323

ldif2db, 325

nsAbandonCount attribute, 205

nsAbandonedSearchCheckInterval attribute, 198

nsActiveChainingComponents attribute, 196

nsAddCount attribute, 204

nsArchiveDir, 115, 116

nsAttributeEncryption, 194, 195

nsBindConnectionCount attribute, 205

nsBindConnectionsLimit attribute, 198

nsBindCount attribute, 205

nsBindMechanism attribute, 202

nsBindRetryLimit attribute, 198

nsBindTimeout attribute, 199 nsCheckLocalACI attribute, 199

nsCompareCount attribute, 205

nsConcurrentBindLimit attribute, 199

nsConcurrentOperationsLimit attribute, 200 nsConnectionLife attribute, 200

nsDatabaseTypes, 115, 116

nsDeleteCount attribute, 204

nsDS50ruv attribute, 94

nsDS5BeginReplicaRefresh attribute, 91

nsDS5Flags attribute, 79

nsDS5ReplConflict attribute, 80

nsDS5Replica, 123

nsDS5ReplicaBindDN attribute, 80

nsDS5ReplicaBindMethod attribute, 86 nsDS5ReplicaBusyWaitTime attribute, 86

nsDS5ReplicaChangeCount attribute, 81

nsDS5ReplicaChangesSentSinceStartup

attribute, 87 nsDS5ReplicaCredentials attribute, 87 nsDS5ReplicaHost attribute, 87

nsDS5ReplicaID attribute, 81

nsDS5ReplicaLastInitEnd attribute, 88 nsDS5ReplicaLastInitStart attribute, 88 nsDS5ReplicaLastInitStatus attribute, 88

nsDS5ReplicaLastUpdateEnd attribute, 89 nsDS5ReplicaLastUpdateStart attribute, 89

nsDS5ReplicaLastUpdateStatus attribute, 90

nsDS5ReplicaLegacyConsumer attribute, 81

nsDS5ReplicaName attribute, 82

nsDS5ReplicaPort attribute, 90

nsDS5ReplicaPurgeDelay attribute, 82

nsDS5ReplicaReapActive attribute, 90

nsDS5ReplicaReferral attribute, 83 nsDS5ReplicaRoot attribute, 83

nsDS5ReplicaSessionPauseTime attribute, 91

nsDS5ReplicatedAttributeList attribute, 92 nsDS5ReplicaTimeout attribute, 92

nsDS5ReplicationAgreement, 124

nsDS5ReplicaTombstonePurgeInterval attribute,

nsDS5ReplicaTransportInfo attribute, 93

nsDS5ReplicaType attribute, 84

nsDS5ReplicaUpdateInProgress attribute, 93 nsDS5ReplicaUpdateSchedule attribute, 93

nsds5Task attribute, 85

nsds7DirectoryReplicaSubtree, 95 nsds7DirsyncCookie, 95 nsds7NewWinGroupSyncEnabled, 95 nsds7NewWinUserSyncEnabled, 95

nsds7WindowsDomain, 96 nsds7WindowsReplicaSubtree, 96

nsDSWindowsReplicationAgreement, 126

nsDumpUniqId, 114

nsEncryptionAlgorithm, 194

nsExcludeSuffix, 109, 112

nsExportReplica, 113

nsFarmServerURL attribute, 203

nsFilename, 109, 112

nshoplimit attribute, 204

nsImportChunkSize, 110 nsImportIndexAttrs, 110

nsIncludeSuffix, 109, 112

nsIndexAttribute, 117

nsIndexType attribute, 190

nsIndexVLVAttribute, 117

nsInstance, 109, 112

nsLookThroughLimit attribute, 166

nsMatchingRule attribute, 190

nsMaxResponseDelay attribute, 196

nsMaxTestResponseDelay attribute, 197

nsModifyCount attribute, 204

nsMultiplexorBindDn attribute, 203 nsMultiplexorCredentials attribute, 203

nsNoWrap, 114

352

nsOperationConnectionCount attribute, 205

nsOperationConnectionsLimit attribute, 200

nsPrintKey, 113

nsProxiedAuthorization attribute, 200

nsReferralOnScopedSearch attribute, 201

nsRenameCount attribute, 205

nsruvReplicaLastModified attribute, 94

nsSaslMapBaseDNTemplate attribute, 99

nsSaslMapFilterTemplate attribute, 100

nsSaslMapping, 128

nsSaslMapRegexString attribute, 100

nsSearchBaseCount attribute, 205 nsSearchOneLevelCount attribute, 205 nsSearchSubtreeCount attribute, 205

