Class of service plug-in | HP UX Identity Security Software specification

Plug-in parameter	Description
Dependencies	None
Performance Related	There are many performance related tuning parameters involved with the chaining
Information	database. See the "Maintaining Database Links" section in the HP-UX Directory Server
	administrator guide.
Further Information	A chaining database is also known as a database link. Database links are described
	in the "Configuring Directory Databases" chapter in the HP-UX Directory Server
	administrator guide.

3.1.10 Class of service plug-in

Plug-in parameter	Description
Plug-in Name	Class of Service
DN of Configuration Entry	cn=Class of Service, cn=plugins, cn=config
Description	Allows for sharing of attributes between entries
Configurable Options	on or off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related	Do not modify the configuration of this plug-in. Leave this plug-in running at all
Information	times.
Further Information	See the "Advanced Entry Management" chapter in the HP-UX Directory Server
	administrator guide.

3.1.11 Country string syntax plug-in

Plug-in parameter	Description
Plug-in Name	Country String Syntax Plug-in
DN of Configuration Entry	cn=Country String Syntax, cn=plugins, cn=config
Description	Syntax for handling countries
Configurable Options	on or off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related	Do not modify the configuration of this plug-in. HP recommends leaving this plug-in
Information	running at all times.
Further Information

3.1.12 Distinguished name syntax plug-in

Plug-in parameter	Description
Plug-in Name	Distinguished Name Syntax
DN of Configuration Entry	cn=Distinguished Name Syntax, cn=plugins, cn=config

3.1 Server plug-in functionality reference 117

Image 117

HP UX Identity Security Software manual Class of service plug-in, Country string syntax plug-in

