HP-UX Directory Server Version
Page
 Table of Contents
 Table of Contents
 Table of Contents
 3.4
3.3
Nsssl3ciphers
Nsslapd-state Nsslapd-backend
 113
 Schema reload plug-in
Password Storage Schemes
Nsslapd-pluginEnabled
Nsslapd-idl-switch
 Cn=ldbm database, cn=plugins, cn=config
Cn=userRoot, cn=ldbm database, cn=plugins, cn=config
NsMaxResponseDelay
NsMaxTestResponseDelay
 173
169
 189
 239
Finding and executing command-line scripts 215
215
 257
243
247
Page
 Using Directory Server command-line utilities
Directory Server configuration
Directory Server configuration
Directory Server instance file reference
 Introduction
Using Directory Server command-line scripts
 Ldif and schema configuration files
Overview of the Directory Server configuration
 Directory Server Ldif configuration files
 Configuration attributes
How the server configuration is organized
Configuration of plug-in functionality
Directory Server Ldif configuration files
 Access control for configuration entries
Accessing and modifying server configuration
Configuration of databases
Configuration of indexes
 Where
Changing configuration attributes
Modifying configuration entries using Ldap
 Configuration changes requiring server restart
Core server configuration attributes reference
 Nsslapd-accesslog Access log
1 cn=config
 Nsslapd-accesslog-list List of access log files
Nsslapd-accesslog-level Access log level
Nsslapd-accesslog-logbuffering Log buffering
Attribute values for enabling or disabling access logging
 Default Value Syntax Directory String Example
Nsslapd-accesslog-logging-enabled Access log enable logging
Valid Values
Valid Range
 SyntaxDirectoryString Example
EntryDN Cn=config Valid Range
Disk space allowed to the access log is unlimited in size
 Syntax DirectoryString Example
 Nsslapd-accesslog-maxlogsize Access log maximum log size
Nsslapd-accesslog-logrotationtime Access log rotation time
 SyntaxInteger Example
Nsslapd-accesslog-mode Access log file permission
 Default Value Off Syntax DirectoryString Example
ValidRange Through Default Value 600 Syntax Integer Example
Nsslapd-attribute-name-exceptions
Nsslapd-auditlog Audit log
 Attribute values for enabling or disabling audit logging
Nsslapd-auditlog-list
Provides a list of audit log files
EntryDN
 Entry DN Cn=config Valid Values
Nsslapd-auditlog-logging-enabled Audit log enable logging
Turns audit logging on and off
Disk space allowed to the audit log is unlimited in size
 Syntax Integer Example Nsslapd-auditlog-logrotationsynchour
Valid Range Through Default Value
 Time between audit log file rotation is unlimited
Nsslapd-auditlog-logrotationtime Audit log rotation time
Syntax Integer Example Nsslapd-auditlog-logrotationsyncmin
 None Read only Execute only
Nsslapd-auditlog-maxlogsize Audit log maximum log size
Nsslapd-auditlog-mode Audit log file permission
 Nsslapd-certdir Certificate and key database directory
Write access to the server user ID
Nsslapd-certmap-basedn Certificate map search base
Write only Read and write Write and execute
 This read-only attribute is the config DN
Nsslapd-config
Nsslapd-conntablesize
Nsslapd-counters
 Default Value Syntax DirectoryString Example
Nsslapd-ds4-compatible-schema
Default Value Off Core server configuration reference
Nsslapd-csnlogging
 Attribute values for enabling or disabling error logging
Nsslapd-errorlog Error log
Nsslapd-errorlog-level Error log level
 This read-only attribute provides a list of error log files
Nsslapd-errorlog-list
 Turns error logging on and off
Nsslapd-errorlog-logging-enabled Enable error logging
 Disk space allowed to the error log is unlimited in size
 Time between error log file rotation is unlimited
Nsslapd-errorlog-logrotationtime Error log rotation time
