Netscape NETSCAPE DIRECTORY SERVER 6.1 - DEPLOYMENT Configuration Manual

Configuration, Command, and

File Reference

Netscape Directory Server

Version 6.1

August 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by

Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed by the license agreement for the Software and applicable copyright law.

Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without notice.

THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE

LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY

ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,

PROFITS, USE, OR DATA.

The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2002 Netscape

Communications Corporation. All rights reserved.

Portions of the Software copyright © 1995 PEER Networks, Inc. All rights reserved. The Software contains the Taligent International

Classes from Taligent, Inc. and IBM Corp. Portions of the Software copyright ©1992-1998 Regents of the University of Michigan. All rights reserved. The software contains encryption software from RSA Security Inc. Copyright © 1994 RSA Data Security, Inc. All rights reserved.

Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications

Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their respective owners.

The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation to the U.S. government is with restricted rights as described in the license agreement for that Software.

Contents

About This Reference Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Directory Server Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Prerequisite Reading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

What Is In This Reference Guide? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Conventions Used In This Reference Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Related Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Chapter 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Overview of Directory Server Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Directory Server Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Directory Server Instance File Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Migrating Directory Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Using Directory Server Command-Line Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Using Directory Server Command-Line Scripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Chapter 2 Core Server Configuration Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Server Configuration - Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

LDIF Configuration Files - Location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Schema Configuration Files - Location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

How the Server Configuration is Organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Configuration Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Configuration of Plug-in Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Configuration of Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Configuration of Indexes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Migration of Pre-Directory Server 6.x Configuration Files to LDIF Format . . . . . . . . . . . . . . . . . . . 32

Accessing and Modifying Server Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Access Control For Configuration Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Changing Configuration Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Modifying Configuration Entries Using LDAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Restrictions to Modifying Configuration Entries and Attributes . . . . . . . . . . . . . . . . . . . . . . . . . 35

3

Configuration Changes Requiring Server Restart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Core Server Configuration Attributes Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 cn=config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 nsslapd-accesscontrol (Enable Access Control) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 nsslapd-accesslog (Access Log) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 nsslapd-accesslog-level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 nsslapd-accesslog-list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 nsslapd-accesslog-logbuffering (Log Buffering) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 nsslapd-accesslog-logexpirationtime (Access Log Expiration Time) . . . . . . . . . . . . . . . . . . . . . . 39 nsslapd-accesslog-logexpirationtimeunit (Access Log Expiration Time Unit) . . . . . . . . . . . . . . 40 nsslapd-accesslog-logging-enabled (Access Log Enable Logging) . . . . . . . . . . . . . . . . . . . . . . . . 40 nsslapd-accesslog-logmaxdiskspace (Access Log Maximum Disk Space) . . . . . . . . . . . . . . . . . 41 nsslapd-accesslog-logminfreediskspace (Access Log Minimum Free Disk Space) . . . . . . . . . . 42 nsslapd-accesslog-logrotationsync-enabled (Access Log Rotation Sync Enabled) . . . . . . . . . . . 42 nsslapd-accesslog-logrotationsynchour (Access Log Rotation Sync Hour) . . . . . . . . . . . . . . . . 43 nsslapd-accesslog-logrotationsyncmin (Access Log Rotation Sync Minute) . . . . . . . . . . . . . . . 43 nsslapd-accesslog-logrotationtime (Access Log Rotation Time) . . . . . . . . . . . . . . . . . . . . . . . . . . 43 nsslapd-accesslog-logrotationtimeunit (Access Log Rotation Time Unit) . . . . . . . . . . . . . . . . . . 44 nsslapd-accesslog-maxlogsize (Access Log Maximum Log Size) . . . . . . . . . . . . . . . . . . . . . . . . . 44 nsslapd-accesslog-maxlogsperdir (Access Log Maximum Number of Log Files) . . . . . . . . . . . 45 nsslapd-attribute-name-exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 nsslapd-auditlog (Audit Log) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 nsslapd-auditlog-list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 nsslapd-auditlog-logexpirationtime (Audit Log Expiration Time) . . . . . . . . . . . . . . . . . . . . . . . 47 nsslapd-auditlog-logexpirationtimeunit (Audit Log Expiration Time Unit) . . . . . . . . . . . . . . . 47 nsslapd-auditlog-logging-enabled (Audit Log Enable Logging) . . . . . . . . . . . . . . . . . . . . . . . . . 48 nsslapd-auditlog-logmaxdiskspace (Audit Log Maximum Disk Space) . . . . . . . . . . . . . . . . . . . 48 nsslapd-auditlog-logminfreediskspace (Audit Log Minimum Free Disk Space) . . . . . . . . . . . . 49 nsslapd-auditlog-logrotationsync-enabled (Audit Log Rotation Sync Enabled) . . . . . . . . . . . . 49 nsslapd-auditlog-logrotationsynchour (Audit Log Rotation Sync Hour) . . . . . . . . . . . . . . . . . . 50 nsslapd-auditlog-logrotationsyncmin (Audit Log Rotation Sync Minute) . . . . . . . . . . . . . . . . . 50 nsslapd-auditlog-logrotationtime (Audit Log Rotation Time) . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 nsslapd-auditlog-logrotationtimeunit (Audit Log Rotation Time Unit) . . . . . . . . . . . . . . . . . . . 51 nsslapd-auditlog-maxlogsize (Audit Log Maximum Log Size) . . . . . . . . . . . . . . . . . . . . . . . . . . 52 nsslapd-auditlog-maxlogsperdir (Audit Log Maximum Number of Log Files) . . . . . . . . . . . . . 52 nsslapd-certmap-basedn (Certificate Map Search Base) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 nsslapd-config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 nsslapd-csnlogging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 nsslapd-ds4-compatible-schema . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 nsslapd-enquote-sup-oc (Enable Superior Object Class Enquoting) . . . . . . . . . . . . . . . . . . . . . . 54 nsslapd-errorlog (Error Log) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 nsslapd-errorlog-level (Error Log Level) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 nsslapd-errorlog-list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

4 Netscape Directory Server Configuration, Command, and File Reference • August 2002

nsslapd-errorlog-logexpirationtime (Error Log Expiration Time) . . . . . . . . . . . . . . . . . . . . . . . . 58 nsslapd-errorlog-logexpirationtimeunit (Error Log Expiration Time Unit) . . . . . . . . . . . . . . . . 58 nsslapd-errorlog-logging-enabled (Enable Error Logging) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 nsslapd-errorlog-logmaxdiskspace (Error Log Maximum Disk Space) . . . . . . . . . . . . . . . . . . . . 59 nsslapd-errorlog-logminfreediskspace (Error Log Minimum Free Disk Space) . . . . . . . . . . . . . 59 nsslapd-errorlog-logrotationsync-enabled (Error Log Rotation Sync Enabled) . . . . . . . . . . . . . 60 nsslapd-errorlog-logrotationsynchour (Error Log Rotation Sync Hour) . . . . . . . . . . . . . . . . . . . 60 nsslapd-errorlog-logrotationsyncmin (Error Log Rotation Sync Minute) . . . . . . . . . . . . . . . . . . 61 nsslapd-errorlog-logrotationtime (Error Log Rotation Time) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 nsslapd-errorlog-logrotationtime (Error Log Rotation Time) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 nsslapd-errorlog-logrotationtimeunit (Error Log Rotation Time Unit) . . . . . . . . . . . . . . . . . . . . 62 nsslapd-errorlog-maxlogsize (Maximum Error Log Size) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 nsslapd-errorlog-maxlogsperdir (Maximum Number of Error Log Files) . . . . . . . . . . . . . . . . . 63 nsslapd-groupevalnestlevel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 nsslapd-idletimeout (Default Idle Timeout) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 nsslapd-instancedir (Instance Directory) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 nsslapd-ioblocktimeout (IO Block Time Out) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 nsslapd-lastmod (Track Modification Time) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 nsslapd-listenhost (Listen to IP Address) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 nsslapd-localhost (Local Host) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 nsslapd-localuser (Local User) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 nsslapd-maxbersize (Maximum Message Size) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 nsslapd-maxdescriptors (Maximum File Descriptors) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 nsslapd-maxthreadsperconn (Maximum Threads Per Connection) . . . . . . . . . . . . . . . . . . . . . . . 69 nsslapd-nagle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 nsslapd-outbound-ldap-io-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 nsslapd-plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 nsslapd-port (Port Number) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 nsslapd-privatenamespaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 nsslapd-readonly (Read Only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 nsslapd-referral (Referral) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 nsslapd-referralmode (Referral Mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 nsslapd-reservedescriptors (Reserved File Descriptors) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 nsslapd-return-exact-case (Return Exact Case) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 nsslapd-rootdn (Manager DN) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 nsslapd-rootpw (Root Password) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 nsslapd-rootpwstoragescheme (Root Password Storage Scheme) . . . . . . . . . . . . . . . . . . . . . . . . 75 nsslapd-schemacheck (Schema Checking) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 nsslapd-schemareplace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 nsslapd-securelistenhost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 nsslapd-securePort (Encrypted Port Number) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 nsslapd-security (Security) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 nsslapd-sizelimit (Size Limit) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

5

nsslapd-ssl-check-hostname (Verify Hostname for Outbound Connections) . . . . . . . . . . . . . . . 79 nsslapd-threadnumber (Thread Number) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 nsslapd-timelimit (Time Limit) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 nsslapd-versionstring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 passwordChange (Password Change) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 passwordCheckSyntax (Check Password Syntax) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 passwordExp (Password Expiration) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 passwordHistory (Password History) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 passwordInHistory (Number of Passwords to Remember) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 passwordLockout (Account Lockout) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 passwordLockoutDuration (Lockout Duration) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 passwordMaxAge (Password Maximum Age) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 passwordMaxFailure (Maximum Password Failures) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 passwordMinAge (Password Minimum Age) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 passwordMinLength (Password Minimum Length) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 passwordMustChange (Password Must Change) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 passwordResetFailureCount (Reset Password Failure Count After) . . . . . . . . . . . . . . . . . . . . . . 86 passwordStorageScheme (Password Storage Scheme) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 passwordUnlock (Unlock Account) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 passwordWarning (Send Warning) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 cn=changelog5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 nsslapd-changelogdir . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 nsslapd-changelogmaxage (Max Changelog Age) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 nsslapd-changelogmaxentries (Max Changelog Records) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 cn=encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 nssslsessiontimeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 nssslclientauth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 nsssl2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 nsssl3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 nsssl3ciphers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 cn=features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 cn=mapping tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

Suffix Configuration Attributes Under cn="suffixName" . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 nsslapd-state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 nsslapd-backend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

Replication Attributes Under cn=replica, cn=“suffixName”, cn=mapping tree,cn=config . . . . . . . 96 cn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 nsDS5Flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 nsDS5ReplicaBindDN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 nsDS5ReplicaChangeCount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 nsDS5ReplicaId . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 nsDS5ReplicaLegacyConsumer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 nsDS5ReplicaName . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

6 Netscape Directory Server Configuration, Command, and File Reference • August 2002

nsDS5ReplicaPurgeDelay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 nsDS5ReplicaReferral . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 nsDS5ReplicaRoot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 nsDS5ReplicaTombstonePurgeInterval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 nsDS5ReplicaType . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 nsState . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

Replication Attributes Under cn=ReplicationAgreementName,cn=replica, cn="suffixName", cn=mapping tree,cn=config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 nsDS5ReplicaBindDN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 nsDS5ReplicaBindMethod . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 nsDS5ReplicaChangesSentSinceStartup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 nsDS5ReplicaCredentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 nsDS5ReplicaHost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 nsDS5ReplicaLastInitEnd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 nsDS5ReplicaLastInitStart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 nsDS5ReplicaLastInitStatus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 nsDS5ReplicaLastUpdateEnd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 nsDS5ReplicaLastUpdateStart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 nsDS5ReplicaLastUpdateStatus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 nsDS5ReplicaPort . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 nsDS5ReplicaReapActive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 nsDS5ReplicaRefresh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 nsDS5ReplicaRoot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 nsDS5ReplicaTimeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 nsDS5ReplicaTransportInfo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 nsDS5ReplicaUpdateInProgress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 nsDS5ReplicaUpdateSchedule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 nsDS50ruv . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 cn=monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 currentConnections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 totalConnections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 dTableSize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 readWaiters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 opsInitiated . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 opsCompleted . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 entriesSent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 bytesSent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 currentTime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 startTime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 nbackEnds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 backendMonitorDN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

7

cn=replication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 cn=SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 nssnmpenabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 nssnmporganization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 nssnmplocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 nssnmpcontact . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 nssnmpdescription . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 nssnmpmasterhost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 nssnmpmasterport . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 cn=tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 cn=uniqueid generator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 nsstate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

Configuration Quick Reference Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

LDIF Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

Configuration Changes Requiring Server Restart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

Chapter 3 Plug-in Implemented Server Functionality Reference . . . . . . . . . . . . . . . . . . . . 119

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

Object Classes for Plug-In Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

Server Plug-in Functionality Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

7-bit check Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

ACL Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

ACL preoperation Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

Binary Syntax Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

Boolean Syntax Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Case Exact String Syntax Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Case Ignore String Syntax Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

Chaining database Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

Class of Service Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

Country String Syntax Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

Distinguished Name Syntax Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126

Generalized Time Syntax Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126

HTTP Client Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

Integer Syntax Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

Internationalization Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 ldbm database Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

Legacy Replication Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

Multimaster Replication Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

Octet String Syntax Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

CLEAR Password Storage Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

CRYPT Password Storage Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

NS-MTA-MD5 Password Storage Scheme Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

SHA Password Storage Scheme Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

8 Netscape Directory Server Configuration, Command, and File Reference • August 2002

SSHA Password Storage Scheme Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

Postal Address String Syntax Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

Presence Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

PTA Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

Referential Integrity Postoperation Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

Retro Changelog Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

Roles Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

Space Insensitive String Syntax Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

State Change Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

Telephone Syntax Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

UID Uniqueness Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

URI Syntax Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

List of Attributes Common to All Plug-ins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 nsslapd-pluginPath . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 nsslapd-pluginInitfunc . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 nsslapd-pluginType . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 nsslapd-pluginEnabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 nsslapd-pluginId . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 nsslapd-pluginVersion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 nsslapd-pluginVendor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 nsslapd-pluginDescription . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

Attributes Allowed by Certain Plug-ins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 nsslapd-plugin-depends-on-type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 nsslapd-plugin-depends-on-named . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

Database Plug-in Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

Database Attributes Under cn=config,cn=ldbm database,cn=plugins,cn=config . . . . . . . . . . . . . 146 nsLookthroughLimit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 nsslapd-allidsthreshold . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 nsslapd-cache-autosize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 nsslapd-cache-autosize-split . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 nsslapd-dbcachesize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 nsslapd-db-checkpoint-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 nsslapd-db-circular-logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 nsslapd-db-debug . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 nsslapd-db-durable-transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 nsslapd-db-home-directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 nsslapd-db-idl-divisor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 nsslapd-db-logbuf-size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 nsslapd-db-logdirectory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 nsslapd-db-logfile-size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 nsslapd-db-page-size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 nsslapd-db-spin-count . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 nsslapd-db-transaction-batch-val . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

9

nsslapd-db-transaction-logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 nsslapd-db-trickle-percentage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 nsslapd-db-verbose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 nsslapd-dbncache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 nsslapd-import-cachesize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 nsslapd-mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

Database Attributes Under cn=monitor,cn=ldbm database, cn=plugins,cn=config . . . . . . . . . . . 159 dbcachehits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 dbcachetries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 dbcachehitratio . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 dbcachepagein . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 dbcachepageout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 dbcacheroevict . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 dbcacherwevict . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

Database Attributes Under cn=NetscapeRoot,cn=ldbm database, cn=plugins,cn=config and cn=UserRoot,cn=ldbm database, cn=plugins,cn=config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 nsslapd-cachesize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 nsslapd-cachememsize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 nsslapd-directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 nsslapd-readonly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 nsslapd-require-index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 nsslapd-suffix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

Database Attributes Under cn=database,cn=monitor,cn=ldbm database, cn=plugins,cn=config 163 nsslapd-db-abort-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 nsslapd-db-active-txns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 nsslapd-db-cache-hit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 nsslapd-db-cache-try . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 nsslapd-db-cache-region-wait-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 nsslapd-db-cache-size-bytes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 nsslapd-db-clean-pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 nsslapd-db-commit-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 nsslapd-db-deadlock-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 nsslapd-db-dirty-pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 nsslapd-db-hash-buckets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 nsslapd-db-hash-elements-examine-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 nsslapd-db-hash-search-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 nsslapd-db-lock-conflicts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 nsslapd-db-lock-region-wait-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 nsslapd-db-lock-request-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 nsslapd-db-lockers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 nsslapd-db-log-bytes-since-checkpoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 nsslapd-db-log-region-wait-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 nsslapd-db-log-write-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

10 Netscape Directory Server Configuration, Command, and File Reference • August 2002

nsslapd-db-longest-chain-length . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 nsslapd-db-page-create-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 nsslapd-db-page-read-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 nsslapd-db-page-ro-evict-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 nsslapd-db-page-rw-evict-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 nsslapd-db-page-trickle-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 nsslapd-db-page-write-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 nsslapd-db-pages-in-use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 nsslapd-db-txn-region-wait-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

Database Attributes Under cn=default indexes,cn=config,cn=ldbm database, cn=plugins,cn=config

166 nsSystemIndex . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 nsIndexType . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 nsMatchingRule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 cn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168

Database Attributes Under cn=monitor,cn=Netscaperoot,cn=ldbm database,cn=plugins,cn=config

168 dbfilenamenumber . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 dbfilecachehit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 dbfilecachemiss . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 dbfilepagein . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 dbfilepageout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

Database Attributes Under cn=index,cn=Netscaperoot,cn=ldbm database, cn=plugins,cn=config and cn=index,cn=UserRoot,cn=ldbm database, cn=plugins,cn=config . . . . . . . . . . . . . . . . . . . . . 169

Database Link Plug-in Attributes (chaining attributes) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

Database Link Attributes Under cn=config,cn=chaining database, cn=plugins,cn=config . . . . . 171 nsActiveChainingComponents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 nsMaxResponseDelay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 nsMaxTestResponseDelay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 nsTransmittedControls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

DatabaseLinkAttributesUndercn=defaultinstanceconfig,cn=chainingdatabase,cn=plugins,cn=config

173 nsAbandonedSearchCheckInterval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 nsBindConnectionsLimit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 nsBindRetryLimit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174 nsBindTimeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174 nsCheckLocalACI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174 nsConcurrentBindLimit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 nsConcurrentOperationsLimit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 nsConnectionLife . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 nsOperationConnectionsLimit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 nsProxiedAuthorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

11

nsReferralOnScopedSearch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 nsSizeLimit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 nsTimeLimit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

DatabaseLinkAttributesUndercn=databaselinkinstancename,cn=chainingdatabase,cn=plugins,cn=config

178 nsFarmServerURL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 nsMultiplexorBindDN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 nsMultiplexorCredentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 nshoplimit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

180 nsAddCount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 nsDeleteCount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 nsModifyCount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 nsRenameCount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 nsSearchBaseCount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 nsSearchOneLevelCount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 nsSearchSubtreeCount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 nsAbandonCount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 nsBindCount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 nsUnbindCount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 nsCompareCount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 nsOperationConnectionCount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 nsBindConnectionCount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181

Retro Changelog Plug-in Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 nsslapd-changelogdir . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 nsslapd-changelogmaxage (Max Changelog Age) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182

Chapter 4 Server Instance File Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

Overview of Directory Server Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

Backup Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

Database Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 ldif Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

Lock Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

Chapter 5 Access Log and Connection Code Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

Access Log Content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

Access Logging Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

Default Access Logging Content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

Connection Number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

12 Netscape Directory Server Configuration, Command, and File Reference • August 2002

File Descriptor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

Slot Number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

Operation Number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

Method Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

Version Number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

Error Number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

Tag Number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

Number of Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

Elapsed Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

LDAP Request Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

LDAP Response Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

Unindexed Search Indicator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

VLV-Related Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

Search Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

Extended Operation OID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

Change Sequence Number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

Abandon Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

Message ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

SASL Multi-Stage Bind Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

Access Log Content for Additional Access Logging Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

Connection Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200

Options Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200

Common Connection Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

LDAP Result Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202

Chapter 6 Migration from Earlier Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

Migration from 4.x Directory Server to 6.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

Server Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

Database Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

Upgrade from Directory Server 5.x to 6.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210

General Server Configuration Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210

Database Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

Database Link Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

SNMP Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216

Chapter 7 Command-Line Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217

Finding and Executing Command-Line Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217

Command-Line Utilities Quick Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

Using Special Characters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

Syntax for Using Special Characters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219 ldapsearch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 ldapsearch Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

13

Commonly Used ldapsearch Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

SSL Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222

Additional ldapsearch Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 ldapmodify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225 ldapmodify Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226

Commonly Used ldapmodify Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226

SSL Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

Additional ldapmodify Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 ldapdelete . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 ldapdelete Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

Commonly Used ldapdelete Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

SSL Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231

Additional ldapdelete Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232 ldif . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 dbscan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

Chapter 8 Command-Line Scripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

Finding and Executing Command-Line Scripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

Command-Line Scripts Quick Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

Shell and Batch Scripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 bak2db (Restore database from backup) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 db2bak (Create backup of database) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 db2ldif (Export database contents to LDIF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 db2dsml (Export database contents to DSML) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244 db2index (Reindex database index files) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 dsml2db (Import DSML document contents into database) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

14 Netscape Directory Server Configuration, Command, and File Reference • August 2002

getpwenc (Print encrypted password) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 ldif2db (Import) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248 ldif2ldap (Perform import operation over LDAP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 monitor (Retrieve monitoring information) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 restart-slapd (Restart the Directory Server) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Exit Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250 restoreconfig (Restore Administration Server Configuration) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251 saveconfig (Save Administration Server Configuration) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251 start-slapd (Start the Directory Server) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252

Exit Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252 stop-slapd (Stop the Directory Server) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252

Exit Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252 suffix2instance (Map Suffix to Backend Name) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 vlvindex (Create virtual list view indexes) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254

Perl Scripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254 bak2db.pl (Restore database from backup) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255 db2bak.pl (Create backup of database) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256

15

db2index.pl (Create and generate indexes) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 db2ldif.pl (Export database contents to LDIF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 ldif2db.pl (Import) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259 logconv.pl (Log converter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263 migrateInstance6 (Migrate to Directory Server 6.x) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 ns-accountstatus.pl (Establish account status) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266 ns-activate.pl (Activate an entry or group of entries) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267 ns-inactivate.pl (Inactivate an entry or group of entries) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268 template-cl-dump.pl (Dump and decode changelog) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269 template-repl-monitor.pl (Monitor replication status) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270

Configuration File Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271

Appendix A Using the ns-slapd and slapd.exe Command-Line Utilities . . . . . . . . . . . . . . 273

Overview of ns-slapd and slapd.exe Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273 ns-slapd (UNIX) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274 slapd.exe (Windows) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274

Finding and Executing the ns-slapd and slapd.exe Command-Line Utilities . . . . . . . . . . . . . . . . . . . 274 ns-slapd and slapd.exe Command-Line Utilities for Exporting Databases . . . . . . . . . . . . . . . . . . . . . 275 db2ldif . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 ns-slapd and slapd.exe Command-Line Utilities for Restoring and Backing up Databases . . . . . . . 277 ldif2db . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277

16 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277 archive2db . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 db2archive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 ns-slapd and slapd.exe Command-Line Utilities for Creating and Regenerating Indexes . . . . . . . . 281 db2index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281

Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281

Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281

Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299

17

18 Netscape Directory Server Configuration, Command, and File Reference • August 2002

About This Reference Guide

Netscape Directory Server (Directory Server) is a powerful and scalable distributed directory server based on the industry-standard Lightweight Directory Access

Protocol (LDAP). Directory Server is the cornerstone for building a centralized and distributed data repository that can be used in your intranet, over your extranet with your trading partners, or over the public Internet to reach your customers.

This Configuration, Command, and File Reference documents server configuration and command-line utilities provided with Directory Server.

This preface contains the following sections:

• Directory Server Overview (page 19)

• Prerequisite Reading (page 20)

• What Is In This Reference Guide? (page 20)

• Conventions Used In This Reference Guide (page 21)

• Related Information (page 21)

Directory Server Overview

The major components of Directory Server include:

• An LDAP server —The core of the directory service, provided by the ns-slapd daemon, and compliant with the LDAP v3 Internet standards.

• Directory Server Console —An improved management console that dramatically reduces the effort of setting up and maintaining your directory service. Directory Server Console is part of Netscape Console, the common management framework for Netscape servers.

19

Prerequisite Reading

• SNMP Agent —Permits you to monitor Directory Server in real time using the

Simple Network Management Protocol (SNMP).

• Online backup and restore —Allows you to create backups and restore from backups while the server is running.

Prerequisite Reading

This reference guide does not describe many of the basic directory and architectural concepts that you need to successfully design, implement, and administer your directory service. Those concepts are described in the Netscape

Directory Server Administrator’s Guide. You should read that book before continuing with this reference guide.

When you are familiar with Directory Server concepts and have done some preliminary planning for your directory service, you can install the Directory

Server. The instructions for installing the various Directory Server components are contained in the Netscape Directory Server Installation Guide.

Managing Servers with Netscape Console contains general background information on how to use Netscape servers. You should read and understand the concepts in this book before you attempt to administer the Directory Server.

What Is In This Reference Guide?

This book is a reference guide for the server configuration and the command-line utilities. It is designed primarily for directory administrators and experienced directory users who want to use the command line to access the directory. After configuring your server, use this reference guide to help you maintain it.

You can also manage the Directory Server using the Directory Server Console, a graphical user interface. The Netscape Directory Server Administrator’s Guide describes how to do this and explains individual administration tasks more fully.

20 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Conventions Used In This Reference Guide

Conventions Used In This Reference Guide

This section explains the conventions used in this book.

Monospaced font

—This typeface is used for any text that appears on the computer screen or text that you should type. It is also used for filenames, functions, and examples.

NOTE Notes and Warnings mark important information. Make sure you read the information before continuing with a task.

Throughout this book you will see path references of the form: serverRoot /slapdserverID /...

serverRoot is the installation directory. For Directory Server 5.x and 6.x,

/usr/netscape/servers is the default installation directory on UNIX. On

Windows, it is c:\usr\netscape\servers

. If you have installed Directory

Server in a different location, you should adapt the path accordingly.

serverID is the ID or identifier you assigned to an instance of Directory Server when you installed it. For example, if you gave the server an identifier of phonebook

, then the actual path would look like this:

/usr/netscape/servers/slapd-phonebook/. . .

All paths specified in this manual are in UNIX format. If you are using a

Windows-based Directory Server, you should assume the equivalent file paths whenever UNIX file paths are shown in this book.

In examples/sample code, paths assume that the Directory Server is installed in the default location

/usr/netscape/servers

. If you have installed your Directory

Server in a different location, adapt the paths accordingly. Also, all examples use phonebook for the server identifier where appropriate.

Related Information

The document set for Directory Server also contains the following guides:

• Netscape Directory Server Installation Guide. Procedures for installing Directory

Server as well as procedures for migrating your Directory Server.

• Netscape Directory Server Deployment Guide. Provides an overview for planning your deployment of the Directory Server. Includes deployment examples.

About This Reference Guide 21

Related Information

• Netscape Directory Server Administrator’s Guide. Procedures for the day-to-day maintenance of your directory service. Includes information on configuring server-side plug-ins.

• Netscape Directory Server Schema Reference. Provides information about the

Netscape Directory Server schema.

• Netscape Directory Server Plug-In Programmer’s Guide. Describes how to write server plug-ins in order to customize and extend the capabilities of Directory

Server.

For a list of documentation installed with Directory Server, open the serverRoot /manual/en/slapd/index.htm

file.

For the latest information about Directory Server, including current release notes, complete product documentation, technical notes, and deployment information, check this site: http://enterprise.netscape.com/docs

22 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Chapter 1

Introduction

This chapter provides a brief overview of the configuration and administration utilities provided to manage the Netscape Directory Server (Directory Server).

This chapter is divided into the following sections:

• Overview of Directory Server Management (page 23)

• Directory Server Configuration (page 24)

• Directory Server Instance File Reference (page 24)

• Migrating Directory Server (page 24)

• Using Directory Server Command-Line Utilities (page 24)

• Using Directory Server Command-Line Scripts (page 25)

Overview of Directory Server Management

Directory Server is based on an open-systems server protocol called the

Lightweight Directory Access Protocol (LDAP). The Directory Server is a robust, scalable server designed to manage large scale directories to support enterprise-wide directory of users and resources, extranets and e-commerce applications over the Internet. The Directory Server runs as the ns-slapd process or service ( slapd on Windows) on your machine. The server manages the directory databases and responds to client requests.

You can perform most Directory Server administrative tasks through Netscape

Console, the graphical user interface provided with the Directory Server. For information on the general use of the Netscape Console see Managing Servers with

Netscape Console, and for details on how to use the console to manage the Directory

Server in particular, see Netscape Directory Server Administrator’s Guide.

23

Directory Server Configuration

This reference manual deals with the other methods of managing the Directory

Server, namely altering the server configuration attributes via the command line and using the command-line utilities.

Directory Server Configuration

The format and method for storing configuration information for Directory Server mark a significant change from previous versions of the Directory Server. A full explanation of these changes and a listing for all server attributes can be found in

Chapter 2, “Core Server Configuration Reference” and Chapter 3, “Plug-in

Implemented Server Functionality Reference.”

Directory Server Instance File Reference

Having an overview of the files and configuration information stored in each instance of Directory Server is useful, as this helps administrators understand the changes or absence of changes in the course of directory activity. From a security standpoint, such an overview can help customers detect errors and intrusion as they know what kind of changes to expect and what will be considered abnormal behavior. See Chapter 4, “Server Instance File Reference” for further information.

Migrating Directory Server

In earlier versions of the Directory Server (for example, versions 4.1x), all configuration parameters were stored in text files. In Directory Server 5.x onwards, configuration attributes are stored as LDAP configuration entries in the dse.ldif

file. The mapping of configuration parameters between earlier versions of

Directory Server and Directory Server 6.x is described in Chapter 6, “Migration from Earlier Versions.”

Using Directory Server Command-Line Utilities

Directory Server comes with a set of configurable command-line utilities that you can use to search and modify entries in the directory and administer the server.

Chapter 7, “Command-Line Utilities”describes these command-line utilities and contains information on where the utilities are stored and how to access them. In

24 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Using Directory Server Command-Line Scripts addition to these command-line utiltiies, Directory Server also provides ns-slapd and slapd.exe

command-line utilities for performing directory operations as described in Appendix A, “Using the ns-slapd and slapd.exe Command-Line

Utilities.”

Using Directory Server Command-Line Scripts

In addition to command-line utilities, several non-configurable scripts are provided with the Directory Server that make it quick and easy to perform routine server administration tasks from the command line. Chapter 8, “Command-Line

Scripts” lists the most frequently used scripts and contains information on where the scripts are stored and how to access them.

Chapter 1 Introduction 25

Using Directory Server Command-Line Scripts

26 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Chapter 2

Core Server Configuration Reference

The configuration information for Netscape Directory Server (Directory Server) is stored as LDAP entries within the directory itself. Therefore, changes to the server configuration must be implemented through the use of the server itself rather than by simply editing configuration files. The principal advantage of this method of configuration storage is that it allows a directory administrator to reconfigure the server via LDAP while it is still running, and thus avoid the need to shut the server down.

This chapter gives details on how the configuration is organized and how to alter it. The chapter also provides an alphabetical reference for all attributes. The chapter is divided into the following sections:

• Server Configuration - Overview (page 27)

• Accessing and Modifying Server Configuration (page 32)

• Core Server Configuration Attributes Reference (page 35)

• Configuration Quick Reference Tables (page 114)

Server Configuration - Overview

When you install the Directory Server, its default configuration is stored as a series of LDAP entries within the directory, under the subtree cn=config

. When the server is started, the contents of the cn=config subtree are read from a file

( dse.ldif

) in LDIF format. This dse.ldif

file contains all of the server configuration information. Note that the latest version of this file is called dse.ldif

, the version prior to the last modification is called dse.ldif.bak

, and the latest file with which the server successfully started is called dse.ldif.startOK

.

27

Server Configuration - Overview

Many of the features of the Directory Server are designed as discrete modules that plug into the core server. The details of the internal configuration for each plug-in are contained in separate entries under cn=plugins,cn=config

. For example, the configuration of the Telephone Syntax plug-in is contained in this entry: cn=Telephone Syntax,cn=plugins,cn=config

Similarly, database-specific configuration is stored under: cn=ldbm database,cn=plugins,cn=config and cn=chaining database,cn=plugins,cn=config

Figure 2-1 shows how the configuration data fits within the cn=config

Directory

Information Tree.

Figure 2-1 Directory Information Tree Showing Configuration Data

This overview is divided into the following sections:

• LDIF Configuration Files - Location

• Schema Configuration Files - Location

• How the Server Configuration is Organized

• Migration of Pre-Directory Server 6.x Configuration Files to LDIF Format

28 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Server Configuration - Overview

LDIF Configuration Files - Location

The Directory Server configuration data is automatically output to files in LDIF format that are located in the following directory: serverRoot /slapdserverID /config

Thus, if you specified a server identifier of phonebook for example, then in a default installation, your configuration LDIF files are all stored under:

/usr/netscape/servers/slapd-phonebook/config

Schema Configuration Files - Location

Schema configuration is also stored in LDIF format and these files are located in the following directory: serverRoot /slapdserverID /config/schema

For a full list of the LDIF configuration files that are supplied with Directory

Server, see Table 2-3 under “Configuration Quick Reference Tables” at the end of this chapter.

How the Server Configuration is Organized

The dse.ldif

file contains all configuration information including directory specific entries created by the directory at server startup, as well as directory specific entries related to the database, also created by the directory at server startup. The file includes the Root DSE (named by "" ) and the entire contents of cn=config

. When the server generates the dse.ldif

file it lists the entries in hierarchical order. It does so in the order that the entries appear in the directory under cn=config

.

Configuration Attributes

Within a configuration entry, each attribute is represented as an attribute name.

The value of the attribute corresponds to the attribute’s configuration.

Code Example 2-1 gives an example of part of the dse.ldif

file for a Directory

Server. The example shows, amongst other things, that schema checking has been turned on; this is represented by the attribute nsslapd-schemacheck

, which takes the value on

.

Code Example 2-1 Extract of dse.ldif

File

Chapter 2 Core Server Configuration Reference 29

Server Configuration - Overview dn: cn=config objectclass: top objectclass: extensibleObject objectclass: nsslapdConfig nsslapd-accesslog-logging-enabled: on nsslapd-enquote-sup-oc: on nsslapd-localhost: phonebook.example.com

nsslapd-errorlog:

/usr/netscape/servers/slapd-phonebook/logs/errors nsslapd-schemacheck: on nsslapd-store-state-info: on nsslapd-port: 389 nsslapd-localuser: nobody

...

Configuration of Plug-in Functionality

The configuration for each part of Directory Server plug-in functionality has its own separate entry and set of attributes under the subtree cn=plugins,cn=config

. Code Example 2-2 shows an example of the configuration entry for a plug-in, the Telephone Syntax plug-in.

Code Example 2-2 Configuration Entry for Telephone Syntax Plug-in dn: cn=Telephone Syntax,cn=plugins,cn=config objectclass: top objectclass: nsSlapdPlugin objectclass: extensibleObject cn: Telephone Syntax nsslapd-pluginPath: /usr/netscape/servers/lib/syntax-plug-in.so

nsslapd-pluginInitfunc: tel_init nsslapd-pluginType: syntax nsslapd-pluginEnabled: on

Some of these attributes are common to all plug-ins and some may be particular to a specific plug-in. You can check which attributes are currently being used by a given plug-in by performing an ldapsearch on the cn=config subtree.

30 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Server Configuration - Overview

For a list of plug-ins supported by Directory Server, general plug-in configuration information, the plug-in configuration attribute reference, and a list of plug-ins requiring restart, see Chapter 3, “Plug-in Implemented Server Functionality

Reference.”

Configuration of Databases

The cn=NetscapeRoot and cn=UserRoot subtrees contain configuration data for the databases containing the o=NetscapeRoot and o=UserRoot suffixes.

• The cn=NetscapeRoot subtree contains the configuration data used by the

Netscape Administration Server for authentication and all actions that cannot be performed through LDAP (such as start/stop).

• The cn=UserRoot subtree contains all the configuration data for the first user-defined database created during server installation. The cn=UserRoot subtree is called UserRoot by default. However, this is not hard-coded, and, given the fact that there will be multiple database instances, this name will be changed and defined by the user as and when new databases are added.

Configuration of Indexes

Configuration information for indexing is stored as entries in the Directory Server under the following information-tree nodes:

• cn=index,cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config

• cn=index,cn=UserRoot,cn=ldbm database,cn=plugins,cn=config

• cn=default indexes,cn=config,cn=ldbm database, cn=plugins,cn=config

For more information regarding indexes in general, see Netscape Directory Server

Administrator’s Guide. For information regarding the index configuration attributes see “Database Attributes Under cn=default indexes,cn=config,cn=ldbm database, cn=plugins,cn=config,” on page 166. The attributes are presented here as this node is the first to appear in our representation of the configuration attributes that is based on the cn=config information tree.

Chapter 2 Core Server Configuration Reference 31

Accessing and Modifying Server Configuration

Migration of Pre-Directory Server 6.x

Configuration Files to LDIF Format

The Directory Server will only recognize configuration files that are in the LDIF format, which means that the slapd.conf

and slapd.ldbm.conf

configuration files from 4.x versions of Directory Server must be converted to LDIF format.

Directory Server 4.x configurations can be migrated to the new LDIF format using the tool migrateInstance6 tool. For more information, see Chapter 6, “Migrating

From Previous Versions” in the Netscape Directory Server Installation Guide and the

Innosoft Distributed Directory Server Transition Guide.

Accessing and Modifying Server Configuration

This section discusses access control for configuration entries and describes the various ways in which the server configuration can be viewed and modified. It also covers restrictions to the kinds of modification that can be made and discusses attributes that require the server to be restarted for changes to take effect.

• Access Control For Configuration Entries

• Changing Configuration Attributes

Access Control For Configuration Entries

When the Directory Server is installed, a default set of Access Control Instructions

(ACIs) is implemented for all entries under cn=config

. Code Example 2-3 shows an example of these default ACIs.

32 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Accessing and Modifying Server Configuration

Code Example 2-3 Default ACIs in dse.ldif

aci: (targetattr = "*")(version 3.0; acl "Configuration

Adminstrators Group"; allow (all) groupdn = "ldap:///cn=Configuration Administrators,ou=Groups, ou=TopologyManagement, o=NetscapeRoot";) aci: (targetattr = "*")(version 3.0; acl "Configuration

Adminstrator"; allow (all) userdn = "ldap:///uid=admin,ou=Administrators, ou=TopologyManagement, o=NetscapeRoot";) aci: (targetattr = "*")(version 3.0; acl "Local Directory

Adminstrators Group"; allow (all) groupdn = "ldap:///ou=Directory Administrators, dc=example,dc=com";) aci: (targetattr = "*")(version 3.0; acl "SIE Group"; allow(all) groupdn = "ldap:///cn=slapd-phonebook, cn=Netscape Directory

Server, cn=Server Group, cn=phonebook.example.com, dc=example,dc=com, o=NetscapeRoot";)

These default ACIs allow all LDAP operations to be carried out on all configuration attributes by the following users:

• Members of the Configuration Administrators Group.

• The user acting as the Administrator, who has the UID admin that can be configured at installation time.

• Members of local Directory Administrators Group.

• The local Directory Administrator (root DN).

• The SIE (Server Instance Entry) Group that is usually assigned using the Set

Access Permissions from the main topology view in the main console.

For more information on Access Control, see the Netscape Directory Server

Administrator’s Guide.

Changing Configuration Attributes

You can view and change server attribute values in one of three ways. You make the changes by using LDAP through Netscape Console, by performing ldapsearch and ldapmodify commands, or by manually editing the dse.ldif

file.

Chapter 2 Core Server Configuration Reference 33

Accessing and Modifying Server Configuration

NOTE If you edit the dse.ldif

file, you must stop the server beforehand, otherwise your changes will be lost. Editing the dse.ldif

file is recommended only for changes to attributes which cannot be altered dynamically. See “Configuration Changes Requiring Server

Restart,” on page 117 for further information.

The following sections describe how to modify entries using LDAP (both via

Netscape Console and over the command line), the restrictions to modifying entries, the restrictions to modifying attributes, and the configuration changes requiring restart.

Modifying Configuration Entries Using LDAP

The configuration entries in the directory can be searched and modified using

LDAP either via the Netscape Console or by performing ldapsearch and ldapmodify operations in the same way as other directory entries. The advantage of using LDAP to modify entries is that you can make the changes while the server is running. You must remember to specify the port number when modifying configuration entries as the server is not necessarily running on port 389. For further information, see Chapter 2, “Creating Directory Entries” in the Netscape

Directory Server Administrator’s Guide. However, certain changes do require the server to be restarted before they are taken into account. See “Configuration

Changes Requiring Server Restart,” on page 117 for further information.

NOTE As with any set of configuration files, care should be taken when changing or deleting nodes in the cn=config subtree, as this risks affecting Directory Server functionality.

The entire configuration, including attributes that always take default values, can be viewed by performing an ldapsearch operation on the cn=config subtree: ldapsearch -b cn=config -D bindDN -w password where bindDN is the DN chosen for the Directory Manager when the server was installed and password is the password chosen for Directory Manager. For more information on using ldapsearch

, see “ldapsearch,” on page 220.

Previously, we saw an example of the configuration entry for the Telephone Syntax plug-in where the plug-in is enabled. If you wanted to disable this feature you might use the following series of commands to implement this change.

34 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Code Example 2-4 Disabling the Telephone Syntax Plug-in ldapmodify -D bindDN -w password dn: cn=Telephone Syntax,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: off

Restrictions to Modifying Configuration Entries and Attributes

Certain restrictions apply when modifying server entries and attributes:

• The cn=monitor entry and its child entries are read-only and cannot be modified.

• If an attribute is added to cn=config , the server will ignore it.

• If an invalid value is entered for an attribute, this will be ignored by the server.

• Because ldapdelete is used for deleting an entire entry, you should use ldapmodify if you want to remove an attribute from an entry.

Configuration Changes Requiring Server Restart

Some configuration attributes cannot be altered dynamically while the server is running. In these cases, for the changes to take effect, the server needs to be shut down and restarted. The modifications should be made either through the

Directory Server Console or by manually editing the dse.ldif

file. Table 2-4 under

“Configuration Quick Reference Tables” at the end of this chapter contains a list of these attributes.

Core Server Configuration Attributes Reference

This section contains reference information on the configuration attributes that are relevant to the core server functionality. For information on changing server configuration, see “Accessing and Modifying Server Configuration,” on page 32.

For a list of server features that are implemented as plug-ins, see Table 2-1 in the section “Configuration Quick Reference Tables,” on page 114. For implementing your own server functionality, contact Netscape Professional Services.

The configuration information which is stored in the dse.ldif

file is organized as an information tree under the general configuration entry cn=config as shown in

Figure 2-2.

Chapter 2 Core Server Configuration Reference 35

Core Server Configuration Attributes Reference

Figure 2-2 Directory Information Tree Showing Configuration Data

The list of configuration tree nodes covered in this section is as follows:

• cn=config

• cn=changelog5

• cn=encryption

• cn=features

• cn=mapping tree

• cn=monitor

• cn=replication

• cn=SNMP

• cn=tasks

• cn=uniqueid generator

The cn=plugins node is covered in the “Configuration Quick Reference Tables,” on page 114” section. The attributes are listed alphabetically, and the description of each attribute contains details such as the DN of its directory entry, its default value, the valid range of values, and an example of its use.

NOTE Some of the entries and attributes described in this chapter may change in future releases of the product.

36 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

cn=config

General configuration entries are stored under the cn=config entry. The cn=config entry is an instance of the nsslapdConfig object class, which in turn inherits from extensibleObject object class. For attributes to be taken into account by the server, both of these object classes (in addition to the top object class) must be present in the entry. General configuration entries are presented in this section.

nsslapd-accesscontrol (Enable Access Control)

Turns access control on and off. If this attribute has a value off

, then any valid bind attempt (including an anonymous bind) results in full access to all information stored in the Directory Server.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off on

DirectoryString nsslapd-accesscontrol: off

nsslapd-accesslog (Access Log)

Specifies the path and filename of the log used to record each database access. The following information is recorded by default in the log file:

• IP address of the client machine that accessed the database

• Operations performed (for example, search, add, modify)

• Result of the access (for example, the number of entries returned)

For more information on turning access logging off, see Chapter 12, “Monitoring

Server and Database Activity” in the Netscape Directory Server Administrator’s

Guide.

For access logging to be enabled, this attribute must have a valid path and filename and the nsslapd-accesslog-logging-enabled configuration attribute must be switched to on

. The table below lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of access logging.

Chapter 2 Core Server Configuration Reference 37

Core Server Configuration Attributes Reference

Attributes in dse.ldif

nsslapd-accesslog-logging-enabled nsslapd-accesslog nsslapd-accesslog-logging-enabled nsslapd-accesslog nsslapd-accesslog-logging-enabled nsslapd-accesslog nsslapd-accesslog-logging-enabled nsslapd-accesslog

Value on empty string on filename off empty string off filename

Logging enabled or disabled

Disabled

Enabled

Disabled

Disabled

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

Any valid filename.

serverRoot /slapdserverID /logs/access

DirectoryString nsslapd-accesslog:

/usr/netscape/servers/slapd-phonebook/logs/access

nsslapd-accesslog-level

Controls what is logged to the access log.

Entry DN:

Valid Values: cn=config

0—No access logging

4—Logging for internal access operations

256—Logging for access to an entry

512—Logging for access to an entry and referrals

These values can be added together to provide you with the exact type of logging you require, for example 516 (4 + 512) to obtain internal access operation, entry access, and referral logging.

38 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Default Value:

Syntax:

Example:

256

Integer nsslapd-accesslog-level: 256

nsslapd-accesslog-list

This read-only attribute which cannot be set provides a list of access log files used in access log rotation.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

N/A

None

DirectoryString nsslapd-accesslog-list:accesslog2,accesslog3

nsslapd-accesslog-logbuffering (Log Buffering)

When set to off

, the server writes all access log entries directly to disk.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off on

DirectoryString nsslapd-accesslog-logbuffering: off

nsslapd-accesslog-logexpirationtime (Access Log Expiration Time)

Specifies the maximum age that a log file is allowed to reach before it is deleted.

This attribute supplies only the number of units. The units are provided by the nsslapd-accesslog-logexpirationtimeunit attribute.

Entry DN:

Valid Range: cn=config

1 to the maximum 32 bit integer value (2147483647)

Chapter 2 Core Server Configuration Reference 39

Core Server Configuration Attributes Reference

Default Value:

Syntax:

Example:

1

Integer nsslapd-accesslog-logexpirationtime: 2

nsslapd-accesslog-logexpirationtimeunit (Access Log Expiration

Time Unit)

Specifies the units for nsslapd-accesslog-logexpirationtime attribute. If the unit is unknown by the server, then the log will never expire.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config month | week | day month

DirectoryString nsslapd-accesslog-logexpirationtimeunit: week

nsslapd-accesslog-logging-enabled (Access Log Enable Logging)

Disables and enables accesslog logging but only in conjunction with the nsslapd-accesslog attribute that specifies the path and filename of the log used to record each database access.

For access logging to be enabled this attribute must be switched to on and the nsslapd-accesslog configuration attribute must have a valid path and filename.

The table below lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of access logging.

Logging Enabled or Disabled

Disabled

Attributes in dse.ldif

nsslapd-accesslog-logging-enabled nsslapd-accesslog nsslapd-accesslog-logging-enabled nsslapd-accesslog nsslapd-accesslog-logging-enabled nsslapd-accesslog

Value on empty string on filename off empty string

Enabled

Disabled

40 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Attributes in dse.ldif

nsslapd-accesslog-logging-enabled nsslapd-accesslog

Value off filename

Core Server Configuration Attributes Reference

Logging Enabled or Disabled

Disabled

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off on

DirectoryString nsslapd-accesslog-logging-enabled: off

nsslapd-accesslog-logmaxdiskspace (Access Log Maximum Disk

Space)

Specifies the maximum amount of disk space in megabytes that the access logs are allowed to consume. If this value is exceeded, the oldest access log is deleted.