Contents

HP-UX Directory Server Version Page Table of Contents Table of Contents Table of Contents 3.4 3.3Nsssl3ciphers Nsslapd-state Nsslapd-backend 113 Schema reload plug-in Password Storage SchemesNsslapd-pluginEnabled Nsslapd-idl-switch Cn=ldbm database, cn=plugins, cn=config Cn=userRoot, cn=ldbm database, cn=plugins, cn=configNsMaxResponseDelay NsMaxTestResponseDelay 173 169 189 Finding and executing command-line scripts 215 215239 243 247257 Page Using Directory Server command-line utilities Directory Server configurationDirectory Server configuration Directory Server instance file reference Introduction Using Directory Server command-line scripts Ldif and schema configuration files Overview of the Directory Server configuration Directory Server Ldif configuration files Configuration attributes How the server configuration is organizedConfiguration of plug-in functionality Directory Server Ldif configuration files Access control for configuration entries Accessing and modifying server configurationConfiguration of databases Configuration of indexes Changing configuration attributes Modifying configuration entries using LdapWhere Configuration changes requiring server restart Core server configuration attributes reference Nsslapd-accesslog Access log 1 cn=config Nsslapd-accesslog-list List of access log files Nsslapd-accesslog-level Access log levelNsslapd-accesslog-logbuffering Log buffering Attribute values for enabling or disabling access logging Default Value Syntax Directory String Example Nsslapd-accesslog-logging-enabled Access log enable loggingValid Values Valid Range EntryDN Cn=config Valid Range Disk space allowed to the access log is unlimited in sizeSyntaxDirectoryString Example Syntax DirectoryString Example Nsslapd-accesslog-maxlogsize Access log maximum log size Nsslapd-accesslog-logrotationtime Access log rotation time SyntaxInteger Example Nsslapd-accesslog-mode Access log file permission Default Value Off Syntax DirectoryString Example ValidRange Through Default Value 600 Syntax Integer ExampleNsslapd-attribute-name-exceptions Nsslapd-auditlog Audit log Attribute values for enabling or disabling audit logging Nsslapd-auditlog-listProvides a list of audit log files EntryDN Entry DN Cn=config Valid Values Nsslapd-auditlog-logging-enabled Audit log enable loggingTurns audit logging on and off Disk space allowed to the audit log is unlimited in size Syntax Integer Example Nsslapd-auditlog-logrotationsynchour Valid Range Through Default Value Nsslapd-auditlog-logrotationtime Audit log rotation time Syntax Integer Example Nsslapd-auditlog-logrotationsyncminTime between audit log file rotation is unlimited Nsslapd-auditlog-maxlogsize Audit log maximum log size Nsslapd-auditlog-mode Audit log file permissionNone Read only Execute only Nsslapd-certdir Certificate and key database directory Write access to the server user IDNsslapd-certmap-basedn Certificate map search base Write only Read and write Write and execute This read-only attribute is the config DN Nsslapd-configNsslapd-conntablesize Nsslapd-counters Default Value Syntax DirectoryString Example Nsslapd-ds4-compatible-schemaDefault Value Off Core server configuration reference Nsslapd-csnlogging Nsslapd-errorlog Error log Nsslapd-errorlog-level Error log levelAttribute values for enabling or disabling error logging This read-only attribute provides a list of error log files Nsslapd-errorlog-list Turns error logging on and off Nsslapd-errorlog-logging-enabled Enable error logging Disk space allowed to the error log is unlimited in size Time between error log file rotation is unlimited Nsslapd-errorlog-logrotationtime Error log rotation time Nsslapd-errorlog-maxlogsize Maximum error log size Nsslapd-errorlog-mode Error log file permission Nsslapd-idletimeout Default idle timeoutNsslapd-groupevalnestlevel Default Value Syntax Integer Example Nsslapd-idletimeout Nsslapd-ioblocktimeout IO block time outNsslapd-instancedir Instance directory Nsslapd-lastmod Track modification time Nsslapd-ldapilisten Enable Ldapi socket Nsslapd-ldapifilepath Ldapi socket file pathNsslapd-listenhost Listen to IP address Nsslapd-localhost Local host Default Value SyntaxDirectoryString ExampleNsslapd-localuser Local user Nsslapd-lockdir Server lock file