nsSizeLimit attribute, 201

nsslapd-accesslog attribute, 11 nsslapd-accesslog-level attribute, 11

nsslapd-accesslog-list attribute, 12 nsslapd-accesslog-logbuffering attribute, 12

nsslapd-accesslog-logexpirationtime attribute, 13

nsslapd-accesslog-logexpirationtimeunit attribute,

13 nsslapd-accesslog-logging-enabled attribute, 13

nsslapd-accesslog-logmaxdiskspace attribute, 14

nsslapd-accesslog-logminfreediskspace attribute,

nsslapd-accesslog-logrotationsync-enabled

attribute, 15

nsslapd-accesslog-logrotationsynchour attribute,

nsslapd-accesslog-logrotationsyncmin attribute,

16 nsslapd-accesslog-logrotationtime attribute, 16

nsslapd-accesslog-maxlogsize attribute, 17 nsslapd-accesslog-maxlogsperdir attribute, 17

nsslapd-accesslog-mode attribute, 18 nsslapd-allow-unauthenticated-binds attribute, 18

nsslapd-attribute-name-exceptions attribute, 19

nsslapd-auditlog-list attribute, 20 nsslapd-auditlog-logexpirationtime attribute, 20

nsslapd-auditlog-logexpirationtimeunit attribute,

21 nsslapd-auditlog-logging-enabled attribute, 21

nsslapd-auditlog-logmaxdiskspace attribute, 22

nsslapd-auditlog-logminfreediskspace attribute,

nsslapd-auditlog-logrotationsync-enabled

attribute, 22

nsslapd-auditlog-logrotationsynchour attribute, 23 nsslapd-auditlog-logrotationsyncmin attribute, 23 nsslapd-auditlog-logrotationtime attribute, 23

nsslapd-auditlog-logrotationtimeunit attribute, 24 nsslapd-auditlog-maxlogsize attribute, 24

nsslapd-auditlog-maxlogsperdir attribute, 25 nsslapd-auditlog-mode attribute, 25

nsslapd-backend attribute, 79

nsslapd-cache-autosize attribute, 166

nsslapd-cache-autosize-split attribute, 167

nsslapd-cachememsize attribute, 180

nsslapd-cachesize attribute, 179

nsslapd-certmap-basedn attribute, 26

nsslapd-changelogdir attribute, 71

nsslapd-changelogmaxage attribute, 72 nsslapd-changelogmaxentries attribute, 72

nsslapd-config attribute, 27 nsslapd-conntablesize attribute, 27 nsslapd-counters attribute, 27

nsslapd-csnlogging attribute, 28

nsslapd-db-abort-rate attribute, 186 nsslapd-db-active-txns attribute, 186 nsslapd-db-cache-hit attribute, 186 nsslapd-db-cache-region-wait-rate attribute, 186 nsslapd-db-cache-size-bytes attribute, 186 nsslapd-db-cache-try attribute, 186

nsslapd-db-checkpoint-interval attribute, 168

nsslapd-db-circular-logging attribute, 169

nsslapd-db-clean-pages attribute, 187 nsslapd-db-commit-rate attribute, 187 nsslapd-db-deadlock-rate attribute, 187

nsslapd-db-debug attribute, 169

nsslapd-db-dirty-pages attribute, 187

nsslapd-db-durable-transactions attribute, 169

nsslapd-db-hash-buckets attribute, 187

nsslapd-db-hash-elements-examine-rate

attribute, 187 nsslapd-db-hash-search-rate attribute, 187

nsslapd-db-home-directory attribute, 170

nsslapd-db-idl-divisor attribute, 171

nsslapd-db-lock-conflicts attribute, 187 nsslapd-db-lock-region-wait-rate attribute, 187 nsslapd-db-lock-request-rate attribute, 187 nsslapd-db-lockers attribute, 187

nsslapd-db-log-bytes-since-checkpoint attribute,

187 nsslapd-db-log-region-wait-rate attribute, 187

nsslapd-db-log-write-rate attribute, 188

nsslapd-db-logbuf-size attribute, 171

nsslapd-db-logdirectory attribute, 172 nsslapd-db-logfile-size attribute, 172

nsslapd-db-longest-chain-length attribute, 188 nsslapd-db-page-create-rate attribute, 188 nsslapd-db-page-ro-evict-rate attribute, 188