When setting a maximum disk space, consider the total number of log files that can be created due to log file rotation. Also remember that there are 3 different log files

(access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the access log.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

-1 | 1 to the maximum 32 bit integer value (2147483647)

500 (A value of -1 means that the disk space allowed to the access log is unlimited in size).

Integer nsslapd-accesslog-logmaxdiskspace: 200

Chapter 2 Core Server Configuration Reference 41

Core Server Configuration Attributes Reference

nsslapd-accesslog-logminfreediskspace (Access Log Minimum Free

Disk Space)

Specifies the minimum allowed free disk space in megabytes. When the amount of free disk space falls below the value specified on this attribute, the oldest access log is deleted until enough disk space is freed to satisfy this attribute.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to the maximum 32 bit integer value (2147483647)

5

Integer nsslapd-accesslog-logminfreediskspace: 4

nsslapd-accesslog-logrotationsync-enabled (Access Log Rotation

Sync Enabled)

Specifies whether access log rotation is to be synchronized with a particular time of the day. Synchronizing log rotation this way enables you to generate log files at a specified time during a day, say midnight to midnight everyday, making analysis of the log files much easier because they then map directly to the calendar.

For access log rotation to be synchronized with time-of-day, this attribute must be enabled with the nsslapd-accesslog-logrotationsynchour and nsslapd-accesslog-logrotationsyncmin attribute values set to the hour and minute of the day for rotating log files.

For example, to rotate access log files everyday at midnight, enable this attribute by setting its value to on and then set the values of the nsslapd-accesslog-logrotationsynchour nsslapd-accesslog-logrotationsyncmin and attributes to

0

.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off on

DirectoryString nsslapd-accesslog-logrotationsync-enabled: on

42 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

nsslapd-accesslog-logrotationsynchour (Access Log Rotation Sync

Hour)

Specifies the hour of the day for rotating access logs. This attribute must be used in conjunction with nsslapd-accesslog-logrotationsync-enabled and nsslapd-accesslog-logrotationsyncmin attributes.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

0 through 23

0

Integer nsslapd-accesslog-logrotationsynchour: 23

nsslapd-accesslog-logrotationsyncmin (Access Log Rotation Sync

Minute)

Specifies the minute of the day for rotating access logs. This attribute must be used in conjunction with nsslapd-accesslog-logrotationsync-enabled and nsslapd-accesslog-logrotationsynchour attributes.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

0 through 59

0

Integer nsslapd-accesslog-logrotationsyncmin: 30

nsslapd-accesslog-logrotationtime (Access Log Rotation Time)

Specifies the time between access log file rotations. The access log will be rotated when this time interval is up, regardless of the current size of the access log. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-accesslog-logrotationtimeunit attribute.

Although it is not recommended for performance reasons to specify no log rotation as the log will grow indefinitely, you have two ways of specifying this. Either you set the nsslapd-accesslog-maxlogsperdir attribute value to 1 or the nsslapd-accesslog-logrotationtime attribute to -1. The server checks the

Chapter 2 Core Server Configuration Reference 43

Core Server Configuration Attributes Reference nsslapd-accesslog-maxlogsperdir attribute first and if this attribute value is larger than 1, the server then checks the nsslapd-accesslog-logrotationtime attribute. See “nsslapd-accesslog-maxlogsperdir (Access Log Maximum Number of

Log Files),” on page 45 for more information.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means that the time between access log file rotation is unlimited.

1

Integer nsslapd-accesslog-logrotationtime: 100

nsslapd-accesslog-logrotationtimeunit (Access Log Rotation Time

Unit)

Specifies the units for the nsslapd-accesslog-logrotationtime attribute.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config month | week | day | hour | minute day

DirectoryString nsslapd-accesslog-logrotationtimeunit: week

nsslapd-accesslog-maxlogsize (Access Log Maximum Log Size)

Specifies the maximum access log size in megabytes. When this value is reached, the access log is rotated. That is, the server starts writing log information to a new log file. If you set nsslapd-accesslog-maxlogsperdir attribute to 1, the server ignores this attribute.

When setting a maximum log size, consider the total number of log files that can be created due to log file rotation. Also remember that there are 3 different log files

(access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the access log.

44 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means the log file is unlimited in size.

100

Integer nsslapd-accesslog-maxlogsize: 100

nsslapd-accesslog-maxlogsperdir (Access Log Maximum Number of

Log Files)

Specifies the total number of access logs that can be contained in the directory where the access log is stored. If you are using log file rotation, then each time the access log is rotated, a new log file is created. When the number of files contained in the access log directory exceeds the value stored on this attribute, then the oldest version of the log file is deleted. For performance reasons it is not recommended that you set this value to 1, as the server will not rotate the log and it will grow indefinitely.

If the value for this attribute is higher than 1, then you need to check the nsslapd-accesslog-logrotationtime attribute to establish whether or not log rotation is specified. If the nsslapd-accesslog-logrotationtime attribute has a value of -1 then there is no log rotation. See “nsslapd-accesslog-logrotationtime

(Access Log Rotation Time),” on page 43 for more information.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to the maximum 32 bit integer value (2147483647)

10

Integer nsslapd-accesslog-maxlogsperdir: 10

nsslapd-attribute-name-exceptions

Allows non-standard characters in attribute names to be used for backwards compatibility with older servers.

Entry DN: cn=config

Chapter 2 Core Server Configuration Reference 45

Core Server Configuration Attributes Reference

Valid Values:

Default Value:

Syntax:

Example: on | off off

DirectoryString nsslapd-attribute-name-exceptions: on

nsslapd-auditlog (Audit Log)

Specifies the pathname and filename of the log used to record changes made to each database.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

Any valid filename serverRoot /slapdserverID /logs/audit

DirectoryString nsslapd-auditlog:

/usr/netscape/servers/slapd-phonebook/logs/audit

For audit logging to be enabled this attribute must have a valid path and file name and the nsslapd-auditlog-logging-enabled configuration attribute must be switched to on . The table below lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of audit logging.

Logging enabled or disabled

Disabled

Attributes in dse.ldif

nsslapd-auditlog-logging-enabled nsslapd-auditlog nsslapd-auditlog-logging-enabled nsslapd-auditlog nsslapd-auditlog-logging-enabled nsslapd-auditlog nsslapd-auditlog-logging-enabled nsslapd-auditlog

Value on empty string on filename off empty string off filename

Enabled

Disabled

Disabled

46 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

nsslapd-auditlog-list

Provides a list of audit log files.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

N/A

None

DirectoryString nsslapd-auditlog-list: auditlog2,auditlog3

nsslapd-auditlog-logexpirationtime (Audit Log Expiration Time)

Specifies the maximum age that a log file is allowed to be before it is deleted. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-auditlog-logexpirationtimeunit attribute.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to the maximum 32 bit integer value (2147483647)

1

Integer nsslapd-auditlog-logexpirationtime: 1

nsslapd-auditlog-logexpirationtimeunit (Audit Log Expiration Time

Unit)

Specifies the units for the nsslapd-auditlog-logexpirationtime attribute. If the unit is unknown by the server, then the log will never expire.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config month | week | day week

DirectoryString nsslapd-auditlog-logexpirationtimeunit: day

Chapter 2 Core Server Configuration Reference 47

Core Server Configuration Attributes Reference

nsslapd-auditlog-logging-enabled (Audit Log Enable Logging)

Turns audit logging on and off.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off off

DirectoryString nsslapd-auditlog-logging-enabled: off

For audit logging to be enabled this attribute must have a valid path and file name and the nsslapd-auditlog-logging-enabled configuration attribute must be switched to on . The table below lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of audit logging.

Logging enabled or disabled

Disabled

Attributes in dse.ldif

nsslapd-auditlog-logging-enabled nsslapd-auditlog nsslapd-auditlog-logging-enabled nsslapd-auditlog nsslapd-auditlog-logging-enabled nsslapd-auditlog nsslapd-auditlog-logging-enabled nsslapd-auditlog

Value on empty string on filename off empty string off filename

Enabled

Disabled

Disabled

nsslapd-auditlog-logmaxdiskspace (Audit Log Maximum Disk Space)

Specifies the maximum amount of disk space in megabytes that the audit logs are allowed to consume. If this value is exceeded, the oldest audit log is deleted.

48 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

When setting a maximum disk space, consider the total number of log files that can be created due to log file rotation. Also remember that there are three different log files (access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations with the total amount of disk space that you want to be used by the audit log.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means that the disk space allowed to the audit log is unlimited in size.

500

Integer nsslapd-auditlog-logmaxdiskspace: 500

nsslapd-auditlog-logminfreediskspace (Audit Log Minimum Free Disk

Space)

Specifies the minimum permissible free disk space in megabytes. When the amount of free disk space falls below the value specified on this attribute, the oldest audit log is deleted until enough disk space is freed to satisfy this attribute.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to the maximum 32 bit integer value (2147483647)

5

Integer nsslapd-auditlog-logminfreediskspace: 3

nsslapd-auditlog-logrotationsync-enabled (Audit Log Rotation Sync

Enabled)

Specifies whether audit log rotation is to be synchronized with a particular time of the day. Synchronizing log rotation this way enables you to generate log files at a specified time during a day, say midnight to midnight everyday, making analysis of the log files much easier because they then map directly to the calendar.

Chapter 2 Core Server Configuration Reference 49

Core Server Configuration Attributes Reference

For audit log rotation to be synchronized with time-of-day, this attribute must be enabled with the nsslapd-auditlog-logrotationsynchour and nsslapd-auditlog-logrotationsyncmin attribute values set to the hour and minute of the day for rotating log files.

For example, to rotate audit log files everyday at midnight, enable this attribute by setting its value to on and then set the values of the nsslapd-auditlog-logrotationsynchour and nsslapd-auditlog-logrotationsyncmin attributes to

0

.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off off

DirectoryString nsslapd-auditlog-logrotationsync-enabled: on

nsslapd-auditlog-logrotationsynchour (Audit Log Rotation Sync Hour)

Specifies the hour of the day for rotating audit logs. This attribute must be used in conjunction with nsslapd-auditlog-logrotationsync-enabled and nsslapd-auditlog-logrotationsyncmin attributes.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

0 through 23

None (because nsslapd-auditlog-logrotationsync-enabled is off )

Integer nsslapd-auditlog-logrotationsynchour: 23

nsslapd-auditlog-logrotationsyncmin (Audit Log Rotation Sync

Minute)

Specifies the minute of the day for rotating audit logs. This attribute must be used in conjunction with nsslapd-auditlog-logrotationsync-enabled and nsslapd-auditlog-logrotationsynchour attributes.

50 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

0 through 59

None (because nsslapd-auditlog-logrotationsync-enabled is off )

Integer nsslapd-auditlog-logrotationsyncmin: 30

nsslapd-auditlog-logrotationtime (Audit Log Rotation Time)

Specifies the time between audit log file rotations. The audit log will be rotated when this time interval is up, regardless of the current size of the audit log. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-auditlog-logrotationtimeunit attribute. If you set the nsslapd-auditlog-maxlogsperdir attribute to 1, the server ignores this attribute.

Although it is not recommended for performance reasons to specify no log rotation as the log will grow indefinitely, you have two ways of specifying this. Either you set the nsslapd-auditlog-maxlogsperdir attribute value to 1 or the nsslapd-auditlog-logrotationtime nsslapd-auditlog-maxlogsperdir attribute to -1. The server checks the attribute first and if this attribute value is larger than 1, the server then checks the nsslapd-auditlog-logrotationtime attribute. See “nsslapd-auditlog-maxlogsperdir (Audit Log Maximum Number of

Log Files),” on page 52 for more information.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means that the time between audit log file rotation is unlimited.

1

Integer nsslapd-auditlog-logrotationtime: 100

nsslapd-auditlog-logrotationtimeunit (Audit Log Rotation Time Unit)

Specifies the units for the nsslapd-auditlog-logrotationtime attribute.

Chapter 2 Core Server Configuration Reference 51

Core Server Configuration Attributes Reference

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config month | week | day | hour | minute week

DirectoryString nsslapd-auditlog-logrotationtimeunit: day

nsslapd-auditlog-maxlogsize (Audit Log Maximum Log Size)

Specifies the maximum audit log size in megabytes. When this value is reached, the audit log is rotated. That is, the server starts writing log information to a new log file. If you set nsslapd-auditlog-maxlogsperdir to 1, the server ignores this attribute.

When setting a maximum log size, consider the total number of log files that can be created due to log file rotation. Also remember that there are 3 different log files

(access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the audit log.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means the log file is unlimited in size.

100

Integer nsslapd-auditlog-maxlogsize: 50

nsslapd-auditlog-maxlogsperdir (Audit Log Maximum Number of Log

Files)

Specifies the total number of audit logs that can be contained in the directory where the audit log is stored. If you are using log file rotation, then each time the audit log is rotated, a new log file is created. When the number of files contained in the audit log directory exceeds the value stored on this attribute, then the oldest version of the log file is deleted. The default is 1 log. If you accept this default, the server will not rotate the log and it will grow indefinitely.

52 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

If the value for this attribute is higher than 1, then you need to check the nsslapd-auditlog-logrotationtime attribute to establish whether or not log rotation is specified. If the nsslapd-auditlog-logrotationtime attribute has a value of -1 then there is no log rotation. See “nsslapd-auditlog-logrotationtime

(Audit Log Rotation Time),” on page 51 for more information.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to the maximum 32 bit integer value (2147483647)

1

Integer nsslapd-auditlog-maxlogsperdir: 10

nsslapd-certmap-basedn (Certificate Map Search Base)

This attribute can be used when client authentication is performed using SSL certificates in order to avoid limitation of the security subsystem certificate mapping, configured in the certmap.conf

file. Depending on the certmap.conf

configuration, the certificate mapping may be done using a directory subtree search based at the root DN. Note that if the search is based at the root DN, then the nsslapd-certmap-basedn attribute may force the search to be based at some entry other than the root. For further information see Chapter 11, “Managing SSL” in the

Netscape Directory Server Administrator’s Guide.

nsslapd-config

This read-only attribute is the config DN.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

Any valid config DN.

N/A

DirectoryString nsslapd-config:cn=config

nsslapd-csnlogging

Specifies whether change sequence numbers (CSNs), when available, are to be logged in the access log. By default, CSN logging is turned on.

Chapter 2 Core Server Configuration Reference 53

Core Server Configuration Attributes Reference

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off on

DirectoryString nsslapd-csnlogging:on

nsslapd-ds4-compatible-schema

Makes the schema in cn=schema compatible with 4.x versions of Directory Server.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off off

DirectoryString nsslapd-ds4-compatible-schema: off

nsslapd-enquote-sup-oc (Enable Superior Object Class Enquoting)

Controls whether quoting in the objectclasses attributes contained in the cn=schema entry will conform to the quoting specified by internet draft RFC 2252.

By default, the Directory Server places single quotes around the superior object class identified on the objectclasses attributes contained in cn=schema

. RFC

2252 indicates that this value should not be quoted.

That is, the Directory Server publishes objectclasses attributes in the cn=schema entry as follows: objectclasses: ( 2.5.6.6 NAME ’person’ DESC ’Standard ObjectClass’

SUP ’top’ MUST ( objectclass $ sn $ cn ) MAY ( aci $ description $ seealso $ telephonenumber $ userpassword ) )

However, RFC 2252 indicates that this attribute should be published as follows: objectclasses: ( 2.5.6.6 NAME ’person’ DESC ’Standard ObjectClass’

SUP top MUST ( objectclass $ sn $ cn ) MAY ( aci $ description $ seealso $ telephonenumber $ userpassword ) )

Notice the absence of single quotes around the word top

.

54 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Turning this attribute on will cause the Directory Server Resource Kit LDAP clients to no longer function, as they require the schema as defined in RFC 2252.

Turning this attribute off causes the Directory Server to conform to RFC 2252, but doing so may interfere with some earlier LDAP clients. Specifically, any client written using the Netscape Java LDAP SDK 4.x will no longer be able to correctly read and modify schema. This includes the 4.x version of the Netscape Console.

Please note that turning this attribute on or off does not affect versions 6.x of

Netscape Console.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off on

DirectoryString nsslapd-enquote-sup-oc: off

nsslapd-errorlog (Error Log)

Specifies the pathname and filename of the log used to record error messages generated by the Directory Server. These messages can describe error conditions, but more often they will contain informative conditions such as these:

• Server startup and shutdown times

• Port number the server uses

This log will contain differing amounts of information depending on the current setting of the Log Level attribute. See “nsslapd-errorlog-level (Error Log Level),” on page 56 for more information.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

Any valid filename serverRoot /slapdserverID /logs/error

DirectoryString nsslapd-errorlog:

/usr/netscape/servers/slapd-phonebook/logs/error

Chapter 2 Core Server Configuration Reference 55

Core Server Configuration Attributes Reference

For error logging to be enabled this attribute must have a valid path and filename and the nsslapd-errorlog-logging-enabled configuration attribute must be switched to on

. The table below lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of error logging.

Logging enabled or disabled

Disabled

Attributes in dse.ldif

nsslapd-errorlog-logging-enabled nsslapd-errorlog nsslapd-errorlog-logging-enabled nsslapd-errorlog nsslapd-errorlog-logging-enabled nsslapd-errorlog nsslapd-errorlog-logging-enabled nsslapd-errorlog

Value on empty string on filename off empty string off filename

Enabled

Disabled

Disabled

nsslapd-errorlog-level (Error Log Level)

Specifies the level of logging to be used by the Directory Server. The log level is additive; that is, specifying a value of 3 causes both levels 1 and 2 to be performed.

To turn logging off, remove the nsslapd-errorlog-level attribute from dse.ldif

and restart the Directory Server.

Entry DN: cn=config

56 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Valid Values:

Default Value:

Syntax:

Example:

1 = Trace function calls. Logs a message when the server enters and exits a function.

2 = Debug Packet handling

4 = Heavy trace output debugging

8 = Connection management

16 = Print out packets sent/received

32 = Search filter processing

64 = Config file processing

128 = Access control list processing

2048 = Log entry parsing debugging

4096 = Housekeeping thread debugging

8192 = Replication debugging

16384 = Default level of logging used for critical errors and other messages that are always written to the error log, for example server startup messages. Messages at this level are always included in the error log regardless of the log level setting.

32768 = Database cache debugging.

65536 = Server plug-in debugging. It writes an entry to the log file when a server plug-in calls slapi-log-error.

Logging is turned off (the nsslapd-errorlog-level attribute is not included in the dse.ldif

file).

Integer nsslapd-errorlog-level: 8192

nsslapd-errorlog-list

This read-only attribute provides a list of error log files.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

N/A

None

DirectoryString nsslapd-errorlog-list:errorlog2,errorlog3

Chapter 2 Core Server Configuration Reference 57

Core Server Configuration Attributes Reference

nsslapd-errorlog-logexpirationtime (Error Log Expiration Time)

Specifies the maximum age that a log file is allowed to reach before it is deleted.

This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-errorlog-logexpirationtimeunit attribute.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to the maximum 32 bit integer value (2147483647)

1

Integer nsslapd-errorlog-logexpirationtime: 1

nsslapd-errorlog-logexpirationtimeunit (Error Log Expiration Time

Unit)

Specifies the units for the nsslapd-errorlog-logexpirationtime attribute. If the unit is unknown by the server, then the log will never expire.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config month | week | day month

DirectoryString nsslapd-errorlog-logexpirationtimeunit: week

nsslapd-errorlog-logging-enabled (Enable Error Logging)

Turns error logging on and off.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off on

DirectoryString nsslapd-errorlog-logging-enabled: on

58 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

nsslapd-errorlog-logmaxdiskspace (Error Log Maximum Disk Space)

Specifies the maximum amount of disk space in megabytes that the error logs are allowed to consume. If this value is exceeded, the oldest error log is deleted.

When setting a maximum disk space, consider the total number of log files that can be created due to log file rotation. Also remember that there are 3 different log files

(access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the error log.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means that the disk space allowed to the error log is unlimited in size.

500

Integer nsslapd-errorlog-logmaxdiskspace: 500

nsslapd-errorlog-logminfreediskspace (Error Log Minimum Free Disk

Space)

Specifies the minimum allowed free disk space in megabytes. When the amount of free disk space falls below the value specified on this attribute, the oldest error log is deleted until enough disk space is freed to satisfy this attribute.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to the maximum 32 bit integer value (2147483647)

5

Integer nsslapd-errorlog-logminfreediskspace: 5

Chapter 2 Core Server Configuration Reference 59

Core Server Configuration Attributes Reference

nsslapd-errorlog-logrotationsync-enabled (Error Log Rotation Sync

Enabled)

Specifies whether error log rotation is to be synchronized with a particular time of the day. Synchronizing log rotation this way enables you to generate log files at a specified time during a day, say midnight to midnight everyday, making analysis of the log files much easier because they then map directly to the calendar.

For error log rotation to be synchronized with time-of-day, this attribute must be enabled with the nsslapd-errorlog-logrotationsynchour and nsslapd-errorlog-logrotationsyncmin attribute values set to the hour and minute of the day for rotating log files.

For example, to rotate error log files everyday at midnight, enable this attribute by setting its value to on and then set the values of the nsslapd-errorlog-logrotationsynchour and nsslapd-errorlog-logrotationsyncmin attributes to 0 .

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off on

DirectoryString nsslapd-errorlog-logrotationsync-enabled: on

nsslapd-errorlog-logrotationsynchour (Error Log Rotation Sync Hour)

Specifies the hour of the day for rotating error logs. This attribute must be used in conjunction with nsslapd-errorlog-logrotationsync-enabled and nsslapd-errorlog-logrotationsyncmin attributes.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

0 through 23

0

Integer nsslapd-errorlog-logrotationsynchour: 23

60 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

nsslapd-errorlog-logrotationsyncmin (Error Log Rotation Sync

Minute)

Specifies the minute of the day for rotating error logs. This attribute must be used in conjunction with nsslapd-errorlog-logrotationsync-enabled and nsslapd-errorlog-logrotationsynchour attributes.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

0 through 59

0

Integer nsslapd-errorlog-logrotationsyncmin: 30

nsslapd-errorlog-logrotationtime (Error Log Rotation Time)

Specifies the time between error log file rotations. The error log will be rotated when this time interval is up, regardless of the current size of the error log. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-errorlog-logrotationtimeunit

(Error Log

Rotation Time Unit) attribute.

Although it is not recommended for performance reasons to specify no log rotation as the log will grow indefinitely, you have two ways of specifying this. Either you set the nsslapd-errorlog-maxlogsperdir attribute value to 1 or the nsslapd-errorlog-logrotationtime attribute to -1. The server checks the nsslapd-errorlog-maxlogsperdir attribute first and if this attribute value is larger than 1, the server then checks the nsslapd-errorlog-logrotationtime attribute. See “nsslapd-errorlog-maxlogsperdir (Maximum Number of Error Log

Files),” on page 63 for more information.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means that the time between error log file rotation is unlimited).

1

Integer nsslapd-errorlog-logrotationtime: 100

Chapter 2 Core Server Configuration Reference 61

Core Server Configuration Attributes Reference

nsslapd-errorlog-logrotationtime (Error Log Rotation Time)

Specifies the time between error log file rotations. The error log will be rotated when this time interval is up, regardless of the current size of the error log. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-errorlog-logrotationtimeunit

(Error Log

Rotation Time Unit) attribute.

Although it is not recommended for performance reasons to specify no log rotation as the log will grow indefinitely, you have two ways of specifying this. Either you set the nsslapd-errorlog-maxlogsperdir attribute value to 1 or the nsslapd-errorlog-logrotationtime nsslapd-errorlog-maxlogsperdir attribute to -1. The server checks the attribute first and if this attribute value is larger than 1, the server then checks the nsslapd-errorlog-logrotationtime attribute. See “nsslapd-errorlog-maxlogsperdir (Maximum Number of Error Log

Files),” on page 63 for more information.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means that the time between error log file rotation is unlimited).

1

Integer nsslapd-errorlog-logrotationtime: 100

nsslapd-errorlog-logrotationtimeunit (Error Log Rotation Time Unit)

Specifies the units for nsslapd-errorlog-logrotationtime

(Error Log Rotation

Time). If the unit is unknown by the server, then the log will never expire.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config month | week | day | hour | minute week

DirectoryString nsslapd-errorlog-logrotationtimeunit: day

62 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

nsslapd-errorlog-maxlogsize (Maximum Error Log Size)

Specifies the maximum error log size in megabytes. When this value is reached, the error log is rotated. That is, the server starts writing log information to a new log file. If you set nsslapd-errorlog-maxlogsperdir to 1, the server ignores this attribute.

When setting a maximum log size, consider the total number of log files that can be created due to log file rotation. Also remember that there are 3 different log files

(access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the error log.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means the log file is unlimited in size.

100

Integer nsslapd-errorlog-maxlogsize: 100

nsslapd-errorlog-maxlogsperdir (Maximum Number of Error Log

Files)

Specifies the total number of error logs that can be contained in the directory where the error log is stored. If you are using log file rotation, then each time the error log is rotated, a new log file is created. When the number of files contained in the error log directory exceeds the value stored on this attribute, then the oldest version of the log file is deleted. The default is

1 log. If you accept this default, the server will not rotate the log and it will grow indefinitely.

If the value for this attribute is higher than 1, then you need to check the nsslapd-errorlog-logrotationtime attribute to establish whether or not log rotation is specified. If the nsslapd-errorlog-logrotationtime attribute has a value of -1 then there is no log rotation. See “nsslapd-errorlog-logrotationtime

(Error Log Rotation Time),” on page 62 for more information.

Entry DN:

Valid Range:

Default Value: cn=config

1 to the maximum 32 bit integer value (2147483647)

1

Chapter 2 Core Server Configuration Reference 63

Core Server Configuration Attributes Reference

Syntax:

Example:

Integer nsslapd-errorlog-maxlogsperdir: 10

nsslapd-groupevalnestlevel

Specifies the number of levels of nesting that the access-control system will perform for group evaluation.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

0 to 5

5

Integer nsslapd-groupevalnestlevel:5

nsslapd-idletimeout (Default Idle Timeout)

Specifies the amount of time in seconds after which an idle LDAP client connection is closed by the server. A value of 0 indicates that the server will never close idle connections. You can use the nsIdleTimeout operational attribute, which can be added to user entries, to override the value assigned to this attribute. For details, see “Setting Resource Limits Based on the Bind DN” in the Netscape Directory

Server Administrator’s Guide.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

0 to the maximum 32 bit integer value (2147483647)

0

Integer nsslapd-idletimeout: 0

64 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

nsslapd-instancedir (Instance Directory)

Specifies the full path to the directory where this server instance is installed. The serverID from installation time is the default ID.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

Any valid file path.

serverRoot /slapdserverID

DirectoryString nsslapd-instancedir:

/usr/netscape/servers/slapd-phonebook

nsslapd-ioblocktimeout (IO Block Time Out)

Specifies the amount of time in milliseconds after which the connection to a stalled

LDAP client is closed. An LDAP client is considered to be stalled when it has not made any I/O progress for read or write operations.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

0 to the maximum 32 bit integer value (2147483647) in ticks

1800000

Integer nsslapd-ioblocktimeout: 1800000

nsslapd-lastmod (Track Modification Time)

Specifies whether the Directory Server maintains the modification attributes for

Directory Server entries. These attributes include:

• modifiersname

—The distinguished name of the person who last modified the entry.

• modifytimestamp

—The timestamp, in GMT format, for when the entry was last modified.

• creatorsname

—The distinguished name of the person who initially created the entry.

Chapter 2 Core Server Configuration Reference 65

Core Server Configuration Attributes Reference

• createtimestamp

—The timestamp for when the entry was created in GMT format.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off on

DirectoryString nsslapd-lastmod: off

nsslapd-listenhost (Listen to IP Address)

Allows multiple Directory Server instances to run on a multihomed machine (or makes it possible to limit listening to one interface of a multihomed machine).

Provide the hostname which corresponds to the IP interface you want to specify as a value for this attribute. Directory Server will only respond to requests sent to the interface that corresponds to the hostname provided on this attribute.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

Any hostname

N/A

DirectoryString nsslapd-listenhost: host_name

nsslapd-localhost (Local Host)

This read-only attribute specifies the host machine on which the Directory Server runs.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

Any fully qualified hostname.

Hostname of installed machine.

DirectoryString nsslapd-localhost:phonebook.example.com

66 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

nsslapd-localuser (Local User)

Applicable to Directory Server installations on Unix machines.

Specifies the user that the Directory Server runs as. The group that the user runs as is derived from this attribute, by examining the groups that the user is a member of. Should the user change, then all the files in the installation directory will need to be owned by this user.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

Any valid user on the local UNIX machine.

To run as the same user who started the Directory Server.

DirectoryString nsslapd-localuser: nobody

nsslapd-maxbersize (Maximum Message Size)

Defines the maximum size in bytes allowed for an incoming message. This limits the size of LDAP requests that can be handled by the Directory Server. Limiting the size of requests prevents some kinds of denial of service attacks.

The limit applies to the total size of the LDAP request. For example, if the request is to add an entry and if the entry in the request is larger than two megabytes, then the add request is denied. Care should be taken when changing this attribute, and we recommend contacting Netscape Professional Services before doing so.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

0 - 2GB (2,147,483,647 bytes) where a value of 0 indicates that the default value should be used.

2097152

Integer nsslapd-maxbersize: 2097152

nsslapd-maxdescriptors (Maximum File Descriptors)

Not applicable to Directory Server installations on Windows and AIX machines.

Chapter 2 Core Server Configuration Reference 67

Core Server Configuration Attributes Reference

This attribute sets the maximum, platform-dependent number of file descriptors that the Directory Server will try to use. A file descriptor is used whenever a client connects to the server, and for some server activities such as index maintenance.

The number of available file descriptors for TCP/IP connections is the total for the nsslapd-maxdescriptors attribute minus the number of file descriptors used by the server as specified in the nsslapd-reservedescriptors attribute for non-client connections, such as index management and managing replication. (see

“nsslapd-reservedescriptors (Reserved File Descriptors),” on page 72).

The number that you specify here should not be greater than the total number of file descriptors that your operating system allows the ns-slapd process to use.

This number will differ depending on your operating system. Some operating systems allow you to configure the number of file descriptors available to a process. See your operating-system documentation for details on file descriptor limits and configuration. Note that the dsktune program (explained in the Netscape

Directory Server Installation Guide) can be used to suggest changes to the system kernel or TCP/IP tuning attributes, including increasing the number of file descriptors if necessary. You should consider increasing the value on this attribute if the Directory Server is refusing connections because it is out of file descriptors.

When this occurs, the following message is written to the Directory Server’s error log file:

Not listening for new connections -- too many fds open

NOTE UNIX shells usually have configurable limits on the number of file descriptors. See your operating-system documentation for further information regarding limit and ulimit as these limits can often cause problems.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to 65535

1024

Integer nsslapd-maxdescriptors: 1024

68 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

nsslapd-maxthreadsperconn (Maximum Threads Per Connection)

Defines the maximum number of threads that a connection should use. For normal operations where a client binds and only performs one or two operations before unbinding, you should use the default value. For situations where a client binds and simultaneously issues many requests, you should increase this value to allow each connection enough resources to perform all the operations. This attribute is not available from the server console.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to maximum threadnumber

5

Integer nsslapd-maxthreadsperconn: 5

nsslapd-nagle

When the value of this attribute is off

, the

TCP_NODELAY option is set so that LDAP responses (such as entries or result messages) are sent back to a client immediately.

When the attribute is turned on, default TCP behavior applies, namely the sending of data is delayed, in the hope that this will enable additional data to be grouped into one packet of the underlying network MTU size (typically 1500 bytes for

Ethernet).

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off off

DirectoryString nsslapd-nagle: off

nsslapd-outbound-ldap-io-timeout

This attribute limits the I/O wait time for all outbound LDAP connections. The default is 300000 milliseconds (5 minutes). A value of 0 indicates that the server will impose no limit on I/O wait time.

Chapter 2 Core Server Configuration Reference 69

Core Server Configuration Attributes Reference

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

0 to the maximum 32 bit integer value (2147483647)

300000

DirectoryString nsslapd-outbound-ldap-io-timeout: 300000

nsslapd-plug-in

This read-only attribute lists the syntaxes and matching rules loaded by the server.

nsslapd-port (Port Number)

TCP/IP port number used for LDAP communications. If you want to run SSL/TLS over this port you can do so through the Start TLS extended operation. This selected port must be unique on the host system; make sure no other application is attempting to use the same port number. On UNIX systems, specifying a port number of less than 1024 requires the Directory Server to run as root .

If you are changing the port number for a configuration directory, you must also update the corresponding Server Instance Entry in the configuration directory.

Note that you need to restart the server for the port number change to be taken into account.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to 65535

389

Integer nsslapd-port: 389

nsslapd-privatenamespaces

Contains the list of the private naming contexts cn=config

, cn=schema and cn=monitor

.

Entry DN:

Valid Values: cn=config cn=config, cn=schema and cn=monitor

70 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Default Value:

Syntax:

Example:

N/A

DirectoryString nsslapd-privatenamespaces: cn=config

nsslapd-readonly (Read Only)

Specifies whether the whole server is in read-only mode, meaning that neither data in the database(s) nor configuration information can be modified. Any attempt to modify a database in read-only mode returns an error indicating that the server is unwilling to perform the operation.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off off

DirectoryString nsslapd-readonly: off

nsslapd-referral (Referral)

This multi-valued attribute specifies the LDAP URL(s) to be returned by the suffix when the server receives a request for an entry not belonging to the local tree; that is, an entry whose suffix does not match the value specified on any of the suffix attributes. For example, assume the database contains only entries: ou=People,dc=example,dc=com but the request is for this entry: ou=Groups,dc=example,dc=com

In this case, the referral would be passed back to the client in an attempt to allow the LDAP client to locate a database that contains the requested entry. Although only one referral is allowed per Directory Server instance, this referral can have multiple values.

NOTE If you want to use SSL and TLS communications, the Referral attribute should be in the following form: ldaps:// server-location

Start TLS does not support referrals.

Chapter 2 Core Server Configuration Reference 71

Core Server Configuration Attributes Reference

For more information on managing referrals, see Chapter 3, “Configuring

Directory Databases” in the Netscape Directory Server Administrator’s Guide.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

Valid LDAP URL in the following format: ldap:// server-location

N/A

DirectoryString nsslapd-referral: ldap://ldap.example.com

nsslapd-referralmode (Referral Mode)

When set this attribute will send back the referral for any request on any suffix.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

Valid LDAP URL in the following format: ldap:// server-location

N/A

DirectoryString nsslapd-referralmode: ldap://ldap.example.com

nsslapd-reservedescriptors (Reserved File Descriptors)

Not applicable to Directory Server installations on Windows and AIX machines.

This read-only attribute specifies the number of file descriptors that Directory

Server reserves for managing non-client connections, such as index management and managing replication. The number of file descriptors that the server reserves for this purpose subtracts from the total number of file descriptors available for servicing LDAP client connections (see “nsslapd-maxdescriptors (Maximum File

Descriptors),” on page 67).

Most installations of Directory Server should never need to change this attribute.

However, consider increasing the value on this attribute if all of the following are true:

• The server is replicating to a large number of consumer servers (more than 10) and/or the server is maintaining a large number of index files (more than 30).

• The server is servicing a large number of LDAP connections.

72 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

• You are seeing error messages reporting that the server is unable to open file descriptors (the actual error message will differ depending on the operation that the server is attempting to perform), but these error messages are NOT related to managing client LDAP connections.

Increasing the value on this attribute may result in more LDAP clients being unable to access your directory. Therefore, when you increase the value on this attribute, you should also increase the value on the nsslapd-maxdescriptors attribute.

Note that you may not be able to increase the nsslapd-maxdescriptors value if your server is already using the maximum number of file descriptors that your operating system allows a process to use (see your operating system documentation for details). If this is the case, then reduce the load on your server by causing LDAP clients to search alternative directory replicas.

To assist you in computing the number of file descriptors you set for this attribute we suggest you use the following formula: nsslapd-reservedescriptor = 20 + (NldbmBackends * 4) + NglobalIndex

+ ReplicationDescriptor + ChainingBackendDescriptors +

PTADescriptors + SSLDescriptors where:

NldbmBackends

NglobalIndex

ReplicationDescriptor

Number of ldbm databases.

Total number of configured indexes for all databases including system indexes.

(By default 8 system indexes and 17 additional indexes per database).

NSupplierReplica + 8

(where NSupplierReplica is number of replicas in the server that can act as a supplier (hub or master)).

ChainingBackendDescriptors NchainingBackend * nsOperationConnectionsLimit

PTADescriptors

SSLDescriptors

(where nsOperationConnectionsLimit is configurable in database link (chaining) configuration and 10 by default).

3 if PTA is configured, 0 if PTA is not configured

5 (4 files + 1 listensocket) if SSL is configured, 0 if

SSL is not configured.

Chapter 2 Core Server Configuration Reference 73

Core Server Configuration Attributes Reference

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to 65535

64

Integer nsslapd-reservedescriptors: 64

nsslapd-return-exact-case (Return Exact Case)

Returns the exact case of attribute type names as requested by the client. Some client applications require attribute names to exactly match the case of the attribute as it is listed in the schema when the attribute is returned by the Directory Server, as the result of a search or modify operation. However, most client applications ignore the case of attributes, therefore, by default this attribute is disabled. Do not modify it unless you have legacy clients that can check the case of attribute names in results returned from the server.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off off

DirectoryString nsslapd-return-exact-case: off

nsslapd-rootdn (Manager DN)

Specifies the distinguished name (DN) of an entry that is not subject to access-control restrictions, administrative limit restrictions for operations on the directory or resource limits in general. The attributes nsslapd-sizelimit , nsslapd-timelimit

, and nsslapd-schemacheck do not apply to this DN either.

For information on changing the Root DN, see Chapter 2, “Creating Directory

Entries” in the Netscape Directory Server Administrator’s Guide

.

Entry DN:

Valid Values:

Default Value: cn=config

Any valid distinguished name

N/A

74 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Syntax:

Example:

Core Server Configuration Attributes Reference

DN nsslapd-rootdn: cn=Directory Manager

nsslapd-rootpw (Root Password)

Allows you to specify the password associated with the "Manager DN" . When you provide the root password, it will be encrypted according to the encryption method you selected for “nsslapd-rootpwstoragescheme (Root Password Storage

Scheme),” on page 75. When viewed from the server console, this attribute shows the value:

*****

When viewed from the dse.ldif

file, this attribute shows the encryption method followed by the encrypted string of the password. Note that the example below is what you view, not what you type.

CAUTION If you configure a root DN at server installation time, you must also provide a root password. However, it is possible for the root password to be deleted from dse.ldif

by direct editing of the file.

In this situation, the root DN can only obtain the same access to your directory as you allow for anonymous access. Always make sure that a root password is defined in dse.ldif

when a root DN is configured for your database.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

Any valid password encrypted by any one of the encryption methods which are described in “passwordStorageScheme (Password Storage

Scheme),” on page 87.

N/A

DirectoryString {encryption_method} encrypted_Password nsslapd-rootpw: {SSHA}9Eko69APCJfF

nsslapd-rootpwstoragescheme (Root Password Storage Scheme)

Available only from the server console. This attribute indicates the encryption method used for the root password.

Entry DN: cn=config

Chapter 2 Core Server Configuration Reference 75

Core Server Configuration Attributes Reference

Valid Values:

Default Value:

Syntax:

Example:

Any encryption method as described in “passwordStorageScheme

(Password Storage Scheme),” on page 87.

CLEAR

DirectoryString nsslapd-rootpwstoragescheme: SSHA

nsslapd-schemacheck (Schema Checking)

Specifies whether the database schema will be enforced during entry insertion or modification. When this attribute has a value of on, Directory Server will not check the schema of existing entries until they are modified. The database schema defines the type of information allowed in the database. You can extend the default schema using the objectclasses and attribute types. For information on how to extend your schema using the Directory Server Console, see Chapter 9, “Extending the

Directory Schema” in the Netscape Directory Server Administrator’s Guide.

NOTE Schema checking works by default when database modifications are made using an LDAP client, such as ldapmodify

, the Directory

Server Gateway, or when importing a database from LDIF using ldif2db

. If you turn schema checking off, you will have to verify manually that your entries conform to the schema. If schema checking is turned on, the server sends an error message to inform you of the entries which do not match the schema. Make sure that the attributes and object classes you create in your LDIF statements are both spelled correctly and identified in dse.ldif

. You will need to create a file in the LDIF format in the schema directory or add the elements to 99user.ldif

.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off on

DirectoryString nsslapd-schemacheck: on

76 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

nsslapd-schemareplace

Determines whether modify operations that replace attribute values are allowed on the cn=schema entry.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off | replication-only replication-only

DirectoryString nsslapd-schemareplace: replication-only

nsslapd-securelistenhost

Allows multiple Directory Server instances to run, using secure SSL/TLS connections, on a multihomed machine (or makes it possible to limit listening to one interface of a multihomed machine). Provide the hostname that corresponds to the IP interface you want to specify as a value for this attribute. Directory Server will only respond to requests sent to the interface that corresponds to the hostname provided on this attribute.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

Any secure hostname.

N/A

DirectoryString nsslapd-securelistenhost: secure_host_name

nsslapd-securePort (Encrypted Port Number)

TCP/IP port number used for SSL/TLS communications. This selected port must be unique on the host system; make sure no other application is attempting to use the same port number. For UNIX systems, specifying a port number of less than

1024 requires that Directory Server runs as root

.

The default value 636 is only used if the server has been configured with a private key and a certificate; otherwise it does not listen on this port.

Entry DN: cn=config

Chapter 2 Core Server Configuration Reference 77

Core Server Configuration Attributes Reference

Valid Range:

Default Value:

Syntax:

Example:

1 to 65535

636

Integer nsslapd-securePort: 636

nsslapd-security (Security)

Specifies whether the Directory Server is to accept SSL/TLS communications on its encrypted port. This attribute should be set to on

, if you want secure connections.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off off

DirectoryString nsslapd-security: off

nsslapd-sizelimit (Size Limit)

Specifies the maximum number of entries to return from a search operation. If this limit is reached, ns-slapd returns any entries it has located that match the search request, as well as an exceeded size limit error.

When no limit is set, ns-slapd will return every matching entry to the client regardless of the number found. To set a no limit value whereby the Directory

Server will wait indefinitely for the search to complete, specify a value of -1 for this attribute in the dse.ldif

file.

This limit applies to everyone regardless of their organization.

NOTE A value of -1 on this attribute in the dse.ldif

is the same as leaving the attribute blank in the server console, in that it causes no limit to be used. Note however, that you cannot specify a negative integer for this field in the server console nor can you specify a null value in dse.ldif

as it is not a valid integer.

78 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

-1 to the maximum 32 bit integer value (2147483647)

2000

Integer nsslapd-sizelimit: 2000

nsslapd-ssl-check-hostname (Verify Hostname for Outbound

Connections)

Specifies whether an SSL-enabled Directory Server (with certificate based client authentication turned on) should verify authenticity of a request by matching the hostname against the value assigned to the Common Name (CN) attribute of the subject name in the certificate being presented. By default, the attribute is set to off.

If it is on and if the hostname does not match the CN attribute of the certificate, appropriate error and audit messages are logged. For example, in a replicated environment, messages similar to these are logged in the supplier server’s log files if it finds that the peer server’s hostname doesn’t match the name specified in its certificate:

[DATE] - SSL alert: ldap_sasl_bind("",LDAP_SASL_EXTERNAL) 81

(Netscape runtime error -12276 - Unable to communicate securely with peer: requested domain name does not match the server's certificate.)

[DATE] NSMMReplicationPlugin - agmt="cn=to ultra60 client auth"

(ultra60:1924): Replication bind with SSL client authentication failed: LDAP error 81 (Can’t contact LDAP server)

It is recommended that you turn this attribute on to protect Directory Server’s outbound SSL connections against a Man In The Middle (MITN) attack.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off off

DirectoryString nsslapd-ssl-check-hostname: on

Chapter 2 Core Server Configuration Reference 79

Core Server Configuration Attributes Reference

nsslapd-threadnumber (Thread Number)

Defines the number of operation threads that the Directory Server will create during startup. The nsslapd-threadnumber value should be increased if you have many directory clients performing time-consuming operations such as add or modify, as this ensures that there are other threads available for servicing short-lived operations such as simple searches. This attribute is not available from the server console.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to the number of threads supported by your system

30

Integer nsslapd-threadnumber: 60

nsslapd-timelimit (Time Limit)

Specifies the maximum number of seconds allocated for a search request. If this limit is reached, Directory Server returns any entries it has located that match the search request, as well as an exceeded time limit error.

When no limit is set ns-slapd will return every matching entry to the client regardless of the time it takes. To set a no limit value whereby Directory Server will wait indefinitely for the search to complete, specify a value of -1 for this attribute in the dse.ldif

file. A value of zero (0) causes no time to be allowed for searches. The smallest time limit is 1 second.

NOTE A value of -1 on this attribute in the dse.ldif

is the same as leaving the attribute blank in the server console, in that it causes no limit to be used. Please note however, that you cannot specify a negative integer for this field in the server console nor can you specify a null value in dse.ldif

as it is not a valid integer.

Entry DN:

Valid Range:

Default Value:

Syntax: cn=config

-1 to the maximum 32 bit integer value (2147483647) in seconds

3600

Integer

80 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Example: nsslapd-timelimit: 3600

nsslapd-versionstring

Specifies the server version number.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config

Any valid server version number.

N/A

DirectoryString nsslapd-versionstring: Netscape-Directory/6.1

passwordChange (Password Change)

Indicates whether users may change their passwords.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off on

DirectoryString passwordChange: on

passwordCheckSyntax (Check Password Syntax)

Indicates whether the password syntax will be checked before the password is saved. The password syntax checking mechanism checks that the password meets or exceeds the password minimum length requirement and that the string does not contain any trivial words, such as the user’s name or user ID or any attribute value stored in the uid , cn , sn , givenName , ou , or mail attributes of the user’s directory entry.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

Chapter 2 Core Server Configuration Reference 81

Core Server Configuration Attributes Reference

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off off

DirectoryString passwordCheckSyntax: off

passwordExp (Password Expiration)

Indicates whether user passwords will expire after a given number of seconds. By default, user passwords do not expire. Once password expiration is enabled, you can set the number of seconds after which the password will expire using the passwordMaxAge attribute.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off off

DirectoryString passwordExp: on

passwordHistory (Password History)

Enables password history. Password history refers to whether users are allowed to reuse passwords. By default, password history is disabled and users can reuse passwords. If you set this attribute to be on, the directory stores a given number of old passwords and prevents users from reusing any of the stored passwords. You set the number of old passwords the Directory Server stores using the passwordInHistory attribute.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

Entry DN:

Valid Values: cn=config on | off

82 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Default Value:

Syntax:

Example: off

DirectoryString passwordHistory: on

passwordInHistory (Number of Passwords to Remember)

Indicates the number of passwords the Directory Server stores in history.

Passwords that are stored in history cannot be reused by users. By default, the password history feature is disabled. That is, the Directory Server does not store any old passwords and so users can reuse passwords. You can enable password history by using the passwordHistory attribute.