directory Nsslapd-maxdescriptors Maximum file descriptors Nsslapd-maxbersize Maximum message size Nsslapd-maxsasliosize Maximum Sasl packet size Nsslapd-maxthreadsperconn Maximum threads per connection Nsslapd-nagleThis attribute value is specified in bytes Default Value Core server configuration reference Nsslapd-outbound-ldap-io-timeoutNsslapd-plugin Nsslapd-port Port number Nsslapd-readonly Read only Nsslapd-referral ReferralBut the request is for this entry Nsslapd-reservedescriptors Reserved file descriptors Nsslapd-referralmode Referral mode Nsslapd-rewrite-rfc1274 Nsslapd-return-exact-case Return exact case Nsslapd-rootpw Root password Default Value SyntaxNsslapd-rootdn Manager DN Nsslapd-saslpath Nsslapd-rootpwstoragescheme Root password storage scheme Nsslapd-schemadir Nsslapd-schemacheck Schema checking Nsslapd-schemareplace Nsslapd-securelistenhostNsslapd-securePort Encrypted port number Nsslapd-sizelimit Size limit Nsslapd-security Security Default Value Syntax Integer Example Nsslapd-threadnumber Nsslapd-threadnumber Thread numberNsslapd-timelimit Time limit Indicates whether users may change their passwords PasswordChange Password changeNsslapd-tmpdir Nsslapd-versionstring PasswordExp Password expiration PasswordCheckSyntax Check password syntax PasswordHistory Password history PasswordGraceLimit Password expirationPasswordInHistory Number of passwords to remember Default Value Syntax Integer Example PasswordGraceLimit PasswordIsGlobalPolicy Password policy and replication PasswordLockout Account lockoutPasswordLockoutDuration Lockout duration PasswordMaxFailure Maximum password failures PasswordMaxAge Password maximum agePasswordMaxRepeats Password syntax Default Value Syntax Integer Example PasswordMaxFailure PasswordMin8Bit Password syntax PasswordMinAge Password minimum ageDefault Value Syntax Integer Example PasswordMinAge PasswordMinCategories Password syntax PasswordMinAlphas Password syntaxPasswordMinDigits Password syntax PasswordMinLength Password minimum length PasswordMinLowers Password syntax PasswordMinSpecials Password syntaxPasswordMinTokenLength Password syntax PasswordMinUppers Password syntax PasswordMustChange Password must changePasswordStorageScheme Password storage scheme PasswordWarning Send warning PasswordUnlock Unlock account Nsslapd-changelogdir 2 cn=changelog5,cn=config Nssslsessiontimeout 3 cn=encryption,cn=configNsslapd-changelogmaxage Max changelog age Nsslapd-changelogmaxentries Max changelog records Default Value Off Syntax DirectoryString Example Nsssl2 off Means disallow certificate-based authenticationNssslclientauth NsSSL2 5 cn=mapping tree,cn=config 4 cn=features,cn=configSuffix configuration attributes under cn=suffixName Nsssl3ciphers Nsslapd-backend Nsslapd-stateDetermines how the suffix handles operations To requests made by client applications NsDS5Flags NsDS5ReplicaBindDNNsDS5ReplicaChangeCount NsDS5ReplicaId NsDS5ReplicaPurgeDelayNsDS5ReplicaLegacyConsumer NsDS5ReplicaName NsDS5ReplicaReferral NsDS5ReplicaRootNsDS5ReplicaTombstonePurgeInterval NsDS5ReplicaType NsDS5ReplicaReapActiveNsState NsDS5ReplConflict 8.1 cnDescription NsDS5ReplicaBusyWaitTime NsDS5ReplicaBindMethod NsDS5ReplicaChangesSentSinceStartup SchemaNsDS5ReplicaCredentials NsDS5ReplicaHost NsDS5ReplicaLastInitStart NsDS5ReplicaLastInitEndNsDS5ReplicaLastInitStatus Time NsDS5ReplicaLastUpdateStart NsDS5ReplicaLastUpdateEndNsDS5ReplicaLastUpdateStatus NsDS5ReplicaPort NsDS5ReplicaPriority Default Value SyntaxInteger ExamplensDS5ReplicaPort389 NsDS5ReplicaSessionPauseTime NsDS5BeginReplicaRefresh NsDS5ReplicaTimeout Valid Range Default Value SyntaxDirectoryString ExampleNsDS5ReplicatedAttributeList NsDS5ReplicaUpdateInProgress NsDS5ReplicaUpdateScheduleNsDS5ReplicaTransportInfo NsDS5ReplicaLastUpdateEnd NsDS50ruvSunday Nsds7NewWinUserSyncEnabled Nsds7NewWinGroupSyncEnabledNsds7DirectoryReplicaSubtree Nsds7DirsyncCookie Nsds7WindowsDomain 10 cn=monitorNsds7WindowsReplicaSubtree WinSyncInterval Connection table For exampleGreenwich Mean Time This is the number of completed operations Nssnmpenabled 12 cn=SNMP,cn=configThis attribute sets whether Snmp is enabled 11 cn=replication Nssnmplocation NssnmporganizationNssnmpcontact Nssnmpdescription Nssnmpmasterhost Snmp statistic