 Nsslapd-errorlog-maxlogsize Maximum error log size
 Nsslapd-groupevalnestlevel
Nsslapd-errorlog-mode Error log file permission
Nsslapd-idletimeout Default idle timeout
 Default Value Syntax Integer Example Nsslapd-idletimeout
Nsslapd-ioblocktimeout IO block time out
Nsslapd-instancedir Instance directory
Nsslapd-lastmod Track modification time
 Nsslapd-listenhost Listen to IP address
Nsslapd-ldapilisten Enable Ldapi socket
Nsslapd-ldapifilepath Ldapi socket file path
 Nsslapd-localhost Local host
Default Value SyntaxDirectoryString Example
Nsslapd-localuser Local user
Nsslapd-lockdir Server lock file directory
 Nsslapd-maxdescriptors Maximum file descriptors
Nsslapd-maxbersize Maximum message size
 Nsslapd-maxsasliosize Maximum Sasl packet size
 This attribute value is specified in bytes
Nsslapd-maxthreadsperconn Maximum threads per connection
Nsslapd-nagle
 Default Value Core server configuration reference
Nsslapd-outbound-ldap-io-timeout
Nsslapd-plugin
Nsslapd-port Port number
 But the request is for this entry
Nsslapd-readonly Read only
Nsslapd-referral Referral
 Nsslapd-reservedescriptors Reserved file descriptors
Nsslapd-referralmode Referral mode
 Nsslapd-rewrite-rfc1274
Nsslapd-return-exact-case Return exact case
 Nsslapd-rootdn Manager DN
Nsslapd-rootpw Root password
Default Value Syntax
 Nsslapd-saslpath
Nsslapd-rootpwstoragescheme Root password storage scheme
 Nsslapd-schemadir
Nsslapd-schemacheck Schema checking
 Nsslapd-securePort Encrypted port number
Nsslapd-schemareplace
Nsslapd-securelistenhost
 Nsslapd-sizelimit Size limit
Nsslapd-security Security
 Nsslapd-timelimit Time limit
Default Value Syntax Integer Example Nsslapd-threadnumber
Nsslapd-threadnumber Thread number
 Indicates whether users may change their passwords
PasswordChange Password change
Nsslapd-tmpdir
Nsslapd-versionstring
 PasswordExp Password expiration
PasswordCheckSyntax Check password syntax
 PasswordHistory Password history
PasswordGraceLimit Password expiration
PasswordInHistory Number of passwords to remember
Default Value Syntax Integer Example PasswordGraceLimit
 PasswordLockoutDuration Lockout duration
PasswordIsGlobalPolicy Password policy and replication
PasswordLockout Account lockout
 PasswordMaxFailure Maximum password failures
PasswordMaxAge Password maximum age
PasswordMaxRepeats Password syntax
Default Value Syntax Integer Example PasswordMaxFailure
 Default Value Syntax Integer Example PasswordMinAge
PasswordMin8Bit Password syntax
PasswordMinAge Password minimum age
 PasswordMinCategories Password syntax
PasswordMinAlphas Password syntax
PasswordMinDigits Password syntax
PasswordMinLength Password minimum length
 PasswordMinTokenLength Password syntax
PasswordMinLowers Password syntax
PasswordMinSpecials Password syntax
 PasswordStorageScheme Password storage scheme
PasswordMinUppers Password syntax
PasswordMustChange Password must change
 PasswordWarning Send warning
PasswordUnlock Unlock account
 Nsslapd-changelogdir
2 cn=changelog5,cn=config
 Nssslsessiontimeout
3 cn=encryption,cn=config
Nsslapd-changelogmaxage Max changelog age
Nsslapd-changelogmaxentries Max changelog records
 Default Value Off Syntax DirectoryString Example Nsssl2 off
Means disallow certificate-based authentication
Nssslclientauth
NsSSL2
 5 cn=mapping tree,cn=config
4 cn=features,cn=config
Suffix configuration attributes under cn=suffixName
Nsssl3ciphers
 Nsslapd-backend
Nsslapd-state
Determines how the suffix handles operations
To requests made by client applications
 NsDS5ReplicaChangeCount
NsDS5Flags
NsDS5ReplicaBindDN
 NsDS5ReplicaId
NsDS5ReplicaPurgeDelay
NsDS5ReplicaLegacyConsumer
NsDS5ReplicaName
 NsDS5ReplicaTombstonePurgeInterval
NsDS5ReplicaReferral
NsDS5ReplicaRoot
 NsState
NsDS5ReplicaType