To prevent users from rapidly cycling through the number of passwords that you are tracking, use the passwordMinAge attribute.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

2 to 24 passwords

6

Integer passwordInHistory: 7

passwordLockout (Account Lockout)

Indicates whether users will be locked out of the directory after a given number of failed bind attempts. By default, users will not be locked out of the directory after a series of failed bind attempts. If you enable account lockout, you can set the number of failed bind attempts after which the user will be locked out using the passwordMaxFailure attribute.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

Entry DN:

Valid Values: cn=config on | off

Chapter 2 Core Server Configuration Reference 83

Core Server Configuration Attributes Reference

Default Value:

Syntax:

Example: on

DirectoryString passwordLockout: off

passwordLockoutDuration (Lockout Duration)

Indicates the amount of time in seconds during which users will be locked out of the directory after an account lockout. The account lockout feature protects against hackers who try to break into the directory by repeatedly trying to guess a user’s password. You enable and disable the account lockout feature using the passwordLockout attribute.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to the maximum 32 bit integer value (2147483647) in seconds

3600

Integer passwordLockoutDuration: 3600

passwordMaxAge (Password Maximum Age)

Indicates the number of seconds after which user passwords will expire. To use this attribute, you must enable password expiration using the passwordExp attribute.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to the maximum 32 bit integer value (2147483647) in seconds

8640000 (100 days)

Integer passwordMaxAge: 100

84 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

passwordMaxFailure (Maximum Password Failures)

Indicates the number of failed bind attempts after which a user will be locked out of the directory. By default, account lockout is disabled. You can enable account lockout by modifying the passwordLockout attribute.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to maximum integer bind failures

3

Integer passwordMaxFailure: 3

passwordMinAge (Password Minimum Age)

Indicates the number of seconds that must pass before a user can change their password. Use this attribute in conjunction with the passwordInHistory

(Number of Passwords to Remember) attribute to prevent users from quickly cycling through passwords so that they can use their old password again. A value of zero

(0) indicates that the user can change the password immediately.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

passwordMinLength (Password Minimum Length)

Specifies the minimum number of characters that must be used in Directory Server user password attributes. In general, shorter passwords are easier to crack, so you are recommended to set a password length of at least 6 or 7 characters. This is long enough to be difficult to crack, but short enough that users can remember the password without writing it down.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

Entry DN:

Valid Range:

Default Value: cn=config

2 to 512 characters

6

Chapter 2 Core Server Configuration Reference 85

Core Server Configuration Attributes Reference

Syntax:

Example:

Integer passwordMinLength: 6

passwordMustChange (Password Must Change)

Indicates whether users must change their passwords when they first bind to the

Directory Server, or when the password has been reset by the

"Manager DN"

.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off off

DirectoryString passwordMustChange: off

passwordResetFailureCount (Reset Password Failure Count After)

Indicates the amount of time in seconds after which the password failure counter will be reset. Each time an invalid password is sent from the user’s account, the password failure counter is incremented. If the passwordLockout attribute is set to on, users will be locked out of the directory when the counter reaches the number of failures specified by the passwordMaxFailure attribute (within 600 seconds by default). After the amount of time specified by the passwordLockoutDuration attribute, the failure counter is reset to zero (0).

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to the maximum 32 bit integer value (2147483647) in seconds

600

Integer passwordResetFailureCount: 600

86 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

passwordStorageScheme (Password Storage Scheme)

Specifies the type of encryption used to store Directory Server passwords. Enter the password in

CLEAR for this attribute indicates that the password will appear in plain text.

The following encryption types are supported by the Directory Server 6.x:

• SSHA (Salted Secure Hash Algorithm) is the recommended method as it is the most secure.

• SHA (Secure Hash Algorithm). This is the method supported by 4.x Directory

Servers.

• CRYPT is the UNIX crypt algorithm. It is provided for compatibility with

UNIX passwords.

NOTE You can no longer choose to encrypt passwords using the

NS-MTA-MD5 password storage scheme. The storage scheme is still present but only for reasons of backward compatibility.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

passwordUnlock (Unlock Account)

Indicates whether users will be locked out of the directory for a specified amount of time or until the administrator resets the password after an account lockout. The account lockout feature protects against hackers who try to break into the directory by repeatedly trying to guess a user’s password. If this passwordUnlock attribute is set to off and the operational attribute accountUnlockTime has a value of 0, then the account will be locked indefinitely.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=config on | off on

DirectoryString passwordUnlock: off

Chapter 2 Core Server Configuration Reference 87

Core Server Configuration Attributes Reference

passwordWarning (Send Warning)

Indicates the number of seconds before a user’s password is due to expire that the user will receive a password expiration warning control on their next LDAP operation. Depending on the LDAP client, the user may also be prompted to change their password at the time the warning is sent.

For more information on password policies, see Chapter 7, “User Account

Management” in the Netscape Directory Server Administrator’s Guide.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=config

1 to the maximum 32 bit integer value (2147483647) in seconds

86400 (1 day)

Integer passwordWarning: 86400

cn=changelog5

Multi-master replication change log configuration entries are stored under the cn=changelog5 entry. The change log behaves much like a database and it has many of attributes also used by the ldbm databases. The change log entry supports the following attributes with the same meaning as for databases:

• “nsslapd-dbcachesize,” on page 148

• “nsslapd-db-checkpoint-interval,” on page 148

• “nsslapd-db-circular-logging,” on page 149

• “nsslapd-db-debug,” on page 150

• “nsslapd-db-durable-transactions,” on page 150

• “nsslapd-db-logfile-size,” on page 154

• “nsslapd-db-page-size,” on page 154

• “nsslapd-db-spin-count,” on page 155

• “nsslapd-db-trickle-percentage,” on page 156

• “nsslapd-db-verbose,” on page 157

• “nsslapd-cachesize,” on page 160

88 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

• “nsslapd-cachememsize,” on page 161

Note that the default values for the cache-related memory parameters (tuned for a single backend replicated to a single consumer) are as follows: nsslapd-cachesize : 3000

(3000 entries) nsslapd-cachememsize : 10000000

(10 MB)

When more backends are replicated or when you need to replicate one backend to more than one consumers, consider tuning the parameters as below: nsslapd-cachesize = 2000*#repl_agreements_initiated_from_this_server nsslapd-cachememsize =

5000000*#repl_agreements_initiated_from_this_server

Also, the relationship between the values assigned to the nsslapd-dbcachesize and nsslapd-cachememsize parameters should be the same as the relationship that is described in the database-tuning section.

The cn=changelog5,cn=config entry is an instance of the extensibleObject object class. For attributes to be taken into account by the server, both of these object classes (in addition to the top object class) must be present in the entry.

It is worth noting that two different types of change logs are maintained by

Directory Server. The first type, which is stored here and referred to as changelog, is used by multi-master replication; the second change log, which is actually a plug-in and referred to as retro changelog, is intended for use by Netscape Meta

Directory. See “Retro Changelog Plug-in,” on page 136” of Chapter 3, “Plug-in

Implemented Server Functionality Reference” for further information regarding the Retro Changelog plug-in. Multi-master replication changelog attributes are presented in this section.

nsslapd-changelogdir

This required attribute specifies the name of the directory in which the change log database will be created. Whenever a change log configuration entry is created, it must contain a valid directory; otherwise, the operation will be rejected. The GUI proposes by default that this database be stored under: serverRoot /slapdserverID /changelogdb

NOTE For performance reasons you will probably want to store this database on a different physical disk.

Entry DN: cn=changelog5,cn=config

Chapter 2 Core Server Configuration Reference 89

Core Server Configuration Attributes Reference

Valid Values:

Default Value:

Syntax:

Example:

Any valid path to the directory storing the changelog

None

DirectoryString nsslapd-changelogdir:

/usr/netscape/servers/slapd-phonebook/changelogdb

nsslapd-changelogmaxage (Max Changelog Age)

Specifies the maximum age of any entry in the change log. The change log contains a record for each directory modification and is used when synchronizing consumer servers. Each record contains a timestamp. Any record with a timestamp that is older than the value specified in this attribute will be removed. If this attribute is absent, there is no age limit on change log records. For information on the change log, see ““nsslapd-changelogdir,” on page 89.”

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=changelog5,cn=config

0 (meaning that entries are not removed according to their age) to maximum integer (2147483647)

0

DirectoryString IntegerAgeID where AgeID is as follows: s for seconds m for minutes h for hours d for days w for weeks nsslapd-changelogmaxage: 30d

nsslapd-changelogmaxentries (Max Changelog Records)

Specifies the maximum number of records the change log may contain. If this attribute is absent, there is no maximum number of records the change log can contain. For information on the change log, see “nsslapd-changelogdir,” on page 89.

Entry DN: cn=changelog5,cn=config

90 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Valid Range:

Default Value:

Syntax:

Example:

0 (meaning that the only maximum limit is the disk size) to maximum integer (2147483647)

0

Integer nsslapd-changelogmaxentries: 5000

cn=encryption

Encryption related attributes are stored under the cn=encryption,cn=config entry. The cn=encryption,cn=config entry is an instance of the nsslapdEncryptionConfig object class. For encryption related attributes to be taken into account by the server this object class (in addition to the top object class) must be present in the entry. Encryption configuration attributes are presented in this section.

nssslsessiontimeout

Specifies the lifetime duration of an SSL session for both SSLv2 and SSLv3. The minimum timeout value is 5 seconds and if you enter a value below this, then it is automatically replaced by 5 seconds. Values outside the valid ranges are replaced by the default value of 100 seconds (SSLv2).

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=encryption,cn=config

SSLv2 - 5 seconds to 100 seconds

SSLv3 - 5 seconds to 24 hours

0, which stands for 100 seconds if you are running SSLv2 and 24 hours if you are running SSLv3

Integer nssslsessiontimeout: 5

nssslclientauth

Specifies, or not as the case may be, client authentication using SSL.

Entry DN:

Valid Values: cn=encryption,cn=config off | allowed | required

Chapter 2 Core Server Configuration Reference 91

Core Server Configuration Attributes Reference

Default Value:

Syntax:

Example: allowed

DirectoryString nssslclientauth: allowed

nsssl2

Supports SSL version 2.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=encryption,cn=config on | off off

DirectoryString nsssl2: on

nsssl3

Supports SSL version 3.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: c n=encryption,cn=config on | off off

DirectoryString nsssl3: on

nsssl3ciphers

This multi-valued attribute specifies the set of encryption ciphers the Directory

Server will use during SSL communications. For more information on the ciphers supported by the Directory Server, refer to Chapter 11, “Managing SSL,” in the

Netscape Directory Server Administrator’s Guide

Entry DN: cn=config

92 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Valid Values:

Default Value:

Syntax:

Example:

For domestic versions, any combination of the following: rsa_null_md5 rsa_rc4_128_md5

For SSLv3 rsa_rc4_40_md5 rsa_rc2_40_md5 rsa_des_sha rsa_fips_des_sha rsa_3des_sha rsa_fips_3des_sha

For TLS tls_rsa_export1024_with_rc4_56_sha tls_rsa_export1024_with_des_cbc_sha

N/A

DirectoryString

+ symbol to enable or symbol to disable followed by the cipher(s). It is important to note that blank spaces are not allowed in the list of ciphers.

To enable all ciphers (except rsa_null_md5 which must be specifically called) you can specify +all .

nsslapd-SSL3ciphers:

+RSA_NULL_MD5,+RC4_56_SHA,-RC4_56_SHA

If you are using the Directory Server Console to set the cipher preferences, the values on the SSL 3.0 tab of the Cipher Preference dialog box correspond to the following:

Table 2-1 SSLv3 Ciphers

Cipher in Console Corresponding SSLv3 Cipher

None

RC4

RC4 (Export) rsa_null_md5 rsa_rc4_128_md5 rsa_rc4_40_md5

Chapter 2 Core Server Configuration Reference 93

Core Server Configuration Attributes Reference

Table 2-1 SSLv3 Ciphers (Continued)

Cipher in Console Corresponding SSLv3 Cipher

RC2(Export)

DES rsa_rc2_40_md5 rsa_des_sha

DES (FIPS)

Triple-DES

Triple-DES (FIPS) rsa_fips_des_sha rsa_3des_sha rsa_fips_3des_sha

If you are using the Directory Server Console to set the cipher preferences, the values on the TLS tab of the Cipher Preference dialog box correspond to the following:

Table 2-2 TLS Ciphers

Cipher in Console

RC4 (Export)

DES (Export)

Corresponding TLS Cipher tls_rsa_export1024_with_rc4_56_sha tls_rsa_export1024_with_des_cbc_sha

cn=features

No attributes to document.

cn=mapping tree

Configuration attributes for suffixes and replication are stored under cn=mapping tree,cn=config

. Configuration attributes related to suffixes are found under the suffix subentry cn=" suffixName ",cn=mapping tree,cn=config

(for example, a suffixName may look like dc=example,dc=com

)

Replication configuration attributes are stored under cn=replica,cn=" suffixName ",cn=mapping tree,cn=config with the replication agreement attributes under cn= replicationAgreementName ,cn=replica,cn=" suffixName ",cn=mapping tree,cn=config

.

94 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Suffix Configuration Attributes Under cn="

suffixName

"

Suffix configuration attributes are stored under the cn=" suffixName " entry. The cn=" suffixName " entry is an instance of the nsMappingTree object class which inherits from the extensibleObject object class. For suffix configuration attributes to be taken into account by the server these object classes (in addition to the top object class) must be present in the entry. Suffix configuration attributes are presented in this section.

nsslapd-state

Determines how the suffix handles operations.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=" suffixName ",cn=mapping tree,cn=config backend | disabled | referral | referral on update backend = the backend (database) is used to process all operations disabled = the database is not available for processing operations. The server returns a “No such search object” error in response to requests made by client applications.

referral = a referral is returned for requests made to this suffix.

referral on update = the database is used for all operations except update requests, which receive a referral.

disabled

DirectoryString nsslapd-state: backend

nsslapd-backend

Gives the name of the database or database link used to process requests. This attribute can be multi valued, with one database or database link per value. This attribute is required when the value of the nsslapd-state attribute is set to backend or referral on update

.

Entry DN:

Valid Values: cn=" suffixName ",cn=mapping tree,cn=config

Any valid partition name

Chapter 2 Core Server Configuration Reference 95

Core Server Configuration Attributes Reference

Default Value:

Syntax:

Example:

None

DirectoryString nsslapd-backend: NetscapeRoot

Replication Attributes Under cn=replica, cn=“

suffixName

”, cn=mapping tree,cn=config

Replication configuration attributes are stored under cn=replica,cn=“ suffixName ”,cn=mapping tree,cn=config

. The cn=replica entry is an instance of the nsDS5Recplia object class. For replication configuration attributes to be taken into account by the server this object class (in addition to the top object class) must be present in the entry. Replication configuration attributes are presented in this section. For further information regarding replication see

Chapter 8, “Managing Replication” in the Netscape Directory Server Administrator’s

Guide.

cn

This attribute is used for naming. Once this attribute has been set it cannot be modified.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=replica,cn=" suffixName ",cn=mapping tree,cn=config

Any valid suffix name cn=replica

DirectoryString cn:cn=replica

nsDS5Flags

This attribute allows you to specify replica properties you will have previously defined in flags. At present only one flag exists, which allows you to specify whether your log changes or not.

Entry DN: cn=replica,cn=" suffixName ",cn=mapping tree,cn=config

96 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Valid Values:

Default Value:

Syntax:

Example:

0 | 1

Changelog activation:

0 = no changes are logged

1 = changes are logged

0 (no changes are logged)

Integer nsDS5Flags: 0

nsDS5ReplicaBindDN

This multivalued attribute specifies the DN to use when binding. Although you can have more than one value in this cn=replica entry, you can only have one supplier bind DN per replication agreement.The value can either be the DN of the local entry on the consumer server or, in the case of an SSL connection, the certificate identity associated with same DN.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=replica,cn=" suffixName ",cn=mapping tree,cn=config

Any valid DN

N/A

DirectoryString nsDS5ReplicaBindDN: cn=replication manager, cn=config

nsDS5ReplicaChangeCount

This read-only attribute informs you of the total number of entries in the change log (whether they still remain to be replicated or not). When the change log is purged only the entries that are still to be replicated will be left. See

“nsDS5ReplicaPurgeDelay,” on page 99 and

“nsDS5ReplicaTombstonePurgeInterval,” on page 100 for more information regarding purge operation properties.

Entry DN:

Valid Range:

Default Value: cn=replica,cn=" suffixName ",cn=mapping tree,cn=config

-1 to maximum integer (2147483647)

N/A

Chapter 2 Core Server Configuration Reference 97

Core Server Configuration Attributes Reference

Syntax:

Example:

Integer nsDS5ReplicaChangeCount: 675

nsDS5ReplicaId

Specifies the unique ID for masters in a given replication environment.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=replica,cn=" suffixName ",cn=mapping tree,cn=config

0 to 254

N/A

Integer nsDS5ReplicaId: 1

nsDS5ReplicaLegacyConsumer

If this attribute is absent or has a value of false then it means that the replica is not a legacy consumer.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=replica,cn=" suffixName ",cn=mapping tree,cn=config true | false false

DirectoryString nsDS5ReplicaLegacyConsumer: false

nsDS5ReplicaName

This read- only attribute specifies the name of the replica with a unique identifier for internal operations. This unique identifier is allocated by the server when the replica is created. This attribute is destined for internal use only.

Entry DN:

Valid Values:

Default Value: cn=replica,cn=" suffixName ",cn=mapping tree,cn=config

N/A

N/A

98 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Syntax:

Example:

Core Server Configuration Attributes Reference

DirectoryString (a UID identifies the replica) nsDS5ReplicaName:

66a2b699-1dd211b2-807fa9c3-a58714648

nsDS5ReplicaPurgeDelay

This multi valued attribute specifies the period of time in seconds after which internal purge operations will be performed on the change log. When setting this attribute ensure that the purge delay is longer than the longest replication cycle in your replication policy, to avoid incurring conflict resolution problems and server divergence.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=replica,cn=" suffixName ",cn=mapping tree,cn=config

0 (keep forever) to maximum integer (2147483647)

604800 (1 week (60x60x24x7)

Integer nsDS5ReplicaPurgeDelay: 604800

nsDS5ReplicaReferral

This multi valued attribute specifies the user-defined referrals. This should only be defined on a consumer. User referrals are only returned when a client attempts to modify data on a read-only consumer.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=replica,cn=" suffixName ",cn=mapping tree,cn=config

Any valid LDAP URL

N/A

DirectoryString nsDS5ReplicaReferral: ldap://ldap.netscape.com

nsDS5ReplicaRoot

Specifies the DN at the root of a replicated area. This attribute must have the same value as the suffix of the database being replicated and cannot be modified.

Chapter 2 Core Server Configuration Reference 99

Core Server Configuration Attributes Reference

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=replica,cn=" suffixName ",cn=mapping tree,cn=config

Suffix of the database being replicated

N/A

DirectoryString nsDS5ReplicaRoot: "dc=example,dc=com"

nsDS5ReplicaTombstonePurgeInterval

Specifies the time interval in seconds between purge operation cycles. When setting this attribute bear in mind that the purge operation is time consuming.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn=replica,cn=" suffixName ",cn=mapping tree,cn=config

0 to maximum integer (2147483647) in seconds

3600 (1 hour)

Integer nsDS5ReplicaTombstonePurgeInterval: 3600

nsDS5ReplicaType

Defines the type of replication relationship that exists between this replica and the others.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=ReplicationAgreementName,cn=" suffixName ",cn=mapping tree,cn=config

0 | 1 | 2 | 3

0 = unknown

1 = primary (not yet used)

2 = consumer (read-only)

3 = consumer/supplier (updateable)

N/A

Integer nsDS5ReplicaType: 2

100 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

nsState

This attribute stores information on the state of the clock. It is destined for internal use only to ensure that the server cannot generate a change sequence number (csn) inferior to existing ones required for detecting backward clock errors.

Replication Attributes Under cn=ReplicationAgreementName,cn=replica, cn="

suffixName

", cn=mapping tree,cn=config

The replication attributes that concern the replication agreement are stored under cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

. Like the cn=replica entry, the cn= ReplicationAgreementName entry is an instance of the nsDS5Replica object class. For replication agreement configuration attributes to be taken into account by the server this object class (in addition to the top object class) must be present in the entry. Replication Agreements are configured only on supplier replicas. The replication agreement configuration attributes are presented in this section.

description

Free form text description of the replication agreement. This attribute can be modified.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ", cn=mapping tree,cn=config

Any string.

N/A

DirectoryString description: Replication Agreement between Server A and Server B.

nsDS5ReplicaBindDN

Specifies the DN to use when binding. The value of this attribute must be the same as the one in cn=replica on the consumer replica. This may be empty if certificate based authentication is used. This can also be modified.

Chapter 2 Core Server Configuration Reference 101

Core Server Configuration Attributes Reference

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

Any valid DN

N/A

DirectoryString nsDS5ReplicaBindDN: cn=replication manager,cn=config

nsDS5ReplicaBindMethod

Specifies the method to use for binding. This attribute can be modified.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

SIMPLE | SSLCLIENTAUTH

SIMPLE bind method requires a DN and password.

SIMPLE

DirectoryString nsDS5ReplicaBindMethod: SIMPLE

nsDS5ReplicaChangesSentSinceStartup

This read-only attribute provides you with the number of changes sent to this replica since the server started.

Entry DN:

Valid Range:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

0 to maximum integer (2147483647)

N/A

Integer nsDS5ReplicaChangesSentSinceStartup: 647

102 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

nsDS5ReplicaCredentials

Specifies the credentials for the bind DN (specified in the nsDS5ReplicaBindDN attribute) on the remote server containing the consumer replica. The value for this attribute can be modified. Please note that when certificate based authentication is used this attribute may not have a value. Please note that the example below is what you view, not what you type.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

Any valid password which will then by encrypted using the DES reversible password encryption schema.

N/A

DirectoryString {DES} encrypted_password nsDS5ReplicaCredentials: {DES} 9Eko69APCJfFReplica

nsDS5ReplicaHost

Specifies the hostname for the remote server containing the consumer replica. Once this attribute has been set it cannot be modified.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

Any valid host server name

N/A

DirectoryString nsDS5ReplicaHost: MyServer

nsDS5ReplicaLastInitEnd

This optional, read-only attribute states when the initialization of the consumer replica ended.

Entry DN:

Valid Values: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

N/A

Chapter 2 Core Server Configuration Reference 103

Core Server Configuration Attributes Reference

Default Value:

Syntax:

Example:

N/A

GeneralizedTime nsDS5ReplicaLastInitEnd: YYYYMMDDhhmmssZ

(19711223113229)

nsDS5ReplicaLastInitStart

This optional, read-only attribute states when the initialization of the consumer replica started.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

N/A

N/A

GeneralizedTime nsDS5ReplicaLastInitStart: YYYYMMDDhhmmssZ

(20000902160000)

nsDS5ReplicaLastInitStatus

This optional, read-only attribute provides status for the initialization of the consumer.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

0 (Consumer Initialization Succeeded) followed by any other status message.

N/A

String nsDS5ReplicaLastUpdateStatus: 0 Consumer Initialization

Succeeded

104 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

nsDS5ReplicaLastUpdateEnd

This read-only attribute states when the most recent replication schedule update ended.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

0 = meaning that the Consumer Initialization has succeeded

N/A

GeneralizedTime nsDS5ReplicaLastUpdateEnd: YYYYMMDDhhmmssZ

(20000902160000)

nsDS5ReplicaLastUpdateStart

This read-only attribute states when the most recent replication schedule update started.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

N/A

N/A

GeneralizedTime nsDS5ReplicaLastUpdateStart: YYYYMMDDhhmmssZ

(20000902160000)

nsDS5ReplicaLastUpdateStatus

This read-only attribute provides the status for the most recent replication schedule updates.

Entry DN:

Valid Values:

Default Value: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

0 (no replication sessions started) followed by any other error or status message

N/A

Chapter 2 Core Server Configuration Reference 105

Core Server Configuration Attributes Reference

Syntax:

Example:

DirectoryString nsDS5ReplicaLastUpdateStatus: 0 replica acquired successfully

nsDS5ReplicaPort

Specifies the port number for the remote server containing the replica. Once this attribute has been set it cannot be modified.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

Port number for the remote server containing the replica.

N/A

I nteger nsDS5ReplicaPort: 389

nsDS5ReplicaReapActive

This read-only attribute specifies whether the background task that removes old tombstones (deleted entries) from the database is active. A value of zero indicates that the task is inactive and a value of 1 indicates that the task is active. If you try to set the value, the server will ignore the modify request.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

0 | 1

N/A

I nteger nsDS5ReplicaReapActive: 0

nsDS5ReplicaRefresh

Allows you to initialize your replica. This attribute is absent by default. However, if you add this attribute with a value of start then the server re initialize the replica and remove the attribute value.

106 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config stop | start

N/A

DirectoryString nsDS5ReplicaRefresh: start

nsDS5ReplicaRoot

Specifies the DN at the root of a replicated area. This attribute must have the same value as the suffix of the database being replicated and cannot be modified.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

Suffix of the database being replicated

N/A

DirectoryString nsDS5ReplicaRoot: “dc=example,dc=com”

nsDS5ReplicaTimeout

This allowed attribute specifies the number of seconds outbound LDAP operations will wait for a response from the remote replica before timing out and failing. If you see “Warning: timed out waiting” messages in the error log file, then you should increase the value of this attribute.

You can find out the amount of time the operation actually lasted by examining the access log on the remote machine and then set the nsDS5ReplicaTimout attribute accordingly to optimize performance.

Entry DN:

Valid Range:

Default Value:

Syntax: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

0 to maximum integer value (2147483647) in seconds

600

Integer

Chapter 2 Core Server Configuration Reference 107

Core Server Configuration Attributes Reference

Example: nsDS5ReplicaTimeout: 600 seconds

nsDS5ReplicaTransportInfo

Specifies the type of transport used for transporting data to and from the replica.

The attribute values can either be SSL which means that the connection is established over SSL, or LDAP, which means that regular LDAP connections are used. If this attribute is absent then regular LDAP connections are used. This attribute cannot be modified once set.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

SSL | LDAP absent

DirectoryString nsDS5ReplicaTransportInfo: LDAP

nsDS5ReplicaUpdateInProgress

This read-only attribute states whether or not a replication schedule update is in progress.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config true | false

N/A

DirectoryString nsDS5ReplicaUpdateInProgress:true

nsDS5ReplicaUpdateSchedule

This multi-valued attribute specifies the replication schedule and can be modified.

Entry DN: cn= ReplicationAgreementName ,cn=" suffixName ",cn=mapping tree,cn=config

108 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

Valid Range:

Default Value:

Syntax:

Example:

Time schedule presented as XXXX-YYYY 012345 where XXXX is the starting hour, YYYY is the finishing hour and the numbers 0123456 are the days of the week starting with Sunday.

0000-2359 0123456 (all the time)

Integer nsDS5ReplicaUpdateSchedule: 0000-2359 0123456

nsDS50ruv

This attribute is responsible for managing the internal state of the replica via the replication update vector. It is always present and must not be changed.

cn=monitor

Monitoring read-only information is stored under cn=monitor,cn=config

. The cn=monitor entry is an instance of the extensibleObject object class. For cn=monitor configuration attributes to be taken into account by the server this object class (in addition to the top object class) must be present in the entry. The cn=monito r read-only attributes are presented in this section.

connection

List of open connections given in the following format: connection=31:20010201164808Z:45:45::cn=directory manager where

31 is the connection number,

20010201164808Z is the date the connection was opened,

45 is the number of operations received,

45 is the number of completed operations, and cn=directory manager is the bind DN.

currentConnections

Number of current Directory Server connections.

totalConnections

Total number of Directory Server connections.

dTableSize

Size of the Directory Server descriptor table.

Chapter 2 Core Server Configuration Reference 109

Core Server Configuration Attributes Reference

readWaiters

Number of connections where some requests are pending and not currently being serviced by a thread in Directory Server.

opsInitiated

Number of Directory Server operations initiated.

opsCompleted

Number of Directory Server operations completed.

entriesSent

Number of entries sent by Directory Server.

bytesSent

Number of bytes sent by Directory Server.

currentTime

Current time usually given in Greenwich Mean Time (indicated by

GeneralizedTime syntax Z notation, for example 20010202131102Z ).

startTime

Directory Server start time.

nbackEnds

Number of Directory Server backends.

backendMonitorDN

DN for each Directory Server backend. For further information on monitoring the database, see these sections:

• Database Attributes Under cn=monitor,cn=ldbm database, cn=plugins,cn=config (on page 159)

• Database Attributes Under cn=database,cn=monitor,cn=ldbm database, cn=plugins,cn=config (on page 163)

• Database Attributes Under cn=monitor,cn=Netscaperoot,cn=ldbm database,cn=plugins,cn=config (on page 168)

110 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

• Database Link Attributes Under cn=monitor,cn=database instance name,cn=chaining database, cn=plugins,cn=config (on page 180)

cn=replication

No attributes to document. When configuring legacy replication, it will be stored under this cn=replication node, which serves as a placeholder.

cn=SNMP

SNMP configuration attributes are stored under cn=SNMP,cn=config

. The cn=SNMP entry is an instance of the nsSNMP object class. For SNMP configuration attributes to be taken into account by the server this object class (in addition to the top object class) must be present in the entry. SNMP configuration attributes are presented in this section.

nssnmpenabled

Specifies whether SNMP is enabled or not.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=SNMP,cn=config on | off on

DirectoryString nssnmpenabled: off

nssnmporganization

Specifies the organization to which the Directory Server belongs.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=SNMP,cn=config

Organization name

N/A

DirectoryString nssnmporganization: netscape

Chapter 2 Core Server Configuration Reference 111

Core Server Configuration Attributes Reference

nssnmplocation

Specifies the location within the company or organization where the Directory

Server resides.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: c n=SNMP,cn=config

Location

N/A

DirectoryString nssnmplocation: B14

nssnmpcontact

Specifies the E-mail address of the person responsible for maintaining the

Directory Server.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=SNMP,cn=config

Contact E-mail address

N/A

DirectoryString nssnmpcontact: [email protected]

nssnmpdescription

Provides a unique description of the Directory Server instance.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=SNMP,cn=config

Description

N/A

DirectoryString nssnmpdescription: Employee directory instance

112 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Core Server Configuration Attributes Reference

nssnmpmasterhost

This mandatory attribute specifies the hostname of the machine on which the master agent is installed. For UNIX only.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=SNMP,cn=config machine hostname or local host localhost

DirectoryString nssnmpmasterhost: localhost

nssnmpmasterport

Specifies the port number used to communicate with the master agent. For UNIX only.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=SNMP,cn=config

Operating System dependent port number. Refer to your Operating

System documentation for further information.

199

Integer nssnmpmasterport: 199

cn=tasks

No attributes to document.

cn=uniqueid generator

The uniqueid generator configuration attributes are stored under cn=uniqueid generator,cn=config

. The cn=uniqueid generator entry is an instance of the extensible object class. For uniqueid generator configuration attributes to be taken into account by the server this object class (in addition to the top object class) must be present in the entry. Uniqueid generator configuration attributes are presented in this section.

Chapter 2 Core Server Configuration Reference 113

Configuration Quick Reference Tables

nsstate

Saves the state of the uniqueid generator across server restarts. This attribute is maintained by the server. You should not edit it.

Entry DN:

Valid Values:

Default Value:

Syntax:

Example: cn=uniqueid generator,cn=config

N/A

N/A

DirectoryString nsstate:AbId0c3oMIDUntiLCyYNGgAAAAAAAAAA

Configuration Quick Reference Tables

This section provides quick reference tables for LDIF configuration files supplied with the Directory Server, object classes and schema used in server configuration, and attributes requiring server restart.

LDIF Configuration Files

Table 2-3 lists all the configuration files which are supplied with the Directory

Server, including those for the schema of other Netscape servers. Each file is preceded by a number which indicates the order in which they should be loaded

(in ascending numerical and then alphabetical order). See “LDIF Configuration

Files - Location,” on page 29 for information on where these files are stored.

Table 2-3 Directory Server Configuration LDIF Files

Configuration Filename Purpose dse.ldif

Contains front-end Directory Specific Entries created by the directory at server startup. These include the Root DSE ( "" ), and the contents of cn=config and cn=monitor .

114 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Configuration Quick Reference Tables

Table 2-3 Directory Server Configuration LDIF Files (Continued)

Configuration Filename Purpose

00core.ldif

05rfc2247.ldif

05rfc2927.ldif

10rfc2307

20subscriber.ldif

25java-object.ldif

28pilot.ldif

30ns-common.ldif

50ns-admin.ldif

50ns-calendar.ldif

51ns-calendar.ldif

50ns-certificate.ldif

Contains LDAPv3 standard operational schema, such as “subschemaSubentry,” LDAPv3 standard user and organization schema defined in RFC 2256

(based on X.520/X.521), inetOrgPerson and select other widely-used attributes, and the operational attributes used by Directory Server configuration. Modifying this file will cause interoperability problems. User defined attributes should be added using Netscape Console.

Schema from RFC 2247 and related pilot schema:

“Using Domains in LDAP/X500 Distinguished

Names.”

Schema from RFC 2927: “MIME Directory Profile for LDAP Schema.” Contains the ldapSchemas operational attribute required for the attribute to show up in the subschema subentry.

Schema from RFC 2307: “An Approach for Using

LDAP as a Network Information Service”.

Contains new schema elements and the Nortel subscriber interoperability specification. Also contains the adminRole and memberOf attributes and inetAdmin class previously stored in

50ns-delegated-admin.ldif file.

Schema from RFC 2713: “Schema for Representing

Java(tm) Objects in an LDAP Directory.”

Contains pilot directory schema from FRC 1274 which is no longer recommended for new deployments. Please note that future RFCs which succeed RFC 1274 may deprecate some or all of

28pilot.ldif

attribute types and classes.

Schema that contains objects classes and attributes common to the Netscape Console framework.

Schema used by Netscape Administration Server.

Schema used by Netscape Calendar Server.

Schema used by Netscape Calendar Server.

Schema for Netscape Certificate Management

System.

Chapter 2 Core Server Configuration Reference 115

Configuration Quick Reference Tables

Table 2-3 Directory Server Configuration LDIF Files (Continued)

Configuration Filename Purpose

50ns-compass.ldif

Schema used by Netscape Compass Server to define personal interest profiles.

50ns-delegated-admin.ldif

Schema used by Netscape Delegated

Administrator.

50ns-directory.ldif

Contains additional configuration schema used by

Netscape Directory Server 4.12 and earlier versions of the directory, which is no longer applicable to

Netscape Directory Server 6.x. This schema is required for replicating between Netscape

Directory Server 4.12 and Netscape Directory

Server 6.x.

50ns-legacy.ldif

50ns-mail.ldif

50ns-mcd-browser.ldif

50ns-mcd-config.ldif

Legacy Netscape Schema used by Netscape

Administration Server for legacy servers.

Schema used by Netscape Messaging Server to define mail users and mail groups.

Schema used by Netscape Mission Control Desktop to hold browser client preferences.

Schema used by Netscape Mission Control Desktop to set MCD "config()" preferences.

50ns-mcd-li.ldif

50ns-mcd-mail.ldif

50ns-media.ldif

50ns-mlm.ldif

50ns-msg.ldif

50ns-netshare.ldif

50ns-news.ldif

50ns-proxy.ldif

50ns-value.ldif

50ns-wcal.ldif

50ns-web.ldif

Schema used by Netscape Mission Control Desktop to define location independence.

Schema used by Netscape Mission Control Desktop to hold mail client preferences and messenger security preferences.

Schema used for Netscape Media Server.

Schema used by Netscape Messaging Server 4.0 for mailing list management.

Schema used for Netscape Web Mail.

Schema used for Netscape Netshare.

Schema used for Netscape Collabra Server to hold news group preferences.

Schema used for Netscape Proxy Server.

Schema for Netscape servers’ “value item” schema.

Schema for Netscape Web Calendaring.

Schema for Netscape Web Server.

116 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Configuration Quick Reference Tables

Table 2-3 Directory Server Configuration LDIF Files (Continued)

Configuration Filename Purpose

99user.ldif

User-defined schema maintained by Directory

Server replication consumers which contains the attributes and object classes from the suppliers.

Configuration Changes Requiring Server Restart

Table 2-4 lists the configuration attributes that cannot be altered dynamically, while the server is still running. They require that the server be stopped and restarted to take effect. The table lists the configuration attributes concerned, with their full DNs, and provides a brief description of their functions.

Table 2-4 Configuration Changes Requiring Server Restart

Configuration Attribute Action Requiring Restart cn=config,cn=ldbm:nsslapd-cachesize cn=config,cn=ldbm:nsslapd-dbcachesize

Modifying the cachesize attribute.

Modifying the dbcachesize attribute.

cn=config,cn=ldbm:nsslapd-dbncache cn=config,cn=ldbm:nsslapd-plug-in cn=config:nsslapd-changelogdir cn=config:nsslapd-changelogmaxage cn=config:nsslapd-changelogmaxentries cn=config:nsslapd-changelogsuffix cn=config:nsslapd-port cn=config:nsslapd-secureport cn=encryption,cn=config:nsssl2 cn=encryption,cn=config:nsssl3 cn=encryption,cn=config:nssslclientauth cn=encryption,cn=config:nssslsessiontimeout

Modifying the database cache

Enabling or disabling a database plug-in.

Modifying the change log directory.

Modifying the maximum age limit of the change log.

Modifying the maximum number of entries supported by the change log.

Modifying the change log suffix.

Changing the port number.

Changing the secure port number.

Enabling or disabling SSL Version 2 for

Directory Server.

Enabling or disabling SSL Version 3 for

Directory Server.

Enabling or disabling client authentication.

Changing the lifetime of an SSL session.

Chapter 2 Core Server Configuration Reference 117

Configuration Quick Reference Tables

118 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Chapter 3

Plug-in Implemented Server

Functionality Reference

This chapter contains reference information on Netscape Directory Server

(Directory Server) server plug-ins. The chapter is divided into the following sections:

• Overview (page 119)

• Server Plug-in Functionality Reference (page 120)

• List of Attributes Common to All Plug-ins (page 141)

• Attributes Allowed by Certain Plug-ins (page 144)

• Database Plug-in Attributes (page 145)

• Database Link Plug-in Attributes (chaining attributes) (page 170)

• Retro Changelog Plug-in Attributes (page 181)

Overview

The configuration for each part of Directory Server plug-in functionality has its own separate entry and set of attributes under the subtree cn=plugins,cn=config

. Code Example 2-2, which you also saw in Chapter 2,

“Core Server Configuration Reference,” shows some of the plug-in configuration attributes.

119

Server Plug-in Functionality Reference dn: cn=Telephone Syntax,cn=plugins,cn=config objectclass: top objectclass: nsSlapdPlugin objectclass: extensibleObject cn: Telephone Syntax nsslapd-pluginPath: /usr/netscape/servers/lib/syntax-plugin.so

nsslapd-pluginInitfunc: tel_init nsslapd-pluginType: syntax nsslapd-pluginEnabled: on

Some of these attributes are common to all plug-ins while others may be particular to a specific plug-in. You can check which attributes are currently being used by a given plug-in by performing an ldapsearch on the cn=config subtree.

Object Classes for Plug-In Configuration

All plug-ins are instances of the nsSlapdPlugin object class which in turn inherits from the extensibleObject object class. For plug-in configuration attributes to be taken into account by the server, both of these object classes (in addition to the top object class) must be present in the entry as shown in the following example: dn:cn=ACL Plugin,cn=plugins,cn=config objectclass:top objectclass:nsSlapdPlugin objectclass:extensibleObject

Server Plug-in Functionality Reference

The tables that follow provide you with a quick overview of the plug-ins provided with Directory Server, along with their configurable options, configurable arguments, default setting, dependencies, general performance related information, and further reading. Information in these tables will help you to weigh up plug-in performance gains and costs and choose the optimal settings for your deployment. The “Further Information” row cross references further reading where this is available.

120 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Server Plug-in Functionality Reference

7-bit check Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

7-bit check (NS7bitAtt) cn=7-bit check,cn=plugins,cn=config

Checks certain attributes are 7-bit clean on | off on list of attributes ( uid mail userpassword ) followed by "," and then suffix(es) on which the check is to occur

None

None

If your Directory Server uses non-ASCII characters, for example,

Japanese, turn this plug-in off.

ACL Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

ACL Plugin cn=ACL Plugin,cn=plugins,cn=config

ACL access check plug-in on | off on

None

None

N/A

Chapter 6, “Managing Access Control” in the Netscape Directory

Server Administrator’s Guide.

Chapter 3 Plug-in Implemented Server Functionality Reference 121

Server Plug-in Functionality Reference

ACL preoperation Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

ACL preoperation cn=ACL preoperation,cn=plugins,cn=config

ACL access check plug-in on | off on

None database

None

Chapter 6, “Managing Access Control” in the Netscape Directory

Server Administrator’s Guide.

Binary Syntax Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Binary Syntax c n=Binary Syntax,cn=plugins,cn=config

Syntax for handling binary data on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

122 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Server Plug-in Functionality Reference

Boolean Syntax Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Boolean Syntax cn=Boolean Syntax,cn=plugins,cn=config

Syntax for handling booleans.

on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Case Exact String Syntax Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Case Exact String Syntax cn=Case Exact String Syntax,cn=plugins,cn=config

Syntax for handling case-sensitive strings on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Chapter 3 Plug-in Implemented Server Functionality Reference 123

Server Plug-in Functionality Reference

Case Ignore String Syntax Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Case Ignore String Syntax cn=Case Ignore String Syntax,cn=plugins,cn=config

Syntax for handling case-insensitive strings on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Chaining database Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Chaining Database cn=Chaining database,cn=plugins,cn=config

Syntax for handling DNs on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Chapter 3, “Configuring Directory Databases” in the Netscape

Directory Server Administrator’s Guide

124 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Server Plug-in Functionality Reference

Class of Service Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Class of Service cn=Class of Service,cn=plugins,cn=config

Allows for sharing of attributes between entries on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Chapter 5, “Advanced Entry Management” in the Netscape

Directory Server Administrator’s Guide

Country String Syntax Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Country String Syntax Plug-in cn=Country String Syntax,cn=plugins,cn=config

Syntax for handling countries on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Chapter 3 Plug-in Implemented Server Functionality Reference 125

Server Plug-in Functionality Reference

Distinguished Name Syntax Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Distinguished Name Syntax cn=Distinguished Name Syntax,cn=plugins,cn=config

Syntax for handling DNs on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Generalized Time Syntax Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Generalized Time Syntax cn=Generalized Time Syntax,cn=plugins,cn=config

Syntax for dealing with dates, times and time zones on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

126 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Server Plug-in Functionality Reference

Further Information The Generalized Time String consists of the following: four digit year, two digit month (for example, 01 for January), two digit day, two digit hour, two digit minute, two digit second, an optional decimal part of a second and a time zone indication. We strongly recommend that you use the Z time zone indication which stands for Greenwich Mean Time.

HTTP Client Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

HTTP Client cn=HTTP Client,cn=plugins,cn=config

HTTP client plug-in on | off on

None database

Integer Syntax Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Integer Syntax cn=Integer Syntax,cn=plugins,cn=config

Syntax for handling integers on | off on

Chapter 3 Plug-in Implemented Server Functionality Reference 127

Server Plug-in Functionality Reference

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Internationalization Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Internationalization Plugin cn=Internationalization

Plugin,cn=plugins,cn=config

Syntax for handling DNs on | off on

The Internationalization has one argument which must not be modified: serverRoot /slapdserverID /config/slapd-collations.conf

This directory stores the collation orders and locales used by the internationalization plug-in.

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

See Appendix D, “Internationalization” in the Netscape Directory

Server Administrator’s Guide.

ldbm database Plug-in

Plug-in Name

DN of Configuration

Entry ldbm database Plug-in cn=ldbm database plug-in,cn=plugins,cn=config

128 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Server Plug-in Functionality Reference

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Implements local databases

N/A on

None

None

See “Database Plug-in Attributes” on page 145 for further information on database configuration.

Chapter 3, “Configuring Directory Databases” in the Netscape

Directory Server Administrator’s Guide

Legacy Replication Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Legacy Replication plug-in cn=Legacy Replication plug-in,cn=plugins,cn=config

Enables Directory Server 6.x to be a consumer of a 4.x supplier on | off on

None. This plug-in can be disabled if the server is not (and never will be) a consumer of a 4.x server.

database

None

Chapter 8, “Managing Replication” in the Netscape Directory Server

Administrator’s Guide

Multimaster Replication Plug-in

Plug-in Name Multimaster Replication Plugin

Chapter 3 Plug-in Implemented Server Functionality Reference 129

Server Plug-in Functionality Reference

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information cn=Multimaster Replication plugin,cn=plugins,cn=config

Enables replication between two 6.x Directory Servers on | off on

None database

N/A

You can turn this plug-in off if you only have one server which will never replicate. See also Chapter 8, “Managing Replication” in the

Netscape Directory Server Administrator’s Guide

Octet String Syntax Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Octet String Syntax cn=Octet String Syntax,cn=plugins,cn=config

Syntax for handling octet strings on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

130 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Server Plug-in Functionality Reference

CLEAR Password Storage Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

CLEAR cn=CLEAR,cn=Password Storage

Schemes,cn=plugins,cn=config

CLEAR password storage scheme used for password encryption on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Chapter 7, “User Account Management” in the Netscape Directory

Server Administrator’s Guide

CRYPT Password Storage Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

CRYPT cn=CRYPT,cn=Password Storage

Schemes,cn=plugins,cn=config

CRYPT password storage scheme used for password encryption on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Chapter 7, “User Account Management” in the Netscape Directory

Server Administrator’s Guide

Chapter 3 Plug-in Implemented Server Functionality Reference 131

Server Plug-in Functionality Reference

NS-MTA-MD5 Password Storage Scheme

Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

NS-MTA-MD5 cn=NS-MTA-MD5,cn=Password Storage

Schemes,cn=plugins,cn=config

NS-MTA-MD5 password storage scheme for password encryption on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

You can no longer choose to encrypt passwords using the

NS-MTA-MD5 password storage scheme. The storage scheme is still present but only for reasons of backward compatibility, i.e. if the data in your directory still contains passwords encrypted with the NS-MTA-MD5 password storage scheme. See Chapter 7, “User

Account Management” in the Netscape Directory Server

Administrator’s Guide

SHA Password Storage Scheme Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

SHA cn=SHA,cn=Password Storage

Schemes,cn=plugins,cn=config

SHA password storage scheme for password encryption on | off on

None

132 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Server Plug-in Functionality Reference

Dependencies

Performance

Related Information

Further Information

None

If there are not passwords encrypted using the SHA password storage scheme, you may turn this plug-in off. If you want to encrypt your password with the SHA password storage scheme, we recommend that you choose SSHA instead, as SSHA is a far more secure option.

Chapter 7, “User Account Management” in the Netscape Directory

Server Administrator’s Guide

SSHA Password Storage Scheme Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

SSHA cn=SSHA,cn=Password Storage

Schemes,cn=plugins,cn=config

SSHA password storage scheme for password encryption on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Chapter 7, “User Account Management” in the Netscape Directory

Server Administrator’s Guide

Postal Address String Syntax Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Postal Address Syntax cn=Postal Address Syntax,cn=plugins,cn=config

Syntax used for handling postal addresses

Chapter 3 Plug-in Implemented Server Functionality Reference 133

Server Plug-in Functionality Reference

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Presence Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Presence cn=Presence,cn=plugins,cn=config

Syntax used for handling postal addresses on | off on

None database

Check the reference provided in Further Information.

Chapter 18, “Configuring IM Presence Information” in the Netscape

Directory Server Administrator’s Guide.

PTA Plug-in

Plug-in Name

DN of Configuration

Entry

Pass-Through Authentication Plugin cn=Pass Through

Authentication,cn=plugins,cn=config

134 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Server Plug-in Functionality Reference

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Enables pass-through authentication, the mechanism which allows one directory to consult another to authenticate bind requests.

on | off off ldap://example.com:389/o=example

None

Chapter 16, “Using the Pass-Through Authentication Plug-in” in the Netscape Directory Server Administrator’s Guide.

Chapter 16, “Using the Pass-Through Authentication Plug-in” in the Netscape Directory Server Administrator’s Guide.

Referential Integrity Postoperation Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Referential Integrity Postoperation cn=Referential Integrity

Postoperation,cn=plugins,cn=config

Enables the server to ensure referential integrity

All configuration and on | off off

Chapter 3 Plug-in Implemented Server Functionality Reference 135

Server Plug-in Functionality Reference

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

When enabled the post operation Referential Integrity plug-in performs integrity updates on the member , uniquemember , owner and seeAlso attributes immediately after a delete or rename operation. You can reconfigure the plug-in to perform integrity checks on all other attributes.