353

Index

nsslapd-db-page-rw-evict-rate attribute, 188

nsslapd-db-page-size attribute, 173

nsslapd-db-page-trickle-rate attribute, 188 nsslapd-db-page-write-rate attribute, 188 nsslapd-db-pages-in-use attribute, 188

nsslapd-db-spin-count attribute, 173 nsslapd-db-transaction-batch-val attribute, 173

nsslapd-db-trickle-percentage attribute, 174

nsslapd-db-txn-region-wait-rate attribute, 188

nsslapd-db-verbose attribute, 175

nsslapd-dbcachesize attribute, 168

nsslapd-dbncache attribute, 175

nsslapd-directory attribute, 176, 180

nsslapd-ds4-compatible-schema attribute, 28

nsslapd-errorlog attribute, 29

nsslapd-errorlog-level attribute, 30

nsslapd-errorlog-list attribute, 31 nsslapd-errorlog-logexpirationtime attribute, 31

nsslapd-errorlog-logexpirationtimeunit attribute,

nsslapd-errorlog-logging-enabled attribute, 32 nsslapd-errorlog-logmaxdiskspace attribute, 32

nsslapd-errorlog-logminfreediskspace attribute,

nsslapd-errorlog-logrotationsync-enabled

attribute, 33 nsslapd-errorlog-logrotationsynchour attribute, 33

nsslapd-errorlog-logrotationsyncmin attribute, 34 nsslapd-errorlog-logrotationtime attribute, 34 nsslapd-errorlog-logrotationtimeunit attribute, 34

nsslapd-errorlog-maxlogsize attribute, 35 nsslapd-errorlog-maxlogsperdir attribute, 35

nsslapd-errorlog-mode attribute, 36 nsslapd-groupvalnestlevel attribute, 36

nsslapd-idletimeout attribute, 37

nsslapd-idlistscanlimit attribute, 166

nsslapd-import-cache-autosize attribute, 176 nsslapd-import-cachesize attribute, 176

nsslapd-instancedir attribute, 37 nsslapd-ioblocktimeout attribute, 37

nsslapd-lastmod attribute, 38 nsslapd-ldapiautobind attribute, 38

nsslapd-ldapientrysearchbase attribute, 39 nsslapd-ldapifilepath attribute, 39

nsslapd-ldapigidnumbertype attribute, 40 nsslapd-ldapilisten attribute, 40 nsslapd-ldapimaprootdn attribute, 40

nsslapd-ldapimaptoentries attribute, 41 nsslapd-ldapiuidnumbertype attribute, 41

nsslapd-listenhost attribute, 42 nsslapd-localhost attribute, 42 nsslapd-localuser attribute, 42

nsslapd-maxbersize attribute, 43

nsslapd-maxdescriptors attribute, 44

nsslapd-maxsasliosize attribute, 45 nsslapd-maxthreadsperconn attribute, 45

nsslapd-mode attribute, 178

nsslapd-nagle attribute, 46 nsslapd-outbound-ldap-io-timeout attribute, 46 nsslapd-plug-in attribute, 46

nsslapd-plugin-depends-on-named attribute, 165

nsslapd-plugin-depends-on-type attribute, 164

nsslapd-pluginDescription attribute, 163

nsslapd-pluginEnabled attribute, 162

nsslapd-pluginId attribute, 163

nsslapd-pluginInitfunc attribute, 162

nsslapd-pluginLoadGlobal attribute, 164 nsslapd-pluginLoadNow attribute, 164

nsslapd-pluginPath attribute, 162 nsslapd-pluginType attribute, 162

nsslapd-pluginVendor attribute, 163 nsslapd-pluginVersion attribute, 163

nsslapd-port attribute, 46

nsslapd-privatenamespaces attribute, 47 nsslapd-pwpolicy-local attribute, 47 nsslapd-readonly attribute, 47

nsslapd-referral attribute, 48 nsslapd-referralmode attribute, 48

nsslapd-require-index attribute, 181

nsslapd-reservedescriptors attribute, 49

nsslapd-return-exact-case attribute, 50 nsslapd-rootdn attribute, 50

nsslapd-rootpw attribute, 51 nsslapd-rootpwstoragescheme attribute, 51

nsslapd-saslpath attribute, 52

nsslapd-schema-ignore-trailing-spaces attribute,

nsslapd-schemacheck attribute, 53

nsslapd-schemareplace attribute, 54 nsslapd-securelistenhost attribute, 54 nsslapd-securePort attribute, 54