NsDS5ReplicaReapActive
 Description
NsDS5ReplConflict
8.1 cn
 NsDS5ReplicaBusyWaitTime
NsDS5ReplicaBindMethod
 NsDS5ReplicaChangesSentSinceStartup
Schema
NsDS5ReplicaCredentials
NsDS5ReplicaHost
 NsDS5ReplicaLastInitStart
NsDS5ReplicaLastInitEnd
NsDS5ReplicaLastInitStatus
Time
 NsDS5ReplicaLastUpdateStart
NsDS5ReplicaLastUpdateEnd
NsDS5ReplicaLastUpdateStatus
NsDS5ReplicaPort
 NsDS5ReplicaPriority
Default Value SyntaxInteger ExamplensDS5ReplicaPort389
 NsDS5ReplicaSessionPauseTime
NsDS5BeginReplicaRefresh
 NsDS5ReplicatedAttributeList
NsDS5ReplicaTimeout
Valid Range Default Value SyntaxDirectoryString Example
 NsDS5ReplicaTransportInfo
NsDS5ReplicaUpdateInProgress
NsDS5ReplicaUpdateSchedule
 Sunday
NsDS5ReplicaLastUpdateEnd
NsDS50ruv
 Nsds7NewWinUserSyncEnabled
Nsds7NewWinGroupSyncEnabled
Nsds7DirectoryReplicaSubtree
Nsds7DirsyncCookie
 Nsds7WindowsDomain
10 cn=monitor
Nsds7WindowsReplicaSubtree
WinSyncInterval
 Connection table
For example
Greenwich Mean Time
This is the number of completed operations
 Nssnmpenabled
12 cn=SNMP,cn=config
This attribute sets whether Snmp is enabled
11 cn=replication
 Nssnmplocation
Nssnmporganization
Nssnmpcontact
Nssnmpdescription
 Nssnmpmasterhost
Snmp statistic attributes
Nssnmpmasterport
Snmp statistic attributes
 Snmp statistic attributes
14 cn=tasks,cn=config
 Task invocation attributes for entries under cn=tasks
 Entry DN
 Default Value Syntax DirectoryString Example Ttl
14.2 cn=import,cn=tasks,cn=config
 NsFilename file1.ldif NsFilename file2.ldif
 Default Value Syntax Integer Example NsImportChunkSize
 14.3 cn=export,cn=tasks,cn=config
 Valid Values Any DN Core server configuration reference
 Syntax Case-insensitive string Example NsUseOneFile true
Default Value Syntax DN, multi-valued Example
Syntax Case-insensitive string Example NsExportReplica true
Syntax Case-insensitive string Example NsPrintKey false
 Syntax Case-insensitive string Example NsUseId2Entry true
14.4 cn=backup,cn=tasks,cn=config
Syntax Case-insensitive string Example NsNoWrap false
Syntax Case-insensitive string Example NsDumpUniqId true
 14.5 cn=restore,cn=tasks,cn=config
 Syntax Case-exact string Example
14.6 cn=index,cn=tasks,cn=config
 NsIndexAttribute attributeindex1,index2
14.7 cn=schema reload task,cn=tasks,cn=config
 14.8 cn=memberof task,cn=tasks,cn=config
 15 cn=uniqueid generator,cn=config
 112
 Server plug-in functionality reference
Server plug-in functionality reference
1 7-bit check plug-in
 Attribute uniqueness plug-in
ACL plug-in
ACL preoperation plug-in
 Boolean syntax plug-in
Binary syntax plug-in
 Description Syntax for handling DNs Configurable Options
Plug-in Name Chaining Database DN of Configuration Entry
Case exact string syntax plug-in
Case ignore string syntax plug-in
 Country string syntax plug-in
Class of service plug-in
Distinguished name syntax plug-in
Dependencies None Performance Related
 Generalized time syntax plug-in
Distributed numeric assignment plug-in
Details of distributed numeric assignment plug-in
Plug-in Name
 Internationalization plug-in
Http client plug-in
 Ldbm database plug-in
Jpeg syntax plug-in
Legacy replication plug-in
Information Further Information
 Details of MemberOf plug-in
MemberOf plug-in
Multi-master replication plug-in
 OID syntax plug-in
Password Storage Schemes
Octet string syntax plug-in
 Postal address string syntax plug-in
Password storage plugins
 Referential integrity postoperation plug-in
PTA plug-in
 Roles plug-in
Retro Changelog plug-in
Both presence and equality
Applications
 Space insensitive string syntax plug-in
Schema reload plug-in
Details of schema reload plug-in
 URI syntax plug-in
Telephone syntax plug-in
Views plug-in
Resource Locators
 Account policy plug-in