Configurable arguments are as follows:

1. Check for referential integrity.

-1 = no check for referential integrity

0 = check for referential integrity is performed immediately positive integer = request for referential integrity is queued and processed at a later stage. This positive integer serves as a wake-up call for the thread to process the request, at intervals corresponding to the integer specified.

2. Log file for storing the change, for example

/usr/netscape/servers/logs/referint

3. All the additional attribute names you want to be checked for referential integrity.

database

You should enable the Referential Integrity plug-in on only one master in a multi-master replication environment to avoid conflict resolution loops. When enabling the plug-in on chained servers you must be sure to analyze your performance resource and time needs as well as your integrity needs. Note that integrity checks can be time consuming and draining on memory/CPU.

See Chapter 3, “Configuring Directory Databases” in the Netscape

Directory Server Administrator’s Guide.

Retro Changelog Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Retro Changelog Plugin cn=Retro Changelog Plugin,cn=plugins,cn=config

Used by LDAP clients for maintaining application compatibility with Directory Server 4.x versions. Maintains a log of all changes occurring in the Directory Server. The Retro Changelog offers the same functionality as the changelog in the 4.x versions of Directory

Server.

136 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Server Plug-in Functionality Reference

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information on | off off

See “Retro Changelog Plug-in Attributes,” on page 181 for further information on the two configuration attributes for this plug-in.

None

May slow down Directory Server performance.

Chapter 8, “Managing Replication” in the Netscape Directory Server

Administrator’s Guide.

Roles Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Roles Plugin cn=Roles Plugin,cn=plugins,cn=config

Enables the use of roles in the Directory Server on | off on

None database

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Chapter 5, “Advanced Entry Management” in the Netscape

Directory Server Administrator’s Guide.

Space Insensitive String Syntax Plug-in

Plug-in Name Space Insensitive String Syntax

Chapter 3 Plug-in Implemented Server Functionality Reference 137

Server Plug-in Functionality Reference

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information cn=Space Insensitive String

Syntax,cn=plugins,cn=config

Syntax for handling space-insensitive values on | off on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

This plug-in enables the Directory Server to support space and case

insensitive values. Applications can now search the directory using entries with ASCII space characters.

For example, applications that use AOL Screen Names™ can search the Directory Server using filters that contain Screen Names—a search or compare operation that uses jOHN Doe will match entries that contain any of the following Screen Name values: johndoe , john doe , and John Doe .

For more information about finding directory entries, see Appendix

B, “Finding Directory Entries” in the Netscape Directory Server

Administrator’s Guide.

Note that the nsAIMID attribute type, which is a part of the

Presence schema, uses this syntax. For details, see Schema For the

Presence Plug-In” in the Netscape Directory Server Administrator’s

Guide.

State Change Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

State Change Plugin cn=State Change Plugin,cn=plugins,cn=config

Enables state-change-notification service.

on | off on

138 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Server Plug-in Functionality Reference

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

None

None

Telephone Syntax Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information

Telephone Syntax cn=Telephone Syntax,cn=plugins,cn=config

Syntax for handling telephone numbers on | off on

None

None

Do not modify the configuration of this plug-in. Netscape recommends that you leave this plug-in running at all times.

UID Uniqueness Plug-in

Plug-in Name

DN of Configuration

Entry

Description

Configurable

Options

UID Uniqueness plug-in cn=UID Uniqueness,cn=plugins,cn=config

Checks that the values of specified attributes are unique each time a modification occurs on an entry.

on | off

Chapter 3 Plug-in Implemented Server Functionality Reference 139

Server Plug-in Functionality Reference

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information off

Enter the following arguments: uid

"DN"

"DN"...

if you want to check for UID attribute uniqueness in all listed subtrees.

However, enter the following arguments: attribute="uid"

MarkerObjectclass = "ObjectClassName" and optionally requiredObjectClass = "ObjectClassName" if you want to check for UID attribute uniqueness when adding or updating entries with the requiredObjectClass , starting from the parent entry containing the ObjectClass as defined by the

MarkerObjectClass attribute.

database

Directory Server 6.x provides the UID Uniqueness plug-in by default. If you want to ensure unique values for other attributes, you can create instances of the UID Uniqueness plug-in for those attributes. See Chapter 17, “Using the Attribute Uniqueness

Plug-in” in the Netscape Directory Server Administrator’s Guide for more information about the Attribute Uniquenss plug-in.

The UID Uniqueness plug-in is off by default due to operation restrictions that need to be addressed before enabling the plug-in in a multi-master replication environment. Turning the plug-in on may slow down Directory Server performance.

Chapter 17, “Using the Attribute Uniqueness Plug-in” in the

Netscape Directory Server Administrator’s Guide.

URI Syntax Plug-in

Plug-in Name URI Syntax

140 Netscape Directory Server Configuration, Command, and File Reference • August 2002

List of Attributes Common to All Plug-ins

DN of Configuration

Entry

Description cn=URI Syntax,cn=plugins,cn=config

Syntax for handling URIs (Unique Resource Identifiers) including

URLs (Unique Resource Locators) on | off Configurable

Options

Default Setting

Configurable

Arguments

Dependencies

Performance

Related Information

Further Information on

None

None

Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

List of Attributes Common to All Plug-ins

This list provides a brief attribute description, the Entry DN, valid range, default value, syntax and an example for each attribute.

nsslapd-pluginPath

Specifies the full path to the plug-in.

Entry DN: cn= plug-in name ,cn=plugins,cn=config

Valid Values: Any valid path

Default Value: None

Syntax: DirectoryString

Example: nsslapd-pluginPath:

/usr/netscape/servers/lib/uid-plugin.so

nsslapd-pluginInitfunc

Specifies the plug-in function to be initiated.

Chapter 3 Plug-in Implemented Server Functionality Reference 141

List of Attributes Common to All Plug-ins

Entry DN: cn= plug-in name ,cn=plugins,cn=config

Valid Values: Any valid plug-in function

Default Value: None

Syntax: DirectoryString

Example: nsslapd-pluginInitfunc:NS7bitAttr_Init

nsslapd-pluginType

Specifies the plug-in type. See “nsslapd-plugin-depends-on-type” on page 144 for further information.

Entry DN: cn= plug-in name ,cn=plugins,cn=config

Valid Values: Any valid plug-in type

Default Value: None

Syntax: DirectoryString

Example: nsslapd-pluginType: preoperation

nsslapd-pluginEnabled

Specifies whether or not the plug-in is enabled. This attribute can be changed over protocol, but will only take effect when the server is next restarted.

Entry DN: cn= plug-in name ,cn=plugins,cn=config

Valid Values: on | off

Default Value: on

Syntax: DirectoryString

Example: nsslapd-pluginEnabled: on

142 Netscape Directory Server Configuration, Command, and File Reference • August 2002

List of Attributes Common to All Plug-ins

nsslapd-pluginId

Specifies the plug-in ID.

Entry DN: cn= plug-in name ,cn=plugins,cn=config

Valid Values: Any valid plug-in ID

Default Value: None

Syntax: DirectoryString

Example: nsslapd-pluginId: chaining database

nsslapd-pluginVersion

Specifies the plug-in version.

Entry DN: cn= plug-in name ,cn=plugins,cn=config

Valid Values: Any valid plug-in version

Default Value: Product version number

Syntax: DirectoryString

Example: nsslapd-pluginVersion: 6.1

nsslapd-pluginVendor

Specifies the vendor of the plug-in.

Entry DN: cn= plug-in name ,cn=plugins,cn=config

Valid Values: Any approved plug-in vendor.

Default Value: Netscape Communications Corporation

Syntax: DirectoryString

Example: nsslapd-pluginVendor: Netscape Communications Corp.

Chapter 3 Plug-in Implemented Server Functionality Reference 143

Attributes Allowed by Certain Plug-ins

nsslapd-pluginDescription

Provides a description of the plug-in.

Entry DN: cn= plug-in name ,cn=plugins,cn=config

Valid Values: N/A

Default Value: None

Syntax: DirectoryString

Example: nsslapd-pluginDescription: acl access check plug-in

Attributes Allowed by Certain Plug-ins nsslapd-plugin-depends-on-type

Multi-valued attribute, used to ensure that plug-ins are called by the server in the correct order. Takes a value which corresponds to the type number of a plug-in, contained in the attribute nsslapd-pluginType.

See “nsslapd-pluginType” on page 142 for further information. All plug-ins whose type value matches one of the values in the following valid range will be started by the server prior to this plug-in. The following post operation Referential Integrity Plug-in example shows that the database plug-in will be started prior to the postoperation Referential

Integrity Plug-in.

Entry DN: cn=referential integrity postoperation,cn=plugins,cn=config

Valid Values: database

Default Value: N/A

Syntax: DirectoryString

Example: nsslapd-plugin-depends-on-type:database

144 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Plug-in Attributes

nsslapd-plugin-depends-on-named

Multi-valued attribute, used to ensure that plug-ins are called by the server in the correct order. Takes a value which corresponds to the cn value of a plug-in. The plug-in whose cn value matches one of the following values will be started by the server prior to this plug-in. If the plug-in does not exist, the server will fail to start.

The following post operation Referential Integrity Plug-in example shows that the

Class of Service plug-in will be started prior to the postoperation Referential

Integrity Plug-in. If the Class of Service plug-in does not exist then the server will fail to start.

Entry DN: cn=referential integrity postoperation,cn=plugins,cn=config

Valid Values: Class of Service

Default Value: N/A

Syntax: DirectoryString

Example: nsslapd-plugin-depends-on-named: Class of Service

Database Plug-in Attributes

The database plug-in is also organized in an information tree as shown in

Figure 3-1.

Figure 3-1 Database Plug-In

Chapter 3 Plug-in Implemented Server Functionality Reference 145

Database Plug-in Attributes

All plug-in technology used by the database instances is stored in the cn=ldbm databas e plug-in node. This section presents the additional attribute information for each of the nodes in bold in the cn=ldbm database,cn=plugins,cn=config information tree.

Database Attributes Under cn=config,cn=ldbm database,cn=plugins,cn=config

Global configuration attributes common to all instances are stored in the cn=config,cn=ldbm database,cn=plugins,cn=config tree node.

nsLookthroughLimit

This performance related attribute specifies the maximum number of entries that the Directory Server will check when examining candidate entries in response to a search request. If you bind as the directory manager DN, however, unlimited is set by default and overrides any other settings you may specify here. It is worth noting that binder based resource limits work for this limit, which means that if a value for the operational attribute nsLookThroughlimit is present in the entry you bind as, the default limit will be overridden. If you attempt to set a value that is not a number or is too big for a 32-bit signed integer you will receive an

LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range: -1 to maximum integer in entries (where -1 is unlimited)

Default Value: 5000

Syntax: Integer

Example: nsLookthroughLimit: 5000

nsslapd-allidsthreshold

This performance related attribute that is present by default, specifies the number of entry IDs that can be maintained for an index key before the server sets the All

IDs token and stops maintaining a list of IDs for that specific key. If you attempt to set a value that is not a number or is too big for a 32-bit signed integer you will receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

146 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Plug-in Attributes

However, as tuning this attribute is a complex task and can severely degrade performance, it is advisable to keep the default value. For a more detailed explanation of the All IDs Threshold see Chapter 10, “Managing Indexes” in the

Netscape Directory Server Administrator’s Guide.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range: 100 to the maximum 32-bit integer value (2147483647) entry IDs

Default Value: 4000

Syntax: Integer

Example: nsslapd-allidsthreshold: 4000

nsslapd-cache-autosize

This performance tuning related attribute which is turned off by default, specifies the percentage of free memory to use for all the combined caches. For example, if the value is set to 80, then 80 percent of the remaining free memory would be claimed for the cache. If you plan to run other servers on the machine, then the value will be lower. Setting the value to 0 turns off the cache autosizing and uses the normal nsslapd-cachememsize and nsslapd-dbcachesize attributes.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range: 0 (turns cache autosizing off) to 100

Default Value: 0

Syntax:

Example:

Integer nsslapd-cache-autosize: 80

nsslapd-cache-autosize-split

This performance tuning related attribute specifies the percentage of cache space to allocate to the database cache. For example, setting this to 60 would give the database cache 60 percent of the cache space and split the remaining 40 percent between the backend entry caches. That is, if there were 2 databases each of them would receive 20 percent. This attribute only applies when the nsslapd-cache-autosize attribute has a value of 0 .

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Chapter 3 Plug-in Implemented Server Functionality Reference 147

Database Plug-in Attributes

Valid Range:

Default Value: 66 (This will not necessarily optimize your operations)

Syntax: Integer

Example: nsslapd-cache-autosize-split: 66

nsslapd-dbcachesize

This performance tuning related attribute specifies database cache size. Note that this is neither the index cache nor the entry cache. If you activate automatic cache resizing, you override this attribute, by replacing these values with its own guessed values at a later stage of the server startup.

If you attempt to set a value that is not a number or is too big for a 32-bit signed integer you will receive an

LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range: 500KB to 4GB for 32-bit platforms and 500KB to 2^64-1 for 64-bit platforms

Default Value: 10,000,000 bytes

Syntax: Integer

Example: nsslapd-dbcachesize: 10,000,000

NOTE On HP-UX only the maximum value for the nsslapd-dbcachesize attribute is 1GB, due to a PA-RISC hardware limitation that prevents memory-mapped files from crossing quadrant boundaries.

nsslapd-db-checkpoint-interval

The amount of time in seconds after which the Directory Server sends a checkpoint entry to the database transaction log. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only. A checkpoint entry indicates which database operations have been physically written to the directory database. The checkpoint entries are used to determine where in the database transaction log to begin recovery after a system failure. The nsslapd db-checkpoint-interval attribute is absent from

148 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Plug-in Attributes dse.ldif

. To change the checkpoint interval, you add the attribute to dse.ldif

.

This attribute can be dynamically modified using ldapmodify . For further information on modifying this attribute, see Chapter 14, “Tuning Directory Server

Performance” in the Netscape Directory Server Administrator’s Guide.

This attribute is provided only for system modification/diagnostics and should be changed only with the guidance of Netscape Technical Support or Netscape

Professional Services. Inconsistent settings of this attribute and other configuration attributes may cause the Directory Server to be unstable.

For more information on database transaction logging, see Chapter 12,

“Monitoring Server and Database Activity” in the Netscape Directory Server

Administrator’s Guide.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range: 10 to 300 seconds

Default Value: 60

Syntax: Integer

Example: nsslapd-db-checkpoint-interval: 120 seconds

nsslapd-db-circular-logging

Specifies circular logging for the transaction log files. If this attribute is switched off, old transaction log files are not removed, and are kept renamed as old log transaction files. Turning circular logging off can severly degrade server performance and as such should should only be modified with the guidance of

Netscape Technical Support or Netscape Professional Services.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Values: on | off

Default Value: on

Syntax: DirectoryString

Example: nsslapd-db-circular-logging: on

Chapter 3 Plug-in Implemented Server Functionality Reference 149

Database Plug-in Attributes

nsslapd-db-debug

Specifies whether additional error information is to be reported to Directory

Server. To report error information, set the parameter to on

. Note that this parameter is meant for troubleshooting, and enabling the parameter may slow down the Directory Server.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Values: on | off

Default Value: off

Syntax: DirectoryString

Example: nsslapd-db-debug: off

nsslapd-db-durable-transactions

Indicates whether database transactions log entries are immediately written to the disk. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only. With durable transactions enabled, every directory change will always be physically recorded in the log file and therefore be able to be recovered in the event of a system failure.

However, the durable transactions feature may also slow the performance of the

Directory Server. When durable transactions is disabled, all transactions are logically written to the database transaction log but may not be physically written to disk immediately. If there was a system failure before a directory change was physically written to disk, that change would not be recoverable. The nsslapd-db-durable-transactions attribute is absent from dse.ldif

. To disable durable transactions, you add the attribute to dse.ldif

.

This attribute is provided only for system modification/diagnostics and should be changed only with the guidance of Netscape Technical Support or Netscape

Professional Services. Inconsistent settings of this attribute and other configuration attributes may cause the Directory Server to be unstable.

For more information on database transaction logging, see Chapter 12,

“Monitoring Server and Database Activity” in the Netscape Directory Server

Administrator’s Guide.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Values: on | off

Default Value: on

150 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Plug-in Attributes

Syntax:

Example:

DirectoryString nsslapd-db-durable_transactions: on

nsslapd-db-home-directory

Applicable to Solaris only. Used to fix a situation in Solaris where the operating system endlessly flushes pages. This flushing can be so excessive that performance of the entire system is severely degraded.

This situation will occur only for certain combinations of the database cache size, the size of physical memory, and kernel tuning attributes. In particular, this situation should not occur if the database cache size is less than 100MB.

If your Solaris host seems excessively slow and your database cache size is around

100mb or more, then you can use the iostat utility to diagnose the problem. Use iostat to monitor the activity of the disk where the Directory Server’s database files are stored. If all of the following conditions are true:

• The disk is heavily used (more than 1mb per second of data transfer)

• There is a long service time (more than 100ms)

• There is mostly write activity then you should use the nsslapd-db-home-directory attribute to specify a subdirectory of a tempfs type file system.

Chapter 3 Plug-in Implemented Server Functionality Reference 151

Database Plug-in Attributes

NOTE The directory referenced by the nsslapd-db-home-directory attribute must be a subdirectory of a file system of type tempfs

(such as

/tmp

). However, Directory Server does not create the subdirectory referenced by this attribute. You must create the directory either manually or by using a script. Failure to create the directory referenced on the nsslapd-db-home-directory attribute will result in Directory Server being unable to start.

Also, if you have multiple Directory Servers on the same machine, their nsslapd-db-home-directory attributes must be configured with different directories. Failure to do so will result in the databases for both directories becoming corrupted.

Finally, use of this attribute causes internal Directory Server database files to be moved to the directory referenced by the attribute. It is possible, but unlikely, that the server will no longer start after the files have been moved because not enough memory can be allocated. This is a symptom of an overly large database cache size being configured for your server. If this happens, reduce the size of your database cache size to a value where the server will start again.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Values: Any valid directory name in a tempfs file system, such as /tmp .

Default Value: N/A

Syntax: DirectoryString

Example: nsslapd-db-home-directory: /tmp/slapd-phonebook

nsslapd-db-idl-divisor

Specifies the index block size in terms of the number of blocks per database page.

The block size is calculated by dividing the database page size by the value of this attribute. A value of 1 makes the block size exactly equal to the page size. The default value of 0 sets the block size to the page size minus an estimated allowance for internal database overhead.

Before modifying the value of this attribute export all databases using the db2ldif script. Once the modification has been made, reload the databases using the ldif2db script.

152 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Plug-in Attributes

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range: 0 to 8

Default Value: 0

Syntax: Integer

Example: nsslapd-db-idl-divisor: 2

nsslapd-db-logbuf-size

Specifies the log information buffer size. Log information is stored in memory until the buffer fills up or the transaction commit forces the buffer to be written to disk.

Larger buffer sizes can signficantly increase throughput in the presence of long running transactions, highly concurrent applications, or transactions producing large amounts of data.

Note that the nsslapd-db-logbuf-size attribute is only valid if the nsslapd-db-durable-transaction attribute is set to on.

Entry DN: c n=config,cn=ldbm database,cn=plugins,cn=config

Valid Range: 32K to maximum integer (limited to the amount of memory available on the machine)

Default Value: 32K

Syntax: Integer

Example: nsslapd-db-logbuf-size: 32K

nsslapd-db-logdirectory

Specifies the path and directory name of the directory containing the database transaction log. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only. By default, the database transaction log is stored in the same directory as the directory entries themselves, serverRoot /slapdserverID /db

. For fault-tolerance and performance reasons you may want to move this log file to another physical disk. The nsslapd-db-logdirectory attribute is absent from dse.ldif

. To change the location of the database transaction log, you add the attribute to dse.ldif

.

Chapter 3 Plug-in Implemented Server Functionality Reference 153

Database Plug-in Attributes

For more information on database transaction logging, see Chapter 12,

“Monitoring Server and Database Activity” in the Netscape Directory Server

Administrator’s Guide.

Entry DN: c n=config,cn=ldbm database,cn=plugins,cn=config

Valid Values: Any valid path and directory name

Default Value: N/A

Syntax: DirectoryString

Example: nsslapd-db-logdirectory: /logs/txnlog

nsslapd-db-logfile-size

Specifies the maximum size of a single file in the log in bytes. By default, or if the value is set to 0, a maximum size of 10 MB is used. The maximum size is an unsigned 4-byte value. The value of this attribute can have significant impact on performance as it can be tuned to avoid extensive log switching in the event of heavy entries.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range: 0 to unsigned 4-byte integer

Default Value: 10MB

Syntax: Integer

Example: nsslapd-db-logfile-size: 10 MB

nsslapd-db-page-size

Specifies the size of the pages used to hold items in the database in bytes. The minimum size is 512 bytes and the maximum size is 64K bytes. If the page size is not explicitly set, Directory Server defaults to a page size of 8K bytes. Changing this default value can have signficant performance impact. If the page size is too small, it results in extensive page splitting and copying, whereas if the page size is too large it can waste disk space.

Before modifying the value of this attribute export all databases using the db2ldif script. Once the modification has been made, reload the databases using the ldif2db script.

154 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Plug-in Attributes

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range: 512 bytes to 64 K bytes

Default Value: 8K bytes

Syntax: Integer

Example: nsslapd-db-page-size: 8K bytes

nsslapd-db-spin-count

Specifies the number of times that test-and-set mutexes should spin without blocking.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range: 0 to 2^31-1

Default Value: 0

Syntax: Integer

Example: nsslapd-db-spin-count: 0

nsslapd-db-transaction-batch-val

Specifies how many transactions will be batched before being committed. You can use this attribute to improve update performance when full transaction durability is not required. This attribute can be dynamically modified using ldapmodify

. For further information on modifying this attribute, see Chapter 14, “Tuning Directory

Server Performance” in the Netscape Directory Server Administrator’s Guide.

If you do not define this attribute or set it to a value of 0, transaction batching will be turned off and it will be impossible to make remote modifications to this attribute via LDAP. However, setting this attribute to a value greater than 0 causes the server to delay committing transactions until the number of queued transactions is equal to the attribute value. A value greater than 0 also allows you to modify this attribute remotely via LDAP. A value of 1 for this attribute allows you to modify the attribute setting remotely via LDAP, but results in no batching behaviour. A value of 1 at server startup is therefore useful for maintaining normal

Chapter 3 Plug-in Implemented Server Functionality Reference 155

Database Plug-in Attributes durability, while also allowing transaction batching to be turned on and off remotely when desired. Bear in mind that the value you choose for this attribute may require you to modify the nsslapd-db-logbuf-size attribute to ensure sufficient log buffer size for accommodating your batched transactions.

Also, the nsslapd-db-transaction-batch-val attribute is only valid if the nsslapd-db-durable-transaction attribute is set to on.

For more information on database transaction logging, see Chapter 12,

“Monitoring Server and Database Activity” in the Netscape Directory Server

Administrator’s Guide.

Entry DN: c n=config,cn=ldbm database,cn=plugins,cn=config

Valid Range: 0 to 30

Default Value: 0 (or turned off))

Syntax: Integer

Example: nsslapd-db-transaction-batch-val: 5

nsslapd-db-transaction-logging

Specifies whether transaction logging is on or off. Turning transaction logging off can considerably improve Directory Server performance but at the risk of data loss and/or database corruption in the event of a system crash. If turned off it would be necessary to set up other database recovery procedures.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Values: on | off

Default Value: on

Syntax: DirectoryString

Example: nsslapd-db-transaction-logging: on

nsslapd-db-trickle-percentage

Ensures that at least the specified percentage of pages in the shared-memory pool are clean, by writing dirty pages to their backing files. This is to ensure that a page is always available for reading in new information without having to wait for a write.

156 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Plug-in Attributes

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range: 0 to 100

Default Value: 40

Syntax: Integer

Example: nsslapd-db-trickle-percentage: 40

nsslapd-db-verbose

Specifies whether to record additional informational and debugging messagses when searching the log for checkpoints, doing deadlock detection, and performing recovery. Note that this parameter is meant for troubleshooting, and enabling the parameter may slow down the Directory Server.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Values: on | off

Default Value: off

Syntax: DirectoryString

Example: nsslapd-db-verbose: off

nsslapd-dbncache

This attribute allows you to split the ldbm cache into equally sized separate pieces of memory. It is possible to specify caches that are large enough so that they cannot be allocated contiguously on some architectures, e.g., some releases of Solaris limit the amount of memory that may be allocated contiguously by a process. If nsslapd-dbncache is 0 or 1, the cache will be allocated contiguously in memory. If it is greater than 1, the cache will be broken up into ncache equally sized separate pieces of memory.

This attribute is provided only for system modification/diagnostics and should be changed only with the guidance of Netscape Technical Support or Netscape

Professional Services. Inconsistent settings of this attribute and other configuration attributes may cause the Directory Server to be unstable.

Chapter 3 Plug-in Implemented Server Functionality Reference 157

Database Plug-in Attributes

nsslapd-import-cachesize

This performance tuning related attribute determines the size of the database cache used in the bulk import process. By setting this attribute value so that the maximum available system physical memory is used for the database cache during bulk importing, you can optimize bulk import speed. If you attempt to set a value that is not a number or is too big for a 32-bit signed integer you will receive an

LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

NOTE A cache is created for each load that occurs. For example, if the user sets the nsslapd-import-cachesize attribute to 1GB, then 1GB is used when loading one database, 2GB is used when loading 2 databases, etc. Ensure that you have sufficient physical memory to prevent swapping from occuring, as this would result in performance degradation.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range: 500KB to 4GB for 32-bit platforms and 500KB to 2^64-1 for 64-bit platforms

Default Value: 20 000 000

Syntax: Integer

Example: nsslapd-import-cachesize: 20 000 000

nsslapd-mode

Specifies the permissions used for newly created index files.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Values: Any four-digit octal number. However, mode 0600 is recommended.

This allows read and write access for the owner of the index files (which is the user that ns-slapd runs as), and no access for other users.

Default Value: 0600

Syntax: Integer

Example: nsslapd-mode: 0600

158 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Plug-in Attributes

Database Attributes Under cn=monitor,cn=ldbm database, cn=plugins,cn=config

Global read-only attributes containing database statistics for monitoring activity on your databases are stored in the cn=monitor,cn=ldbm database, cn=plugins,cn=config tree node. For more information on these monitoring read-only entries see Chapter 12, “Monitoring Server and Database Activity” in the

Netscape Directory Server Administrator’s Guide.

dbcachehits

Requested pages found in the database.

dbcachetries

Total requested pages found in the database cache.

dbcachehitratio

Percentage of requested pages found in the database cache (hits/tries)

dbcachepagein

Pages read into the database cache.

dbcachepageout

Pages written from the database cache to the backing file.

dbcacheroevict

Clean pages forced from the cache.

dbcacherwevict

Dirty pages forced from the cache.

Chapter 3 Plug-in Implemented Server Functionality Reference 159

Database Plug-in Attributes

Database Attributes Under cn=NetscapeRoot,cn=ldbm database, cn=plugins,cn=config and cn=UserRoot,cn=ldbm database, cn=plugins,cn=config

The cn=NetscapeRoot and cn=UserRoot subtrees contain configuration data for, or if we prefer, the definition of, the databases containing the o=NetscapeRoot and o=France.Sun

suffixes respectively. The cn=NetscapeRoot subtree contains the configuration data used by the Netscape Administration Server for authentication and all actions that cannot be performed through LDAP (such as start/stop) and the cn=UserRoot subtree contains all the configuration data for the user-defined database. The cn=UserRoot subtree is called

UserRoot by default. However, this is not hard-coded and, given the fact that there will be multiple database instances, this name will be changed and defined by the user as and when new databases are added. The following attributes are common to both the cn=NetscapeRoot, cn=ldbm database,cn=plugins,cn=config and cn=UserRoot, cn=ldbm database,cn=plugins,cn=config subtrees.

nsslapd-cachesize

This performance tuning related attribute specifies the cache size in terms of the entries it can hold. However, it is worth noting that it is simpler to limit by memory size only (see nsslapd-cachememsize attribute). If you attempt to set a value that is not a number or is too big for a 32-bit signed integer you will receive an

LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Entry DN:

Valid Range: 1 to 2,147,483,647 ( or -1 which means limitless) entries

Default Value: -1

Syntax:

Example: cn=Netscaperoot,cn=ldbm database,cn=plugins,cn=config or cn=UserRoot,cn=ldbm database,cn=plugins,cn=config

Integer nsslapd-cachesize: -1

160 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Plug-in Attributes

nsslapd-cachememsize

This performance tuning related attribute specifies the cache size in terms of available memory space. Limiting cachesize in terms of memory occupied is the simplest method. By activating automatic cache resizing you override this attribute, replacing these values with its own guessed values at a later stage of the server startup. If you attempt to set a value that is not a number or is too big for a

32-bit signed integer you will receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Entry DN:

Valid Range: 200KB to 4GB

Default Value: 10 485 760 (10Mb)

Syntax:

Example: cn=Netscaperoot,cn=ldbm database,cn=plugins,cn=config or cn=UserRoot,cn=ldbm database,cn=plugins,cn=config

Integer nsslapd-cachememsize:10Mb

nsslapd-directory

Specifies absolute path to database instance. If your database instance is manually created then this attribute must be included, something which is set by default

(and modifiable) in the Netscape Console. Once your database instance is created, do not modify this path as any changes risk preventing the server from accessing data. This attribute is related to server5.

Entry DN: cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Values: Any valid absolute path to the database instance

Default Value: N/A

Syntax:

Example:

DirectoryString nsslapd-directory:

/usr/netscape/servers/slapd-phonebook/db

nsslapd-readonly

Specifies Read Only permission rights. If this attribute has a value of off

, then the user has all read, write, and execute permissions.

Chapter 3 Plug-in Implemented Server Functionality Reference 161

Database Plug-in Attributes

Entry DN: c n=Netscaperoot,cn=ldbm database,cn=plugins,cn=config or cn=UserRoot,cn=ldbm database,cn=plugins,cn=config

Valid Values: on | off

Default Value: off

Syntax: DirectoryString

Example: nsslapd-readonly: off

nsslapd-require-index

When switched to on this attribute allows you to refuse non-indexed or allids searches. This performance related attribute avoids saturating the server with erroneous searches.

Entry DN:

Valid Values: on | off

Default Value: off

Syntax:

Example: c n=Netscaperoot,cn=ldbm database,cn=plugins,cn=config or cn=UserRoot,cn=ldbm database,cn=plugins,cn=config

DirectoryString nsslapd-require: off

nsslapd-suffix

Specifies the suffix of the database link. This is a mono-valued attribute as each database instance can have only one suffix. Previously it was possible to have more than one suffix on a single database instance but this is no longer the case. As a result this attribute is mono-valued to enforce the fact that each database instance can only have one suffix entry. Any changes made to this attribute after the entry has been created take effect only after you restart the server containing the database link.

Entry DN: cn=Netscaperoot,cn=ldbm database,cn=plugins,cn=config or cn=UserRoot,cn=ldbm database,cn=plugins,cn=config

Valid Values: Any valid DN

Default Value: N/A

162 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Plug-in Attributes

Syntax:

Example:

DirectoryString nsslapd-suffix: o=Netscaperoot

Database Attributes Under cn=database,cn=monitor,cn=ldbm database, cn=plugins,cn=config

The attributes in this tree node entry are all read-only, database performance counters. All of the values for these attributes are 32-bit integers.

nsslapd-db-abort-rate

Number of transactions that have been aborted.

nsslapd-db-active-txns

Number of transactions that are currently active.

nsslapd-db-cache-hit

Requested pages found in the cache.

nsslapd-db-cache-try

Total cache lookups.

nsslapd-db-cache-region-wait-rate

Number of times that a thread of control was forced to wait before obtaining the region lock.

nsslapd-db-cache-size-bytes

Total cache size in bytes.

nsslapd-db-clean-pages

Clean pages currently in the cache.

nsslapd-db-commit-rate

Number of transactions that have been committed.

Chapter 3 Plug-in Implemented Server Functionality Reference 163

Database Plug-in Attributes

nsslapd-db-deadlock-rate

Number of deadlocks detected.

nsslapd-db-dirty-pages

Dirty pages currently in the cache.

nsslapd-db-hash-buckets

Number of hash buckets in buffer hash table.

nsslapd-db-hash-elements-examine-rate

Total number of hash elements traversed during hash table lookups.

nsslapd-db-hash-search-rate

Total number of buffer hash table lookups.

nsslapd-db-lock-conflicts

Total number of locks not immediately available due to conflicts.

nsslapd-db-lock-region-wait-rate

Number of times that a thread of control was forced to wait before obtaining the region lock.

nsslapd-db-lock-request-rate

Total number of locks requested.

nsslapd-db-lockers

Number of current lockers.

nsslapd-db-log-bytes-since-checkpoint

Number of bytes written to this log since the last checkpoint.

nsslapd-db-log-region-wait-rate

Number of times that a thread of control was forced to wait before obtaining the region lock.

164 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Plug-in Attributes

nsslapd-db-log-write-rate

Number of megabytes and bytes written to this log.

nsslapd-db-longest-chain-length

Longest chain ever encountered in buffer hash table lookups.

nsslapd-db-page-create-rate

Pages created in the cache.

nsslapd-db-page-read-rate

Pages read into the cache.

nsslapd-db-page-ro-evict-rate

Clean pages forced from the cache.

nsslapd-db-page-rw-evict-rate

Dirty pages forced from the cache.

nsslapd-db-page-trickle-rate

Dirty pages written using the memp_trickle interface.

nsslapd-db-page-write-rate

Pages read into the cache.

nsslapd-db-pages-in-use

All pages, clean or dirty, currently in use.

nsslapd-db-txn-region-wait-rate

Number of times that a thread of control was force to wait before obtaining the region lock.

Chapter 3 Plug-in Implemented Server Functionality Reference 165

Database Plug-in Attributes

Database Attributes Under cn=default indexes,cn=config,cn=ldbm database, cn=plugins,cn=config

The set of default indexes is stored here. Default indexes are configured per backend in order to optimize Directory Server functionality for the majority of set up scenarios. All indexes, except system essential ones, can be removed, but care should be taken so as not to cause unnecessary disruptions. This section presents four required indexing attributes and one optional indexing attribute. For further information on indexes see Chapter 10, “Managing Indexes” in the Netscape

Directory Server Administrator’s Guide.

nsSystemIndex

This mandatory attribute specifies whether or not the index is a system index, that is, an index which is vital for Directory Server 6.x operations. If this attribute has a value of true

, then it is system essential. System indexes should not be removed as this will seriously disrupt server functionality.

Entry DN: cn=default indexes,cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Values: true | false

Default Value: N/A

Syntax:

Example:

DirectoryString nssystemindex: true

nsIndexType

This optional multi valued, attribute specifies the type of index for Directory Server

6.x operations and takes the values of the attributes to be indexed. Each desired index type has to be entered on a separate line.

Entry DN: cn=default indexes,cn=config,cn=ldbm database,cn=plugins,cn=config

166 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Plug-in Attributes

Valid Values: pres = presence index eq = equality index approx = approximate index index browse = browsing index

Default Value: N/A

Syntax:

Example: sub = substring index matching rule = international index

DirectoryString nsindextype: eq

nsMatchingRule

This optional, multivalued attribute specifies the collation order object identifier

(OID) required for the Directory Server to operate international indexing.

Entry DN: cn=default indexes,cn=monitor,cn=ldbm database,cn=plugins,cn=config

Valid Values: Any valid collation order object identifier (OID)

Default Value: None

Syntax: DirectoryString

Example: cn: 2.16.840.1.113730.3.3.2.3.1

(For Bulgarian)

cn

Provides the name of the attribute you want to index.

Entry DN: cn=default indexes,cn=monitor,cn=ldbm database,cn=plugins,cn=config

Valid Values: Any valid index cn

Default Value: None

Syntax:

Example:

DirectoryString cn: aci

Chapter 3 Plug-in Implemented Server Functionality Reference 167

Database Plug-in Attributes

description

This non-mandatory attribute provides a free-hand text description of what the index actually performs.

Entry DN: cn=default indexes,cn=monitor,cn=ldbm database,cn=plugins,cn=config

Valid Values: N/A

Default Value: None

Syntax: DirectoryString

Example: description:substring index

Database Attributes Under cn=monitor,cn=Netscaperoot,cn=ldbm database,cn=plugins,cn=config

Global, read-only entries for monitoring activity on the NetscapeRoot database.

These attributes containing database statistics are given for each file that makes up your database. For further information see Chapter 12, “Monitoring Server and

Database Activity” in the Netscape Directory Server Administrator’s Guide.

dbfilenamenumber

This attribute indicates the name of the file and provides a sequential integer identifier (starting at 0) for the file. All associated statistics for the file are given this same numerical identifier.

dbfilecachehit

Number of times that a search requiring data from this file was performed and that the data was successfully obtained from the cache.

dbfilecachemiss

Number of times that a search requiring data from this file was performed and that the data could not be obtained from the cache.

dbfilepagein

Number of pages brought to the cache from this file.

168 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Plug-in Attributes

dbfilepageout

Number of pages for this file written from cache to disk.

Database Attributes Under cn=index,cn=Netscaperoot,cn=ldbm database, cn=plugins,cn=config and cn=index,cn=UserRoot,cn=ldbm database, cn=plugins,cn=config

In addition to the set of default indexes that are stored under cn=default indexes,cn=config,cn=ldbm database,cn=plugins,cn=config

, custom indexes can be created for o=Netscaperoot and o=UserRoot and are stored under the cn=index,cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config, and cn=index,cn=UserRoot,cn=ldbm database,cn=plugins,cn=config, respectively. Each indexed attribute represents a subentry entry under the above cn=config information tree nodes, as shown in Figure 3-2.

Figure 3-2 Indexed Attribute Representing a Subentry

For example, the index file for the aci attribute under o=UserRoot will appear in the Directory Server as follows:

Chapter 3 Plug-in Implemented Server Functionality Reference 169

Database Link Plug-in Attributes (chaining attributes) dn:cn=aci,cn=index,cn=UserRoot,cn=ldbm database,cn=plugins,cn=confi objectclass:top objectclass:nsIndex cn=aci nssystemindex:true nsindextype:pres

For details regarding the five possible indexing attributes see the section “Database

Attributes Under cn=default indexes,cn=config,cn=ldbm database, cn=plugins,cn=config,” on page 166.For further information about indexes see

Chapter 10, “Managing Indexes” in the Netscape Directory Server Administrator’s

Guide.

Database Link Plug-in Attributes (chaining attributes)

The database link plug-in is also organized in an information tree as shown in

Figure 3-3.

Figure 3-3 Database Link Plug-In

All plug-in technology used by the database link instances is stored in the cn=chaining database plug-in node. This section presents the additional attribute information for the three nodes marked in bold in the cn=chaining database,cn=plugins,cn=config information tree.

170 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Link Plug-in Attributes (chaining attributes)

Database Link Attributes Under cn=config,cn=chaining database, cn=plugins,cn=config

Global configuration attributes common to all instances are stored in the cn=config,cn=chaining database,cn=plugins,cn=config tree node.

nsActiveChainingComponents

Lists the components using chaining. A component is any functional unit in the server. The value of this attribute overrides the value in the global configuration attribute. To disable chaining on a particular database instance, use the value

None.

This attribute also allows you to alter the components used to chain. By default no components are allowed to chain, which explains why this attribute will probably not appear in a list of cn=config,cn=chaining database,cn=config attributes, as LDAP considers empty attributes to be non-existent.

Entry DN: cn=config,cn=chaining database,cn=plugins,cn=config

Valid Values: Any valid component entry

Default Value: None

Syntax: DirectoryString

Example: nsActiveChainingComponents: cn=uid uniqueness,cn=plugins,cn=config

nsMaxResponseDelay

This error detection, performance related attribute specifies the maximum amount of time it can take a remote server to respond to an LDAP operation request made by a database link before an error is suspected. Once this delay period has been met, the database link tests the connection with the remote server.

Entry DN: cn=config,cn=chaining database,cn=plugins,cn=config

Valid Values: Any valid dealay period in seconds

Default Value: 60 seconds

Syntax: Integer

Example: nsMaxResponseDelay: 60

Chapter 3 Plug-in Implemented Server Functionality Reference 171

Database Link Plug-in Attributes (chaining attributes)

nsMaxTestResponseDelay

This error detection, performance related attribute specifies the duration of the test issued by the database link to check whether the remote server is responding. If a response from the remote server is not returned before this period has passed, the database link assumes the remote server is down and the connection is not used for subsequent operations.

Entry DN: cn=config,cn=chaining database,cn=plugins,cn=config

Valid Values: Any valid delay period in seconds

Default Value: 15 seconds

Syntax: Integer

Example: nsMaxTestResponseDelay: 15

nsTransmittedControls

This attribute, which can be both a global (and thus dynamic) configuration or an instance (i.e.

cn=database link instance,cn=chaining database,cn=plugins,cn=config

) configuration attribute, allows you to alter the controls the database link forwards. The following controls are forwarded by default by the database link:

• Managed DSA, object identifier: 2.16.840.1.113730.3.4.2.

• Virtual list view (VLV), object identifier:2.16.840.1.113730.3.4.9

• Server side sorting, object identifier: 1.2.840.113556.1.4.473

Entry DN: cn=config,cn=chaining database,cn=plugins,cn=config

Valid Values: Any valid OID or the above listed controls forwarded by the database link.

Default Value: None

Syntax: Integer

Example: nsTransmittedControls: 1.2.840.113556.1.4.473

172 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Link Plug-in Attributes (chaining attributes)

Database Link Attributes Under cn=default instance config,cn=chaining database,cn=plugins,cn=config

Default instance configuration attributes for instances are housed in the cn=default instance config,cn=chaining database,cn=plugins,cn=config tree node.

nsAbandonedSearchCheckInterval

Number of seconds that pass before the server checks for abandoned operations.

Entry DN: cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range: 0 to 2147483647 seconds

Default Value: 2

Syntax: Integer

Example: nsabandonedsearchcheckinterval: 10

nsBindConnectionsLimit

Maximum number of TCP connections the database link establishes with the remote server.

Entry DN: cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range: 1 to 50 connections

Default Value: 3

Syntax:

Example:

Integer nsbindconnectionslimit: 3

Chapter 3 Plug-in Implemented Server Functionality Reference 173

Database Link Plug-in Attributes (chaining attributes)

nsBindRetryLimit

Contrary to what the name suggests, this attribute does not specify the number of times a database link retries to bind with the remote server, but the number of times it tries to bind with the remote server. A value of 0 here indicates that the database link will only attempt to bind once.

Entry DN: cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range: 1 to 5

Default Value: 3

Syntax:

Example:

Integer nsbindretrylimit: 3

nsBindTimeout

Amount of time, before the bind attempt times out. There is no real Valid Range for this attribute, except reasonable patience limits.

Entry DN: cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range: 0 to 60 seconds

Default Value: 15

Syntax: Integer

Example: nsbindtimeout:15

nsCheckLocalACI

Reserved for advanced use only. Controls whether ACIs are evaluated on the database link as well as the remote data server. Changes to this attribute only take effect once the server has been restarted.

Entry DN: cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Values: on | off

Default Value: off

174 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Link Plug-in Attributes (chaining attributes)

Syntax:

Example:

DirectoryString nschecklocalaci: on

nsConcurrentBindLimit

Maximum number of concurrent bind operations per TCP connection.

Entry DN: cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range: 1 to 25 binds

Default Value: 10

Syntax:

Example:

Integer nsconcurrentbindlimit:10

nsConcurrentOperationsLimit

Specifies the maximum number of concurrent operations allowed.

Entry DN: cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range: 1 to 50 operations

Default Value: 50

Syntax:

Example:

Integer nsconcurrentoperationslimit: 50

nsConnectionLife

Specifies connection lifetime. You can keep connections between the database link and the remote server open for an unspecified time, or you can close them after a specific period of time. It is faster to keep the connections open, but is uses more resources. When the value is 0 and you provide a list of failover servers in the nsFarmServerURL attribute, the “main” server is never contacted after failover to the alternate server.

Chapter 3 Plug-in Implemented Server Functionality Reference 175

Database Link Plug-in Attributes (chaining attributes)

Entry DN: cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range: 0 to limitless seconds (where 0 means forever)

Default Value: 0

Syntax: Integer

Example: nsconnectionlife: 0

nsOperationConnectionsLimit

Maximum number of LDAP connections the database link establishes with the remote server.

Entry DN: cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range: 1 to 20 connections

Default Value: 10

Syntax:

Example:

Integer nsoperationconnectionslimit:10

nsProxiedAuthorization

Reserved for advanced use only. Allows you to disable proxied authorization, where a value of off means proxied authorization is disabled.

Entry DN: cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Values: on | off

Default Value: on

Syntax:

Example:

DirectoryString nsproxiedauthorization: on

176 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Database Link Plug-in Attributes (chaining attributes)

nsReferralOnScopedSearch

Controls whether or not referrals are returned by scoped searches. This attribute allows you to optimize your directory, because returning referrals in response to scoped searches is more efficient.

Entry DN: cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Values: on | off

Default Value: off

Syntax:

Example:

DirectoryString nsreferralonscopedsearch: off

nsSizeLimit

Specifies the default size limit for the database link in bytes.

Entry DN: cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range: -1 (no limit) to 2147483647 entries

Default Value: 2000

Syntax:

Example:

Integer nsSizeLimit: 2000

nsTimeLimit

Specifies the default search time limit for the database link.

Entry DN: cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range: -1 to 2147483647 seconds

Default Value: 3600

Syntax: Integer

Example: nsTimeLimit: 3600

Chapter 3 Plug-in Implemented Server Functionality Reference 177

Database Link Plug-in Attributes (chaining attributes)

Database Link Attributes Under cn=database link instance name,cn=chaining database, cn=plugins,cn=config

This information node stores the attributes concerning the server containing the data. A farm server is a server which contains data on databases. This attribute can contain optional servers for failover, separated by spaces. For cascading chaining, this URL can point to another database link.

nsFarmServerURL

Gives the LDAP URL of the remote server. A farm server is a server containing data in one or more databases. This attribute can contain optional servers for failover, separated by spaces. If using cascading changing, this URL can point to another database link.

Entry DN: cn= database link instance name ,cn=chaining database,cn=plugins,cn=config

Valid Values: Any valid remote server LDAP URL

Default Value: N/A

Syntax: DirectoryString

Example: nsFarmServerURL: ldap://epdiote.example.com:alternate_server:3333

nsMultiplexorBindDN

Gives the DN of the administrative entry used to communicate with the remote server. The multiplexor is the server that contains the database link and communicates with the farm server. This bind DN cannot be the Directory

Manager and if this attribute is not specified, the database link binds as anonymous.

Entry DN: cn= database link instance name ,cn=chaining database,cn=plugins,cn=config

Valid Values: N/A

Default Value: DN of the multiplexor

Syntax: DirectoryString

178 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Example:

Database Link Plug-in Attributes (chaining attributes) nsMultiplexerBindDN: cn=proxy manager

nsMultiplexorCredentials

Password for the administrative user, given in plain text. If no password is provided, it means that users can bind as anonymous.The password is encrypted in the configuration file. Please note that the example below is what you view, not what you type.

Entry DN: cn= database link instance name ,cn=chaining database,cn=plugins,cn=config

Valid Values: Any valid password which will then by encrypted using the DES reversible password encryption schema.

Default Value: N/A

Syntax: DirectoryString

Example: nsMultiplexerCredentials: {DES} 9Eko69APCJfF

nshoplimit

Specifies the maximum number of times a database is allowed to chain, that is the number of times a request can be forwarded from one database link to another.