nsslapd-security attribute, 55 nsslapd-sizelimit attribute, 55

nsslapd-ssl-check-hostname, 56 nsslapd-ssl-check-hostname attribute, 56

nsslapd-state attribute, 78

nsslapd-suffix attribute, 181

nsslapd-timelimit attribute, 57 nsslapd-versionstring attribute, 57

nsslapd-workingdir attribute, 58

nssnmpcontact attribute, 101 nssnmpdescription attribute, 101

354

nssnmpenabled attribute, 100

nssnmplocation attribute, 101 nssnmpmasterhost attribute, 101

nssnmpmasterport attribute, 102

nssnmporganization attribute, 100

nsSSL2 attribute, 75

nsSSL3 attribute, 76 nsSSL3ciphers attribute, 76

nsSSLclientauth attribute, 58, 75 nsSSLSessionTimeout attribute, 75

nsState attribute, 85, 120

nsSubStrBegin attribute, 192

nsSubStrEnd attribute, 193 nsSubStrMiddle attribute, 193

nsSystemIndex attribute, 191

nsTaskCancel, 107

nsTaskCurrentItem, 106 nsTaskExitCode, 106 nsTaskLog, 106

nsTaskStatus, 105, 107

nsTimeLimit attribute, 201

nsTransmittedControls attribute, 197

nsUnbindCount attribute, 205

nsuniqueid.db4 file, 215

nsUniqueIdGenerator, 110

nsUniqueIdGeneratorNamespace, 111

nsUseId2Entry, 114

nsUseOneFile, 113

nsUseStartTLS attribute, 204

numsubordinates.db4 file, 215

O o=NetscapeRoot

configuration, 7

object classes

nsAttributeEncryption, 195

nsSaslMapping, 128

objectclass.db4 file, 215

operational attributes

passwordRetryCount, 69

opscompleted attribute, 98 opsinitiated attribute, 98

parentid.db4 file, 215

passwordAllowChangeTime, 58

passwordChange attribute, 59 passwordCheckSyntax attribute, 59

passwordExp attribute, 60 passwordExpirationTime, 60 passwordExpWarned, 60

passwordGraceUserTime, 61 passwordHistory attribute, 61 passwordInHistory attribute, 61

passwordLockout attribute, 62

passwordLockoutDuration attribute, 63 passwordMaxAge attribute, 63

passwordMaxFailure attribute, 64

passwordMinAge attribute, 65

passwordMinLength attribute, 66

passwordMustChange attribute, 67

passwordResetDuration attribute, 68 passwordResetFailureCount attribute, 68

passwordRetryCount, 69

passwords

root, 51

passwordStorageScheme attribute, 69 passwordUnlock attribute, 69

passwordWarning attribute, 70

perl scripts, 294

locating, 278

permissions

specifying for index files, 178

plug-in functionality configuration attributes

cn, 188

dbcachehitratio, 178 dbcachehits, 178 dbcachepagein, 178 dbcachepageout, 178 dbcacheroevict, 178 dbcacherwevict, 178 dbcachetries, 178

dbfilecachehit, 191 dbfilecachemiss, 191 dbfilenamenumber, 191 dbfilepagein, 191

dbfilepageout, 192

description, 189

dnaFilter, 207 dnaMagicRegen, 207

dnaMaxValue, 208 dnaNextRange, 208

dnaNextValue, 209 dnaPrefix, 209 dnaRangeRequestTimeout, 209

dnaScope, 210 dnaSharedCfgDN, 210

dnaThreshold, 211 dnaType, 211

memberofattr, 212 memberofgroupattr, 212

nsAbandonCount, 205

355

Index

nsAbandonedSearchCheckInterval, 198

nsActiveChainingComponents, 196

nsAddCount, 204

nsBindConnectionCount, 205

nsBindConnectionsLimit, 198

nsBindCount, 205

nsBindMechanism, 202

nsBindRetryLimit, 198

nsBindTimeout, 199 nsCheckLocalACI, 199

nsCompareCount, 205

nsConcurrentBindLimit, 199

nsConcurrentOperationsLimit, 200 nsConnectionLife, 200

nsLookThroughLimit, 166

nsMatchingRule, 190

nsMaxResponseDelay, 196

nsMaxTestResponseDelay, 197

nsModifyCount, 204

nsMultiplexorBindDn, 203 nsMultiplexorCredentials, 203

nsOperationConnectionCount, 205

nsOperationConnectionsLimit, 200 nsProxiedAuthorization, 200

nsReferralOnScopedSearch, 201

nsRenameCount, 205 nsSearchBaseCount, 205 nsSearchOneLevelCount, 205 nsSearchSubtreeCount, 205