List of attributes common to all plug-ins
Nsslapd-pluginPath
This attribute specifies the full path to the plug-in
 Nsslapd-pluginInitfunc
Nsslapd-pluginEnabled
Nsslapd-pluginType
Nsslapd-pluginId
 Nsslapd-pluginVersion
Attributes allowed by certain plug-ins
Nsslapd-pluginVendor
Nsslapd-pluginDescription
 Nsslapd-plugin-depends-on-named
Nsslapd-pluginLoadGlobal
Nsslapd-plugin-depends-on-type
 NsLookthroughLimit
Database plug-in attributes
 Nsslapd-cache-autosize-split
Nsslapd-cache-autosize
 Platforms
Nsslapd-dbcachesize
Nsslapd-db-checkpoint-interval
 Nsslapd-db-circular-logging
Default Value Database plug-in attributes
Nsslapd-db-debug
Nsslapd-db-durable-transactions
 Nsslapd-db-idl-divisor
Nsslapd-db-home-directory
 Nsslapd-db-logdirectory
Automatically adjusted to the minimum value
Nsslapd-db-logbuf-size
 Nsslapd-db-logfile-size
Valid Range Bytes to 64 kilobytes Default Value
Nsslapd-db-page-size
Nsslapd-db-private-import-mem
 Nsslapd-db-transaction-batch-val
Nsslapd-db-spin-count
 Nsslapd-dbncache
Nsslapd-db-trickle-percentage
Nsslapd-db-verbose
 Nsslapd-exclude-from-export
Nsslapd-idl-switch
Nsslapd-directory
 Nsslapd-import-cache-autosize
Nsslapd-idlistscanlimit
Nsslapd-import-cachesize
 Default Value 600 Database plug-in attributes
No access for other users
Nsslapd-mode
Memory to importCache
 Nsslapd-serial-lock
Nsslapd-search-bypass-filter-test
Nsslapd-search-use-vlv-index
 Nsslapd-cachememsize
Nsslapd-cachesize
 Nsslapd-suffix
Nsslapd-readonly
Nsslapd-require-index
 Database plug-in attributes
 This attribute provides the name of the attribute to index
5.1 cn
NsSystemIndex
 NsMatchingRule
NsIndexType
 Indexed attribute representing a subentry
NsSubStrBegin
 NsSubStrMiddle
NsSubStrEnd
 Encrypted attributes under the cn=config node
 NsEncryptionAlgorithm
Database link plug-in attributes chaining attributes
NsActiveChainingComponents
Database link plug-in attributes chaining attributes
 Nspossiblechainingcomponents
NsMaxResponseDelay
NsMaxTestResponseDelay
 NsBindConnectionsLimit
NsTransmittedControls
NsAbandonedSearchCheckInterval
 Default Value Syntax Integer Example
NsBindTimeout
NsBindRetryLimit
NsCheckLocalACI
 NsConcurrentOperationsLimit
NsConcurrentBindLimit
NsConnectionLife
NsOperationConnectionsLimit
 NsSizeLimit
NsProxiedAuthorization
NsReferralOnScopedSearch
 NsBindMechanism
NsTimeLimit
 Valid Values Empty
NsFarmServerURL
NsMultiplexorBindDN
 NsMultiplexorCredentials
Encryption schema
Nshoplimit
NsUseStartTLS
 Nsslapd-changelogdir
Retro changelog plug-in attributes
 Nsslapd-changelogmaxage Max changelog age
Distributed numeric assignment plug-in attributes
DnaFilter
DnaMagicRegen
 DnaNextValue
DnaMaxValue
DnaNextRange
 Default Value Syntax Integer Example DnaNextValue
DnaRangeRequestTimeout
DnaPrefix
Bit systems
 DnaThreshold
DnaScope
DnaSharedCfgDN
 DnaType
MemberOf plug-in attributes
Memberofattr
Memberofgroupattr
 Account policy plug-in attributes
 Configuration files
Backup files
Overview of Directory Server files
Database files
 At setup for example, dc=example,dc=com
Setup-ds-admin.plscript is run
Used internally by the database and should not be moved
Deleted, or modified in any way
 Lock files
Ldif files
Log files
PID files
 Scripts
Tools
 Access logging levels
Access log reference
 Example 5-1 Example access log
Default access logging content
Connection number
File descriptor
 Slot number
Error number
Operation number
Method type
 Ldap request type
Number of entries
Elapsed time
 Ldap response type
Unindexed search indicator
VLV-related entries
Search scope
 Change sequence number
Extended operation OID
Abandon message
LDAPv3 extended operations supported by Directory Server
 Sasl multi-stage bind logging
Access log content for additional access logging levels