attributesNssnmpmasterport Snmp statistic attributes Snmp statistic attributes 14 cn=tasks,cn=config Task invocation attributes for entries under cn=tasks Entry DN Default Value Syntax DirectoryString Example Ttl 14.2 cn=import,cn=tasks,cn=config NsFilename file1.ldif NsFilename file2.ldif Default Value Syntax Integer Example NsImportChunkSize 14.3 cn=export,cn=tasks,cn=config Valid Values Any DN Core server configuration reference Syntax Case-insensitive string Example NsUseOneFile true Default Value Syntax DN, multi-valued ExampleSyntax Case-insensitive string Example NsExportReplica true Syntax Case-insensitive string Example NsPrintKey false Syntax Case-insensitive string Example NsUseId2Entry true 14.4 cn=backup,cn=tasks,cn=configSyntax Case-insensitive string Example NsNoWrap false Syntax Case-insensitive string Example NsDumpUniqId true 14.5 cn=restore,cn=tasks,cn=config Syntax Case-exact string Example 14.6 cn=index,cn=tasks,cn=config NsIndexAttribute attributeindex1,index2 14.7 cn=schema reload task,cn=tasks,cn=config 14.8 cn=memberof task,cn=tasks,cn=config 15 cn=uniqueid generator,cn=config 112 Server plug-in functionality reference 1 7-bit check plug-inServer plug-in functionality reference ACL plug-in ACL preoperation plug-inAttribute uniqueness plug-in Boolean syntax plug-in Binary syntax plug-in Description Syntax for handling DNs Configurable Options Plug-in Name Chaining Database DN of Configuration EntryCase exact string syntax plug-in Case ignore string syntax plug-in Country string syntax plug-in Class of service plug-inDistinguished name syntax plug-in Dependencies None Performance Related Generalized time syntax plug-in Distributed numeric assignment plug-inDetails of distributed numeric assignment plug-in Plug-in Name Internationalization plug-in Http client plug-in Ldbm database plug-in Jpeg syntax plug-inLegacy replication plug-in Information Further Information MemberOf plug-in Multi-master replication plug-inDetails of MemberOf plug-in Password Storage Schemes Octet string syntax plug-inOID syntax plug-in Postal address string syntax plug-in Password storage plugins Referential integrity postoperation plug-in PTA plug-in Roles plug-in Retro Changelog plug-inBoth presence and equality Applications Schema reload plug-in Details of schema reload plug-inSpace insensitive string syntax plug-in URI syntax plug-in Telephone syntax plug-inViews plug-in Resource Locators Account policy plug-in List of attributes common to all plug-insNsslapd-pluginPath This attribute specifies the full path to the plug-in Nsslapd-pluginInitfunc Nsslapd-pluginEnabledNsslapd-pluginType Nsslapd-pluginId Nsslapd-pluginVersion Attributes allowed by certain plug-insNsslapd-pluginVendor Nsslapd-pluginDescription Nsslapd-pluginLoadGlobal Nsslapd-plugin-depends-on-typeNsslapd-plugin-depends-on-named NsLookthroughLimit Database plug-in attributes Nsslapd-cache-autosize-split Nsslapd-cache-autosize Nsslapd-dbcachesize Nsslapd-db-checkpoint-intervalPlatforms Nsslapd-db-circular-logging Default Value Database plug-in attributesNsslapd-db-debug Nsslapd-db-durable-transactions Nsslapd-db-idl-divisor Nsslapd-db-home-directory Automatically adjusted to the minimum value Nsslapd-db-logbuf-sizeNsslapd-db-logdirectory Nsslapd-db-logfile-size Valid Range Bytes to 64 kilobytes Default ValueNsslapd-db-page-size Nsslapd-db-private-import-mem Nsslapd-db-transaction-batch-val Nsslapd-db-spin-count Nsslapd-db-trickle-percentage Nsslapd-db-verboseNsslapd-dbncache Nsslapd-idl-switch Nsslapd-directoryNsslapd-exclude-from-export Nsslapd-idlistscanlimit Nsslapd-import-cachesizeNsslapd-import-cache-autosize Default Value 600 Database plug-in attributes No access for other usersNsslapd-mode Memory to importCache Nsslapd-search-bypass-filter-test Nsslapd-search-use-vlv-indexNsslapd-serial-lock Nsslapd-cachememsize Nsslapd-cachesize Nsslapd-readonly Nsslapd-require-indexNsslapd-suffix Database plug-in attributes 5.1 cn NsSystemIndexThis attribute provides the name of the attribute to index NsMatchingRule NsIndexType Indexed attribute representing a subentry NsSubStrBegin NsSubStrMiddle NsSubStrEnd Encrypted attributes under the cn=config node NsEncryptionAlgorithm Database link plug-in attributes chaining attributesNsActiveChainingComponents