Entry DN: cn= database link instance name ,cn=chaining database,cn=plugins,cn=config

Valid Range: 1 to an appropriate upper limit for your deployment

Default Value: 10

Syntax: Integer

Example: nsHopLimit: 3

Chapter 3 Plug-in Implemented Server Functionality Reference 179

Database Link Plug-in Attributes (chaining attributes)

Database Link Attributes Under cn=monitor,cn=database instance name,cn=chaining database, cn=plugins,cn=config

Attributes used for monitoring activity on your instances are stored in the cn=monitor,cn= database instance name ,cn=chaining database,cn=plugins,cn=config information tree.

nsAddCount

Number of add operations received.

nsDeleteCount

Number of delete operations received.

nsModifyCount

Number of modify operations received.

nsRenameCount

Number of rename operations received.

nsSearchBaseCount

Number of base level searches received.

nsSearchOneLevelCount

Number of one-level searches received.

nsSearchSubtreeCount

Number of subtree searches received.

nsAbandonCount

Number of abandon operations received.

nsBindCount

Number of bind requests received.

180 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Retro Changelog Plug-in Attributes

nsUnbindCount

Number of unbinds received.

nsCompareCount

Number of compare operations received.

nsOperationConnectionCount

Number of open connections for normal operations.

nsBindConnectionCount

Number of open connections for bind operations.

Retro Changelog Plug-in Attributes

Two different types of changelogs are maintained by Directory Server 6.x. The first type, referred to as changelog, is used by multi-master replication and the second changelog, which is in fact a plug-in referred to as retro changelog, is intended for use by LDAP clients for maintaining application compatibility with Directory

Server 4.x versions.

This Retro Changelog plug-in is used to record modifications made to a supplier server. When the supplier server’s directory is modified, an entry is written to the

Retro Changelog that contains:

• A number that uniquely identifies the modification. This number is sequential with respect to other entries in the change log.

• The modification action; that is, exactly how the directory was modified.

It is through the Retro Changelog plug-in that you access the changes performed to the DS using searches to “ cn=changelog,cn=config

” file.

nsslapd-changelogdir

This attribute specifies the name of the directory in which the changelog database is created the first time the plug-in is run. By default the database is stored with all the other databases under: serverRoot /slapdserverID /db/changelog

Chapter 3 Plug-in Implemented Server Functionality Reference 181

Retro Changelog Plug-in Attributes

NOTE For performance reasons you will probably want to store this database on a different physical disk.

Entry DN: cn=Retro Changelog Plugin,cn=plugins,cn=config

Valid Values: Any valid path to the directory

Default Value: None

Syntax: DirectoryString

Example: nsslapd-changelogdir: /var/slapd-serverID/changelog

nsslapd-changelogmaxage (Max Changelog Age)

Specifies the maximum age of any entry in the change log. The change log contains a record for each directory modification and is used when synchronizing consumer servers. Each record contains a timestamp. Any record with a timestamp that is older than the value specified in this attribute will be removed. If this attribute is absent, there is no age limit on change log records, which is the default behavior as this attribute is not present by default.

Entry DN: cn=Retro Changelog Plugin,cn=plugins,cn=config

Valid Range: 0 (meaning that entries are not removed according to their age) to the maximum 32 bit integer value (2147483647)

Default Value: 0

Syntax: DirectoryString IntegerAgeID where AgeID is “s” for seconds, “m” for minutes, “h” for hours, “d” for days, or “w” for weeks.

Example: nsslapd-changelogmaxage: 30d

182 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Chapter 4

Server Instance File Reference

This chapter provides an overview of the files that are specific to an instance of

Netscape Directory Server (Directory Server)—the files stored under the serverRoot /slapdserverID directory. Having an overview of the files and configuration information stored in each instance of Directory Server should help you understand the file changes or absence of file changes which occur in the course of directory activity. It should also help you to detect errors and intrusion, by indicating what kind of changes to expect, and as a result, what changes are considered abnormal.

This chapter contains the following sections:

• Overview of Directory Server Files (page 183)

• Backup Files (page 185)

• Configuration Files (page 185)

• Database Files (page 185)

• ldif Files (page 186)

• Lock Files (page 187)

• Log Files (page 187)

Overview of Directory Server Files

Directory Server files and command-line scripts are stored under the serverRoot /slapdserverID directory. The only exception is the migrateInstance6 script which is stored under the serverRoot /bin/slapd/admin/bin directory.

183

Overview of Directory Server Files

Code Example 4-1 shows the contents of the serverRoot /slapdserverID directory, where directories are marked with a / and scripts are marked with an * . See

Chapter 8, “Command-Line Scripts” for further information on command-line scripts.

Code Example 4-1

./

../ bak/ bak2db* bak2db.pl* conf_bk/ confbak/ config/ db/ db2bak* db2bak.pl* db2index.pl*

Contents of the serverRoot /slapdserverID directory db2ldif* db2ldif.pl* getpwenc* ldif/ ldif2db* ldif2db.pl* ldif2ldap* locks/ logs/ monitor* ns-accountstatus.pl* ns-activate.pl* ns-inactivate.pl* restart-slapd* restoreconfig* saveconfig* start-slapd* stop-slapd* suffix2instance* tmp/ vlvindex*

To reflect the directory structure under the serverRoot /slapdserverID directory, this chapter is divided into the following sections:

• Backup Files

• Configuration Files

• Database Files

• ldif Files

• Lock Files

• Log Files

Each section describes the file type and contents.

184 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Backup Files

Backup Files

Each Directory Server instance contains the following three directories for storing backup related files:

• bak - contains a directory dated with the time and date of your database backup, for example

2001_02_13_174524/

, which in turn holds your database backup copy.

• confbak

- is the default directory used by the restoreconfig script and the saveconfig scripts. See Chapter 8, “Command-Line Scripts” for further information on Command-line Scripts.

• conf_bk

- contains a backup copy of the dse.ldif

configuration file from the time of installation.

Configuration Files

Each Directory Server instance contains the following directory for storing configuration files:

• config

- contains the configuration files as explained in “Server Configuration

- Overview” on page 27.

Database Files

Each Directory Server instance contains the db directory for storing all the database files. Code Example 4-2 shows a sample listing of the db directory contents.

Code Example 4-2

./

../

__db.001

Contents of sample db directory

__db.002

__db.003

__db.004

__db.005

DBVERSION log.0000000017

NetscapeRoot/ userRoot/

• db.00x

files are used internally by the database and should not be moved, deleted, or modified in any way.

• log.xxxxxxxxxx

files are used to store the transaction logs per database.

Chapter 4 Server Instance File Reference 185

ldif Files

•

DBVERSION

- used for storing the version of the database.

•

NetscapeRoot

- this directory stores the o=NetscapeRoot database created by default at Typical installation.

• userRoot this directory stores the user-defined suffix (user-defined databases) created at Typical installation time, for example dc=example,dc=com

.

Code Example 4-3 shows a sample listing of the

NetscapeRoot directory contents.

Code Example 4-3

./

../ aci.db3

cn.db3

DBVERSION dncomp.db3

Contents of a sample NetscapeRoot subdirectory entrydn.db3

givenName.db3

id2entry.db3

nsUniqueId.db3

numsubordinates.db3

objectclass.db3

parentid.db3

sn.db3

uid.db3

uniquemember.db3

The

NetscapeRoot subdirectories contain an index_name .db3

file for every index currently defined in the database, where index_name is the name of the index. In addition to these index_name .db3

files the

Netscape and userRoot subdirectories contain the following files:

• dncomp.db3

- contains a list of partial DNs enabling you to find IDs.

• entrydn.db3

- contains a list of full DNs enabling you to find IDs.

• id2entry.db3

- contains the actual directory database entries. All other database files can be recreated from this one, if necessary.

• nsuniqueid.db3

- contains a list of Netscape unique IDs enabling you to find

IDs.

• objectclass.db3

- contains a list of IDs which have a particular objectclass.

• parentid.db3

- contains a list of IDs allowing you to find ID of parent.

ldif Files

Each Directory Server instance contains the ld if directory for storing ldif related files. Code Example 4-4 shows a sample listing of the ldif directory contents.

186 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Lock Files

Code Example 4-4 Contents of a sample ldif directory

../ European.ldif Example.ldif Example-roles.ldif

The following list describes the content of each of the ldif files:

•

European.ldif

- contains European character samples.

•

Example.ldif

- is a sample ldif file.

•

Example-roles.ldif

- is a sample ldif file similar to

Example.ldif

except that it uses roles and class of service instead of groups for setting access control and resource limits for Directory Administrators.

Lock Files

Each Directory Server instance contains a locks directory for storing lock related files. Code Example 4-5 shows a sample listing of the locks directory contents.

Code Example 4-5

./ ../

Contents of a sample locks directory exports/ imports/ server/

The lock mechanisms stored under the locks subdirectories exports

, imports

, and server prevent multiple, simultaneous operations conflicting with each other.

The lock mechanisms allow for one server instance to run at a time, with possible multiple export jobs. They also permits one ldif2db import operation at a time

(not ldif2db.p

l since you can run multiple ldif2db.pl

operations at any time) to the exclusion of all export and slapd server operations.

Log Files

Each Directory Server instance contains a logs directory for storing log related files.

Code Example 4-6 shows a sample listing of the logs directory contents.

Chapter 4 Server Instance File Reference 187

Log Files

Code Example 4-6 Contents of a sample logs directory

./ errors.rotationinfo

../ audit.rotationinfo

access access.20010126-120123 audit access.20010130-140221 pid access.20010201-100122 errors slapd.stats

access.20010124-180611 access.rotationinfo

errors.20010124-180607

The following list describes the content of the log related files:

• The content of the access

, audit and error log files is dependent on the log configuration.

• The slapd.stats

file is a memory-mapped file which cannot be read by an editor. It contains data collected by the Directory Server SNMP data collection component. This data is read by the SNMP subagent in response to SNMP attribute queries and is communicated to the SNMP master agent responsible for handling Directory Server SNMP requests.

• The pid is the slapd process identifier.

188 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Chapter 5

Access Log and Connection Code

Reference

Netscape Directory Server (Directory Server) provides you with logs to help you monitor directory activity. Monitoring allows you to quickly detect and remedy failures and where done proactively, anticipate and resolve potential problems before they result in failure or poor performance. To monitor your directory effectively, you need to understand the structure and content of your logs.

Note that this chapter does not provide an exhaustive list of error messages.

However, the information presented in this chapter will serve as a a good starting point for common problems. This chapter includes the following sections:

• Access Log Content (page 189)

• Common Connection Codes (page 201)

• LDAP Result Codes (page 202)

Access Log Content

The Directory Server access log contains detailed information about client connections to the directory. A connection is a sequence of requests from the same client with the following structure:

• Connection record which gives the connection index and the IP address of the client

• Bind record

• Bind result record

• Sequence of operation request/operation result pairs of records (or individual records in the case of connection, closed and abandon records)

189

Access Log Content

• Unbind record

• Closed record

Every line begins with a timestamp -

[21/Apr/2001:11:39:51 -0700]the format of which may vary depending on which platform you are using, where

-0700 indicates the time difference in relation to GMT. Apart from the connection, closed and abandon records, which appear individually, all records appear in pairs, consisting of a request for service record followed by a result record. These two records frequently appear on adjacent lines but this is not always the case.

This section presents the different levels of access logging available with Directory

Server, then describes the default access logging content and ends with a description of the additional access logging level content. This section is divided into the following parts:

• Access Logging Levels

• Default Access Logging Content

• Access Log Content for Additional Access Logging Levels

NOTE Directory Server provides a script, which can analyze access logs to extract usage statistics and count the occurrences of significant events. For details about this script, see “logconv.pl (Log converter),” on page 260.

Access Logging Levels

Different levels of access log logging exist and by changing the value of the nsslapd-accesslog-level configuration attribute (see “nsslapd-accesslog-level,” on page 38), you can select the exact type of logging you require. The default level of logging is level 256, which logs access to an entry but you can choose from the following logging levels, combining more than one level to suit your needs:

0

= No access logging

4 = Logging for internal access operations

256

= Logging for access to an entry

512 = Logging for access to an entry and referrals

131072

= Precise timing of operation duration. This gives microsecond resolution for the Elapsed Time item in the access log.

190 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Access Log Content

For example, if you want to log internal access operations, entry access, and referrals, you would insert a value of 516 (512+4) in the nsslapd-accesslog-level configuration attribute. For further information on other access log configuration attributes, see “Core Server Configuration Attributes

Reference,” on page 35.”

Default Access Logging Content

This section describes the access log content in detail based on the default access logging level extract in Code Example 5-1.

Code Example 5-1 Access Log Extract with Default Access Logging Level (level 256)

[21/Apr/2001:11:39:51 -0700] conn=11 fd=608 slot=608 connection from 207.1.153.51 to 192.18.122.139

[21/Apr/2001:11:39:51 -0700] conn=11 op=0 BIND dn="cn=Directory

Manager" method=128 version=3

[21/Apr/2001:11:39:51 -0700] conn=11 op=0 RESULT err=0 tag=97 nentries=0 etime=0

[21/Apr/2001:11:39:51 -0700] conn=11 op=1 SRCH base="dc=example,dc=com" scope=2 filter="(uid=bjensen)"

[21/Apr/2001:11:39:51 -0700] conn=11 op=1 RESULT err=0 tag=101 nentries=1 etime=1000 notes=U

[21/Apr/2001:11:39:51 -0700] conn=11 op=2 UNBIND

[21/Apr/2001:11:39:51 -0700] conn=11 op=2 fd=608 closed - U1

[21/Apr/2001:11:39:52 -0700] conn=12 fd=634 slot=634 connection from 207.1.153.51 to 192.18.122.139

[21/Apr/2001:11:39:52 -0700] conn=12 op=0 BIND dn="cn=Directory

Manager" method=128 version=3

[21/Apr/2001:11:39:52 -0700] conn=12 op=0 RESULT err=0 tag=97 nentries=0 etime=0

[21/Apr/2001:11:39:52 -0700] conn=12 op=1 SRCH base="dc=example,dc=com" scope=2 filter="(uid=bjensen)"

[21/Apr/2001:11:39:52 -0700] conn=12 op=2 ABANDON targetop=1 msgid=2 nentries=0 etime=0

[21/Apr/2001:11:39:52 -0700] conn=12 op=3 UNBIND

[21/Apr/2001:11:39:52 -0700] conn=12 op=3 fd=634 closed - U1

[21/Apr/2001:11:39:53 -0700] conn=13 fd=659 slot=659 connection from 207.1.153.51 to 192.18.122.139

[21/Apr/2001:11:39:53 -0700] conn=13 op=0 BIND dn="cn=Directory

Manager" method=128 version=3

[21/Apr/2001:11:39:53 -0700] conn=13 op=0 RESULT err=0 tag=97 nentries=0 etime=0

[21/Apr/2001:11:39:53 -0700] conn=13 op=1 EXT oid="2.16.840.1.113730.3.5.3"

[21/Apr/2001:11:39:53 -0700] conn=13 op=1 RESULT err=0 tag=120 nentries=0 etime=0

Chapter 5 Access Log and Connection Code Reference 191

Access Log Content

Code Example 5-1 Access Log Extract with Default Access Logging Level (level 256)

21/Apr/2001:11:39:53 -0700] conn=13 op=2 ADD dn="cn=Sat Apr 21

11:39:51 MET DST 2001, dc=example,dc=com"

[21/Apr/2001:11:39:53 -0700] conn=13 op=2 RESULT err=0 tag=105 nentries=0 etime=0 csn=3b4c8cfb000000030000

[21/Apr/2001:11:39:53 -0700] conn=13 op=3 EXT oid="2.16.840.1.113730.3.5.5"

[21/Apr/2001:11:39:53 -0700] conn=13 op=3 RESULT err=0 tag=120 nentries=0 etime=0

[21/Apr/2001:11:39:53 -0700] conn=13 op=4 UNBIND

[21/Apr/2001:11:39:53 -0700] conn=13 op=4 fd=659 closed - U1

[21/Apr/2001:11:39:55 -0700] conn=14 fd=700 slot=700 connection from 207.1.153.51 to 192.18.122.139

[21/Apr/2001:11:39:55 -0700] conn=14 op=0 BIND dn="" method=sasl version=3 mech=DIGEST-MD5

[21/Apr/2001:11:39:55 -0700] conn=14 op=0 RESULT err=14 tag=97 nentries=0 etime=0, SASL bind in progress

[21/Apr/2001:11:39:55 -0700] conn=14 op=1 BIND dn="uid=jdoe,dc=example,dc=com" method=sasl version=3 mech=DIGEST-MD5

[21/Apr/2001:11:39:55 -0700] conn=14 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=jdoe,dc=example,dc=com"

[21/Apr/2001:11:39:55 -0700] conn=14 op=2 UNBIND

[21/Apr/2001:11:39:53 -0700] conn=14 op=2 fd=700 closed - U1

Connection Number

Every external LDAP request is listed with an incremental connection number, in this case conn=11 or conn=28

, starting at conn=0 immediately after server startup.

Internal LDAP requests are not recorded in the access log by default. To activate the logging of internal access operations, specify access logging level 4 on the nsslapd-accesslog-level configuration attribute (see “nsslapd-accesslog-level,” on page 38).

File Descriptor

Every connection from an external LDAP client to Directory Server requires a file descriptor, or socket descriptor from the operating system in this case fd=608

.

fd=608 indicates that it was file descriptor number 608 out of the total pool of available file descriptors which was used.

Slot Number

The slot number, in this case slot=608

, is a legacy part of the access log which has the same meaning as file descriptor. Ignore this part of the access log.

192 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Access Log Content

Operation Number

To process a given LDAP request, Directory Server will perform the required series of operations. For a given connection, all operation request and operation result pairs are given incremental operation numbers beginning with op=0 to identify the distinct operations being performed. In Code Example 5-1 on page 191 we have op=0 for the bind operation request and result pair, then op=1 for the LDAP search request and result pair, and so on. Should you see op=-1 in the access log it generally means that the LDAP request for this connection was not issued by an external LDAP client, but instead initiated internally.

Method Type

The method number, in this case method=128

, indicates which LDAPv3 bind method was used by the client. There are three possible bind method values:

0

= no authentication

128

= simple bind with user password sasl

= SASL bind using external authentication mechanism

Version Number

The version number, in this case, version=3 , indicates the LDAP version number

(either LDAPv2 or LDAPv3) that the LDAP client used to communicate with the

LDAP server.

Error Number

The error number, in this case err=0 , provides the LDAP result code returned from the LDAP operation performed. The LDAP error number

0 means that the operation was successful. For a more comprehensive list of LDAP result codes see

“LDAP Result Codes,” on page 202.

Tag Number

The tag number, in this case tag=97 , indicates the type of result returned, which is almost always a reflection of the type of operation performed. The tags used are the

BER tags from the LDAP protocol. Commonly used tags include: tag=97 for a result from a client bind operation tag=100 indicates the actual entry for which you were searching tag=101 for a result from a search operation tag=103 for a result from a modify operation

Chapter 5 Access Log and Connection Code Reference 193

Access Log Content tag=105 for a result from an add operation tag=107 for a result from delete operation tag=109 for a result from a moddn operation tag=111 for a result from a compare operation tag=115 indicates a search reference when the entry you perform your search on holds a referral to the entry you require. Search references are expressed in terms of a referral.

tag=120 for a result from an extended operation

NOTE tag=100 and tag=115 are not result tags as such and so it is unlikely that you will see them in your access log.

Number of Entries

The number of entries, in this case nentries=0

, indicates the number of entries that were found matching the LDAP client’s request.

Elapsed Time

Elapsed time, in this case etime=1000

, indicates the amount of time (in seconds) that it took the directory server to perform the LDAP operation. An etime value of

0 means that the operation actually took milliseconds to perform. If you want to have microsecond resolution for this item in the access log, enter a value of 131328

(256+131072) in the nsslapd-accesslog-level configuration attribute.

LDAP Request Type

The LDAP request type indicates the type of LDAP request being issued by the

LDAP client. Possible values are:

SRCH

= search

MOD

= modify

DEL

= delete

ADD = add

MODDN

= moddn

EXT = extended operation

ABANDON

= abandon operation

194 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Access Log Content

Note that if the LDAP request resulted in sorting of entries, then you will see

SORT serialno followed by the number of candidate entries that were sorted. See the bold text in this example:

[04/May/2002:15:51:46 -0700] conn=114 op=68 SORT serialno (1)

The number enclosed in parentheses specifies the number of candidate entries that were sorted, which, in this case is 1.

LDAP Response Type

The LDAP response type indicates the LDAP response being issued by the LDAP client. Possible values are:

RESULT

= result

ENTRY

= entry

REFERRAL = referral or search reference

Unindexed Search Indicator

The unindexed search indicator, notes=U

, indicates that the search performed was unindexed, which means that the database itself had to be directly searched instead of the index file. Unindexed searches occur either when the All IDs Threshold was reached within the index file used for the search, when no index file existed or when the index file was not configured in the way required by the search.

NOTE An unindexed search indicator is often accompanied by a large etime value, as unindexed searches are generally more time consuming.

VLV-Related Entries

When a search involves virtual list views (VLVs), appropriate entries are logged in the access log file. Similar to the other entries, VLV-specific entries show the request and response information side by side, like this:

VLV RequestInformation ResponseInformation where

RequestInformation is of the form: beforeCount:afterCount:index:contentCount and ResponseInformation is of the form: targetPosition:contentCount

(resultCode)

Chapter 5 Access Log and Connection Code Reference 195

Access Log Content

If the client uses a position-by-value VLV request, the format for the first part, the request information, would be: beforeCount:afterCount:value

The example below shows VLV-specific entries in bold:

[07/May/2002:11:43:29 -0700] conn=877 op=8530 SRCH base="(ou=People)" scope=2 filter="(uid=*)"

[07/May/2002:11:43:29 -0700] conn=877 op=8530 SORT uid

[07/May/2002:11:43:29 -0700] conn=877 op=8530 VLV 0:5:0210 10:5397

(0)

[07/May/2002:11:43:29 -0700] conn=877 op=8530 RESULT err=0 tag=101 nentries=1 etime=0

In the above example, the first part, 0:5:0210 , is the VLV request information: beforeCount afterCount

= 0

= 5 value

= 0210 and the second part, 10:5397 (0) , is the VLV response information: targetPosition

= 10 contentCount

(resultCode)

= 5397

= (0)

Search Scope

The entry scope=n defines the scope of the search performed, and n can have a value of 0, 1, or 2.

0

= base search

1

= one-level search

2

= subtree search

For more information about search scopes, see section “Using ldapsearch” in

Appendix B, “Finding Directory Entries” of Netscape Directory Server

Administrator’s Guide.

Extended Operation OID

An extended operation OID, in this case either

EXT oid="2.16.840.1.113730.3.5.3" or EXT oid="2.16.840.1.113730.3.5.5" , provides the OID of the extended operation being performed. Table 5-1 provides the list of LDAPv3 extended operations and their OIDs supported in Directory

Server.

196 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Access Log Content

Table 5-1 LDAPv3 Extended Operations supported by Directory Server

Extended Operation Name Description OID

Directory Server 6.x Start

Replication Request

Directory Server 6.x

Replication Response

Directory Server 6.x End

Replication Request

Directory Server 6.x

Replication Entry Request

Directory Server 6.x Bulk

Import Start

Directory Server 6.x Bulk

Import Finished

Sent by a replication initiator to indicate that a replication session is requested.

Sent by a replication responder in response to a Start Replication

Request Extended Operation or an End Replication Request

Extended Operation.

Sent to indicate that a replication session is to be terminated.

Carries an entry, along with its state information (csn and

UniqueIdentifier) and is used to perform a replica initialization.

Sent by the client to request a bulk import together with the suffix being imported to and sent by the server to indicate that the bulk import may begin.

Sent by the client to signal the end of a bulk import and sent by the server to acknowledge it.

2.16.840.1.113730.3.5.3

2.16.840.1.113730.3.5.4

2.16.840.1.113730.3.5.5

2.16.840.1.113730.3.5.6

2.16.840.1.113730.3.5.7

2.16.840.1.113730.3.5.8

Change Sequence Number

The change sequence number, in this case csn=3b4c8cfb000000030000

, is the replication change sequence number, thus indicating that replication is enabled on this particular naming context.

Abandon Message

The abandon message, in this case, [

21/Apr/2001:11:39:52 -0700

] conn=12 op=2 ABANDON targetop=1 msgid=2 nentries=0 etime=0, indicates that an operation has been aborted, where nentries=0 indicates the number of entries sent before the operation was aborted, etime=0 value indicates how much time (in seconds) had elapsed, and targetop=1 corresponds to an operation value from a previously initiated operation (that appears earlier in the access log).

Chapter 5 Access Log and Connection Code Reference 197

Access Log Content

There are two possible log

ABANDON messages depending on whether the message

ID succeeds in locating which operation was to be aborted or not. If the message ID succeeds in locating the operation (the targetop) then the log will read as above.

However, if the message ID does not succeed in locating the operation or if the operation had already finished prior to the

ABANDON request being sent, then the log will read as follows:

[21/Apr/2001:11:39:52 -0700] conn=12 op=2 ABANDON targetop=NOTFOUND msgid=2 where targetop=NOTFOUND indicates the operation to be aborted was either an unknown operation or already complete.

Message ID

The message ID, in this case msgid=2

, is the LDAP operation identifier, as generated by the LDAP SDK client. The message ID may have a different value to the Netscape Directory Server Operation Number, but identifies the same operation. The message ID is used in the context of an ABANDON operation and tells the user which client operation is being abandoned.

NOTE The Directory Server operation number starts counting at 0 and in the majority of LDAP SDK/client implementations the message ID number starts counting at 1, which explains why the message ID is frequently equal to the Directory Server operation number plus 1.

SASL Multi-Stage Bind Logging

Directory Server 6.x logging for multi-stage binds is now more explicit. Each stage in the bind process is now logged and where appropriate the progress statement

SASL bind in progress is included.

198 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Access Log Content

NOTE Note also that the authenticated DN (the DN used for access control decisions) is now logged in the BIND result line as opposed to the bind request line as was previously the case:

[21/Apr/2001:11:39:55 -0700] conn=14 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=jdoe,dc=example,dc=com"

For SASL binds, the DN value displayed in the BIND request line is not used by the server and as a consequence not relevant. However, given that the authenticated DN is the DN which, for SASL binds, must be used for audit purposes, it is essential that this be clearly logged. Having this authenticated DN logged in the BIND result line avoids any confusion as to which DN is which.

Access Log Content for Additional Access

Logging Levels

This section presents the additional access logging levels available in the Directory

Server access log. In Code Example 5-2 access logging level 4 is enabled which logs internal operations.

Code Example 5-2 Access Log Extract with Internal Access Operations Level (Level 4)

[12/Jul/2001:16:45:46 +0200] conn=Internal op=-1 SRCH base="cn=\22dc=example,dc=com\22,cn=mapping tree,cn=config"scope=0 filter="objectclass=nsMappingTree"attrs="nsslapd-referral" options=persistent

12/Jul/2001:16:45:46 +0200] conn=Internal op=-1 RESULT err=0 tag=48 nentries=1etime=0

[12/Jul/2001:16:45:46 +0200] conn=Internal op=-1 SRCH base="cn=\22dc=example,dc=com\22,cn=mapping tree,cn=config" scope=0 filter="objectclass=nsMappingTree" attrs="nsslapd-state"

[12/Jul/2001:16:45:46 +0200] conn=Internal op=-1 RESULT err=0 tag=48 nentries=1etime=0

Chapter 5 Access Log and Connection Code Reference 199

Access Log Content

Access log level 4 enables logging for internal operations which log the following items in addition to the details of the search being performed, including search base, scope, filter, and requested search attributes.

In Code Example 5-3, access logging level 512 is enabled which logs access to entries and referrals. In this extract, 6 entries and 1 referral are returned in response to the search request, which is shown in bold.

Code Example 5-3 Access Log Extract with Entry Access and Referral Logging Level

(Level 512)

12/Jul/2001:16:43:02 +0200] conn=306 fd=60 slot=60 connection from 127.0.0.1 to

127.0.0.1

[12/Jul/2001:16:43:02 +0200] conn=306 op=0 SRCH base="dc=example,dc=com" scope=2 filter="(description=*)" attrs=ALL

[12/Jul/2001:16:43:02 +0200] conn=306 op=0 ENTRY dn="ou=Special

Users,dc=example,dc=com"

[12/Jul/2001:16:43:02 +0200] conn=306 op=0 ENTRY dn="cn=Accounting Managers,ou=groups,dc=example,dc=com"

[12/Jul/2001:16:43:02 +0200] conn=306 op=0 ENTRY dn="cn=HR

Managers,ou=groups,dc=example,dc=com"

[12/Jul/2001:16:43:02 +0200] conn=306 op=0 ENTRY dn="cn=QA

Managers,ou=groups,dc=example,dc=com"

[12/Jul/2001:16:43:02 +0200] conn=306 op=0 ENTRY dn="cn=PD

Managers,ou=groups,dc=example,dc=com"

[12/Jul/2001:16:43:02 +0200] conn=306 op=0 ENTRY dn="ou=Netscape

Servers,dc=example,dc=com"

[12/Jul/2001:16:43:02 +0200] conn=306 op=0 REFERRAL

Connection Description

The connection description, in this case conn=Internal, indicates that the connection is an internal connection. The operation number op=-1 also indicates that the operation was initiated internally.

Options Description

The options description, in this case options=persistent

, indicates that a persistent search is being performed. Persistent searches can be used as a form of monitoring and configured to return changes to given configurations as and when changes occur.

200 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Common Connection Codes

NOTE Directory Server access log now distinguishes between persistent and regular searches, which was not the case for previous Directory

Server releases.

In Code Example 5-4 both access logging level 512 and 4 are enabled, which results in both internal access operations, as well as entry access and referrals being logged.

Code Example 5-4 Access Log Extract with Internal Access Operation, Entry Access and Referral Logging Levels (Levels 4+512)

[12/Jul/2001:16:45:46 +0200] conn=Internal op=-1 ENTRY dn="cn=\22dc=example,dc=com\22, cn=mapping tree, cn=config"

[12/Jul/2001:16:45:46 +0200] conn=Internal op=-1 ENTRY dn="cn=\22dc=example,dc=com\22, cn=mapping tree, cn=config"

Common Connection Codes

A connection code is a code which is added to the closed log message to provide additional information related to the connection closure. Common connection codes include:

A1 = Client aborts the connection.

B1 = Corrupt BER tag encountered.

If BER tags, which encapsulate data being sent over the wire, are corrupt when they are received, a B1 connection code is logged to the access log. BER tags can be corrupted due to physical layer network problems or bad LDAP client operations, such as an LDAP client aborting before receiving all request results.

B2 = BER tag is longer than the nsslapd-maxbersize attribute value. For further information about this configuration attribute see “nsslapd-maxbersize (Maximum

Message Size),” on page 67.

B3 = Corrupt BER tag encountered

B4 = Server failed to flush data response back to client

P2 = Closed or corrupt connection has been detected.

T1 = Client does not receive a result within the specified idletimeout period

Chapter 5 Access Log and Connection Code Reference 201

LDAP Result Codes

T2 = Server closed connection after ioblocktimeout period was exceeded

U1 = Connection closed by server after client sends an UNBIND request. The server will always close the connection when it sees an UNBIND request.

LDAP Result Codes

LDAP has a set of result codes that it is useful to be familiar with.

12

13

14

16

8

9

10

11

17

18

19

20

21

6

7

4

5

2

3

0

1

Table 5-2 LDAP Result Codes

Result Code Defined Value

SUCCESS

OPERATION_ERROR

PROTOCOL_ERROR

TIME_LIMIT_EXCEEDED

SIZE_LIMIT_EXCEEDED

COMPARE_FALSE

COMPARE_TRUE

AUTH_METHOD_NOT_SUPPORTED

STRONG_AUTH_REQUIRED

LDAP_PARTIAL_RESULTS

REFERRAL (LDAP v3)

ADMIN_LIMIT_EXCEEDED (LDAP v3)

UNAVAILABLE_CRITICAL_EXTENSION (LDAP v3)

CONFIDENTIALITY_REQUIRED (LDAP v3)

SASL_BIND_IN_PROGRESS

NO_SUCH_ATTRIBUTE

UNDEFINED_ATTRIBUTE_TYPE

INAPPROPRIATE_MATCHING

CONSTRAINT_VIOLATION

ATTRIBUTE_OR_VALUE_EXISTS

INVALID_ATTRIBUTE_SYNTAX

202 Netscape Directory Server Configuration, Command, and File Reference • August 2002

LDAP Result Codes

85

89

91

92

69

71

80

81

93

94

95

96

51

52

53

54

36

48

49

50

64

65

66

67

68

Table 5-2 LDAP Result Codes (Continued)

Result Code Defined Value

32

33

34

35

NO_SUCH_OBJECT

ALIAS_PROBLEM

INVALID_DN_SYNTAX

IS_LEAF

ALIAS_DEREFERENCING_PROBLEM

INAPPROPRIATE_AUTHENTICATION

INVALID_CREDENTIALS

INSUFFICIENT_ACCESS_RIGHTS

BUSY

UNAVAILABLE

UNWILLING_TO_PERFORM

LOOP_DEFECT

NAMING_VIOLATION

OBJECT_CLASS_VIOLATION

NOT_ALLOWED_ON_NONLEAF

NOT_ALLOWED_ON_RDN

ENTRY_ALREADY_EXISTS

OBJECT_CLASS_MODS_PROHIBITED

AFFECTS_MULTIPLE_DSAS (LDAP v3)

OTHER

SERVER_DOWN

LDAP_TIMEOUT

PARAM_ERROR

CONNECT_ERROR

LDAP_NOT_SUPPORTED

CONTROL_NOT_FOUND

NO_RESULTS_RETURNED

MORE_RESULTS_TO_RETURN

CLIENT_LOOP

Chapter 5 Access Log and Connection Code Reference 203

LDAP Result Codes

Table 5-2 LDAP Result Codes (Continued)

Result Code Defined Value

97 REFERRAL_LIMIT_EXCEEDED

204 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Chapter 6

Migration from Earlier Versions

This chapter is intended to provide a reference of the information migrated by the migrateInstance6 script. In the case of migration from a 4.x Netscape Directory

Server (Directory Server) to a 6.x Directory Server, it describes the mapping of configuration parameters to configuration attributes and configuration entries in the new Directory Server.

In the case of an upgrade from Directory Server 5.x to Directory Server 6.x, it describes which attributes are migrated automatically by the migration script, and which ones must be set manually.

For information on how to run the migrateInstance6 script, refer to the Netscape

Directory Server Installation Guide.

This chapter contains the following sections:

• Migration from 4.x Directory Server to 6.x (page 205)

• Upgrade from Directory Server 5.x to 6.x (page 210)

Migration from 4.x Directory Server to 6.x

In the Directory Server 4.x architecture, all configuration parameters were stored in text files. In Directory Server 5.x and 6.x, all configuration attributes are stored in

LDAP configuration entries in the dse.ldif

file.

This section describes the mapping of configuration parameters in Directory Server

4.x to the corresponding LDAP configuration entries and attributes in Directory

Server 6.x.

205

Migration from 4.x Directory Server to 6.x

Server Attributes

In Directory Server 4.x, configuration parameters are stored in the slapd.conf

file under the serverRoot /slapdserverID directory.

The corresponding configuration attributes in Directory Server 6.x are stored in the cn=config entry. Table 6-1 shows the mapping of Directory Server 4.x

configuration parameters to Directory Server 6.x configuration attributes.

Table 6-1 Mapping of Legacy Server Parameters to Configuration Attributes

Legacy Configuration Parameter Directory Server Configuration Attribute accesscontrol nsslapd-accesscontrol error-logging-enabled audit-logging-enabled nsslapd-error-logging-enabled nsslapd-audit-logging-enabled logbuffering accesslog-logexpirationtime accesslog-logexpirationtimeunit accesslog-maxlogdiskspace accesslog-minfreediskspace accesslog-logrotationtime accesslog-logrotationtimeunit accesslog-maxlogsize accesslog-MaxNumOfLogsPerDir auditlog-logexpirationtime auditlog-logexpirationtimeunit auditlog-maxlogdiskspace auditlog-minfreediskspace auditlog-logrotationtime auditlog-logrotationtimeunit auditlog-maxlogsize auditlog-MaxNumOfLogsPerDir certmap-basedn enquote_sup_oc nsslapd-accesslog-buffering nsslapd-accesslog-logexpirationtime nsslapd-accesslog-logexpirationtimeunit nsslapd-accesslog-logmaxdiskspace nsslapd-accesslog-minfreediskspace nsslapd-accesslog-logrotationtime nsslapd-accesslog-logrotationtimeunit nsslapd-accesslog-maxlogsize nsslapd-accesslog-maxlogsperdir nsslapd-auditlog-logexpirationtime nsslapd-auditlog-logexpirationtimeunit nsslapd-auditlog-logmaxdiskspace nsslapd-auditlog-minfreediskspace nsslapd-auditlog-logrotationtime nsslapd-auditlog-logrotationtimeunit nsslapd-auditlog-maxlogsize nsslapd-auditlog-maxlogsperdir nsslapd-certmap-basedn nsslapd-enquote_sup_oc

206 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Migration from 4.x Directory Server to 6.x

Table 6-1 Mapping of Legacy Server Parameters to Configuration Attributes (Continued)

Legacy Configuration Parameter Directory Server Configuration Attribute loglevel nsslapd-error-loglevel errorlog-logexpirationtime errorlog-logexpirationtimeunit nsslapd-errorlog-logexpirationtime nsslapd-errorlog-logexpirationtimeunit errorlog-maxlogdiskspace errorlog-minfreediskspace errorlog-logrotationtime errorlog-logrotationtimeunit errorlog-maxlogsize nsslapd-errorlog-logmaxdiskspace nsslapd-errorlog-logminfreediskspace nsslapd-errorlog-logrotationtime nsslapd-errorlog-logrotationtimeunit nsslapd-errorlog-maxlogsize errorlog-maxlogsperdir idletimeout ioblocktimeout lastmod listenhost maxdescriptors

NOTHING

NOTHING referral reservedescriptors rootpwstoragescheme schemacheck secure-port security sizelimit

SSL3ciphers timelimit pw_change pw_syntax pw_exp pw_history nsslapd-errorlog-maxlogsperdir nsslapd-idletimeout nsslapd-ioblocktimeout nsslapd-ioblocktimeout nsslapd-listenhost nsslapd-maxdescriptors nsslapd-depends-on-named nsslapd-depends-on-type nsslapd-referral nsslapd-reservedescriptors nsslapd-rootpwstoragescheme nsslapd-schemacheck nsslapd-securePort nsslapd-security nsslapd-sizelimit nsslapd-SSL3ciphers nsslapd-timelimit passwordChange passwordCheckSyntax passwordExp passwordHistory

Chapter 6 Migration from Earlier Versions 207

Migration from 4.x Directory Server to 6.x

Table 6-1 Mapping of Legacy Server Parameters to Configuration Attributes (Continued)

Legacy Configuration Parameter Directory Server Configuration Attribute pw_inhistory passwordinHistory pw_lockout pw_lockduration passwordLockout passwordLockoutDuration pw_maxage pw_maxfailure pw_minage pw_minlength pw_must_change passwordMaxAge passwordMaxFailure passwordMinAge passwordMinLength passwordMustChange pw_reset_failurecount pw_storagescheme pw_unlock pw_warning localhost localuser port rootdn rootpw accesslog accesslog-level auditfile errorlog instancedir maxbersize nagle result_tweak return_exact_case threadnumber maxthreadsperconn passwordResetFailureCount passwordStorageScheme passwordUnlock passwordWarning nsslapd-localhost nsslapd-localuser nsslapd-port nsslapd-rootdn nsslapd-rootpw nsslapd-accesslog nsslapd-accesslog-level nsslapd-auditlog nsslapd-errorlog nsslapd-instancedir nsslapd-maxbersize nsslapd-nagle nsslapd-result_tweak nsslapd-return_exact_case nsslapd-threadnumber maxthreadsperconn

208 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Migration from 4.x Directory Server to 6.x

Database Attributes

In Directory Server 4.x, database parameters are stored in the slapd.ldbm.conf

file under the serverRoot /slapdserverID directory.

Because one instance of Directory Server 5.x or 6.x can manage several databases, the corresponding attributes in Directory Server 5.x or 6.x are stored in a general entry for all databases ( cn=config,cn=ldbm database,cn=plugins,cn=config

), or in an entry specific to a particular database, of the form cn= database instance nam e,cn=ldbm database,cn=config

.

Table 6-2 shows the mapping of general database configuration parameters between Directory Server 4.x and Directory Server 5.x or 6.x. Table 6-3 shows the mapping of database-specific parameters between Directory Server 4.x and

Directory Server 5.x or 6.x.

Table 6-2 Mapping of Legacy Database Parameters to Configuration Attributes (general)

Legacy Configuration Parameter Directory Server Configuration Attribute allidthreshold nsslapd-allidthreshold lookthroughlimit mode dbcachesize database nsslapd-lookthroughlimit nsslapd-mode nsslapd-dbcachesize

OBSOLETE (used to specify database type)

Table 6-3 Mapping of Legacy Database Parameters to Configuration Attributes

(database-specific)

Legacy Configuration Parameter Directory Server Configuration Attribute cachesize nsslapd-cachesize readonly nsslapd-readonly directory nsslapd-directory

Chapter 6 Migration from Earlier Versions 209

Upgrade from Directory Server 5.x to 6.x

Upgrade from Directory Server 5.x to 6.x

In Directory Server 5.x and 6.x, the configuration information is stored in the same way. This section explains which configuration attributes are automatically migrated by the migrateInstance6 script, and which ones are not. Attributes which are not automatically migrated are either configured during the installation process for the new Directory Server, or need to be configured manually for security reasons after the initial set up.

General Server Configuration Attributes

Table 6-4 lists the configuration attributes stored in the cn=config entry that are automatically migrated when you run the migrateInstance6 script.

Table 6-5 lists the configuration attributes store in the cn=config entry that are not automatically migrated when you run the migrateInstance6 script. Attributes that are not automatically migrated are either configured during the installation process for the new Directory Server, or need to be configured manually. The reason for not migrating an attribute is stated in the table.

Table 6-4 Attributes in cn=config Automatically Migrated nsslapd-accesscontrol nsslapd-errorlog-logging-enabled nsslapd-accesslog-logging-enabled nsslapd-auditlog-logging-enabled nsslapd-accesslog-level nsslapd-accesslog-logbuffering nsslapd-accesslog-logexpirationtime nsslapd-accesslog-logexpirationtimeunit nsslapd-accesslog-logmaxdiskspace nsslapd-accesslog-logminfreediskspace nsslapd-accesslog-logrotationtime nsslapd-accesslog-logrotationtimeunit nsslapd-accesslog-maxlogsize nsslapd-accesslog-maxlogsperdir

210 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Upgrade from Directory Server 5.x to 6.x

Table 6-4 Attributes in cn=config Automatically Migrated (Continued) nsslapd-attribute_name_exceptions nsslapd-auditlog-logexpirationtime nsslapd-auditlog-logexpirationtimeunit nsslapd-auditlog-logmaxdiskspace nsslapd-auditlog-logminfreediskspace nsslapd-auditlog-logrotationtime nsslapd-auditlog-logrotationtimeunit nsslapd-auditlog-maxlogsize nsslapd-auditlog-maxlogsperdir nsslapd-certmap-basedn nsslapd-ds4-compatible-schema nsslapd-enquote_sup_oc nsslapd-errorlog-level nsslapd-errorlog-logexpirationtime nsslapd-errorlog-logexpirationtimeunit nsslapd-errorlog-logmaxdiskspace nsslapd-errorlog-logminfreediskspace nsslapd-errorlog-logrotationtime nsslapd-errorlog-logrotationtimeunit nsslapd-errorlog-maxlogsize nsslapd-errorlog-maxlogsperdir nsslapd-groupevalnestlevel nsslapd-idletimeout nsslapd-ioblocktimeout nsslapd-lastmod nsslapd-listenhost nsslapd-maxdescriptors (Not applicable on NT and AIX platforms) nsslapd-nagle nsslapd-readonly nsslapd-referralmode

Chapter 6 Migration from Earlier Versions 211

Upgrade from Directory Server 5.x to 6.x

Table 6-4 Attributes in cn=config Automatically Migrated (Continued) nsslapd-plugin-depends-on-name nsslapd-plugin-depends-on-type nsslapd-referral nsslapd-reservedescriptors (Not applicable on NT and AIX platforms) nsslapd-rootpwstoragescheme nsslapd-schemacheck nsslapd-securePort nsslapd-security nsslapd-sizelimit nsslapd-SSL3ciphers nsslapd-timelimit passwordChange passwordCheckSyntax passwordExp passwordExpirationTime passwordHistory passwordInHistory passwordLockout passwordLockoutDuration passwordMaxAge passwordMaxFailure passwordMinAge passwordMinLength passwordMustChange passwordResetFailureCount passwordStorageScheme passwordUnlock passwordWarning

212 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Upgrade from Directory Server 5.x to 6.x

Table 6-5 Attributes in cn=config not Migrated

Attribute Name Reason for not Migrating Automatically nsslapd-localhost nsslapd-localuser

Already set up.

Configured during the installation process.

nsslapd-port nsslapd-rootdn nsslapd-rootpw nsslapd-accesslog nsslapd-accesslog-list nsslapd-auditlog nsslapd-accesslog-level nsslapd-errorlog nsslapd-errorlog-list nsslapd-instancedir nsslapd-maxbersize

Configured during the installation process.

Configured during the installation process.

Configured during the installation process.

Path name to the log that records database access. It is set up during installation.

Read-only attribute.

Path name to the log that records changes made to the directory database. It is set up during installation.

Read-only attribute.

Path name to the log that records error messages generated by Directory Server. It is set up during installation.

Read-only attribute.

Configured during the installation process.

Do not change the value of this attribute unless told to do so by Netscape Technical Support.

nsslapd-plug-in nsslapd-result-tweak nsslapd-return-exact-case nsslapd-threadnumber nsslapd-maxthreadsperconn

Reserved for future use. Do not change or remove.

Doing so can have unpredictable results do not modify unless you have legacy client applications that can check the case of attribute names in results returned from the server.

This attribute is not available from the Directory

Server Console.

This attribute corresponds to a system parameter.

Chapter 6 Migration from Earlier Versions 213

Upgrade from Directory Server 5.x to 6.x

Database Attributes

All general database configuration attributes are automatically migrated. These attributes are stored in the entry cn=config,cn=ldbm database, cn=plugins,cn=config and are listed in Table 6-6.

Database-specific attributes are stored in entries of the form cn= database instance nam e,cn=ldbm database,cn=config

. The attributes that are migrated are listed in

Table 6-7, the ones that are not migrated are listed in Table 6-8.

Table 6-6 General Database Attributes Automatically Migrated nsslapd-allidthreshold nsslapd-lookthroughlimit nsslapd-mode nsslapd-dbcachesize nsslapd-cache-autosize nsslapd-cache-autosize-split nsslapd-db-transaction-logging

Table 6-7 Database-Specific Attributes Automatically Migrated nsslapd-cachesize nsslapd-cachememsize nsslapd-readonly nsslapd-require-index

Table 6-8 Database-Specific Attributes not Migrated

Attribute Name Reason for not Migrating Automatically nsslapd-directory nsslapd-db-logdirectory

Set up automatically during installation.

Set up automatically during installation.

214 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Upgrade from Directory Server 5.x to 6.x

Table 6-8 Database-Specific Attributes not Migrated (Continued)

Attribute Name Reason for not Migrating Automatically nsslapd-db-checkpoint-interval nsslapd-db-durable-transactions nsslapd-db-home-directory

This attribute is provided only for system modification/diagnostics and should be changed only under guidance from Netscape Technical

Support. Inconsistent settings of this attribute might cause Directory Server crashes.

This attribute is provided only for system modification/diagnostics and should be changed only under guidance from Netscape Technical

Support. Inconsistent settings of this attribute might cause Directory Server crashes.

If you have several directory servers running on the same machine, the value of this attribute must be different for each instance of the directory server. Therefore, it needs to be configured manually.

Database Link Attributes

All database link configuration attributes are automatically migrated. Table 6-9 lists the configuration attributes that are common to all database links. These attributes are stored in the entry cn=config, cn=chaining database, cn=plugins, cn=config

.

Table 6-10 lists the configuration attributes for a default instance of a database link.

hese attributes are stored in the entry cn=default instance config, cn=chaining database, cn=plugins, cn=config

.