nsSizeLimit, 201

nsslapd-cache-autosize, 166

nsslapd-cache-autosize-split, 167

nsslapd-cachememsize, 180

nsslapd-cachesize, 179

nsslapd-changelogdir, 206 nsslapd-changelogmaxage, 206

nsslapd-db-abort-rate, 186 nsslapd-db-active-txns, 186 nsslapd-db-cache-hit, 186 nsslapd-db-cache-region-wait-rate, 186 nsslapd-db-cache-size-bytes, 186 nsslapd-db-cache-try, 186

nsslapd-db-checkpoint-interval, 168

nsslapd-db-circular-logging, 169

nsslapd-db-clean-pages, 187 nsslapd-db-commit-rate, 187 nsslapd-db-deadlock-rate, 187

356

nsslapd-db-debug, 169

nsslapd-db-dirty-pages, 187

nsslapd-db-durable-transactions, 169

nsslapd-db-hash-buckets, 187 nsslapd-db-hash-elements-examine-rate, 187 nsslapd-db-hash-search-rate, 187

nsslapd-db-home-directory, 170

nsslapd-db-idl-divisor, 171

nsslapd-db-log-write-rate, 188

nsslapd-db-logbuf-size, 171

nsslapd-db-logdirectory, 172 nsslapd-db-logfile-size, 172

nsslapd-db-longest-chain-length, 188 nsslapd-db-page-create-rate, 188 nsslapd-db-page-ro-evict-rate, 188 nsslapd-db-page-rw-evict-rate, 188

nsslapd-db-page-size, 173

nsslapd-db-page-trickle-rate, 188 nsslapd-db-page-write-rate, 188 nsslapd-db-pages-in-use, 188

nsslapd-db-spin-count, 173 nsslapd-db-transaction-batch-val, 173

nsslapd-db-trickle-percentage, 174

nsslapd-db-txn-region-wait-rate, 188

nsslapd-db-verbose, 175

nsslapd-dbcachesize, 168

nsslapd-dbncache, 175

nsslapd-directory, 176, 180

nsslapd-idlistscanlimit, 166

nsslapd-import-cache-autosize, 176 nsslapd-import-cachesize, 176

nsslapd-mode, 178

nsslapd-plugin-depends-on-named, 165

nsslapd-plugin-depends-on-type, 164

nsslapd-pluginDescription, 163

nsslapd-pluginEnabled, 162

nsslapd-pluginId, 163

nsslapd-pluginInitfunc, 162

nsslapd-pluginLoadGlobal, 164 nsslapd-pluginLoadNow, 164

nsslapd-pluginPath, 162 nsslapd-pluginType, 162

nsslapd-pluginVendor, 163 nsslapd-pluginVersion, 163

nsslapd-readonly, 181

nsslapd-require-index, 181 nsslapd-suffix, 181

nsSubStrBegin, 192

nsSubStrEnd, 193 nsSubStrMiddle, 193

nsSystemIndex, 191

nsTimeLimit, 201

nsTransmittedControls, 197

nsUnbindCount, 205

nsUseStartTLS, 204

vlvBase, 182 vlvEnabled, 182

vlvFilter, 183

vlvScope, 184

vlvSort, 185 vlvUses, 185

plug-ins

configuration of, 3

distributed number assignment plug-in, 149

memberOf plug-in, 152

schema reload plug-in, 158

port numbers

less than 1024, 46

pwdhash

command-line shell script, 291

currentConnections, 98 currenttime, 98 dTableSize, 98 entriessent, 98

R read-only monitoring configuration attributes

backendMonitorDN, 99

bytessent, 98

connection, 97

nbackends, 99

opscompleted, 98 opsinitiated, 98 readWaiters, 98 startTime, 98 totalConnections, 98

read-only monitoring configuration entries

cn=monitor, 97

readWaiters attribute, 98

syntax, 313

remove-ds.pl

options, 313, 314 syntax, 314

remove-ds.pl command-line script

repl-monitor

command-line shell script, 288

command-line perl script, 314

repl-monitor.pl

nsDS5BeginReplicaRefresh, 91

replication agreement configuration attributes

cn, 85 description, 85

nsDS50ruv, 94

nsDS5ReplicaBindDN, 85

nsDS5ReplicaBindMethod, 86 nsDS5ReplicaBusyWaitTime, 86

nsDS5ReplicaChangesSentSinceStartup, 87 nsDS5ReplicaCredentials, 87 nsDS5ReplicaHost, 87