Database link plug-in attributes chaining attributes NsMaxResponseDelay NsMaxTestResponseDelayNspossiblechainingcomponents NsTransmittedControls NsAbandonedSearchCheckIntervalNsBindConnectionsLimit Default Value Syntax Integer Example NsBindTimeoutNsBindRetryLimit NsCheckLocalACI NsConcurrentOperationsLimit NsConcurrentBindLimitNsConnectionLife NsOperationConnectionsLimit NsProxiedAuthorization NsReferralOnScopedSearchNsSizeLimit NsBindMechanism NsTimeLimit NsFarmServerURL NsMultiplexorBindDNValid Values Empty NsMultiplexorCredentials Encryption schemaNshoplimit NsUseStartTLS Nsslapd-changelogdir Retro changelog plug-in attributes Nsslapd-changelogmaxage Max changelog age Distributed numeric assignment plug-in attributesDnaFilter DnaMagicRegen DnaMaxValue DnaNextRangeDnaNextValue Default Value Syntax Integer Example DnaNextValue DnaRangeRequestTimeoutDnaPrefix Bit systems DnaScope DnaSharedCfgDNDnaThreshold DnaType MemberOf plug-in attributesMemberofattr Memberofgroupattr Account policy plug-in attributes Configuration files Backup filesOverview of Directory Server files Database files At setup for example, dc=example,dc=com Setup-ds-admin.plscript is runUsed internally by the database and should not be moved Deleted, or modified in any way Lock files Ldif filesLog files PID files Scripts Tools Access logging levels Access log reference Example 5-1 Example access log Default access logging contentConnection number File descriptor Slot number Error numberOperation number Method type Number of entries Elapsed timeLdap request type Ldap response type Unindexed search indicatorVLV-related entries Search scope Change sequence number Extended operation OIDAbandon message LDAPv3 extended operations supported by Directory Server Access log content for additional access logging levels Message IDSasl multi-stage bind logging Common connection codes Connection descriptionOptions description Error log logging levels Error log referenceError log levels Common connection codes Error log levels Error log content Example 5-3 Error log excerpt Error log content for other log levels Into pending list Example 5-4 Replication error log entry Timestamp Pluginname message Timestamp function message Example 5-6 Config file processing log entry Example 5-7 Access control summary loggingAudit log reference Ldap result codes Example 5-8 Audit log contentAudit log does not have any other log level to set Ldap result codes Ldap result codes Adminlimitexceeded LdapReferral Ldap Ldap Using special characters Finding and executing command-line utilitiesCommand-line utilities quick reference Commonly-used command-line utilities Ldapsearch syntax LdapsearchCommonly-used ldapsearch options Ldapsearch syntax Commonly-used ldapsearch options Ldapsearch SSL options Persistent search optionsCommonly-used ldapsearch options Persistent search options Additional SSL ldapsearch options Ldapsearch Sasl options Sasl options Description of CRAM-MD5 mechanism options Description of CRAM-MD5 mechanism options Do not permit mechanisms that allow anonymous accessDo not permit mechanisms susceptible to active attacks Require forward secrecy Maxbufsize Description of DIGEST-MD5 Sasl mechanism options Required Mech=DIGEST-MD5 Gives the Sasl MechanismFollowing UID. For example Additional ldapsearch options Description of Gssapi Sasl mechanism options10 Additional ldapsearch options 10 Additional ldapsearch options Ldapmodify syntax LdapmodifyCommonly-used ldapmodify options 11 Commonly-used ldapmodify options Ldapmodify SSL options 11 Commonly-used ldapmodify options12 ldapmodify SSL options Ldapmodify Sasl options 12 ldapmodify SSL options13 Sasl options Ldapdelete Additional ldapmodify options14 Additional ldapmodify options Commonly-used ldapdelete options Ldapdelete syntaxLdapdelete SSL options 15 Commonly-used ldapdelete options Ldapdelete Sasl options 16 ldapdelete SSL options17 Sasl options Additional ldapdelete options LdappasswdLdappasswd syntax 18 Additional ldapdelete options General ldappasswd options Ldappasswd-specific options19 ldappasswd-specific options 20 General ldappasswd options 20 General ldappasswd options Ldappasswd Sasl options Ldappasswd examples 21 Sasl optionsSix values Example 6-3 User changing his own password Example 6-2 