Table 6-9 General Database Link Attributes Automatically Migrated nsActivechainingComponents nsTransmittedControls

Table 6-10 Default Instance Database Link Attributes Automatically Migrated nsAbandonedSearchCheckInterval nsBindConnectionsLimit

Chapter 6 Migration from Earlier Versions 215

Upgrade from Directory Server 5.x to 6.x

Table 6-10 Default Instance Database Link Attributes Automatically Migrated nsBindTimeout nsBindRetryLimit nsHopLimit nsmaxresponsedelay nsmaxtestresponsedelay nsCheckLocalACI nsConcurrentBindLimit nsConcurrentOperationsLimit nsConnectionLife nsOperationConnectionslimit nsProxiedAuthorization nsReferralOnScopedSearch nsslapd-sizelimit nsslapd-timelimit

SNMP Attributes

All SNMP configuration attributes are automatically migrated. These attributes are stored in the entry cn=SNMP,cn=config , and are listed in Table 6-11.

Table 6-11 SNMP Attributes Automatically Migrated nssnmpenabled nssnmporganization nssnmplocation nssnmpcontact nssnmpdescription nssnmpmasterhost nssnmpmasterport

216 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Chapter 7

Command-Line Utilities

This chapter contains reference information on command-line utilities provided by

Netscape Directory Server (Directory Server). These command-line utilities make it easy to perform administration tasks on the Directory Server.

This chapter is divided into the following sections:

• Finding and Executing Command-Line Utilities (page 217)

• Command-Line Utilities Quick Reference (page 218)

• Using Special Characters (page 219)

• ldapsearch (page 220)

• ldapmodify (page 225)

• ldapdelete (page 230)

• ldif (page 233)

Finding and Executing Command-Line Utilities

The ldapsearch

, ldapmodify

, and ldapdelete command-line utilities are stored in the following directory: serverRoot /shared/bin

The ldif and dbscan command-line utilities are stored in the following directory: serverRoot /bin/slapd/server

217

Command-Line Utilities Quick Reference

NOTE In order to execute the command-line utilities, you must change to the directory where the command-line utilities are stored. Although it is possible to set command-path and library-path variables to execute the utilities, it is not recommended because you run the risk, particularly when you have more than one server version installed, of disrupting the correct execution of other utilities. There’s also the risk of compromising the security of the system.

The same procedure also applies to the Perl scripts discussed in

Chapter 8, “Command-Line Scripts.”

Command-Line Utilities Quick Reference

Table 7-1 provides a summary of the command-line utilites provided for Directory

Server.

Directory Server LDAP utilities are not to be confused with the Solaris LDAP utilities. If you have Directory Server installed on a Solaris machine, the LDAP utility manpages you can access are for the Solaris LDAP utilities and not for the

Directory Server LDAP utilities, ldapsearch

, ldapmodify

, ldapdelete

, and ldapadd

.

Table 7-1 Commonly Used Command-Line Utilities

Command-Line Utility Description ldapsearch ldapmodify ldapdelete ldif dbscan

Allows you to search the directory. Returns search results in

LDIF format. For details on this tool, see Appendix B,

“Finding Directory Entries” in the Netscape Directory Server

Administrator’s Guide.

Allows you to add, delete, modify, or rename entries. All operations are specified using LDIF update statements. For details on this tool, see “Adding and Modifying Entries Using ldapmodify”.

Allows you to delete entries in the directory. For information on using this utility, see “Deleting Entries Using ldapdelete”.

Automatically formats LDIF files for you, and creates base 64 encoded attribute values. For details on this tool, see “Base 64

Encoding”.

Analyzes and extracts information from a Directory Server database file.

218 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Using Special Characters

Using Special Characters

When using the ldapsearch command-line utility, you may need to specify values that contain characters that have special meaning to the command-line interpreter

(such as space [ ], asterisk [*], backslash [\], and so forth). When this situation occurs, enclose the value in quotation marks (""). For example:

-D "cn=Barbara Jensen, ou=Product Development, dc=example,dc=com"

Depending on which command-line interpreter you use, you should use either single or double quotation marks for this purpose. Refer to your operating-system documentation for more information.

In addition, if you are using DNs that contain commas in values, you must escape the commas with a backslash. For example:

-D "cn=Patricia Fuentes, ou=people, dc=example,dc=Bolivia\, S.A."

Syntax for Using Special Characters

When you use ldapsearch , you must enter the command using the following format: ldapsearch -b basedn filter [ optional_options ] [ optional_list of_attributes ] where

• optional_options is a series of command line options. These must be specified before the search filter, if any.

• filter is an LDAP search filter as described in Netscape Directory Server

Administrator’s Guide. Do not specify a search filter if you are supplying search filters in a file using the

-f option.

• optional_list_of_attributes are space-separated attributes that reduce the scope of the attributes returned in the search results. This list of attributes must appear after the search filter. For a usage example, see the Netscape Directory Server

Administrator’s Guide. If you do not specify a list of attributes, the search returns values for all attributes permitted by the access control set in the directory with the exception of operational attributes.

If you want operational attributes returned as a result of a search operation, you must explicitly specify them in the search command. To retrieve regular attributes in addition to explicitly specified operational attributes, specify “*” in addition to the operational attributes.

Chapter 7 Command-Line Utilities 219

ldapsearch

ldapsearch

ldapsearch is a configurable utility that enables you to locate and retrieve directory entries via LDAP. This utility opens a connection to the specified server using the specified distinguished name and password, and locates entries based on a specified search filter. Search scopes can include a single entry, an entry’s immediate subentries, or an entire tree or subtree. Search results are returned in

LDIF format.

ldapsearch Options

The following three sections list the options which can be specified with ldapsearch . The first section lists those options most commonly used, the second section lists SSL options, and the third lists less common options.

Commonly Used ldapsearch Options

The following lists the most commonly used ldapsearch command-line options. If you specify a value that contains a space [ ], the value should be surrounded by double quotation marks, for example,

-b "ou=groups, dc=example,dc=com"

.

Option

-b

-D

Description

Specifies the starting point for the search. The value specified here must be a distinguished name that currently exists in the database. This option is optional if the LDAP_BASEDN environment variable has been set to a base DN.

The value specified in this option should be provided in double quotation marks. For example:

-b "cn=Barbara Jensen, ou=Product Development, dc=example,dc=com" .

The root DSE entry is a special entry that contains a list of all the suffixes supported by the local directory. To search this entry you must supply a search base of "", a search scope of base and a filter of "objectclass=*" .

For example:

-b "" -s base "objectclass=*"

Specifies the distinguished name with which to authenticate to the server. This option is optional if anonymous access is supported by your server. If specified, this value must be a DN recognized by the Directory Server, and it must also have the authority to search for the entries. For example:

D "uid=bjensen, dc=example,dc=com" .

220 Netscape Directory Server Configuration, Command, and File Reference • August 2002

ldapsearch

-p

-s

Option

-h

-l

-w

-x

-z

Description

Specifies the hostname or IP address of the machine on which the Directory

Server is installed. If you do not specify a host, ldapsearch uses the localhost. For example, -h mozilla .

Specifies the maximum number of seconds to wait for a search request to complete. Regardless of the value specified here, ldapsearch will never wait longer than is allowed by the server’s nsslapd-timelimit attribute. For example, -l 300 . The default value for the nsslapd-timelimit attribute is

3,600 seconds. See “nsslapd-timelimit (Time Limit),” on page 80 for more information.

Specifies the TCP port number that the Directory Server uses. For example,

-p 1049 . The default is 389. If -Z is used, the default is 636.

Specifies the scope of the search. The scope can be one of the following: base —Search only the entry specified in the -b option or defined by the

LDAP_BASEDN environment variable.

one —Search only the immediate children of the entry specified in the -b option. Only the children are searched; the actual entry specified in the -b option is not searched.

sub —Search the entry specified in the -b option and all of its descendants.

That is, perform a subtree search starting at the point identified in the -b option. This is the default.

Specifies the password associated with the distinguished name that is specified in the -D option. If you do not specify this option, anonymous access is used. For example, -w diner892 .

Specifies that the search results are sorted on the server rather than on the client. This is useful if you want to sort according to a matching rule, as with an international search. In general, it is faster to sort on the server rather than on the client.

Specifies the maximum number of entries to return in response to a search request. For example, -z 1000 . Normally, regardless of the value specified here, ldapsearch never returns more entries than the number allowed by the server’s nsslapd-sizelimit attribute. However, you can override this limitation by binding as the root DN when using this command-line argument. This is because, when you bind as the root DN, this option defaults to zero (0). The default value for the nsslapd-sizelimit attribute is 2,000 entries. See “nsslapd-sizelimit (Size Limit),” on page 78 for more information.

Chapter 7 Command-Line Utilities 221

ldapsearch

SSL Options

You can use the following command-line options to specify that ldapsearch use

LDAPS when communicating with your SSL-enabled Directory Server. You also use these options if you want to use certificate-based authentication. These options are valid only when LDAPS has been turned on and configured for your Directory

Server. For information on certificate-based authentication and creating a certificate database for use with LDAP clients see Chapter 11, “Managing SSL” in the Netscape Directory Server Administrator’s Guide.

In addition to the standard ldapsearch options, to run an ldapsearch command using SSL, you must specify the following:

•

-p to specify Directory Server’s encrypted port

•

-Z to specify SSL

•

-P to specify your certificate database’s filename and path

•

-N to specify your certificate name

•

-K to specify your private key database’s filename and path

• -W to specify the password for your private key database

Option

-K

-m

-N

Description

Specifies the filename and path of the private key database of the client.

In previous releases of Directory Server, except for when doing certificate-based authentication, it wasn’t necessary to specify the path to the key database (using the -K option). In this release of Directory Server, irrespective of the type of authentication being performed, you must specify the -K option when the key database has a different name than key3.db

or when the key database is not under the same directory as the certificate database, the cert7.db

file (the path for which is specified with the -P option).

Specifies the path to the security module database. For example,

/usr/netscape/servers/admin-serv/config/secmodule.db

. You only need to specify this option if the security module database is in a different directory from the certificate database itself.

Specifies the certificate name to use for certificate-based client authentication.

For example, -N "Server-Cert" . If this option is specified, then the -Z , -P , and -W options are required. Also, if this option is specified, then the -D and

-w options must not be specified, or certificate-based authentication will not occur and the bind operation will use the authentication credentials specified on -D and -w .

222 Netscape Directory Server Configuration, Command, and File Reference • August 2002

ldapsearch

Option

-P

-W

-Z

Description

Specifies the path and filename of the certificate database of the client. This option is used only with the -Z option. When used on a machine where an

SSL-enabled version of Netscape Communicator is configured, the path specified on this option can be that of the certificate database for

Communicator. For example, -P c:\security\cert.db

. The client security files can also be stored on the Directory Server in the serverRoot /alias directory. In this case, the -P option would call out a path and filename similar to the following:

-P c:\netscape\servers\alias\client-cert.db

Specifies the password for the private key database identified in the -P option.

For example: -W serverpassword

Specifies that SSL is to be used for the search request.

Additional ldapsearch Options

To further customize a search, use the following optional options:

Option

-A

-a

-B

-F

-f

Description

Specifies that the search retrieve the attributes only, not the attribute values.

This option is useful if you just want to determine if an attribute is present for an entry and you are not interested in the value.

Specifies how alias dereferencing is completed. Value can be “never,”

“always,” “search,” or “find.” Default value is “never.”

Print binary values. Specifies that binary values stored in the directory should be printed in the search output. If you use -B and -o together, then the binary data will not use base 64 encoding.

Specify a different separator. This option can only be used with -o . This option allows you to specify a separator other than a colon “:” to separate an attribute name from the corresponding value. For example, -F +

Specifies the file containing the search filter(s) to be used in the search. For example, -f search_filters . Omit this option if you want to supply a search filter directly to the command line. For more information about search filters, see Appendix B, “Finding Directory Entries” in the Netscape Directory

Server Administrator’s Guide.

Chapter 7 Command-Line Utilities 223

ldapsearch

Option

-G

-i

-k

-M

-n

-O

Description

Virtual list search. Allows you to specify the number of entries before or after the search target, and the index or value of the first entry returned. For example, if you are sorting by surname, -G 20:30:johnson returns the first entry with a surname equal to or less than johnson, in addition to 20 entries that come before it and 30 entries that come after it. If there are fewer matching entries in the directory than the “before” or “after” number requested by the search, all available entries before/after the search target that match the search criteria are returned.

Character set. Specifies the character set to use for command line input. The default is the character set specified in the LANG environment variable. You might want to use this option to perform the conversion from the specified character set to UTF8, thus overriding the environment variable setting.

Using this argument, you can input the bind DN, base DN, and the search filter pattern in the specified character set.

ldapsearch converts the input from these arguments before it processes the search request. For example, -i no indicates that the bind DN, base DN, and search filter are provided in

Norwegian.

This argument only affects the command-line input, that is, if you specify a file containing a search filter (with the -f option) ldapsearch will not convert the data in the file.

Conversion routines directory. If you want to specify a sort language that is not supported by default in this release of the Directory Server, for example, one obtained from a later release of the LDAP SDK, you need to supply the directory in which you store the conversion routines. You can view the list of supported languages in Table B.1 in the Netscape Directory Server

Administrator’s Guide.

When performing the search, the server looks in the current working directory. However, if the conversion routines are not in the current working directory you need to specify this option when using ldapsearch . The conversion routines directory is located by default in

<NSHOME>/<ServerID>/lib/nls .

Manage smart referrals. Causes the server not to return the smart referral contained on the entry, but to instead return the actual entry containing the referral. Use this option if you are attempting to search for entries that contain smart referrals. For more information about smart referrals see Chapter 2,

“Configuring Directory Databases” in the Netscape Directory Server

Administrator’s Guide.

Specifies that the search is not to be actually performed, but that ldapsearch is to show what it would do with the specified input.

Specifies the maximum number of referral hops ldapsearch should automatically follow. For example, -O 2 .

224 Netscape Directory Server Configuration, Command, and File Reference • August 2002

ldapmodify

Option

-o

-R

-S

-T

-t

-u

-v

-V

-y

Description

Specifies that the output for individual values be formatted without line breaks and that equal signs “=” be used to separate attribute names from values. This argument produces output in a non-LDIF format.

Specifies that referrals are not to be followed automatically. By default, referrals are followed automatically.

Specifies the attribute to use as the sort criteria. For example, -S sn . You can use multiple -S arguments if you want to further define the sort order. In the following example, the search results will be sorted first by surname and then by given name:

-S sn -S givenname

The default is not to sort the returned entries.

Specifies that no line breaks should be used within individual values in the search results.

Specifies that the results be written to a set of temporary files. When you use this option, each attribute value is placed in a separate file within the system temporary directory. No base64 encoding is performed on the values, regardless of the content.

Specifies that the user-friendly form of the distinguished name be used in the output.

Specifies that the utility is to run in verbose mode.

Specifies the LDAP version number to be used on the search. For example, -V

2 . LDAP v3 is the default. You cannot perform an LDAP v3 search against a

Directory Server that only supports LDAP v2. Only use LDAP v2 when connecting to LDAP v2 servers, such as Directory Server 1.x.

Specifies the proxy DN to use for the search. This argument is provided for testing purposes. For more information about proxied authorization, see

Chapter 6, “Managing Access Control” in the Netscape Directory Server

Administrator’s Guide.

ldapmodify

ldapmodify enables you to make changes to directory entries via LDAP.

Syntax

ldapmodify [ optional_options ]

Chapter 7 Command-Line Utilities 225

ldapmodify ldapmodify -D binddn [-w passwd ] [-acmnrvFR] [-d debug_level ] [-h host]

[-p port] [-M auth_mechanism ] [-Z] [-V version ] [ -f file | [-l number_of_ldap_connections ] < entryfile ]

ldapmodify Options

The following three sections list the options that can be specified with ldapmodify

.

The first section lists those options most commonly used, the second section lists

SSL options, and the third lists less common options.

NOTE On Windows, avoid using stdin and stdout with the ldapmodify command-line utility; using stdin and stdout with the ldapmodify command-line utility may not work well, particularly with non-ASCII data. It is recommended that you always use the

-f argument to specify the file containing the LDIF update statements

(for example,

-f new_file

) as this prevents the statements being read from stdin .

Commonly Used ldapmodify Options

To modify an entry or entries in an existing directory, use the ldapmodify command-line utility with the following options:

Option

-a

-B

-D

-f

Description

Allows you to add LDIF entries to the directory without requiring the changetype:add LDIF update statement. This provides a simplified method of adding entries to the directory. This option also allows you to directly add a file created by ldapsearch .

Specifies the suffix under which the new entries will be added.

Specifies the distinguished name with which to authenticate to the server. The value must be a DN recognized by the Directory Server, and it must also have the authority to modify the entries. For example, -D "uid=bjensen, dc=example,dc=com" . You cannot use this option with the -N option.

Optional option that specifies the file containing the LDIF update statements used to define the directory modifications. For example, -f modify_statements . If you do not supply this option, the update statements are read from stdin . For information on supplying LDIF update statements from the command line, see Chapter 2, “Creating Directory

Entries” in the Netscape Directory Server Administrator’s Guide.

226 Netscape Directory Server Configuration, Command, and File Reference • August 2002

ldapmodify

Option

-h

-p

-q

-w

-R

-v

-V

-y

Description

Specifies the name of the host on which the server is running. For example, -h cyclops .

Specifies the port number that the server uses. For example, -p 1049 . The default is 389. If -Z is used, the default is 636.

Causes each add to be performed silently as opposed to being echoed to the screen individually.

Specifies the password associated with the distinguished name specified in the

-D option. For example, -w mypassword .

Specifies that referrals are not to be followed automatically. By default, the server follows referrals.

Specifies that the utility is to run in verbose mode.

Specifies the LDAP version number to be used on the operation. For example,

-V 2 . LDAP v3 is the default. You cannot perform an LDAP v3 operation against a Directory Server that only supports LDAP v2.

Specifies the proxy DN to use for the delete operation. This argument is provided for testing purposes. For more information about proxied authorization, see Chapter 6, “Managing Access Control” in the Netscape

Directory Server Administrator’s Guide.

SSL Options

You can use the following command-line options to specify that ldapmodify is to use LDAP over SSL (LDAPS) when communicating with your Directory Server.

LDAPS encrypts data during transit. You also use these options if you want to use certificate-based authentication. These options are valid only when SSL has been turned on and configured for your Directory Server. For more information on certificate-based authentication and on creating a certificate database for use with

LDAP clients, see Chapter 11, “Managing SSL” in the Netscape Directory Server

Administrator’s Guide.

Make sure that you specify your Directory Server’s encrypted port when you use these options:

Chapter 7 Command-Line Utilities 227

ldapmodify

Option

-K

-N

-P

-W

-Z

Description

Specifies the filename and path of the private key database of the client.

In previous releases of Directory Server, except for when doing certificate-based authentication, it wasn’t necessary to specify the path to the key database (using the -K option). In this release of Directory Server, irrespective of the type of authentication being performed, you must specify the -K option when the key database has a different name than key3.db

or when the key database is not under the same directory as the certificate database, the cert7.db

file (the path for which is specified with the -P option).

Specifies the certificate name to use for certificate-based client authentication.

For example, -N Server-Cert . If this option is specified, then the -Z , and

-W options are required. Also, if this option is specified, then the -D and -w options must not be specified, or certificate-based authentication will not occur and the bind operation will use the authentication credentials specified on -D and -w .

Specifies the path and filename of the security files for the client. This option is used only with the -Z option. When used on a machine where a SSL-enabled web browser is configured, the path specified on this option can be pointed to the security database for the web browser. For example, -P c:\security\cert.db

. You can also store the client security files on the

Directory Server in the serverRoot /alias directory. In this case, the -P option calls out a path and filename similar to the following:

-P c:\netscape\servers\alias\client-cert.db

Specifies the password for the certificate database identified on the -P option.

For example, -W serverpassword .

Specifies that SSL is to be used for the directory request.

Additional ldapmodify Options

The following options offer additional functionality:

228 Netscape Directory Server Configuration, Command, and File Reference • August 2002

ldapmodify

-O

-R

-v

Option

-b

-c

-H

-M

-n

Description

Causes the utility to check every attribute value to determine whether the value is a valid file reference. If the value is a valid file reference, then the content of the referenced file is used as the attribute value. This is often used for specifying a path to a file containing binary data, such as JPEG. For example, if you wanted to add a jpegPhoto attribute, then specify the -b option on the ldapmodify call. In the LDIF you provide to ldapmodify , include something like the following: jpegPhoto: /tmp/photo.jpeg

ldapmodify reads the contents of the photo.jpeg

file into the jpegPhoto attribute that you are placing on the entry.

On Windows, the format of this option is exactly the same (including the forward slashes, except that you can specify a drive letter). For example: jpegPhoto: c:\tmp\photo.jpeg

As an alternative to the -b option, you can you can use the :< URL specifier notation, which is in fact simpler to use. For example: j pegphoto:< file:///tmp/myphoto.jpg

Although the official notation requires three /// , the use of one / is tolerated.

For further information on the LDIF format see Chapter 4, “Managing

Directory Entries” in the Netscape Directory Server Administrator’s Guide.

Specifies that the utility run in continuous operation mode. Errors are reported, but the utility continues with modifications. The default is to quit after reporting an error.

Lists all available ldapmodify options.

Manage smart referrals. Causes the server not to return the smart referral contained on the entry, but to instead apply the modification request directly to the entry. Use this option if you are attempting to add, change, or delete a directory entry that contains a smart referral. For more information about smart referrals, see Chapter 3, “Configuring Directory Databases” in the

Netscape Directory Server Administrator’s Guide.

Specifies that the entries are not to be actually modified, but that ldapmodify is to show what it would do with the specified input.

Specifies the maximum number of referral hops to follow. For example, -O 2 .

Specifies that referrals are not to be followed automatically.

Specifies that the utility is to run in verbose mode.

Chapter 7 Command-Line Utilities 229

ldapdelete

Option

-V

-y

Description

Specifies the LDAP version number to be used on the operation. For example,

-V 2 . LDAP v3 is the default. You can not perform an LDAP v3 operation against a Directory Server that only supports LDAP v2.

Specifies the proxy DN to use for the modify operation. This argument is provided for testing purposes. For more information about proxied authorization, see Chapter 6, “Managing Access Control” in the Netscape

Directory Server Administrator’s Guide.

ldapdelete

ldapdelete enables you to perform delete operations on directory entries via

LDAP.

Syntax

ldapdelete [optional options ]

ldapdelete Options

The following three sections list the options that can be specified with ldapsdelete

. The first section lists those options most commonly used, the second section lists SSL options, and the third lists less common options.

Commonly Used ldapdelete Options

To delete an entry or entries from an existing database, use the ldapdelete command-line utility with the following options:

Option

-D

Description

Specifies the distinguished name with which to authenticate to the server. The value must be a DN recognized by the Directory Server, and it must also have the authority to delete the entries. For example, -D "uid=bjensen, dc=example,dc=com" . For more information on access control, see Chapter

6, “Managing Access Control” in the Netscape Directory Server Administrator’s

Guide. If you use the -D option, you cannot use the -N option.

230 Netscape Directory Server Configuration, Command, and File Reference • August 2002

ldapdelete

Option

-h

-p

-w dn

Description

Specifies the name of the host on which the server is running. For example, -h cyclops . The default is localhost .

Specifies the port number that the server uses. Default is 389. If -Z is used, the default is 636.

Specifies the password associated with the distinguished name specified in the

-D option. For example, -w mypassword . The default is "", or anonymous.If

you do not specify a password on the command line, and the server requires one, the command will prompt you to provide one. It is more secure not to provide a password on the command line so that it does not show up in clear text in a listing of commands.

Specifies the dn of the entry to delete.

SSL Options

You can use the following options to specify that ldapdelete use LDAPS when communicating with your Directory Server. You also use these options if you want to use certificate-based authentication. These options are valid only when LDAPS has been turned on and configured for your Directory Server. For more information on certificate-based authentication and how to create a certificate database for use with LDAP clients, see Chapter 11, “Managing SSL” in the

Netscape Directory Server Administrator’s Guide.

Make sure that you specify your Directory Server’s encrypted port when you use these options:

Option

-K

Description

Specifies the filename and path of the private key database of the client.

In previous releases of Directory Server, except for when doing certificate-based authentication, it wasn’t necessary to specify the path to the key database (using the -K option). In this release of Directory Server, irrespective of the type of authentication being performed, you must specify the -K option when the key database has a different name than key3.db

or when the key database is not under the same directory as the certificate database, the cert7.db

file (the path for which is specified with the -P option).

Chapter 7 Command-Line Utilities 231

ldapdelete

Option

-N

-P

-W

-Z

Description

Specifies the certificate name to use for certificate-based client authentication.

For example, -N Server-Cert . If this option is specified, then the -Z and -W options are required. Also, if this option is specified, then the -D and -w options must not be specified, or certificate-based authentication will not occur and the bind operation will use the authentication credentials specified on -D and -w .

Specifies the path and filename of the security files for the client. This option is used only with the -Z option. When used on a machine where an SSL-enabled web browser is configured, the path specified on this option can point to the security database for the web browser. For example, -P c:\security\cert.db

. The client security files can also be stored on the

Directory Server in the serverRoot /alias directory. In this case, the -P option calls out a path and filename similar to the following:

-P c:\netscape\servers\alias\client-cert.db

.

Specifies the password for the certificate database identified on the -P option.

For example, -W serverpassword .

Specifies that SSL is to be used for the delete request.

Additional ldapdelete Options

The following options offer additional functionality:

Option

-c

-f

-H

-M

-n

Description

Specifies that the utility must run in continuous operation mode. Errors are reported, but the utility continues with deletions. The default is to quit after reporting an error.

Specifies the file containing the distinguished names of entries to be deleted.

For example, -f modify_statements . Omit this option if you want to supply the distinguished name of the entry to be deleted directly to the command line.

Lists all available ldapdelete options.

Manage smart referrals. Causes the server to not return the smart referral contained on the entry, but to instead delete the actual entry containing the smart referral. For more information about smart referrals, see Chapter 3,

“Configuring Directory Databases” in the Netscape Directory Server

Administrator’s Guide.

Specifies that the entries are not to be actually deleted, but that ldapdelete is to show what it would do with the specified input.

232 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Option

-O

-R

-v

-V

-y

Description

Specifies the maximum number of referral hops to follow. For example, -O 2 .

There is no maximum number of referral hops.

Specifies that referrals are not to be followed automatically. By default, the server follows referrals.

Specifies that the utility is to run in verbose mode.

Specifies the LDAP version number to be used on the operation. For example,

-V 2 . LDAP v3 is the default. You cannot perform an LDAP v3 operation against a Directory Server that only supports LDAP v2.

Specifies the proxy DN to use for the delete operation. This argument is provided for testing purposes. For more information about proxied authorization, see Chapter 6, “Managing Access Control” in the Netscape

Directory Server Administrator’s Guide.

ldif

ldif

ldif automatically formats LDIF files for you and creates base 64 encoded attribute values. With Base 64 Encoding you can represent Binary data, such as a

JPEG image, in LDIF by using base 64 encoding. You identify base 64 encoded data by using the :: symbol. For example: jpegPhoto:: <encoded data>

In addition to binary data, other values that must be base 64 encoded include:

• Any value that begins with a semicolon (;) or a space

• Any value that contains non-ASCII data, including newlines

The ldif command-line utility will take any input and format it with the correct line continuation and appropriate attribute information. The ldif utility also senses whether the input requires base 64 encoding.

Syntax

When you use ldif , you must enter the command using the following format: ldif [-b] [ attrtypes] [optional-options]

Chapter 7 Command-Line Utilities 233

dbscan

Options

Option

-b

Description

Specifies that the ldif utility should interpret the entire input as a single binary value. If -b is not present, each line is considered to be a separate input value.

As an alternative to the -b option, you can you can use the :< URL specifier notation, which is in fact simpler to use. For example: j pegphoto:< file:///tmp/myphoto.jpg

Although the official notation requires three /// , the use of one / is tolerated.

dbscan

The dbscan tool analyzes and extracts information from a Directory Server database file; see “Database Files,” on page 185. Database files use the

.db2

and

.db3

extensions in their filename, depending on the version of Directory Server.

Syntax

dbscan filename [ options ]

Options

Option Parameter

-f filename

-i

-e

-c

-l size

Description

Specifies the name of the database file, the contents of which is to be analyzed and extracted.

Specifies that the output is to be generated as an index file.

Specifies that the output is to be generated as an entry

( id2entry ) file.

Specifies that the output is to be dumped as a changelog file.

Specifies the maximum length for the dumped ID list; the default length is 4096.

234 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Option Parameter

-n

-G

-r

-k

-s key dbscan

Description

Specifies that only the lengths of ID lists should be displayed

(and not the contents).

Specifies that only those index entries with ID lists exceeding the length specified by the -n option are to be displayed.

Must be used with the

-n option (

-G <n>

).

Specifies that the output should show libdb record numbers.

Specifies the key to lookup in the database file.

Specifies that the output should show a summary of index counts.

Chapter 7 Command-Line Utilities 235

dbscan

236 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Chapter 8

Command-Line Scripts

This chapter provides information on the scripts you can use to manage your directory, for example, backing up and restoring your database. Scripts are a shortcut way of executing the ns-slapd interface commands that are documented in Appendix A, “Using the ns-slapd and slapd.exe Command-Line Utilities.”

This chapter contains the following sections:

• Finding and Executing Command-Line Scripts (page 237)

• Command-Line Scripts Quick Reference (page 238)

• Shell and Batch Scripts (page 241)

• Perl Scripts (page 254)

Finding and Executing Command-Line Scripts

By default all scripts are stored in the following directory: serverRoot /slapdserverID

Be sure to refer to “Command-Line Scripts Quick Reference,” on page 238 for the exact location of each script.

When scripts request either a directory name or a file name, always provide the absolute path. The scripts assume that you want to use the dse.ldif

file located in this directory: serverRoot /slapdserverID /config

237

Command-Line Scripts Quick Reference

NOTE In order to execute the Perl scripts, you must change to the directory where the scripts are stored. Although it is possible to set command-path and library-path variables to execute the scripts, it is not recommended because you run the risk, particularly when you have more than one server version installed, of disrupting the correct execution of other utilities. There’s also the risk of compromising the security of the system.

(The same procedure also applies to the command-line utilities discussed in Chapter 7, “Command-Line Utilities.”)

Also note that when you are running the Perl scripts on Windows machines, you must make sure that the path environment variable contains the Perl executable ( perl.exe

) file. For this reason, make sure to run the scripts from the following directory on these machines: serverRoot \bin\slapd\admin\bin

Command-Line Scripts Quick Reference

Table 8-1 Commonly Used Command-Line Shell and Batch Scripts

Command Line Script Description bak2db db2bak db2ldif db2dsml db2index dsml2db

Restores the database from the most recent archived backup.

Located in: serverRoot /slapdserverID

Creates a backup of the current database contents.

Located in: serverRoot /slapdserverID

Exports the contents of the database to LDIF.

Located in: serverRoot /slapdserverID

Exports the contents of the database to DSML.

Located in: serverRoot /slapdserverID

Reindexes the database index files.

Located in: serverRoot /slapdserverID

Imports DSML file to the database.

Located in: serverRoot /slapdserverID

238 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Command-Line Scripts Quick Reference

Table 8-1 Commonly Used Command-Line Shell and Batch Scripts (Continued)

Command Line Script Description getpwenc ldif2db ldif2ldap monitor restart-slapd restoreconfig saveconfig start-slapd stop-slapd suffix2instance vlvindex

Prints the encrypted form of a password using one of the server’s encryption algorithms. If a user cannot log in, you can use this script to compare the user’s password to the password stored in the directory.

Located in: serverRoot /slapdserverID

Imports LDIF files to the database.

Runs the slapd (Windows) or ns-slapd (Unix) command-line utility with the ldif2db keyword. By default, the script first saves and then merges any existing configuration tree ( o=NetscapeRoot ) with any files to be imported.

Located in: serverRoot /slapdserverID

Performs an import operation over LDAP to the Directory Server.

Located in: serverRoot /slapdserverID

Retrieves performance monitoring information using the ldapsearch command-line utility.

Located in: serverRoot /slapdserverID

Restarts Directory Server.

Located in: serverRoot /slapdserverID

Restores by default the most recently saved Administration Server configuration to NetscapeRoot partition.

Located in: serverRoot /slapdserverID

Saves Administration Server configuration, stored in the NetscapeRoot partition to the serverRoot /slapdserverID /confbak directory.

Located in: serverRoot /slapdserverID

Starts Directory Server.

Located in: serverRoot /slapdserverID

Stops Directory Server.

Located in: serverRoot /slapdserverID

Maps a suffix to a backend name.

Located in: serverRoot /slapdserverID

Creates and generates virtual list view (VLV) indexes.

Located in: serverRoot /slapdserverID

Chapter 8 Command-Line Scripts 239

Command-Line Scripts Quick Reference

Table 8-2 Commonly Used Command-Line Perl Scripts

Command Line Perl Script Description bak2db.pl

Restores the database from the most recent archived backup.

Located in: serverRoot /slapdserverID db2bak.pl

db2index.pl

db2ldif.pl

ldif2db.pl

logconv.pl

Creates a backup of the current database contents

Located in: serverRoot /slapdserverID

Creates and regenerates indexes.

Located in: serverRoot /slapdserverID

Exports the contents of the database to LDIF.

Located in: serverRoot /slapdserverID

Imports LDIF files to database.

Runs the slapd (Windows) or ns-slapd (Unix) command-line utility with the ldif2db keyword. By default, the script first saves and then merges any existing configuration tree ( o=NetscapeRoot ), with any files to be imported.

Located in: serverRoot /slapdserverID

Analyzes the access logs of a Directory Server to extract usage statistics and count the occurrences of significant events.

Located in: serverRoot /bin/slapd/server migrateInstance6 ns-accountstatus.pl

ns-activate.pl

ns-inactivate.pl

template-cl-dump.pl

Migrates a 4.x or 5.x version of Directory Server to the 6.x version, converting the configuration files to LDIF format.

Located in: serverRoot /bin/slapd/admin/bin

Provides account status information to establish whether an entry or group of entries is locked or not.

Located in: serverRoot /slapdserverID

Activates an entry or a group of entries by unlocking it (them).

Located in: serverRoot /slapdserverID

Inactivates an entry or a group of entries.

Located in: serverRoot /slapdserverID

Dumps and decodes the change log.

Located in: serverRoot /bin/slapd/admin/scripts

240 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Shell and Batch Scripts

Table 8-2 Commonly Used Command-Line Perl Scripts (Continued)

Command Line Perl Script Description template-repl-monitor.pl

Provides in-progress status of replication.

Located in: serverRoot /bin/slapd/admin/scripts

Shell and Batch Scripts

This section covers the following scripts:

• bak2db (Restore database from backup)

• db2bak (Create backup of database)

• db2ldif (Export database contents to LDIF)

• db2dsml (Export database contents to DSML)

• db2index (Reindex database index files)

• dsml2db (Import DSML document contents into database)

• getpwenc (Print encrypted password)

• ldif2db (Import)

• ldif2ldap (Perform import operation over LDAP)

• monitor (Retrieve monitoring information)

• restart-slapd (Restart the Directory Server)

• restoreconfig (Restore Administration Server Configuration)

• saveconfig (Save Administration Server Configuration)

• start-slapd (Start the Directory Server)

• stop-slapd (Stop the Directory Server)

• suffix2instance (Map Suffix to Backend Name)

• vlvindex (Create virtual list view indexes)

Some of the Shell and Batch scripts can be executed while the server is running. For others, the server must be stopped. The description of each script below indicates whether the server must be stopped, or if it can continue to run while you execute the script.

Chapter 8 Command-Line Scripts 241

Shell and Batch Scripts

When a Shell or Batch script has a Perl equivalent, there is a cross-reference to the section describing the equivalent Perl script.

bak2db (Restore database from backup)

Restores the database from the most recent archived backup. To run this script the server must be stopped.

Syntax

Shell script (UNIX): bak2db [ backupDirectory ]

Batch file (Windows): bak2db [ backupDirectory ]

For information on the equivalent Perl script, see “bak2db.pl (Restore database from backup),” on page 255. For more information on restoring databases, see

Chapter 4, “Populating Directory Databases” in the Netscape Directory Server

Administrator’s Guide.

db2bak (Create backup of database)

Creates a backup of the current database contents. This script can be executed while the server is still running.

Syntax

Shell script (UNIX):

Batch file (Windows): db2bak [ backupDirectory ] db2bak [ backupDirectory ]

For information on the equivalent Perl script, refer to “db2bak.pl (Create backup of database),” on page 255.

242 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Shell and Batch Scripts

db2ldif (Export database contents to LDIF)

Exports the contents of the database to LDIF. This script can be executed while the server is still running.

For information on the equivalent Perl script, see “db2ldif.pl (Export database contents to LDIF),” on page 257.

For the shell and batch scripts, the script runs the slapd

(Windows) or ns-slapd

(UNIX) command-line utility with the ldif2db keyword.

Syntax

Shell script (UNIX):

Batch file (Windows): db2ldif {-n backendInstance }* | {-s includeSuffix }*

[{-x excludeSuffix }*] [-r] [-C] [-u] [-U] [-m] [M]

[-a outputFile ] [-1] [-N] db2ldif {-n backendInstance }* | {-s includeSuffix }*

[{-x excludeSuffix }*] [-r] [-C] [-u] [-U] [-m] [M]

[-a outputFile ] [-1] [-N]

Options

You must specify either the -n or the -s option. By default, the output LDIF will be stored in one file. Should you want to specify the use of several files, then use the option -M .

Option Parameter

-a

-n

-s

-x

-r

-C

-u

-U

-m

Description outputFile Name of the output LDIF file.

backendInstance Instance to be exported.

includeSuffix Suffixes to be included or the subtrees to be included if -n has been used.

excludeSuffix Suffixes to be excluded.

Export replica.

Only the main db file is used.

Request that the unique id is not exported.

Request that the output LDIF is not folded.

Minimal base64 encoding.

Chapter 8 Command-Line Scripts 243

Shell and Batch Scripts

Option Parameter

-M

-1

-N

Description

Use of several files for storing the output LDIF with each instance stored in instance filename (where file name is the file name specified for -a option).

Delete, for reasons of backward compatibility, the first line of the LDIF file which gives the version of the LDIF standard.

Specifies that the entry IDs are not to be included in the LDIF output. The entry IDs are necessary only if the db2ldif output is to be used as input to db2index .

db2dsml (Export database contents to DSML)

Exports the contents of the database to DSML, version 1.0. This script can be executed while the server is still running.

Syntax

Shell script (UNIX):

Batch file (Windows): db2dsml {-n backendInstance }* | {-s includeSuffix }*

[{-x excludeSuffix }*] [-u] [-a outputFile ] db2dsml {-n backendInstance }* | {-s includeSuffix }*

[{-x excludeSuffix }*] [-u] [-a outputFile ]

Options

You must specify either the

-n or

-s option.

Option Parameter

-n

-s

-x

-u

-a

Description backendInstance Instance to be exported.

includeSuffix Suffixes to be included or to specify the subtrees to be included if -n has been used.

excludeSuffix Suffixes to be excluded.

Request that the the unique ID be not exported.

outputFile Name of the output DSML file.

244 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Shell and Batch Scripts

db2index (Reindex database index files)

Reindexes the database index files.

For information on the equivalent Perl script, see “db2index.pl (Create and generate indexes),” on page 256.

Syntax

Shell script (UNIX):

Batch file (Windows): db2index [-n backendInstance | {-s includeSuffix }* -t attributeName -T vlvAttribute ] db2index [-n backend_instance | {-s includeSuffix }* -t attributeName -T vlvAttribute ]

Usage

Here are a few sample commands:

• To reindex all the database index files:

•

$ db2index

To reindex cn and givenname in the database instance userRoot

:

$ db2index -n userRoot -t cn -t givenname

• To reindex cn in the database where the root suffix is dc=example,dc=com

:

$ db2index -s "dc=example,dc=com" -t cn

Options

Option Parameter

-n

-s

-t

-T

Description backendInstance Instance to be reindexed.

includeSuffix Suffixes to be included or the subtrees to be included if has been used.

-n attributeName vlvAttribute

Name(s) of the attributes to be reindexed.

Name(s) of the VLV attributes to be reindexed.

Chapter 8 Command-Line Scripts 245

Shell and Batch Scripts

dsml2db (Import DSML document contents into database)

Imports the contents of the DSML, version 1.0, document into the database. To run this script, the server must be stopped.

Syntax

Shell script (UNIX):

Batch file (Windows): dsml2db -n backendInstance | {-s includeSuffix }* [{-x excludeSuffix }*] {-i dsmlFile } dsml2db -n backendInstance | {-s includeSuffix }* [{-x excludeSuffix }*] {-i dsmlFile }

Options

Option Parameter

-n

-s

-x

-i

Description backendInstance Instance to be exported.

includeSuffix excludeSuffix

Suffix(es) to be included or to specify the subtree(s) to be included if -n has been used.

Suffix(es) to be excluded.

dsmlFile Name of the input DSML file.

getpwenc (Print encrypted password)

Prints the encrypted form of a password using one of the server’s encryption algorithms. If a user cannot log in, you can use this script to compare the user’s password to the password stored in the directory.

Syntax

Shell script (UNIX):

Batch file (Windows): getpwenc storagescheme clearpassword getpwenc storageScheme clearpassword

246 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Shell and Batch Scripts

Options

There are no options for this script.

For more information on the different storage schemes, such as

SSHA

,

SHA

,

CRYPT

, and

CLEAR

, see the Netscape Directory Server Administrator’s Guide.

ldif2db (Import)

Runs the slapd

(Windows) or ns-slapd

(Unix) command-line utility with the ldif2db keyword. To run this script the server must be stopped.

For information on the equivalent Perl script, refer to “ldif2db.pl (Import),” on page 258.

NOTE Note that ldif2db supports LDIF version 1 specifications. You can load an attribute using the

:<

URL specifier notation, for example: j pegphoto:< file:///tmp/myphoto.jpg

Although the official notation requires three /// , the use of one / is tolerated. For further information on the LDIF format see Chapter

4, “Managing Directory Entries” in the Netscape Directory Server

Administrator’s Guide.

Syntax

Shell script (UNIX):

Batch file (Windows): ldif2db -n backendInstance | {-s includeSuffix }* [{-x excludeSuffix }*] {-i ldifFile }* [-O] [-g string ] [-G namespaceId ] ldif2db -n backendInstance | {-s includeSuffix }* [{-x excludeSuffix }*] {-i ldifFile }* [-O] [-g string ] [-G namespaceId ]

Chapter 8 Command-Line Scripts 247

Shell and Batch Scripts

Options

Option Parameter

-n

-s

-x

-i

-O

-g

-G

-c

Description backendInstance Instance to be imported. Ensure that you specify an instance that corresponds to the suffix contained by the LDIF file because otherwise the data contained by the database is deleted and the import fails.

includeSuffix excludeSuffix ldifFile

Suffixes to be included or to specify the subtrees to be included if -n has been used.

Suffixes to be included.

Names of the input ldif files. When you import multiple files, they are imported in the order in which you specify them on the command line.

string

Request that only the core db is created without attribute indexes.

Generation of a unique ID. Type none for no unique ID to be generated and deterministic for the generated unique ID to be name-based. By default a time based unique ID is generated.

namespaceId

If you use the deterministic generation to have a name-based unique ID, you can also specify the namespace you want the server to use as follows:

g deterministic namespace_id where namespace_id is a string of characters in the following format

00-xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx

Use this option if you want to import the same LDIF file into two different Directory Servers, and you want the contents of both directories to have the same set of unique IDs. If unique

IDs already exist in the LDIF file you are importing, then the existing IDs are imported to the server regardless of the options you have specified.

Generates a namespace ID as a name-based unique ID. This is the same as specifying the -g deterministic option.

Merge chunk size.

248 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Shell and Batch Scripts

ldif2ldap (Perform import operation over LDAP)

Performs an import operation over LDAP to the Directory Server. To run this script the server must be running.

Syntax

Shell script (UNIX):

Batch file (Windows): ldif2ldap -D rootdn -w password -f filename ldif2ldap -D rootdn -w password -f filename

Options

Option Parameter

-D

-w

-f rootdn password filename

Description

User DN with root permissions, such as Directory Manager.

Password associated with the user DN.

Name of the file to be imported. When you import multiple files, they are imported in the order in which you specify them on the command line.

monitor (Retrieve monitoring information)

Retrieves performance monitoring information using the ldapsearch command-line utility.

Syntax

Shell script (UNIX):

Batch file (Windows): monitor monitor

Options

There are no options for this script.

For more information on the ldapsearch command-line utility, see Chapter 7,

“Command-Line Utilities.”

Chapter 8 Command-Line Scripts 249

Shell and Batch Scripts

restart-slapd (Restart the Directory Server)

Restarts the Directory Server.

Syntax

Shell script (UNIX):

Batch file (Windows): restart-slapd restart-slapd

Options

There are no options for this script.

Exit Status

0

1

2

3

Server restarted successfully.

Server could not be started.

Server restarted successfully, but was already stopped.

Server could not be stopped.

restoreconfig (Restore Administration Server

Configuration)

Restores, by default, the most recently saved Administration Server configuration information to the

NetscapeRoot partition under the following directory: serverRoot /slapdserverID /config

To restore the Administration Server configuration:

1.

Stop the Directory Server

2.

3.

4.

Run the restoreconfig script

Restart the Directory Server

Restart the Administration Server for the changes to be taken into account.

250 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Shell and Batch Scripts

Syntax

Shell script (UNIX):

Batch file (Windows): restoreconfig restoreconfig

Options

There are no options for this script.

saveconfig (Save Administration Server

Configuration)

Saves Administration Server configuration information to the following directory: serverRoot /slapdserverID /confbak

Note that this script will only run if the server is running.

Syntax

Shell script (UNIX):

Batch file (Windows): saveconfig saveconfig

Options

There are no options for this script.

start-slapd (Start the Directory Server)

Starts the Directory Server. It might be a good idea to check whether the server has been effectively started using the ps command, because it could sometimes be that the script returned while the startup process was still ongoing, resulting in a confusing message.

Chapter 8 Command-Line Scripts 251

Shell and Batch Scripts

Syntax

Shell script (UNIX):

Batch file (Windows): start-slapd start-slapd

Options

There are no options for this script.

Exit Status

0

1

2

Server started successfully

Server could not be started

Server was already started

stop-slapd (Stop the Directory Server)

Stops the Directory Server. It might be a good idea to check whether the server has been effectively stopped using the ps command, because it could sometimes be that the script returned while the shutdown process was still ongoing, resulting in a confusing message.

Syntax

Shell script (UNIX): stop-slapd

Batch file (Windows): stop-slapd

Options

There are no options for this script.

Exit Status

0 Server stopped successfully.

252 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Shell and Batch Scripts

1

2

Server could not be stopped.

Server was already stopped.

suffix2instance (Map Suffix to Backend Name)

Maps a suffix to a backend name.

Syntax

Shell script (UNIX): suffix2instance {-s suffix }

Batch file (Windows): suffix2instance {-s suffix }

Options

-s Suffix to be mapped to the backend.

vlvindex (Create virtual list view indexes)

To run the vlvindex script the server must be stopped. The vlvindex script creates virtual list view (VLV) indexes, known in the Directory Server Console as

Browsing Indexes. VLV indexes introduce flexibility in the way you view search results. Using VLV indexes, you can organize search results alphabetically or in reverse alphabetical order, and you can scroll through the list of results. VLV index configuration must already exist prior to running this script.

Syntax

Shell script (UNIX): vlvindex [-d debugLevel ] [-n backendInstance ] [-s suffix ][-T vlvTag ]

Batch file (Windows): vlvindex [-d debugLevel ] -n backendInstance [-s suffix ][-T vlvTag ]

Chapter 8 Command-Line Scripts 253

Perl Scripts

Options

You must specify either the

-n or the

-s option.

Option Parameter

-d

-D

-n

-s

-T debugLevel

Description

Specifies the debug level to use during index creation. Debug levels are defined in “nsslapd-errorlog-level (Error Log

Level),” on page 56.