nsDS5ReplicaLastInitEnd, 88 nsDS5ReplicaLastInitStart, 88 nsDS5ReplicaLastInitStatus, 88

nsDS5ReplicaLastUpdateEnd, 89 nsDS5ReplicaLastUpdateStart, 89

nsDS5ReplicaLastUpdateStatus, 90 nsDS5ReplicaPort, 90 nsDS5ReplicaReapActive, 90

nsDS5ReplicaRoot, 91 nsDS5ReplicaSessionPauseTime, 91

nsDS5ReplicatedAttributeList, 92 nsDS5ReplicaTimeout, 92

nsDS5ReplicaTransportInfo, 93 nsDS5ReplicaUpdateInProgress, 93 nsDS5ReplicaUpdateSchedule, 93

nsruvReplicaLastModified, 94

object classes, 85

replication configuration attributes

nsDS5Flags, 79

nsDS5ReplConflict, 80 nsDS5ReplicaBindDN, 80

nsDS5ReplicaChangeCount, 81 nsDS5ReplicaID, 81 nsDS5ReplicaLegacyConsumer, 81

nsDS5ReplicaName, 82 nsDS5ReplicaPurgeDelay, 82

nsDS5ReplicaReferral, 83 nsDS5ReplicaRoot, 83 nsDS5ReplicaTombstonePurgeInterval, 83

nsDS5ReplicaType, 84

nsds5Task, 85

357

Index

nsState, 85

object classes, 79

restart, 291

restart-slapd

command-line shell script, 291

command-line shell script, 292

restarting server requirement for certain configuration changes,

restoreconfig

Meta Directory changelog, 71

retro changelog

retro changelog plug-in configuration attributes

nsslapd-changelogdir, 206

retryCountResetTime, 70

SASL configuration attributes

nsSaslMapBaseDNTemplate, 99

nsSaslMapFilterTemplate, 100 nsSaslMapRegexString, 100

SASL configuration entries

cn=sasl, 99

saveconfig

command-line shell script, 292

schema-reload.pl, 317

related configuration entry, 118

schemadir, 119

scripts, 277

location of perl scripts, 278

location of shell scripts, 277

perl scripts, 294

search filters

specifying file, 252

search operations

limiting entries returned, 55

setting time limits, 57

server restart

after configuration changes, 9

setting the location of SASL plugins, 52

setup-ds-admin.pl

setup-ds-admin.pl command-line script

options, 320

syntax, 319

setup-ds.pl

nssnmpcontact, 101 nssnmpdescription, 101

setup-ds.pl command-line script

options, 318 syntax, 318

slapd.conf file

location of, 7

smart referrals

ldapsearch option, 252

SNMP configuration attributes

nssnmpenabled, 100

nssnmplocation, 101 nssnmpmasterhost, 101

nssnmpmasterport, 102

nssnmporganization, 100

SNMP configuration entries

cn=SNMP, 100

special attributes

changeLog, 73 changeNumber, 73 changes, 73 changeTime, 73 changeType, 73

deleteOldRdn, 74 newRdn, 74 newSuperior, 74 targetDn, 74

special object classes

changeLogEntry, 120

nsDS5Replica, 123

nsDS5ReplicationAgreement, 124

nsDSWindowsReplicationAgreement, 126

start-slapd

command-line shell script, 292

command-line shell script, 293

startTime attribute, 98

statistics

from access logs, 302

stop-slapd

nsslapd-state, 78 object classes, 78

suffix and replication configuration entries

cn=mapping tree, 78

suffix configuration attributes

nsslapd-backend, 79

suffix2instance

command-line shell script, 293

nsds7DirectoryReplicaSubtree, 95 nsds7DirsyncCookie, 95 nsds7NewWinGroupSyncEnabled, 95 nsds7NewWinUserSyncEnabled, 95

synchronization agreement attributes

358

nsds7WindowsDomain, 96 nsds7WindowsReplicaSubtre, 96 winSyncInterval, 96

targetDn, 74

totalConnections attribute, 98

trailing spaces in object class names, 52

ttl, 107

U uniqueid generator configuration attributes

nsState, 120

uniqueid generator configuration entries

cn=uniqueid generator, 120

V verify-db.pl

command-line perl script, 321

quick reference, 277, 278

vlvBase attribute, 182 vlvEnabled attribute, 182

vlvFilter attribute, 183

vlvindex

command-line shell script, 294