Directory Manager generating a users passwordLdif Ldif Dbscan Ldif command has the following formatLdif syntax Ldif options Dbscan examples Dbscan options23 Common options 24 Entry file options Example 6-13 Displaying the changelog file contents Example 6-8 Displaying VLV index file contentsExample 6-14 Dumping the index file uid.db4 with raw mode Example 6-7 Dumping the entry file Command-line scripts quick reference Finding and executing command-line scriptsSaveconfig Shell scripts in /opt/dirsrv/slapd-instancename Perl scripts in /opt/dirsrv/slapd-instancename Shell scriptsScripts in /opt/dirsrv/bin This section covers the following scripts Cl-dump Dumps and decodes the changelog 1 bak2db Restores a database from backupSyntax Bak2db options Cl-dump options Dbverify Checks for corrupt databasesOptions Dbverify options 5 db2ldif Exports database contents to Ldif 4 db2bak Creates a backup of a database Ldif2db Import 6 db2index Reindexes database index filesReindex cn and givenname in the database instance userRoot Db2index options Ldif2ldap Performs import operation over Ldap Pwdhash Prints encrypted passwordsLdif2db options 10 ldif2ldap options Repl-monitor Monitors replication status Monitor Retrieves monitoring information11 pwdhash options Syntax monitor Hostportbinddnbindpwdbindcert Restoreconfig Restores Administration Server configuration Saveconfig Saves Administration Server configurationRestart-slapd Restarts the Directory Server Stop-slapd Stops the Directory Server Start-slapd Starts the Directory ServerSuffix2instance Maps a suffix to a backend name Vlvindex Creates virtual list view indexes Restores a database from a backup 1 bak2db.pl Restores a database from backupPerl scripts Options Either the -nor the -soption must be specified 19 cl-dump.pl command options 3 db2bak.pl Creates a backup of a databaseCreates a backup of the database Cl-dump.pl Dumps and decodes the changelog 4 db2index.pl Creates and generates indexes 5 db2ldif.pl Exports database contents to Ldif 22 db2ldif.pl options Fixup-memberof.pl Regenerate memberOf attributes Ldif2db.pl Import 23 fixup-memberof.pl options24 ldif2db.pl options 25 Information extracted from access logs Logconv.pl Log converter24 ldif2db.pl options 26 logconv.pl options Ns-accountstatus.pl Establishes account status 27 logconv.pl options to display occurrences28 ns-accountstatus.pl options Ns-inactivate.pl Inactivates an entry or group of entries Ns-activate.pl Activates an entry or group of entriesActivates an entry or group of entries 29 ns-activate.pl options 31 ns-newpwdpolicy.pl options Repl-monitor.pl Monitors replication statusShows in-progress status of replication 32 repl-monitor.pl options Where 33 schema-reload.pl options Schema-reload.pl Reload schema files dynamicallySchemadirectory script uses the default schema directory Verify-db.pl Check for corrupt databases Command, then it uses the default database directory 34 verify-db.pl optionUsage information Contacting HP How to contact HP technical supportInformation to collect before contacting HP HP authorized resellers Related information HP-UX Directory Server documentation setSupport and other resources Typographic conventions Troubleshooting resourcesHP-UX documentation set This document uses the following typographical conventions TIP Exports the contents of the database to Ldif Finding and executing the ns-slapd command-line utilitiesOverview of ns-slapd Utilities for exporting databases db2ldif Table A-1 db2ldif options Utilities for restoring and backing up databases ldif2dbImports Ldif files to the database Table A-2 ldif2db options Utilities for restoring and backing up databases archive2db Utilities for restoring and backing up databases db2archiveUtilities for creating and regenerating indexes db2index Table A-5 db2index options 247 Glossary Glossary Bind rule 249 CoS definition GSS-API 251 Ldap NIS 253 Proxy Sasl 255 Superuser 256 Symbols Statistics for monitoring and optimizing directory257 Read-only monitoring configuration entries Suffix and replication configuration entries 259 Index 261 Database link plug-in configuration attributes Distributed numeric assignment plug-in configuration 263 Ldap NsDS5ReplicaChangesSentSinceStartup attribute 265 Page 267 Index 269 Index 271