Specifies the server configuration directory that contains the configuration information for the index creation process. You must specify the full path to the slapdserverID directory.

backendInstance Name of the database containing the entries to index.

suffix Name of the suffix containing the entries to index.

vlvTag VLV index identifier to use to create VLV indexes. You can use the console to specify VLV index identifier for each database supporting your directory tree, as described in the

Netscape Directory Server Administrator’s Guide. You can define additional VLV tags by creating them in LDIF, and adding them to Directory Server’s configuration, as described in the Netscape Directory Server Administrator’s

Guide. In any case, we recommend you use the DN of the entry for which you want to accelerate the search sorting.

Perl Scripts

This section covers the following scripts:

• bak2db.pl (Restore database from backup)

• db2bak.pl (Create backup of database)

• db2index.pl (Create and generate indexes)

• db2ldif.pl (Export database contents to LDIF)

• ldif2db.pl (Import)

• logconv.pl (Log converter)

• migrateInstance6 (Migrate to Directory Server 6.x)

• ns-accountstatus.pl (Establish account status)

• ns-activate.pl (Activate an entry or group of entries)

254 Netscape Directory Server Configuration, Command, and File Reference • August 2002

• ns-inactivate.pl (Inactivate an entry or group of entries)

• template-cl-dump.pl (Dump and decode changelog)

• template-repl-monitor.pl (Monitor replication status)

bak2db.pl (Restore database from backup)

Restores a database from a backup.

Syntax

Perl script (UNIX and

Windows): bak2db.pl [-v] -D rootdn -w password -a backupDirectory ] [-t databaseType ]

Perl Scripts

Options

The script bak2db.pl

creates an entry in the directory that launches this dynamic task. The entry is generated based upon the values you provide for each option.

Option Parameter

-D

-w

-a rootdn

Description

The user DN with root permissions, such as Directory

Manager . The default is the DN of the directory manager, which is read from the nsslapd-root attribute under cn=config .

password The password associated with the user DN.

backupDirectory The directory of the backup files.

-v

-t databaseType

Verbose mode.

The database type.

type is ldbm

.

Currently, the only possible database

db2bak.pl (Create backup of database)

Creates a backup of the database.

Chapter 8 Command-Line Scripts 255

Perl Scripts

Syntax

Perl script (UNIX and

Windows): db2bak.pl [-v] -D rootdn -w password [-a dirName ]

Options

The script db2bak.pl

creates an entry in the directory that launches this dynamic task. The entry is generated based upon the values you provide for each option.

Currently, the only possible database type is ldbm

.

Option Parameter

-D rootdn

-w

-a

-v

-t password dirName

Description

The user DN with root permissions, such as Directory

Manager . The default is the DN of the directory manager, which is read from the nsslapd-root attribute under cn=config .

The password associated with the user DN.

The directory where the backup files will be stored. By default it is under serverRoot /slapdserverID /bak

The backup file is named according to the year-month-day-hour format (YYYY_MM_DD_hhmmss).

Verbose mode.

The database type.

type is ldbm .

Currently, the only possible database

db2index.pl (Create and generate indexes)

Creates and generates the new set of indexes to be maintained following the modification of indexing entries in the cn=config configuration file.

Syntax

Perl script (UNIX and

Windows): db2index.pl [-v] -D rootdn { -w password | -j filename

} [-n backendInstance ] [-t attributeName ]

256 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Perl Scripts

Options

The script db2index.pl

creates an entry in the directory that launches this dynamic task. The entry is generated based upon the values you provide for each option.

Option Parameter

-v

-D

-w

-n

-t

-j

Description rootdn

Verbose mode.

The user DN with root permissions, such as Directory

Manager .

The password associated with the user DN.

password backendInstance The instance to be indexed. If the instance is not specified, the script reindexes all.

attributeName The name of the attribute to be indexed. If omitted, all the indexes defined for the specified instance are generated.

filename The name of the file containing the password.

db2ldif.pl (Export database contents to LDIF)

Exports the contents of the database to LDIF. This script creates an entry in the directory that launches this dynamic task. The entry is generated based upon the values you provide for each option. The

* indicates that multiple occurrences are allowed.

Syntax

Perl script (UNIX And

Windows): db2ldif.pl [-v] -D rootdn -w password {-n backendInstance }* | {-s includeSuffix }* [{-x excludeSuffix }*] [-a outputFile ] [-N] [-r] [-C] [-u]

[-U] [-m] [-o] [-1] [M]

Options

To run this script, the server must be running and either

-n

backend_instance or

-s

includesuffix is required.

Chapter 8 Command-Line Scripts 257

Perl Scripts

This perl script db2ldif.pl

creates an entry in the directory that launches this dynamic task. The entry is generated based upon the values you provide for each option.

Option Parameter

-v

-D

-w

-n

-s

-x

-a

-N

-r

-C

-u

-U

-m

-o

-1

-M

Description rootdn

Verbose mode.

The user DN with root permissions, such as Directory

Manager .

password The password associated with the user DN.

backendInstance The instance to be exported.

includeSuffix Suffixes to be included or the subtrees to be included if -n has been used.

excludeSuffix outputFile

Suffixes to be excluded.

The filename of the output LDIF file.

Suppress printing sequential number.

Export replica.

Only the main db file is used.

Request that the unique id is not exported.

Request that the output LDIF is not folded.

Minimal base64 encoding.

The output LDIF to be stored in one file by default with each instance stored in instance_filename.

Delete, for reasons of backward compatibility the first line of the LDIF file that gives the version of the LDIF standard.

Output LDIF is stored in multiple files.

ldif2db.pl (Import)

To run this script the server must be running. The script creates an entry in the directory that launches this dynamic task. The entry is generated based upon the values you provide for each option.

258 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Perl Scripts

Syntax

Perl script (UNIX and

Windows): ldif2db.pl [-v] -D rootdn -w password -n backendInstance | {-s includeSuffix }* [{-x excludeSuffix }*]

[-O] [-c] [-g string ] [-G namespaceId ] {-i filename }*

Options

Option Parameter

-D

-w

-n

-s

-x

-O

-c

-g

Description rootdn password Specifies the password associated with the user DN.

backendInstance Specifies the instance to be imported.

includeSuffix

Specifies the user DN with root permissions, such as

Directory Manager.

excludeSuffix

Specifies the suffixes to be included or to specifies the subtrees to be included if -n has been used.

Specifies the suffixes to be excluded.

string

Requests that only the core db is created without attribute indexes.

Merges chunk size.

Generates a unique ID. Type none for no unique ID to be generated and deterministic for the generated unique ID to be name-based. By default a time based unique ID is generated.

If you use the deterministic generation to have a name-based unique ID, you can also specify the namespace you want the server to use as follows:

g deterministic namespaceId where namespaceId is a string of characters in the following format

00-xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx

Use this option if you want to import the same LDIF file into two different Directory Servers, and you want the contents of both directories to have the same set of unique IDs. If unique

IDs already exist in the LDIF file you are importing, then the existing IDs are imported to the server regardless of the options you have specified.

Chapter 8 Command-Line Scripts 259

Perl Scripts

Option Parameter

-G namespaceId

-i filename

-v

Description

Generates a namespace ID as a name-based unique ID. This is the same as specifying the -g deterministic option.

Specifies the filename of the input LDIF files. When you import multiple files, they are imported in the order in which you specify them on the command line.

Specifies verbose mode.

logconv.pl (Log converter)

Analyzes the access logs of a Directory Server to extract usage statistics and count the occurrences of significant events. It is compatible with log formats from

Directory Server 3.x, 4.x, 5.x, and 6.x. For information on access logs, see Chapter 5,

“Access Log and Connection Code Reference.”

The tool will extract the following information from access logs:

260 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Perl Scripts

Number of restarts

Total number of connections

Total operations requested

Total results returned

Results to requests ratio

Number of searches

Number of modifications

Number of adds

Number of deletes

Number of modified RDNs

For Directory Server 6.x logs only:

Persistent searches

Internal operations (with verbose logs)

Entry operations (with verbose logs)

Extended operations

Abandoned requests

Smart referrals received (verbose logs)

VLV (virtual list view) operations

VLV unindexed searches

Server-side sorting operations

SSL connections

Performance lowering operations:

Entire database searches

Unindexed searches (details optional)

FDs (file descriptors) taken

FDs returned

Highest FD taken

Disruptions:

Broken pipes

Connections reset by peer

Unavailable resources (and detail)

Total binds and types of binds

Most frequent occurrence lists (optional):

Error and return codes

Failed logins

Connection codes

Client IP addresses and connection codes

Bind DNs

Base DNs for searching

Search filters

Etimes (elapsed operation time)

Longest etimes

Nentries (number of entries in result)

Largest Nentries

Extended operations (Directory Server 6.x

only)

Most requested attributes (Directory Server

6.x only)

Abandoned operation details (Directory

Server 4.15)

Recommendations (optional)

The logconv.pl

tool displays two types of statistics useful for monitoring and optimizing directory usage:

• Simple counts of events such as the total number of binds and the total number of searches provide overall usage information. This is the basic information that the tool will always print.

• Lists of the most frequently occurring parameters in LDAP requests provide insight how the directory information is being accessed. For example, lists of the top ten bind DNs, base DNs, filter strings, and attributes returned can help administrators optimize the directory for its users. These lists are optional because they are computation intensive: specify only the command-line options for those you need (see “Options,” on page 263).

Chapter 8 Command-Line Scripts 261

Perl Scripts

Some information that is extracted by the logconv.pl

script is available only in

Directory Server 6.x logs: the corresponding values will be zero when analyzing logs from other versions. In addition, some information will only be present in the logs if verbose logging is enabled in your Directory Server. For more information, see “nsslapd-accesslog-level,” on page 38.

The following issues will affect the output and performance of this tool:

• Some data extracted from logs depend on connection and operation numbers that are reset and no longer unique after a server restarts. Therefore, to obtain the most accurate counts, the logs to be analyzed should not span the restart of the Directory Server.

• Due to changes in access logs formats in Directory Server 6.x that also affect operation numbers, the tool will be more accurate on 6.x logs when processing large amounts of access logs.

• For performance reasons, it is not recommended to run more than one gigabyte of access logs through the script at any one time.

The logconv.pl

script is supported when using Perl version 5.005_03.

If you customize the logconv.pl

script for added functionality, we encourage you to share your work with other LDAP users. Please post a message to the netscape.dev.directory

public newsgroup with your ideas or your code.

Syntax

Perl script (UNIX and

Windows): logconv.pl [ options ] [-efcibaltnxgju] accessLog ...

Where:

• options and

[-efcibaltnxgju] are the command-line options described in the next section.

• accessLog is the name of a file that contains the access log of your Directory

Server. You may use wildcards in the filename or specify multiple filenames.

However, the statistics are computed over the set of all logs, so all logs should pertain to the same Directory Server. The tool will ignore any file with the name access.rotationinfo

.

The logconv.pl -h command will display the usage help text that briefly describes all options.

262 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Perl Scripts

Options

The logconv.pl

command-line options are described in the following table.

The parameters without a preceding dash (

-

) at the end of the table will enable the optional lists of occurrences. Specify only those you need to limit the output and improve execution speed. You may specify any number of these parameters in any order, but they must all be given together as a single option on the command line, for example:

-abcefg

.

Regardless of the order of options on the command line, the lists will appear in the output in the order they are listed in this table. Use the

-V option to display all optional output. Also, use the

-s

number option to control the length of these lists.

-v

-h

-s

Opti on

-S

-E

-d

-X

Parameter Description startTimestamp Specifies the start timestamp; the timestamp must follow the exact format as specified in the access log.

endTimestamp Specifies the end timestamp; the timestamp must follow the exact format as specified in the access log.

mgrDN ipAddress

Specifies the distinguished name (DN) of the directory manger in the logs being analyzed. This allows the tool to collect statistics for this special user. The mgrDN parameter should be given in double quotes ( "" ) for the shell. When this parameter is omitted, logconv.pl

will use the default manager DN of

Directory Server Server: "cn=directory manager" .

Specifies the IP address of a client to exclude from the statistics.

This client will not appear in lists of IP addresses (the i flag), and the connection codes it generates will not be tallied in the total connections (default statistic) nor in the connection code details (the c flag). For example, you may wish to ignore the effect of a load balancer that connects to the Directory Server a regular intervals. This option may be repeated to exclude multiple IP addresses.

number

Displays the version number of the logconv.pl

script.

Displays the usage help text that briefly describes all options.

Specifies the number of items in each of the list options below.

The default is 20 when this parameter is omitted. For example,

-s 10 -i will list the ten client machines that access the

Directory Server most often. This parameter will apply to all lists that are enabled, and it will have no effect if none are displayed.

Chapter 8 Command-Line Scripts 263

Perl Scripts e f

-y

-p c i n x l t b a r g j u

Opti on

-V

Parameter Description

Enables the most verbose output. With this option, logconv.pl

will compute and display all of the optional lists described below.

Lists connection latency details (gives you an idea about the overall connection latency).

Lists open connection ID statistics (gives you an idea about the

FDs that are not yet closed).

Lists the most frequent error and return codes.

Lists the bind DNs with the most failed logins (invalid password).

Lists the number of occurrences for each type of connection code.

Lists the IP addresses and connection codes of the clients with the most connections, which detects clients that may be trying to compromise security.

Lists the most frequently used bind DNs.

Lists the most frequent base DNs when performing operations.

Lists the most frequently used filter strings for searches.

Lists the longest and most frequent etimes (elapsed operation time)

Lists the largest and most frequent nentries (entries per result).

Lists the number and OID of all extended operations (Directory

Server 6.x only).

Lists the names of the most requested attributes (Directory

Server 6.x only).

Lists the details of all abandoned operations.

Gives recommendations based on data collected from the log file.

Gives operation details about unindexed searches.

264 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Perl Scripts

migrateInstance6 (Migrate to Directory Server

6.x)

The migrateInstance6 script (note that this is a Perl script despite the fact that it does not have the .pl

extension) migrates an instance of 4.x or 5.x Directory Server to Directory Server 6.x.

When you run this script, it migrates the configuration files or configuration entries, database instances, and schema with minimum manual intervention. The migrateInstance6 script calls on the migrateTo6 script, which then executes the migration.

For complete information on the configuration parameters and attributes that are migrated, refer to Chapter 6, “Migration from Earlier Versions.” For migration procedure, refer to the Netscape Directory Server Installation Guide.

Before performing the migration check that the user-defined variables contain the following associated values, where server6Root is the path to where Netscape

Directory Server 6.x is installed:

$PERL5LIB

PATH server6Root /bin/slapd/admin/bin server6Root /bin/slapd/admin/bin

Syntax

Perl script (UNIX and

Windows): migrateInstance6 -D rootdn -w password -p port -o oldInstancePath -n newInstancePath [-t] [-L]

Options

Option Parameter

-D rootdn

-w

-p password port

Description

Specifies the Directory Server 6.x

user DN with root permissions, such as Directory Manager .

Specifies the password associated with the Directory Server

6.x

user DN.

Specifies the port number of Directory Server 6.x

.

Chapter 8 Command-Line Scripts 265

Perl Scripts

Option Parameter

-o

-n

-t

-L

Description oldInstancePath Specifies the path to the legacy (4.x or 5.x) Directory Server instance. For example:

/usr/netscape/server4/slapd-phonebook .

newInstancePath Specifies the path to the new (6.x) Directory Server instance.

For example:

/usr/netscape/servers/slapd-phonebook .

Specifies the trace level. The trace level is set to 0 by default with a valid range of 0 to 3.

Specifies the file in which to log the migration report. By default the migration report is stored under serverRoot /slapdserverID /logs/Migration _ddmmyyy_h

hmmss.

log . A sample log might read

/usr/netscape/servers/slapd-phonebook/logs/Mi gration_20122001_153604.log

for a log created on 20

December 2001 at 15.36:04.

ns-accountstatus.pl (Establish account status)

Provides account status information to establish whether an entry or group of entries is inactivated.

Syntax

Perl script (UNIX and

Windows): ns-accountstatus.pl [-D rootdn ] -w password [-p port ] [-h host ] -I DN

Options

Option Parameter

-D rootdn

-w

-p password port

Description

Specifies the Directory Server user DN with root permissions, such as Directory Manager .

Specifies the password associated with the user DN.

Specifies the Directory Server’s port. The default value is the

LDAP port of Directory Server specified at installation time.

266 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Perl Scripts

Option Parameter

-h host

-I DN

Description

Specifies the host name of the Directory Server. The default value is the full host name of the machine where Directory

Server is installed.

Specifies the entry DN or role DN whose status is required.

ns-activate.pl (Activate an entry or group of entries)

Activates an entry or group of entries.

Syntax

Perl script (UNIX and

Windows): ns-activate.pl [-D rootdn ] -w password [-p port ] [-h host ] -I DN

Options

Option Parameter

-D rootdn

-w

-p

-h password port host

-I DN

Description

Specifies the Directory Server user DN with root permissions, such as Directory Manager .

Specifies the password associated with the user DN.

Specifies the Directory Server’s port. The default value is the

LDAP port of Directory Server specified at installation time.

Specifies the host name of the Directory Server. The default value is the full host name of the machine where Directory

Server is installed.

Specifies the entry DN or role DN to activate.

ns-inactivate.pl (Inactivate an entry or group of entries)

Inactivates and thus locks and entry or group of entries.

Chapter 8 Command-Line Scripts 267

Perl Scripts

Syntax

Perl script (UNIX and

Windows) ns-inactivate.pl [-D rootdn ] -w password [-p port ]

[-h host ] -I DN

Options

Option Parameter

-D rootdn

-w

-p

-h password port host

-I DN

Description

Specifies the Directory Server user DN with root permissions, such as Directory Manager .

Specifies the password associated with the user DN.

Specifies the Directory Server’s port. The default value is the

LDAP port of Directory Server specified at installation time.

Specifies the host name of the Directory Server. The default value is the full host name of the machine where Directory

Server is installed.

Specifies the entry DN or role DN to inactivate.

template-cl-dump.pl (Dump and decode changelog)

Troubleshoots replication-related problems.

Syntax

Perl script (UNIX and

Windows): template-cl-dump.pl [-h host ] [-p port ] [-D bindDn ]

-w bindPassword | -P bindCert [-r replicaRoots ] [-o outputFile ] [-c] [-v] template-cl-dump.pl -i changelogFile [-o outputFile ]

[-c]

268 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Perl Scripts

Options

In the absence of the

-i option, the script must be run when the Directory Server is running and from a location from which the server’s change-log directory is accessible.

Option Parameter

-h

-p

-D

-w

-P

-r

-o

-i

-c

-v host port bindDn bindPassword bindCert replicaRoots outputFile changelogFile

Description

Specifies the Directory Server’s host. Defaults to the server where the script is running.

Specifies the Directory Server’s port. The default value is 389.

Specifies the Directory Server’s bind DN. Defaults to cn=Directory Manager if the option is omitted.

Specifies the password for the bind DN.

Specifies the path, including the filename, to the certificate database that contains the certificate used for binding.

Specifies the replica-roots whose change log you want to dump. When specifying multiple roots, use commas to separate roots. If the option is omitted, all the replica roots will be dumped.

Specifies the path, including the filename, for the final result.

Defaults to STDOUT if omitted.

Specifies the path to the change-log file. If you have a change-log file and if certain changes in that file are base-64 encoded, use this option to decode that change log.

Dumps and interprets CSN only. This option can be used with or without the -i option.

Prints the version of the script.

template-repl-monitor.pl (Monitor replication status)

Shows in-progress status of replication.

Chapter 8 Command-Line Scripts 269

Perl Scripts

Syntax

Perl script (UNIX and

Windows): template-repl-monitor.pl -h host -p port -f configFile

[-u refreshUrl ] [-t refreshInterval ] [-r] [-v]

Options

Option Parameter

-h

-p

-f

-u

-t

-r

-v

Description host port configFile

Specifies the initial replication supplier’s host. The default value is the current hostname.

Specifies the initial replication supplier’s port. The default value is 389.

Specifies the absolute path to the configuration file, which defines the connection parameters used to connect to LDAP servers to get replication information. For more information about the configuration file, see section “Configuration File

Format” that follows this table.

refreshUrl Specifies the refresh URL.

The output HTML file may invoke a CGI program periodically.

If this CGI program in turn calls this script, the effect is that the output HTML file would automatically refresh itself. This is useful for continuous monitoring. See also the -t option.

Note that the script has been integrated into Netscape

Administration Express, enabling you to monitor replication status via that interface.

refreshInterval Specifies the refresh interval in seconds. The default value is

300 seconds. This option must be jointly used with the -u option.

If specified, the -r option causes the routine to be entered without printing the HTML header information. This is suitable when making multiple calls to this routine (for example, when specifying multiple, different, "unrelated" supplier servers) and expecting a single HTML output.

Prints the version of this script.

270 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Perl Scripts

Configuration File Format

The configuration file defines the following:

• The connection parameters for connecting to the LDAP servers to get replication information; specifying this information is mandatory.

• The server alias for more readable server names; specifying this information is optional.

• The color thresholds for time lags; specifying this information is optional.

The format for the configuration file is shown below.

[connection] host:port:binddn:bindpwd:bindcert host:port:binddn:bindpwd:bindcert

...

[alias] alias = host:port alias = host:port

...

[color] lowmark = color lowmark = color

In the connection section, you specify how this tool may connect to each LDAP server in your replication topology to get the replication-agreement information.

The default binddn is cn=Directory Manager

. Simple bind will be used unless bindcert is specified with the path of a certificate database.

A server may have a dedicated or shared entry in the connection section. The script will find out the most matched entry for a given server. For example, if all the

LDAP servers except host1 share the same binddn and bindpassword

, the connection section will need to contain just two entries:

[connection]

*:*:binddn:bindpassword: host1:*:binddn1:bindpassword1:

In the optional alias section, you may use aliases such as

Master 1

,

Master 2

,

Hub1

, and so on to identify the servers in the replication topology. If used, the output will show these aliases, instead of http(s):// hostname : port .

Chapter 8 Command-Line Scripts 271

Perl Scripts

You may also choose to display CSN time lags between masters and consumers in different colors based on their range. The default color set is green for 0-5 minutes lag, yellow for 5-60 minutes lag, and pink for a lag of 60 minutes and more.

Note that the connection parameters for all the servers in a replication topology must be specified within one configuration file. One configuration file, however, may contain information for multiple replication topology.

Because of the connection parameters, the replication-monitoring tool does not need to do DES decryption of the credentials stored in the Directory Server. Each line in this file could either be a comment started with the

# character or a connection entry of the format: host:port:binddn:bindpwd:bindcert where

• host

, port

, and binddn can be replaced with relevant values or

*

, or omitted altogether. If host is null or * , the entry may apply to any host that does not have a dedicated entry in the file. If port is null or

*

, the port will default to the port stored in the current replication agreement. If binddn is null or * , it defaults to cn=Directory Manager

.

• bindcert can be replaced with the full path to the certificate database, null, or

*. If bindcert is omitted or replaced with

*

, the connection will be simple bind.

For example, your configuration file may look like the example shown below.

#Configuration File for Monitoring Replication Via Admin Express

[connection]

*:*:*:mypassword

[alias]

M1 = host1.example.com:10011

C1 = host4.example.com:10021

C2 = host2.example.com:10022

[color]

0 = #ccffcc

5 = #FFFFCC

60 = #FFCCCC

272 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Appendix A

Using the ns-slapd and slapd.exe

Command-Line Utilities

In Chapter 8, “Command-Line Scripts,” we looked at the scripts for performing routine administration tasks on the Netscape Directory Server (Directory Server).

In this Appendix we will look at the ns-slapd and slapd command-line utilities that can also be used to perform the same tasks.

This chapter contains the following sections:

• Overview of ns-slapd and slapd.exe Commands (page 273)

• Finding and Executing the ns-slapd and slapd.exe Command-Line Utilities

(page 274)

• ns-slapd and slapd.exe Command-Line Utilities for Exporting Databases

(page 275)

• ns-slapd and slapd.exe Command-Line Utilities for Restoring and Backing up

Databases (page 277)

• ns-slapd and slapd.exe Command-Line Utilities for Creating and Regenerating

Indexes (page 281)

Overview of ns-slapd and slapd.exe Commands

The ns-slapd and slapd.exe

command-line utilities all perform server administration tasks, and while it can be argued that they allow a greater degree of flexibility for users, we still recommend that you use the command-line scripts presented in Chapter 8, “Command-Line Scripts.”

273

Finding and Executing the ns-slapd and slapd.exe Command-Line Utilities

ns-slapd (UNIX)

ns-slapd is used on a Unix operating system to start the directory server process, to build a directory database from an LDIF file, or to convert an existing database to an LDIF file. For more information on starting and stopping the Directory

Server, importing from LDIF using the command line, and exporting to LDIF using the command line, see Chapter 4, “Populating Directory Databases” in the Netscape

Directory Server Administrator’s Guide.

slapd.exe (Windows)

slapd.exe

is the ns-slapd

Windows equivalent.

NOTE You must stop the server before running the ns-slapd and slapd.exe

command-line utilities.

Finding and Executing the ns-slapd and slapd.exe Command-Line Utilities

The ns-slapd command-line utilities are stored under: serverRoot /bin/slapd/server/ns-slapd

The slapd.exe

command-line utilities are stored under: serverRoot \bin\slapd\server\slapd.exe

Do not mistake ns-slapd.exe

, the slapd process watchdog, for slapd.exe

on

Windows.

CAUTION In order to execute the command-line utilities, you must change directory to the directory where the command-line utilities are stored. Although it is possible to set command path and library path variables to execute the utilities, this is not recommended procedure because you run the risk, particularly when you have more than one server version installed, not only of disrupting the correct execution of other utilities, but also of compromising the security of the system.

274 Netscape Directory Server Configuration, Command, and File Reference • August 2002

ns-slapd and slapd.exe Command-Line Utilities for Exporting Databases

ns-slapd and slapd.exe Command-Line Utilities for Exporting Databases db2ldif

Exports the contents of the database to LDIF.

Syntax

Shell script (UNIX): ns-slapd db2ldif -D configDir -a outputFile

[-d debugLevel ] [-n backendInstance ] [ -r] [-s includeSuffix ] [-x excludeSuffix ] [-N] [-u] -[U]

Batch file (Windows): slapd.exe db2ldif -D configDir -a outputFile

[-d debugLevel ] [-n backendInstance ] [-r] [-s includeSuffix ] [-x excludeSuffix ] [-N] [-u] [-U]

For slapdserverID , which is the location of your server configuration directory, enter the full path. You must also specify either the

-n or the

-s option.

Options

Option Parameter

-a outputFile

-d

-D

-N debugLevel configDir

Description

Defines the output file in which the server saves the exported

LDIF. This file is stored by default in the directory where the command-line utility resides.

Specifies the debug level to use during the db2ldif runtime.

For further information see “nsslapd-errorlog-level (Error Log

Level)” on page 56.

Specifies the location of the server configuration directory that contains the configuration information for the export process.

You must specify the full path to the slapdserverID directory.

Specifies that entry IDs are not to be included in the LDIF output. The entry IDs are necessary only if the db2ldif output is to be used as input to db2index .

Appendix A Using the ns-slapd and slapd.exe Command-Line Utilities 275

ns-slapd and slapd.exe Command-Line Utilities for Exporting Databases

Option Parameter

-r

-s

-u

-U

-x

-n

Description includeSuffix

Causes the server to include the copiedFrom attribute and its contents in the LDIF output when importing the LDIF file to a consumer server. This information is required by the server by the replication process.

Note that if you use the -r option, you also need to specify the suffix you want to export by using the -s option. You must shut down the server before exporting using this option.

Specifies the suffix or suffixes to include in the export. You may use multiple -s arguments. If you do not specify -s or

-x , the server exports all suffixes within the database. If you use both -x and -s arguments with the same suffix, the -x operation takes precedence. Exclusion always takes precedence over inclusion.

Note if you exclude one or more suffixes from the exported

LDIF file, and you intend to import the LDIF file into your configuration directory, do not exclude o=NetscapeRoot . If you use -s to specify a suffix to include, and you intend to import the LDIF file into your configuration directory, make sure that you also use -s to include o=NetscapeRoot .

Specifies that the uniqueID will not be included in the LDIF output. By default, the server includes the uniqueID for all entries with a uniqueID in the exported LDIF file.

Use this option if you intend to use the exported LDIF to initialize a 4.x consumer server. However, do not use this option when you are importing into a 5.x consumer, as it does not cause the server to create a uniqueID for entries but simply takes what already exists in the database.

Outputs the contents of the database without wrapping lines.

excludeSuffix Specifies a suffix or suffixes to exclude in the export. You may use multiple -x arguments. If you do not specify -s or -x , the server exports all suffixes within the database. If you use both

-x and -s options with the same suffix, the -x operation takes precedence. Exclusion always takes precedence over inclusion. If you intend to import the LDIF file into your configuration directory, do not exclude o=NetscapeRoot .

backendInstance Specifies the name of the backend instance to be exported.

276 Netscape Directory Server Configuration, Command, and File Reference • August 2002

ns-slapd and slapd.exe Command-Line Utilities for Restoring and Backing up Databases

ns-slapd and slapd.exe Command-Line Utilities for Restoring and Backing up Databases ldif2db

Imports LDIF files to the database.

Syntax

Shell script (UNIX): ns-slapd ldif2db -D configDir -i ldifFile

[-d debugLevel ] [-g string ] [-n backendInstance ] -O

[-s includeSuffix ] -x excludeSuffix ]

Batch file (Windows): slapd ldif2db -D configDir -i ldifFile [-d debugLevel ]

[-g string ] [-n backendInstance ] [-O] [-s includeSuffix ]

[-x excludeSuffix ]

For configDir , which is the location of your server configuration directory, enter the full path. ldifFile is the name of the file containing the LDIF to be imported. You can find a demo LDIF file under the serverRoot /slapdserverID /ldif directory. You must also specify either the

-n or the

-s option.

Options

Option Parameter

-d debugLevel

-D configDir

Description

Specifies the debug level to use during runtime. For further information see “nsslapd-errorlog-level (Error Log Level)” on page 56.

Specifies the location of the server configuration directory that contains the configuration information for the import process.

You must specify the full path to the slapdserverID directory.

Appendix A Using the ns-slapd and slapd.exe Command-Line Utilities 277

ns-slapd and slapd.exe Command-Line Utilities for Restoring and Backing up Databases

Option Parameter

-g

-i

-n

-O

-s

Description string Generation of a unique ID. Type none for no unique ID to be generated and deterministic for the generated unique ID to be name based. By default a time based unique ID is generated.

If you use the deterministic generation to have a name-based unique ID, you can also specify the namespace you want the server to use as follows:

g deterministic namespace_id where namespace_id is a string of characters in the following format

00-xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx

Use this option if you want to import the same LDIF file into two different directory servers, and you want the contents of both directories to have the same set of unique IDs. If unique

IDs already exist in the LDIF file you are importing, then the existing IDs are imported to the server regardless of the options you have specified.

ldifFile Specifies the LDIF file to be imported. This option is required.

You can use multiple -i arguments to import more than one

LDIF file at a time. When you import multiple files, the server imports the LDIF files in the order in which you specify them from the command line.

backendInstance Specifies the name of the backend to be imported.

includeSuffix

Specifies that no attribute indexes are created for the imported database. If you specify this option and you want to restore the indexes later, you will need to recreate the indexes by hand. See the Netscape Directory Server Administrator’s Guide for further information.

Specifies the suffix or suffixes within the LDIF file you want to import. If you use -s to specify a suffix to include, and you are importing the LDIF file into your configuration directory, make sure that you also use -s to include o=NetscapeRoot .

You can use multiple -s arguments. If you use both -x and -s with the same suffix, -x takes precedence. Exclusion always takes precedence over inclusion. If you do not specify -x or

-s , then all available suffixes will be imported from the LDIF file.

278 Netscape Directory Server Configuration, Command, and File Reference • August 2002

ns-slapd and slapd.exe Command-Line Utilities for Restoring and Backing up Databases

Option Parameter

-x excludeSuffix

Description

Allows you to specify suffixes within the LDIF file to exclude during the import. You can use multiple -x arguments. This option lets you selectively import portions of the LDIF file. If you use both -x and -s with the same suffix, -x takes precedence. Exclusion always takes precedence over inclusion. If you do not specify -x or -s , then all available suffixes will be imported from the LDIF file. If you are importing the LDIF file into your configuration directory, do not exclude o=NetscapeRoot .

CAUTION If you are importing the LDIF file into your configuration directory, make sure the o=NetscapeRoot suffix and its contents are included in your LDIF file before you import. Do not exclude the suffix o=NetscapeRoot using

-s

,

-x

, or combination of the two. The

Netscape Administration Server uses this suffix to store information about installed Netscape servers. Failure to import o=NetscapeRoot into your configuration directory could force you to reinstall (or restore from backup) all of your Netscape 4.x servers including the

Directory Server.

archive2db

Restores database from the archives.

Syntax

Shell script (UNIX): slapd archive2db -D configDir -a archiveDir

Batch file (Windows): slapd archive2db -D configDir -a archiveDir

Appendix A Using the ns-slapd and slapd.exe Command-Line Utilities 279

ns-slapd and slapd.exe Command-Line Utilities for Restoring and Backing up Databases

Options

Option Parameter Description

-D

-a configDir Specifies the location of the server configuration directory that contains the configuration information for the index creation process. You must specify the full path to the slapdserverID directory.

archiveDir Specifies the archive directory.

db2archive

Backs up all databases to the archives.

Syntax

Shell script (UNIX): slapd db2archive -D configDir -a archiveDir

Batch file (Windows): slapd db2archive -D configDir -a archiveDir

Options

Option Parameter Description

-D

-a configDir Specifies the location of the server configuration directory that contains the configuration information for the index creation process. You must specify the full path to the slapdserverID directory.

archiveDir Specifies the archive directory.

280 Netscape Directory Server Configuration, Command, and File Reference • August 2002

ns-slapd and slapd.exe Command-Line Utilities for Creating and Regenerating Indexes

ns-slapd and slapd.exe Command-Line Utilities for Creating and Regenerating Indexes db2index

Creates and regenerates indexes.

Syntax

Shell script (UNIX): slapd db2index -D configDir [-d debugLevel ]

-n backendName

-t attributeName [: indexTypes [: matchingRules ]] | [-T vlvTag ]

Batch file (Windows): slapd db2index -D configDir [-d debugLevel ]

-n backendName

-t attributeName [: indexTypes [: matchingRules ]] | [-T vlvTag ]

Options

Option Parameter

-d

-D

-n

Description debugLevel configDir

Specifies the debug level to use during index creation. For further information see “nsslapd-errorlog-level (Error Log

Level)” on page 56.

Specifies the location of the server configuration directory that contains the configuration information for the index creation process. You must specify the full path to the slapdserverID directory.

backendName Specifies the name of the backend containing the entries to index.

Appendix A Using the ns-slapd and slapd.exe Command-Line Utilities 281

ns-slapd and slapd.exe Command-Line Utilities for Creating and Regenerating Indexes

Option Parameter

-t

-T

Description attributeName Specifies the attribute to be indexed as well as the types of indexes to create and matching rules to apply (if any). If you want to specify a matching rule, you must specify an index type.

You cannot use this option with option -T .

indexTypes specifies a comma separated list of indexes to be created for the attributes.

vlvTag

matchingRules is an optional, comma-separated list of the OIDs for the languages in which you want the attribute to be indexed.

This option is used to created international indexes. For information on supported locales and collation order OIDs, see

Appendix D, “Internationalization” in the Netscape Directory

Server Administrator’s Guide.

Specifies the VLV tag to use to create VLV indexes. You can use the console to specify VLV tags for each database supporting your directory tree, as described in xref. You can define additional VLV tags by creating them in LDIF, and adding them in the directory server configuration, as described in xref. You cannot use this option with option -t .

282 Netscape Directory Server Configuration, Command, and File Reference • August 2002

Glossary

access control instruction See ACI.

ACI Access Control Instruction. An instruction that grants or denies permissions to entries in the directory.

access control list See ACL.

ACL Access control list. The mechanism for controlling access to your directory.

access rights In the context of access control, specify the level of access granted or denied. Access rights are related to the type of operation that can be performed on the directory. The following rights can be granted or denied: read, write, add, delete, search, compare, self-write, proxy and all.

account inactivation Disables a user account, group of accounts, or an entire domain so that all authentication attempts are automatically rejected.

All IDs Threshold A size limit which is globally applied to every index key managed by the server. When the size of an individual ID list reaches this limit, the server replaces that ID list with an All IDs token.

All IDs token A mechanism which causes the server to assume that all directory entries match the index key. In effect, the All IDs token causes the server to behave as if no index was available for the search request.

anonymous access When granted, allows anyone to access directory information without providing credentials, and regardless of the conditions of the bind.

approximate index Allows for efficient approximate or “sounds-like” searches.

283

attribute Holds descriptive information about an entry. Attributes have a label and a value. Each attribute also follows a standard syntax for the type of information that can be stored as the attribute value.

attribute list A list of required and optional attributes for a given entry type or object class.

authenticating directory server In pass-through authentication (PTA), the authenticating directory server is the directory server that contains the authentication credentials of the requesting client. The PTA-enabled host sends

PTA requests it receives from clients to the bind host.

authentication (1) Process of proving the identity of the client user to the

Directory Server. Users must provide a bind DN and either the corresponding password or certificate in order to be granted access to the directory. Directory

Server allows the user to perform functions or access files and directories based on the permissions granted to that user by the directory administrator.

(2) Allows a client to make sure they are connected to a secure server, preventing another computer from impersonating the server or attempting to appear secure when it is not.

authentication certificate Digital file that is not transferable and not forgeable and is issued by a third party. Authentication certificates are sent from server to client or client to server in order to verify and authenticate the other party.

base DN Base distinguished name. A search operation is performed on the base

DN, the DN of the entry and all entries below it in the directory tree.

base distinguished name See base DN.

bind DN Distinguished name used to authenticate to Directory Server when performing an operation.

bind distinguished name See bind DN.

bind rule In the context of access control, the bind rule specifies the credentials and conditions that a particular user or client must satisfy in order to get access to directory information.

branch entry An entry that represents the top of a subtree in the directory.

284 Netscape Directory Server Configuration, Command, and File Reference • August 2002

browser Software, such as Netscape Navigator, used to request and view World

Wide Web material stored as HTML files. The browser uses the HTTP protocol to communicate with the host server.

browsing index Otherwise known as the virtual view index, speeds up the display of entries in the Directory Server Console. Browsing indexes can be created on any branchpoint in the directory tree to improve display performance.

CA See Certificate Authority.

cascading replication In a cascading replication scenario, one server, often called the hub supplier acts both as a consumer and a supplier for a particular replica. It holds a read-only replica and maintains a change log. It receives updates from the supplier server that holds the master copy of the data, and in turn supplies those updates to the consumer.

certificate A collection of data that associates the public keys of a network user with their DN in the directory. The certificate is stored in within the directory as user object attributes.

Certificate Authority Company or organization that sells and issues authentication certificates. You may purchase an authentication certificate from a

Certification Authority that you trust. Also known as a CA.

CGI Common Gateway Interface. An interface for external programs to communicate with the HTTP server. Programs written to use CGI are called CGI programs or CGI scripts, and can be written in many of the common programming languages. CGI programs handle forms or perform output parsing that is not done by the server itself.

chaining A method for relaying requests to another server. Results for the request are collected, compiled and then returned to the client.

change log A change log is record that describes the modifications that have occurred on a replica. The supplier server then replays these modifications on the replicas stored on consumer servers, or on other masters, in the case of multi-master replication.

character type Distinguishes alphabetic characters from numeric or other characters and the mapping of upper-case to lower-case letters.

ciphertext Encrypted information that cannot be read by anyone without the proper key to decrypt the information.

Glossary 285

CIR See consumer-initiated replication.

class definition Specifies the information needed to create an instance of a particular object and determines how the object works in relation to other objects in the directory.

class of service See CoS.

classic CoS A classic CoS identifies the template entry by both its DN and the value of one of the target entry’s attributes.

client See LDAP client.

code page An internal table used by a locale in the context of the internationalization plug-in that the operating system uses to relate keyboard keys to character font screen displays.

collation order Provides language and cultural-specific information about how the characters of a given language are to be sorted. This information might include the sequence of letters in the alphabet or how to compare letters with accents to letters without accents.

consumer Server containing replicated directory trees or subtrees from a supplier server.

consumer-initiated replication Replication configuration where consumer servers pull directory data from supplier servers.

consumer server In the context of replication, a server that holds a replica that is copied from a different server is called a consumer for that replica.

CoS A method for sharing attributes between entries in a way that is invisible to applications.

CoS definition entry Identifies the type of CoS you are using. It is stored as an

LDAP subentry below the branch it affects.

CoS template entry Contains a list of the shared attribute values.

daemon A background process on a Unix machine that is responsible for a particular system task. Daemon processes do not need human intervention to continue functioning.

286 Netscape Directory Server Configuration, Command, and File Reference • August 2002

DAP Directory Access Protocol. The ISO X.500 standard protocol that provides client access to the directory.

Data Master The server that is the master source of a particular piece of data.

database link An implementation of chaining. The database link behaves like a database but has no persistent storage. Instead, it points to data stored remotely.

default index One of a set of default indexes created per database instance.

Default indexes can be modified, although care should be taken before removing them, as certain plug-ins may depend on them.

definition entry See CoS definition entry.

Directory Access Protocol See DAP.

directory tree The logical representation of the information stored in the directory. It mirrors the tree model used by most file systems, with the tree’s root point appearing at the top of the hierarchy. Also known as DIT.

Directory Manager The privileged database administrator, comparable to the root user in UNIX. Access control does not apply to the directory manager.

Directory Server Gateway (DSGW) A collection of CGI forms that allows a browser to perform LDAP client functions, such as querying and accessing a

Directory Server, from a web browser.

directory service A database application designed to manage descriptive, attribute-based information about people and resources within an organization.

distinguished name String representation of an entry’s name and location in an

LDAP directory.

DIT See directory tree.

DM See Directory Manager.

DNS Domain Name System. The system used by machines on a network to associate standard IP addresses (such as 198.93.93.10) with hostnames (such as www.example.com

). Machines normally get the IP address for a hostname from a

DNS server, or they look it up in tables maintained on their systems.

Glossary 287

DNS alias A DNS alias is a hostname that the DNS server knows points to a different host—specifically a DNS CNAME record. Machines always have one real name, but they can have one or more aliases. For example, an alias such as www.[yourdomain].[domain] might point to a real machine called realthing.[yourdomain].[domain] where the server currently exists.

DSGW See Directory Server Gateway (DSGW).

entry A group of lines in the LDIF file that contains information about an object.

entry distribution Method of distributing directory entries across more than one server in order to scale to support large numbers of entries.

entry ID list Each index that the directory uses is composed of a table of index keys and matching entry ID lists. The entry ID list is used by the directory to build a list of candidate entries that may match the client application’s search request.

equality index Allows you to search efficiently for entries containing a specific attribute value.

file extension The section of a filename after the period or dot (.) that typically defines the type of file (for example, .GIF and .HTML). In the filename index.html

the file extension is html

.

file type The format of a given file. For example, graphics files are often saved in

GIF format, while a text file is usually saved as ASCII text format. File types are usually identified by the file extension (for example, .GIF or .HTML).

filter A constraint applied to a directory query that restricts the information returned.

filtered role Allows you to assign entries to the role depending upon the attribute contained by each entry. You do this by specifying an LDAP filter. Entries that match the filter are said to possess the role.

gateway See Directory Server Gateway (DSGW).

general access When granted, indicates that all authenticated users can access directory information.

hostname A name for a machine in the form machine.domain.dom, which is translated into an IP address. For example, www.example.com

is the machine www in the subdomain example and com domain.

288 Netscape Directory Server Configuration, Command, and File Reference • August 2002

HTML Hypertext Markup Language. The formatting language used for documents on the World Wide Web. HTML files are plain text files with formatting codes that tell browsers such as the Netscape Navigator how to display text, position graphics and form items, and display links to other pages.

HTTP Hypertext Transfer Protocol. The method for exchanging information between HTTP servers and clients.

HTTPD An abbreviation for the HTTP daemon or service, a program that serves information using the HTTP protocol. The daemon or service is often called an httpd.

HTTP-NG The next generation of Hypertext Transfer Protocol.

HTTPS A secure version of HTTP, implemented using the Secure Sockets Layer,

SSL.

hub supplier In the context of replication, a server that holds a replica that is copied from a different server, and in turn replicates it to a third server. See also cascading replication.

index key Each index that the directory uses is composed of a table of index keys and matching entry ID lists.

indirect CoS An indirect CoS identifies the template entry using the value of one of the target entry’s attributes.

international index Speeds up searches for information in international directories.

International Standards Organization See ISO.

IP address Internet Protocol address. A set of numbers, separated by dots, that specifies the actual location of a machine on the Internet (for example,

198.93.93.10).

ISO International Standards Organization knowledge reference Pointers to directory information stored in different databases.

LDAP Lightweight Directory Access Protocol. Directory service protocol designed to run over TCP/IP and across multiple platforms.

Glossary 289

LDAPv3 Version 3 of the LDAP protocol, upon which Directory Server bases its schema format

LDAP client Software used to request and view LDAP entries from an LDAP

Directory Server. See also browser.

LDAP Data Interchange Format See LDAP Data Interchange Format.

LDAP URL Provides the means of locating directory servers using DNS and then completing the query via LDAP. A sample LDAP URL is ldap://ldap.example.com

LDBM database A high-performance, disk-based database consisting of a set of large files that contain all of the data assigned to it. The primary data store in

Directory Server.

LDIF LDAP Data Interchange Format. Format used to represent Directory Server entries in text form.

leaf entry An entry under which there are no other entries. A leaf entry cannot be a branch point in a directory tree.

Lightweight Directory Access Protocol See LDAP.

locale Identifies the collation order, character type, monetary format and time / date format used to present data for users of a specific region, culture, and/or custom. This includes information on how data of a given language is interpreted, stored, or collated. The locale also indicates which code page should be used to represent a given language.

managed object A standard value which the SNMP agent can access and send to the NMS. Each managed object is identified with an official name and a numeric identifier expressed in dot-notation.

managed role Allow you to create an explicit enumerated list of members.

management information base See MIB.

mapping tree A data structure that associates the names of suffixes (subtrees) with databases.

master agent See SNMP master agent.

290 Netscape Directory Server Configuration, Command, and File Reference • August 2002

matching rule Provides guidelines for how the server compares strings during a search operation. In an international search, the matching rule tells the server what collation order and operator to use.

MD5 A message digest algorithm by RSA Data Security, Inc., which can be used to produce a short digest of data, that is unique with high probability, and is mathematically extremely hard to produce a piece of data that will produce the same message digest.

MD5 signature A message digest produced by the MD5 algorithm.

MIB Management Information Base. All data, or any portion thereof, associated with the SNMP network. We can think of the MIB as a database which contains the definitions of all SNMP managed objects. The MIB has a tree like hierarchy, where the top level contains the most general information about the network and lower levels deal with specific, separate network areas.

MIB namespace Management Information Namespace. The means for directory data to be named and referenced. Also called the directory tree.

monetary format Specifies the monetary symbol used by specific region, whether the symbol goes before or after its value, and how monetary units are represented.

multi-master replication An advanced replication scenario in which two servers each hold a copy of the same read-write replica. Each server maintains a change log for the replica. Modifications made on one server are automatically replicated to the other server. In case of conflict, a time stamp is used to determine which server holds the most recent version.

multiplexor The server containing the database link that communicates with the remote server.

n + 1 directory problem The problem of managing multiple instances of the same information in different directories, resulting in increased hardware and personnel costs.

name collisions Multiple entries with the same distinguished name.

nested role Allow you to create roles that contain other roles.

network management application Network Management Station component that graphically displays information about SNMP managed devices (which device is up or down, which and how many error messages were received, etc.).

Glossary 291

network management station See NMS.

NIS Network Information Service. A system of programs and data files that Unix machines use to collect, collate, and share specific information about machines, users, file systems, and network parameters throughout a network of computers.

NMS Network Management Station. Powerful workstation with one or more network management applications installed.

ns-slapd Netscape’s LDAP Directory Server daemon or service that is responsible for all actions of the Directory Server. See also slapd.

object class Defines an entry type in the directory by defining which attributes are contained in the entry.

object identifier A string, usually of decimal numbers, that uniquely identifies a schema element, such as an object class or an attribute, in an object-oriented system. Object identifiers are assigned by ANSI, IETF or similar organizations.

OID See object identifier.

operational attribute Operational attributes contain information used internally by the directory to keep track of modifications and subtree properties. They are not returned in response to a search unless explicitly requested.

parent access When granted, indicates that users have access to entries below their own in the directory tree, that is, if the bind DN is the parent of the targeted entry.

pass-through authentication See PTA.

pass-through subtree In pass-through authentication, the PTA directory server will pass through bind requests to the authenticating directory server from all clients whose DN is contained in this subtree.

password file A file on Unix machines that stores Unix user login names, passwords, and user ID numbers. It is also known as

/etc/passwd

, because of where it is kept.

password policy A set of rules that govern how passwords are used in a given directory.

292 Netscape Directory Server Configuration, Command, and File Reference • August 2002

permission In the context of access control, the permission states whether access to the directory information is granted or denied, and the level of access that is granted or denied. See access rights.

PDU Protocol Data Unit. Encoded messages which form the basis of data exchanges between SNMP devices.

pointer CoS A pointer CoS identifies the template entry using the template DN only.

presence index Allows you to search for entries that contain a specific indexed attribute.

protocol A set of rules that describes how devices on a network exchange information.

protocol data unit See PDU.

proxy authentication A special form of authentication where the user requesting access to the directory does not bind with its own DN but with a proxy DN.

proxy DN Used with proxied authorization. The proxy DN is the DN of an entry that has access permissions to the target on which the client-application is attempting to perform an operation.

PTA Pass-through authentication. Mechanism by which one directory server consults another to check bind credentials.

PTA directory server In pass-through authentication (PTA), the PTA directory server is the server that sends (passes through) bind requests it receives to the authenticating directory server.

PTA LDAP URL In pass-through authentication, the URL that defines the authenticating directory server, pass-through subtree(s) and optional parameters.

RAM Random access memory. The physical semiconductor-based memory in a computer. Information stored in RAM is lost when the computer is shut down.

rc.local

A file on Unix machines that describes programs that are run when the machine starts. It is also called /etc/rc.local

because of its location.

Glossary 293

RDN Relative distinguished name. The name of the actual entry itself, before the entry’s ancestors have been appended to the string to form the full distinguished name.

referential integrity Mechanism that ensures that relationships between related entries are maintained within the directory.

referral (1) When a server receives a search or update request from an LDAP client that it cannot process, it usually sends back to the client a pointer to the

LDAP sever that can process the request.

(2) In the context of replication, when a read-only replica receives an update request, it forwards it to the server that holds the corresponding read-write replica.

This forwarding process is called a referral.

replica A database that participates in replication read-only replica A replica that refers all update operations to read-write replicas. A server can hold any number of read-only replicas.

read-write replica A replica that contains a master copy of directory information and can be updated. A server can hold any number of read-write replicas.

relative distinguished name See RDN.

replication Act of copying directory trees or subtrees from supplier servers to consumer servers.

replication agreement Set of configuration parameters that are stored on the supplier server and identify the databases to replicate, the consumer servers to which the data is pushed, the times during which replication can occur, the DN and credentials used by the supplier to bind to the consumer, and how the connection is secured.

RFC Request For Comments. Procedures or standards documents submitted to the Internet community. People can send comments on the technologies before they become accepted standards.

role An entry grouping mechanism. Each role has members, which are the entries that possess the role.

role-based attributes Attributes that appear on an entry because it possesses a particular role within an associated CoS template.

294 Netscape Directory Server Configuration, Command, and File Reference • August 2002

root The most privileged user available on Unix machines. The root user has complete access privileges to all files on the machine.

root suffix The parent of one or more sub suffixes. A directory tree can contain more than one root suffix.

schema Definitions describing what types of information can be stored as entries in the directory. When information that does not match the schema is stored in the directory, clients attempting to access the directory may be unable to display the proper results.

schema checking Ensures that entries added or modified in the directory conform to the defined schema. Schema checking is on by default and users will receive an error if they try to save an entry that does not conform to the schema.

Secure Sockets Layer See SSL.

self access When granted, indicates that users have access to their own entries, that is, if the bind DN matches the targeted entry.

Server Console Java-based application that allows you to perform administrative management of your Directory Server from a GUI.

server daemon The server daemon is a process that, once running, listens for and accepts requests from clients.

server service The server service is a process on Windows that, once running, listens for and accepts requests from clients. It is the SMB server on Windows NT.

server root A directory on the server machine dedicated to holding the server program and configuration, maintenance, and information files.

Server Selector Interface that allows you select and configure servers using a browser.

service A background process on a Windows machine that is responsible for a particular system task. Service processes do not need human intervention to continue functioning.

SIE Server Instance Entry.

Simple Network Management Protocol See SNMP.

Glossary 295

single-master replication The most basic replication scenario in which two servers each hold a copy of the same read-write replicas to consumer servers. In a single-master replication scenario, the supplier server maintains a change log.

SIR See supplier-initiated replication.

slapd LDAP Directory Server daemon or service that is responsible for most functions of a directory except replication. See also ns-slapd.

SNMP Simple Network Management Protocol. Used to monitor and manage application processes running on the servers, by exchanging data about network activity.

SNMP master agent Software that exchanges information between the various subagents and the NMS.

SNMP subagent Software that gathers information about the managed device and passes the information to the master agent.

SSL Secure Sockets Layer. A software library establishing a secure connection between two parties (client and server) used to implement HTTPS, the secure version of HTTP.

standard index Indexes that are maintained by default.

sub suffix A branch underneath a root suffix.

subagent See SNMP subagent.

substring index Allows for efficient searching against substrings within entries.

Substring indexes are limited to a minimum of two characters for each entry.

suffix The name of the entry at the top of the directory tree, below which data is stored. Multiple suffixes are possible within the same directory. Each database only has one suffix.

superuser The most privileged user available on Unix machines (also called root). The superuser has complete access privileges to all files on the machine.

supplier Server containing the master copy of directory trees or subtrees that are replicated to consumer servers.

296 Netscape Directory Server Configuration, Command, and File Reference • August 2002

supplier server In the context of replication, a server that holds a replica that is copied to a different server is called a supplier for that replica.

supplier-initiated replication Replication configuration where supplier servers replicate directory data to consumer servers.

symmetric encryption Encryption that uses the same key for both encrypting and decrypting. DES is an example of a symmetric encryption algorithm.

system index Cannot be deleted or modified as it is essential to Directory Server operations.

target In the context of access control, the target identifies the directory information to which a particular ACI applies.

target entry The entries within the scope of a CoS.

TCP/IP Transmission Control Protocol/Internet Protocol. The main network protocol for the Internet and for enterprise (company) networks.

template entry See CoS template entry.

time / date format Indicates the customary formatting for times and dates in a specific region.

TLS Transport Layer Security. The new standard for secure socket layers, a public key based protocol.

topology The way a directory tree is divided among physical servers and how these servers link with one another.

Transport Layer Security See TLS.

uid A unique number associated with each user on a Unix system.

URL Uniform Resource Locator. The addressing system used by the server and the client to request documents. It is often called a location. The format of a URL is

[protocol]://[machine:port]/[document]

. The port number is necessary only on selected servers, and it is often assigned by the server, freeing the user of having to place it in the URL.

Glossary 297

virtual list view index Otherwise known as a browsing index, speeds up the display of entries in the Directory Server Console. Virtual list view indexes can be created on any branchpoint in the directory tree to improve display performance.

X.500 standard The set of ISO/ITU-T documents outlining the recommended information model, object classes and attributes used by directory server implementations.

298 Netscape Directory Server Configuration, Command, and File Reference • August 2002

SYMBOLS

::, in LDIF statements 233

NUMERICS

00core.ldif

ldif files 115

05rfc2247.ldif

ldif files 115

05rfc2927.ldif

ldif files 115

10rfc2307.ldif

ldif files 115

20subscriber.ldif

ldif files 115

25java-object.ldif

ldif files 115

28pilot.ldif

ldif files 115

30ns-common.ldif

ldif files 115

50ns-admin.ldif

ldif files 115

50ns-calendar.ldif

ldif files 115

50ns-certificate.ldif

ldif files 115

50ns-compass.ldif

ldif files 116

Index

50ns-delegated-admin.ldif

ldif files 116

50ns-directory.ldif

ldif files 116

50ns-legacy.ldif

ldif files 116

50ns-mail.ldif

ldif files 116

50ns-mcd-browser.ldif

ldif files 116

50ns-mcd-config.ldif

ldif files 116

50ns-mcd-li.ldif

ldif files 116

50ns-mcd-mail.ldif

ldif files 116

50ns-media.ldif

ldif files 116

50ns-mlm.ldif

ldif files 116

50ns-msg.ldif

ldif files 116

50ns-netshare.ldif

ldif files 116

50ns-news.ldif

ldif files 116

50ns-proxy.ldif

ldif files 116

50ns-value.ldif

ldif files 116

50ns-wcal.ldif

ldif files 116

299

50ns-web.ldif

ldif files 116

51ns-calendar.ldif

ldif files 115

99user.ldif

ldif files 117

LDAP result codes 202 levels 190 sample 1 (level 256) 191 sample 2 (level 4) 199 sample 3 (level 512) 200 statistics for monitoring and optimizing directory usage 261 tool for analyzing 190, 260 alias dereferencing 223

A access log connection code 201

A1 201

B1 201

B2 201

B3 201

B4 201

P2 201

T1 201

T2 202

U1 202 contents 189 abandon message (ABANDON) 197 change sequence number (csn) 197 connection description (conn) 200 connection number (conn) 192 elapsed time (etime) 194 error number (err) 193 extended operation OID (oid) 196 file descriptor (fd) 192 format 190

LDAP request type 194

LDAP response type 195 message ID (msgid) 198 method type (method) 193 number of entries (nentries) 194 operation number (op) 193 options description (options) 200

SASL multi-stage binds 198 scope of the search (scope) 196 slot number (slot) 192 sort (SORT) 195 tag number (tag) 193 unindexed search indicator (notes=U) 195 version number (version) 193

VLV-related entries 195

B backendMonitorDN attribute 110 backup files 185 bak2db command-line shell and batch script 242 quick reference 238 bak2db.pl

command-line perl script 255 quick reference 240

Base 233 base 64 encoding 233 binary data, LDIF and 233

Browsing Indexes 253 bytessentattribute 110

C changelog multi-master replication changelog 88 changelog configuration attributes changelogmaxentries 90 nsslapd-changelogdir 89 nsslapd-changelogmaxage 90 changelog configuration entries cn=changelog5 88 ciphers list of 93 cn attribute 96, 167 cn=changelog5 changelog configuration entries 88

300 Netscape Directory Server Configuration, Command, and File Reference • August 2002

object classes 88 cn=config general 27 general configuration entries 37 object classes 37 cn=config Directory Information Tree configuration data 28 cn=encryption encryption configuration entries 91 object classes 91 cn=mapping tree object classes 94 suffix and replication configuration entries 94 cn=monitor object classes 109 read-only monitoring configuration entries 109 cn=NetscapeRoot configuration 31 cn=SNMP object classes 111

SNMP configuration entries 111 cn=uniqueid generator object classes 113 uniqueid generator configuration entries 113 cn=UserRoot configuration 31 command-line scripts 237 bak2db 242 bak2db.pl 255 db2bak 242 db2bak.pl 255 db2dsml 244 db2index 245 db2index.pl 256 db2ldif 243 db2ldif.pl 257 dsml2db 246 finding and executing 237 getpwenc 246 ldif2db 247 ldif2db.pl 258 ldif2ldap 249 monitor 249 ns-accountstatus.pl 266 ns-activate.pl 267 ns-inactivate.pl 267 perl scripts 254–272 quick reference 238–241 restart-slapd 250 restoreconfg 250 saveconfig 251 shell and batch scripts 241–254 start-slapd 251 stop-slapd 252 suffix2instance 253 template-cl-dump.pl 268 template-repl-monitor.pl 269 vlvindex 253 command-line utilities dbscan 234–235 finding and executing 217 ldapdelete 230–233 ldapmodify 225–230 ldapsearch 220–225 ldif 233–234

Configuration plug-in functionality 30 configuration access control 32 accessing and modifying 32 changing attributes 33 cn=NetscapeRoot 31 cn=UserRoot 31 database-specific 28 overview 27 configuration attributes changelog5 configuration attributes 88–91 changing 33 core server configuration attributes 35–114 database link plug-in configuration attributes 170–181 database plug-in configuration attributes 145–170 encryption configuration attributes 91–93 mapping tree configuration attributes 94–109 monitoring configuration attributes 109–111 overview 29 plug-in functionality configuration attributes 141–181 plug-in functionality configuration attributes allowed by certain plug-ins 144–145 plug-in functionality configuration attributes common to all plug-ins 141–144

Index 301

replication agreement configuration attributes 101–109 replication configuration attributes 96–101 restrictions to modifying 35 retro changelog plug-in configuration attributes 181–182

SNMP configuration attributes 111–113 suffix configuration attributes 95–96 uniqueid generator configuration attributes 113–114 configuration changes requiring server restart 35, 117 configuration entries modifying using LDAP 34 restrictions to modifying 35 configuration files 185 location of 32 configuration files, pre-6.x

migration to LDIF format 32 configuration information tree dse.ldif file 35 connection attribute 109 connection code 201 core server configuration attributes backendMonitorDN 110 bytessent 110 cn 96 connection 109 currentconnection 109 currenttime 110 description 101 dtablesize 109 entriessent 110 nbackends 110 nsDS50ruv 109 nsDS5Flags 96 nsDS5ReplicaBindDN 97, 101 nsDS5ReplicaBindMethod 102 nsDS5ReplicaChangeCount 97 nsDS5ReplicaChangesSentSinceStartup 102 nsDS5ReplicaCredentials 103 nsDS5ReplicaHost 103 nsDS5ReplicaID 98 nsDS5ReplicaLastInitEnd 103 nsDS5ReplicaLastInitStart 104 nsDS5ReplicaLastInitStatus 104

302 Netscape Directory Server Configuration, Command, and File Reference • August 2002 nsDS5ReplicaLastUpdateEnd 105 nsDS5ReplicaLastUpdateStart 105 nsDS5ReplicaLastUpdateStatus 105 nsDS5ReplicaLegacyConsumer 98 nsDS5ReplicaName 98 nsDS5ReplicaPort 106 nsDS5ReplicaPurgeDelay 99 nsDS5ReplicaReapActive 106 nsDS5ReplicaReferral 99 nsDS5ReplicaRefresh 106 nsDS5ReplicaRoot 99, 107 nsDS5ReplicaTimeout 107 nsDS5ReplicaTombstonePurgeInterval 100 nsDS5ReplicaTransportInfo 108 nsDS5ReplicaType 100 nsDS5ReplicaUpdateInProgress 108 nsDS5ReplicaUpdateSchedule 108 nsslapd-accesscontrol 37 nsslapd-accesslog 37 nsslapd-accesslog-level 38 nsslapd-accesslog-list 39 nsslapd-accesslog-logbuffering 39 nsslapd-accesslog-logexpirationtime 39, 81 nsslapd-accesslog-logexpirationtimeunit 40, 44 nsslapd-accesslog-logging-enabled 40 nsslapd-accesslog-logmaxdiskspace 41 nsslapd-accesslog-logminfreediskspace 42 nsslapd-accesslog-logrotationsync-enabled 42 nsslapd-accesslog-logrotationsynchour 43 nsslapd-accesslog-logrotationsyncmin 43 nsslapd-accesslog-logrotationtime 43 nsslapd-accesslog-maxlogsize 44 nsslapd-accesslog-maxlogsperdir 45 nsslapd-attribute-name-exceptions 45 nsslapd-auditlog-list 47 nsslapd-auditlog-logexpirationtime 47 nsslapd-auditlog-logexpirationtimeunit 47 nsslapd-auditlog-logging-enabled 48 nsslapd-auditlog-logmaxdiskspace 48 nsslapd-auditlog-logmaxsdiskspace 48 nsslapd-auditlog-logminfreediskspace 49 nsslapd-auditlog-logrotationsync-enabled 49 nsslapd-auditlog-logrotationsynchour 50 nsslapd-auditlog-logrotationsyncmin 50 nsslapd-auditlog-logrotationtime 51 nsslapd-auditlog-logrotationtimeunit 51 nsslapd-auditlog-maxlogsize 52

nsslapd-auditlog-maxlogsperdir 52 nsslapd-backend 95 nsslapd-certmap-basedn 53 nsslapd-changelogdir 89 nsslapd-changelogmaxage 90 nsslapd-changelogmaxentries 90 nsslapd-config 53 nsslapd-csnlogging 53 nsslapd-ds4-compatible-schema 54 nsslapd-errorlog 55 nsslapd-errorlog-level 56 nsslapd-errorlog-llist 57 nsslapd-errorlog-logexpirationtime 58 nsslapd-errorlog-logexpirationtimeunit 58 nsslapd-errorlog-logging-enabled 58 nsslapd-errorlog-logmaxdiskspace 59 nsslapd-errorlog-logminfreediskspace 59 nsslapd-errorlog-logrotationsync-enabled 60 nsslapd-errorlog-logrotationsynchour 60 nsslapd-errorlog-logrotationsyncmin 61 nsslapd-errorlog-logrotationtime 61, 62 nsslapd-errorlog-logrotationtimeunit 62 nsslapd-errorlog-maxlogsize 63 nsslapd-errorlog-maxlogsperdir 63 nsslapd-groupvalnestlevel 64 nsslapd-idletimeout 64 nsslapd-instancedir 65 nsslapd-ioblocktimeout 65 nsslapd-lastmod 65 nsslapd-listenhost 66 nsslapd-localhost 66 nsslapd-localuser 67 nsslapd-maxbersize 67 nsslapd-maxdescriptors 67 nsslapd-maxthreadsperconn 69 nsslapd-nagle 69 nsslapd-outbound-ldap-io-timeout 69 nsslapd-plug-in 70 nsslapd-port 70 nsslapd-privatenamespaces 70 nsslapd-readonly 71 nsslapd-referral 71 nsslapd-referralmode 72 nsslapd-reservedescriptors 72 nsslapd-return-exact-case 74 nsslapd-rootdn 74 nsslapd-rootpw 75 nsslapd-rootpwstoragescheme 75 nsslapd-schemacheck 76 nsslapd-schemareplace 77 nsslapd-securelistenhost 77 nsslapd-securePort 77 nsslapd-security 78 nsslapd-sizelimit 78 nsslapd-ssl-check-hostname 79 nsslapd-state 95 nsslapd-threadnumber 79, 80 nsslapd-timelimit 80 nsslapd-versionstring 81 nssnmpcontact 112 nssnmpdescription 112 nssnmpenabled 111 nssnmplocation 112 nssnmpmasterhost 113 nssnmpmasterport 113 nssnmporganization 111 nsssl2 attribute 92 nsssl3 attribute 92 nsssl3ciphers attribute 92 nssslclientauth attribute 91 nssslsessiontimeout attribute 91 nsState 101 nsstate 114 opscompleted 110 opsinitiated 110 passwordCheckSyntax 81 passwordExp 82 passwordHistory 82 passwordInHistory 83 passwordLockout 83 passwordLockoutDuration 84 passwordMaxAge 84 passwordMaxFailure 85 passwordMinAge 85 passwordMinLength 85 passwordMustChange 86 passwordResetFailureCount 86 passwordStorageScheme 87 passwordUnlock 87 passwordWarning 88 readwaiters 110 starttime 110 totalconnections 109 currentconnections attribute 109

Index 303

currenttime attribute 110

D database exporting 243, 244 importing 246 reindexing index files 245 database files 185 database link plug-in configuration attributes nsAbandonCount 180 nsAbandonedSearchCheckInterval 173 nsActiveChainingComponents 171 nsAddCount 180 nsBindConnectionCount 181 nsBindConnectionsLimit 173 nsBindCount 180 nsBindRetryLimit 174 nsBindTimeout 174 nsCheckLocalACI 174 nsCompareCount 181 nsConcurrentBindLimit 175 nsConcurrentOperationsLimit 175 nsConnectionLife 175 nsDeleteCount 180 nsFarmServerURL 178 nshoplimit 179 nsMaxResponseDelay 171 nsMaxTestResponseDelay 172 nsModifyCount 180 nsMultiplexorBindDN 178 nsMultiplexorCredentials 179 nsOperationConnectionCount 181 nsOperationConnectionsLimit 176 nsProxiedAuthorization 176 nsReferralOnScopedSearch 177 nsRenameCount 180 nsSearchBaseCount 180 nsSearchOneLevelCount 180 nsSearchSubtreeCount 180 nsSizeLimit 177 nsslapd-changelogmaxage 182 nsTimeLimit 177 nsTransmittedControls 172 nsUndbindCount 181

304 Netscape Directory Server Configuration, Command, and File Reference • August 2002 database plug-in configuration attributes cn 167 dbcachehitratio 159 dbcachehits 159 dbcachepagein 159 dbcachepageout 159 dbcacheroevict 159 dbcacherwevict 159 dbcachetries 159 dbfilecachehit 168 dbfilecachemiss 168 dbfilenamenumber 168, 173 dbfilepagein 168 dbfilepageout 169 description 168 nsIndexType 166 nsLookThroughLimit 146 nsMatchingRule 167 nsslapd-allidsthreshold 146 nsslapd-cache-autosize 147 nsslapd-cache-autosize-split 147 nsslapd-cachememsize 161 nsslapd-cachesize 160 nsslapd-db-abort-rate 163 nsslapd-db-active-txns 163 nsslapd-db-cache-hit 163 nsslapd-db-cache-region-wait-rate 163 nsslapd-dbcachesize 148 nsslapd-db-cache-size-bytes 163 nsslapd-db-cache-try 163 nsslapd-db-checkpoint-interval 148 nsslapd-db-circular-logging 149 nsslapd-db-clean-pages 163 nsslapd-db-commit-rate 163 nsslapd-db-deadlock-rate 164 nsslapd-db-debug 150 nsslapd-db-dirty-pages 164 nsslapd-db-durable-transactions 150 nsslapd-db-hash-buckets 164 nsslapd-db-hash-elements-examine-rate 164 nsslapd-db-hash-search-rate 164 nsslapd-db-home-directory 151 nsslapd-db-idl-divisor 152 nsslapd-db-lock-conflicts 164 nsslapd-db-lockers 164 nsslapd-db-lock-region-wait-rate 164 nsslapd-db-lock-request-rate 164

nsslapd-db-logbuf-size 153 nsslapd-db-log-bytes-since-checkpoint 164 nsslapd-db-logdirectory 153 nsslapd-db-logfile-size 154 nsslapd-db-log-region-wait-rate 164 nsslapd-db-log-write-rate 165 nsslapd-db-longest-chain-length 165 nsslapd-dbncache 157 nsslapd-db-page-create-rate 165 nsslapd-db-page-ro-evict-rate 165 nsslapd-db-page-rw-evict-rate 165 nsslapd-db-pages-in-use 165 nsslapd-db-page-size 154 nsslapd-db-page-trickle-rate 165 nsslapd-db-page-write-rate 165 nsslapd-db-spin-count 155 nsslapd-db-transaction-batch-val 155 nsslapd-db-transaction-logging 156 nsslapd-db-trickle-percentage 156 nsslapd-db-txn-region-wait-rate 165 nsslapd-db-verbose 157 nsslapd-directory 161 nsslapd-import-cachesize 158 nsslapd-mode 158 nsslapd-readonly 161 nsslapd-require-index 162 nsslapd-suffix 162 nsSystemIndex 166 database schema defined 76 database-specific configuration location of 28 db.00x files 185 db2bak command-line shell and batch script 242 quick reference 238 db2bak.pl

command-line perl script 255 quick reference 240 db2dsml command-line shell and batch script 244 quick reference 238 db2index command-line shell and batch script 245 quick reference 238 db2index.pl

command-line perl script 256 quick reference 240 db2indexns-slapd and slapd.exe command-line utilities db2index 281 db2ldif command-line shell and batch script 243 quick reference 238 db2ldif.pl

command-line perl script 257 quick reference 240 dbcachehitratio attribute 159 dbcachehits attribute 159 dbcachepagein attribute 159 dbcachepageout attribute 159 dbcacheroevict attribute 159 dbcacherwevict attribute 159 dbcachetries attribute 159 dbfilecachehit attribute 168 dbfilecachemiss attribute 168 dbfilenamenumber attribute 168, 173 dbfilepagein attribute 168 dbfilepageout attribute 169 dbscan command-line utility options 234 syntax 234 description attribute 101, 168 distinguished names root 74 dse.ldif

ldif files 114 dse.ldif file configuration information tree 35 contents of 27, 29 editing 35 dse.ldif.bak file 27 dse.ldif.startOK file 27 dsml2db command-line shell and batch script 246 quick reference 238 dtablesize attribute 109

Index 305

I

E editing dse.ldif file 35 encryption root password 75 specifying password storage scheme 87 encryption configuration attributes nsssl2 92 nsssl3 92 nsssl3ciphers 92 nssslclientauth 91 nssslsessiontimeout 91 encryption configuration entries cn=encryption 91 encryption method, for root password 75 entriessent attribute 110 entrydn.db3 186

F files containing search filters 223 id2entry.db2 186 locating configuration 32 slapd.conf 75

G getpwenc command-line shell and batch script 246 quick reference 239 id2entry.db2 file 186

Indexes configuration of 31

J jpeg images 233

L

LDAP modifying configuration entries 34

LDAP Data Interchange Format (LDIF) binary data 233

LDAP result codes 202 ldapdelete command-line utility additional options 232 commonly used options 230 options 226, 230 ssl options 231 syntax 230 ldapmodify command-line utility additional options 228 commonly used options 226 ssl options 227 syntax 225 ldapsearch command-line utility additional options 223 commonly used options 220 options 220 ssl options 222 ldif 50ns-delegated-admin.ldif 116 ldif command-line utility options 234 syntax 233

LDIF configuration files contents of 29 detailed contents of 114 location of 29 migration of pre-6.x configuration files to 32

LDIF entries binary data in 233 ldif files 186

00core.ldif 115

05rfc2247.ldif 115

05rfc2927.ldif 115

10rfc2307.ldif 115

20subscriber.ldif 115

306 Netscape Directory Server Configuration, Command, and File Reference • August 2002

25java-object.ldif 115

28pilot.ldif 115

30ns-common.ldif 115

50ns-admin.ldif 115

50ns-calendar.ldif 115

50ns-certificate.ldif 115

50ns-compass.ldif 116

50ns-directory.ldif 116

50ns-legacy.ldif 116

50ns-mail.ldif 116

50ns-mcd-browser.ldif 116

50ns-mcd-config.ldif 116

50ns-mcd-li.ldif 116

50ns-mcd-mail.ldif 116

50ns-media.ldif 116

50ns-mlm.ldif 116

50ns-msg.ldif 116

50ns-netshare.ldif 116

50ns-news.ldif 116

50ns-proxy.ldif 116

50ns-value.ldif 116

50ns-wcal.ldif 116

50ns-web.ldif 116

51ns-calendar.ldif 115

99user.ldif 117 dse.ldif 114 ldif2db command-line shell and batch script 247 quick reference 239 ldif2db.pl

command-line perl script 258 quick reference 240 ldif2ldap command-line shell and batch script 249 quick reference 239 lock files 187 log files 187 access 37 error 55 log.xxxxxxxxxx files 185 logconv.pl

quick reference 240 logconv.pl script 260 options 263 syntax 262

M

Meta Directory changelog retro changelog 88 migrateInstance6 quick reference 240 monitor command-line shell and batch script 249 quick reference 239 multi-master replication changelog changelog 88

N nbackends attribute 110 nsAbandonCount attribute 180 nsAbandonedSearchCheckInterval attribute 173 ns-accountstatus.pl

command-line perl script 266 quick reference 240 ns-activate.pl

command-line perl script 267 quick reference 240 nsActiveChainingComponents attribute 171 nsAddCount attribute 180 nsBindConnectionCount attribute 181 nsBindConnectionsLimit attribute 173 nsBindCount attribute 180 nsBindRetryLimit attribute 174 nsBindTimeout attribute 174 nsCheckLocalACI attribute 174 nsCompareCount attribute 181 nsConcurrentBindLimit attribute 175 nsConcurrentOperationsLimit attribute 175 nsConnectionLife attribute 175 nsDeleteCount attribute 180 nsDS50ruv attribute 109 nsDS5Flags attribute 96 nsDS5ReplicaBindDN attribute 97, 101 nsDS5ReplicaBindMethod attribute 102 nsDS5ReplicaChangeCount attribute 97

Index 307

nsDS5ReplicaChangesSentSinceStartup attribute 102 nsDS5ReplicaCredentials attribute 103 nsDS5ReplicaHost attribute 103 nsDS5ReplicaID attribute 98 nsDS5ReplicaLastInitEnd attribute 103 nsDS5ReplicaLastInitStart attribute 104 nsDS5ReplicaLastInitStatus attribute 104 nsDS5ReplicaLastUpdateEnd attribute 105 nsDS5ReplicaLastUpdateStart attribute 105 nsDS5ReplicaLastUpdateStatus attribute 105 nsDS5ReplicaLegacyConsumer attribute 98 nsDS5ReplicaName attribute 98 nsDS5ReplicaPort attribute 106 nsDS5ReplicaPurgeDelay attribute 99 nsDS5ReplicaReapActive attribute 106 nsDS5ReplicaReferral attribute 99 nsDS5ReplicaRefresh attribute 106 nsDS5ReplicaRoot attribute 99, 107 nsDS5ReplicaTimeout attribute 107 nsDS5ReplicaTombstonePurgeInterval attribute 100 nsDS5ReplicaTransportInfo attribute 108 nsDS5ReplicaType attribute 100 nsDS5ReplicaUpdateInProgress attribute 108 nsDS5ReplicaUpdateSchedule attribute 108 nsFarmServerURL attribute 178 nshoplimit attribute 179 ns-inactivate.pl

command-line perl script 267 quick reference 240 nsIndexType attribute 166 nsLookThroughLimit attribute 146 nsMatchingRule attribute 167 nsMaxResponseDelay attribute 171 nsMaxTestResponseDelay attribute 172 nsModifyCount attribute 180 nsMultiplexorBindDN attribute 178 nsMultiplexorCredentials attribute 179 nsOperationConnectionCount attribute 181 nsOperationConnectionsLimit attribute 176 nsProxiedAuthorization attribute 176 nsReferralOnScopedSearch attribute 177 nsRenameCount attribute 180 nsSearchBaseCount attribute 180 nsSearchOneLevelCount attribute 180 nsSearchSubtreeCount attribute 180 nsSizeLimit attribute 177 ns-slapd and slapd.exe command-line utilities archive2db 279 db2archive 280 db2ldif 275 finding and executing 274 ldif2db 277 ns-slapd and slapd.exe commands overview 273 nsslapd-accesscontrol attribute 37 nsslapd-accesslog attribute 37 nsslapd-accesslog-auditlog-list attribute 47 nsslapd-accesslog-level attribute 38 nsslapd-accesslog-list attribute 39 nsslapd-accesslog-logbuffering attribute 39 nsslapd-accesslog-logexpirationtime attribute 39 nsslapd-accesslog-logexpirationtimeunit attribute 40, 44 nsslapd-accesslog-logging-enabled attribute 40 nsslapd-accesslog-logmaxdiskspace attribute 41 nsslapd-accesslog-logminfreediskspace attribute 42 nsslapd-accesslog-logrotationsync-enabled attribute 42 nsslapd-accesslog-logrotationsynchour attribute 43 nsslapd-accesslog-logrotationsyncmin attribute 43 nsslapd-accesslog-logrotationtime attribute 43 nsslapd-accesslog-maxlogsize attribute 44 nsslapd-accesslog-maxlogsperdir attribute 45 nsslapd-allidsthreshold attribute 146 nsslapd-attribute-name-exceptions attribute 45 nsslapd-auditlog-logexpirationtime attribute 47 nsslapd-auditlog-logexpirationtimeunit attribute 47 nsslapd-auditlog-logging-enabled attribute 48 nsslapd-auditlog-logmaxdiskspace attribute 48 nsslapd-auditlog-logminfreediskspace attribute 49 nsslapd-auditlog-logrotationsync-enabled attribute 49 nsslapd-auditlog-logrotationsynchour attribute 50 nsslapd-auditlog-logrotationsyncmin attribute 50

308 Netscape Directory Server Configuration, Command, and File Reference • August 2002

nsslapd-auditlog-logrotationtime attribute 51 nsslapd-auditlog-logrotationtimeunit attribute 51 nsslapd-auditlog-maxlogsize attribute 52 nsslapd-auditlog-maxlogsperdir attribute 52 nsslapd-backend attribute 95 nsslapd-cache-autosize attribute 147 nsslapd-cache-autosize-split attribute 147 nsslapd-cachememsize attribute 161 nsslapd-cachesize attribute 160 nsslapd-certmap-basedn attribute 53 nsslapd-changelogdir attribute 89, 181 nsslapd-changelogmaxage attribute 90, 182 nsslapd-changelogmaxentries attribute 90 nsslapd-config attribute 53 nsslapd-csnlogging attribute 53 nsslapd-db-abort-rate attribute 163 nsslapd-db-active-txns attribute 163 nsslapd-db-cache-hit attribute 163 nsslapd-db-cache-region-wait-rate attribute 163 nsslapd-dbcachesize attribute 148 nsslapd-db-cache-size-bytes attribute 163 nsslapd-db-cache-try attribute 163 nsslapd-db-checkpoint-interval attribute 148 nsslapd-db-circular-logging attribute 149 nsslapd-db-clean-pages attribute 163 nsslapd-db-commit-rate attribute 163 nsslapd-db-deadlock-rate attribute 164 nsslapd-db-debug attribute 150 nsslapd-db-dirty-pages attribute 164 nsslapd-db-durable-transactions attribute 150 nsslapd-db-hash-buckets attribute 164 nsslapd-db-hash-elements-examine-rate attribute 164 nsslapd-db-hash-search-rate attribute 164 nsslapd-db-home-directory attribute 151 nsslapd-db-idl-divisor attribute 152 nsslapd-db-lock-conflicts attribute 164 nsslapd-db-lockers attribute 164 nsslapd-db-lock-region-wait-rate attribute 164 nsslapd-db-lock-request-rate attribute 164 nsslapd-db-logbuf-size attribute 153 nsslapd-db-log-bytes-since-checkpoint attribute 164 nsslapd-db-logdirectory attribute 153 nsslapd-db-logfile-size attribute 154 nsslapd-db-log-region-wait-rate attribute 164 nsslapd-db-log-write-rate attribute 165 nsslapd-db-longest-chain-length attribute 165 nsslapd-dbncache attribute 157 nsslapd-db-page-create-rate attribute 165 nsslapd-db-page-ro-evict-rate attribute 165 nsslapd-db-page-rw-evict-rate attribute 165 nsslapd-db-pages-in-use attribute 165 nsslapd-db-page-size attribute 154 nsslapd-db-page-trickle-rate attribute 165 nsslapd-db-page-write-rate attribute 165 nsslapd-db-spin-count attribute 155 nsslapd-db-transaction-batch-val attribute 155 nsslapd-db-transaction-logging attribute 156 nsslapd-db-trickle-percentage attribute 156 nsslapd-db-txn-region-wait-rate attribute 165 nsslapd-db-verbose attribute 157 nsslapd-directory attribute 161 nsslapd-ds4-compatible-schema attribute 54 nsslapd-errorlog attribute 55 nsslapd-errorlog-level attribute 56 nsslapd-errorlog-list attribute 57 nsslapd-errorlog-logexpirationtime attribute 58 nsslapd-errorlog-logexpirationtimeunit attribute 58 nsslapd-errorlog-logging-enabled attribute 58 nsslapd-errorlog-logmaxdiskspace attribute 59 nsslapd-errorlog-logminfreediskspace attribute 59 nsslapd-errorlog-logrotationsync-enabled attribute 60 nsslapd-errorlog-logrotationsynchour attribute 60 nsslapd-errorlog-logrotationsyncmin attribute 61 nsslapd-errorlog-logrotationtime attribute 61, 62 nsslapd-errorlog-logrotationtimeunit attribute 62 nsslapd-errorlog-maxlogsize attribute 63 nsslapd-errorlog-maxlogsperdir attribute 63 nsslapd-groupvalnestlevel attribute 64 nsslapd-idletimeout attribute 64 nsslapd-import-cachesize attribute 158 nsslapd-instancedir attribute 65 nsslapd-ioblocktimeout attribute 65

Index 309

nsslapd-lastmod attribute 65 nsslapd-listenhost attribute 66 nsslapd-localhost attribute 66 nsslapd-localuser attribute 67 nsslapd-maxbersize attribute 67 nsslapd-maxdescriptors attribute 67 nsslapd-maxthreadsperconn attribute 69 nsslapd-mode attribute 158 nsslapd-nagle attribute 69 nsslapd-outbound-ldap-io-timeout attribute 69 nsslapd-plug-in attribute 70 nsslapd-plugin-depends-on-named attribute 145 nsslapd-plugin-depends-on-type attribute 144 nsslapd-pluginDescription attribute 144 nsslapd-pluginEnabled attribute 142 nsslapd-pluginId attribute 143 nsslapd-pluginInitFunc attribute 141 nsslapd-pluginPath attribute 141 nsslapd-pluginType attribute 142 nsslapd-pluginVendor attribute 143 nsslapd-pluginVersion attribute 143 nsslapd-port attribute 70 nsslapd-privatenamespaces attribute 70 nsslapd-readonly attribute 71, 161 nsslapd-referral attribute 71 nsslapd-referralmode attribute 72 nsslapd-require-index attribute 162 nsslapd-reservedescriptors attribute 72 nsslapd-return-exact-case attribute 74 nsslapd-rootdn attribute 74 nsslapd-rootpw attribute 75 nsslapd-rootpwstoragescheme attribute 75 nsslapd-schemacheck attribute 76 nsslapd-schemareplace attribute 77 nsslapd-securelistenhost attribute 77 nsslapd-securePort attribute 77 nsslapd-security attribute 78 nsslapd-sizelimit attribute 78 nsslapd-ssl-check-hostname attribute 79 nsslapd-state attribute 95 nsslapd-suffix attribute 162 nsslapd-threadnumber attribute 79, 80 nsslapd-timelimit attribute 80 nsslapd-versionstring attribute 81 nssnmpcontact attribute 112 nssnmpdescription attribute 112 nssnmpenabled attribute 111 nssnmplocation attribute 112 nssnmpmasterhost attribute 113 nssnmpmasterport attribute 113 nssnmporganization attribute 111 nsssl2 attribute 92 nsssl3 attribute 92 nsssl3ciphers attribute 92 nssslclientauth attribute 91 nssslsessiontimeout attribute 91 nsState attribute 101 nsstate attribute 114 nsSystemIndex attribute 166 nsTimeLimit attribute 177 nsTransmittedControls attribute 172 nsUnbindCount attribute 181 nsuniqueid.db3 186

O objectclass.db3 186 opscompleted attribute 110 opsinitiated attribute 110

P parentid.db3 186 passswordLockoutDuration attribute 84 passwordChange attribute 81 passwordCheckSyntax attribute 81 passwordExp attribute 82 passwordHistory attribute 82 passwordInHistory attribute 83 passwordLockout attribute 83

310 Netscape Directory Server Configuration, Command, and File Reference • August 2002

passwordMaxAge attribute 84 passwordMaxFailure attribute 85 passwordMinAge attribute 85 passwordMinLength attribute 85 passwordMustChange attribute 86 passwordResetFailureCount attribute 86 passwords root 75 passwordStorageScheme attribute 87 passwordUnlock attribute 87 passwordWarning attribute 88 permissions specifying for index files 158 plug-in functionality configuration attributes cn 167 dbcachehitratio 159 dbcachehits 159 dbcachepagein 159 dbcachepageout 159 dbcacheroevict 159 dbcacherwevict 159 dbcachetries 159 dbfilecachehit 168 dbfilecachemiss 168 dbfilenamenumber 168, 173 dbfilepagein 168 dbfilepageout 169 description 168 nsAbandonCount 180 nsAbandonedSearchCheckInterval 173 nsActiveChainingComponents 171 nsAddCount 180 nsBindConnectionCount 181 nsBindConnectionsLimit 173 nsBindCount 180 nsBindRetryLimit 174 nsBindTimeout 174 nsCheckLocalACI 174 nsCompareCount 181 nsConcurrentBindLimit 175 nsConcurrentOperationsLimit 175 nsConnectionLife 175 nsDeleteCount 180 nsFarmServerURL 178 nshoplimit 179 nsIndexType 166 nsLookThroughLimit 146 nsMatchingRule 167 nsMaxResponseDelay 171 nsMaxTestResponseDelay 172 nsModifyCount 180 nsMultiplexorBindDN 178 nsMultiplexorCredentials 179 nsOperationConnectionCount 181 nsOperationConnectionsLimit 176 nsProxiedAuthorization 176 nsReferralOnScopedSearch 177 nsRenameCount 180 nsSearchBaseCount 180 nsSearchOneLevelCount 180 nsSearchSubtreeCount 180 nsSizeLimit 177 nsslapd-allidsthreshold 146 nsslapd-cache-autosize 147 nsslapd-cache-autosize-split 147 nsslapd-cachememsize 161 nsslapd-cachesize 160 nsslapd-changelogdir 181 nsslapd-changelogmaxage 182 nsslapd-db-abort-rate 163 nsslapd-db-active-txns 163 nsslapd-db-cache-hit 163 nsslapd-db-cache-region-wait-rate 163 nsslapd-dbcachesize 148 nsslapd-db-cache-size-bytes 163 nsslapd-db-cache-try 163 nsslapd-db-checkpoint-interval 148 nsslapd-db-circular-logging 149 nsslapd-db-clean-pages 163 nsslapd-db-commit-rate 163 nsslapd-db-deadlock-rate 164 nsslapd-db-debug 150 nsslapd-db-dirty-pages 164 nsslapd-db-durable-transactions 150 nsslapd-db-hash-buckets 164 nsslapd-db-hash-elements-examine-rate 164 nsslapd-db-hash-search-rate 164 nsslapd-db-home-directory 151 nsslapd-db-idl-divisor 152 nsslapd-db-lock-conflicts 164 nsslapd-db-lockers 164 nsslapd-db-lock-region-wait-rate 164 nsslapd-db-lock-request-rate 164

Index 311

nsslapd-db-logbuf-size 153 nsslapd-db-log-bytes-since-checkpoint 164 nsslapd-db-logdirectory 153 nsslapd-db-logfile-size 154 nsslapd-db-log-region-wait-rate 164 nsslapd-db-log-write-rate 165 nsslapd-db-longest-chain-length 165 nsslapd-dbncache 157 nsslapd-db-page-create-rate 165 nsslapd-db-page-ro-evict-rate 165 nsslapd-db-page-rw-evict-rate 165 nsslapd-db-pages-in-use 165 nsslapd-db-page-size 154 nsslapd-db-page-trickle-rate 165 nsslapd-db-page-write-rate 165 nsslapd-db-spin-count 155 nsslapd-db-transaction-batch-val 155 nsslapd-db-trasaction-logging 156 nsslapd-db-trickle-percentage 156 nsslapd-db-txn-region-wait-rate 165 nsslapd-db-verbose 157 nsslapd-directory 161 nsslapd-import-cachesize 158 nsslapd-mode 158 nsslapd-plugin-depends-on-named 145 nsslapd-plugin-depends-on-type 144 nsslapd-pluginDescription 144 nsslapd-pluginEnabled 142 nsslapd-pluginId 143 nsslapd-pluginInitFunc 141 nsslapd-pluginPath 141 nsslapd-pluginType 142 nsslapd-pluginVendor 143 nsslapd-pluginVersion 143 nsslapd-readonly 161 nsslapd-require-index 162 nsslapd-suffix 162 nsSystemIndex 166 nsTimeLimit 177 nsTransmittedControls 172 nsUnbindCount 181 plug-ins configuration of 28 port numbers less than 1024 70

R read-only monitoring configuration attributes backendMonitorDN 110 bytessent 110 connection 109 currentconnections 109 currenttime 110 dtablesize 109 entriessent 110 nbackends 110 opscompleted 110 opsinitiated 110 readwaiters 110 starttime 110 totalconnections 109 read-only monitoring configuration entries cn=monitor 109 readwaiters attribute 110 replication agreement configuration attributes description 101 nsDS50ruv 109 nsDS5ReplicaBindDN 101 nsDS5ReplicaBindMethod 102 nsDS5ReplicaChangesSentSinceStartup 102 nsDS5ReplicaCredentials 103 nsDS5ReplicaHost 103 nsDS5ReplicaLastInitEnd 103 nsDS5ReplicaLastInitStart 104 nsDS5ReplicaLastInitStatus 104 nsDS5ReplicaLastUpdateEnd 105 nsDS5ReplicaLastUpdateStart 105 nsDS5ReplicaLastUpdateStatus 105 nsDS5ReplicaPort 106 nsDS5ReplicaReapActive 106 nsDS5ReplicaRefresh 106 nsDS5ReplicaRoot 107 nsDS5ReplicaTimeout 107 nsDS5ReplicaTransportInfo 108 nsDS5ReplicaUpdateInProgress 108 nsDS5ReplicaUpdateSchedule 108 object classes 101 replication configuration attributes cn 96 nsDS5Flags 96 nsDS5ReplicaBindDN 97 nsDS5ReplicaChangeCount 97

312 Netscape Directory Server Configuration, Command, and File Reference • August 2002

nsDS5ReplicaID 98 nsDS5ReplicaLegacyConsumer 98 nsDS5ReplicaName 98 nsDS5ReplicaPurgeDelay 99 nsDS5ReplicaReferral 99 nsDS5ReplicaRoot 99 nsDS5ReplicaTombstonePurgeInterval 100 nsDS5ReplicaType 100 nsState 101 object classes 96 restart 250 restarting server requirement for certain configuration changes 35,

117 restart-slapd command-line shell and batch script 250 quick reference 239 restoreconfig command-line shell and batch script 250 quick reference 239 retro changelog

Meta Directory changelog 88 retro changelog plug-in configuration attributes nsslapd-changelogdir 181 root password, Root DN and 75

S saveconfig command-line shell and batch script 251 quick reference 239 search filters specifying file 223, 232 search operations limiting entries returned 78 setting time limits 80 searches sort criteria 225 specifying scope 221 server restart after configuration changes 35, 117 serverID 21 serverRoot 21 slapd.conf file converting to LDIF format 32 location of 32 root password and 75 slapd.ldbm.conf file converting to LDIF format 32 smart referrals ldapsearch option 224

SNMP configuration attributes nssnmpcontact 112 nssnmpdescription 112 nssnmpenabled 111 nssnmplocation 112 nssnmpmasterhost 113 nssnmpmasterport 113 nssnmporganization 111

SNMP configuration entries cn=SNMP 111 sort criteria 225 start-slapd command-line shell and batch script 251 quick reference 239 starttime attribute 110 statistics from access logs 261 stop-slapd command-line shell and batch script 252 quick reference 239 suffix and replication configuration entries cn=mapping tree 94 suffix configuration attributes nsslapd-backend 95 nsslapd-state 95 object classes 95 suffix2instance quick reference 239 suffixd2instance command-line shell and batch script 253

T template-cl-dump.pl

command-line perl script 268

Index 313

quick reference 240 template-repl-monitor.pl

command-line perl script 269 quick reference 241 totalconnections attribute 109

U uniqueid generator configuration attributes nsstate 114 uniqueid generator configuration entries cn=uniqueid generator 113

V vlvindex command-line shell and batch script 253 quick reference 239

314 Netscape Directory Server Configuration, Command, and File Reference • August 2002