Message ID
 Options description
Common connection codes
Connection description
 Error log logging levels
Error log reference
Error log levels
Common connection codes
 Error log levels
Error log content
 Example 5-3 Error log excerpt
Error log content for other log levels
 Into pending list
Example 5-4 Replication error log entry
 Timestamp Pluginname message Timestamp function message
 Audit log reference
Example 5-6 Config file processing log entry
Example 5-7 Access control summary logging
 Ldap result codes
Example 5-8 Audit log content
Audit log does not have any other log level to set
Ldap result codes
 Ldap result codes
Adminlimitexceeded Ldap
Referral Ldap
Ldap
 Using special characters
Finding and executing command-line utilities
Command-line utilities quick reference
Commonly-used command-line utilities
 Ldapsearch syntax
Ldapsearch
Commonly-used ldapsearch options
Ldapsearch syntax
 Commonly-used ldapsearch options
 Ldapsearch SSL options
Persistent search options
Commonly-used ldapsearch options
Persistent search options
 Additional SSL ldapsearch options
Ldapsearch Sasl options
 Sasl options
 Description of CRAM-MD5 mechanism options
 Description of CRAM-MD5 mechanism options
Do not permit mechanisms that allow anonymous access
Do not permit mechanisms susceptible to active attacks
Require forward secrecy
 Maxbufsize
 Following UID. For example
Description of DIGEST-MD5 Sasl mechanism options
Required Mech=DIGEST-MD5 Gives the Sasl Mechanism
 10 Additional ldapsearch options
Additional ldapsearch options
Description of Gssapi Sasl mechanism options
 10 Additional ldapsearch options
 Ldapmodify syntax
Ldapmodify
Commonly-used ldapmodify options
11 Commonly-used ldapmodify options
 12 ldapmodify SSL options
Ldapmodify SSL options
11 Commonly-used ldapmodify options
 13 Sasl options
Ldapmodify Sasl options
12 ldapmodify SSL options
 14 Additional ldapmodify options
Ldapdelete
Additional ldapmodify options
 Commonly-used ldapdelete options
Ldapdelete syntax
Ldapdelete SSL options
15 Commonly-used ldapdelete options
 17 Sasl options
Ldapdelete Sasl options
16 ldapdelete SSL options
 Additional ldapdelete options
Ldappasswd
Ldappasswd syntax
18 Additional ldapdelete options
 General ldappasswd options
Ldappasswd-specific options
19 ldappasswd-specific options
20 General ldappasswd options
 20 General ldappasswd options
Ldappasswd Sasl options
 Six values
Ldappasswd examples
21 Sasl options
 Example 6-3 User changing his own password
Example 6-2 Directory Manager generating a users password
Ldif
Ldif
 Dbscan
Ldif command has the following format
Ldif syntax
Ldif options
 Dbscan examples
Dbscan options
23 Common options
24 Entry file options
 Example 6-13 Displaying the changelog file contents
Example 6-8 Displaying VLV index file contents
Example 6-14 Dumping the index file uid.db4 with raw mode
Example 6-7 Dumping the entry file
 Command-line scripts quick reference
Finding and executing command-line scripts
Saveconfig
Shell scripts in /opt/dirsrv/slapd-instancename
 Perl scripts in /opt/dirsrv/slapd-instancename
Shell scripts
Scripts in /opt/dirsrv/bin
This section covers the following scripts
 Cl-dump Dumps and decodes the changelog
1 bak2db Restores a database from backup
Syntax
Bak2db options
 Cl-dump options
Dbverify Checks for corrupt databases
Options
Dbverify options
 5 db2ldif Exports database contents to Ldif
4 db2bak Creates a backup of a database
 Ldif2db Import
6 db2index Reindexes database index files
Reindex cn and givenname in the database instance userRoot
Db2index options
 Ldif2ldap Performs import operation over Ldap
Pwdhash Prints encrypted passwords
Ldif2db options
10 ldif2ldap options
 Repl-monitor Monitors replication status
Monitor Retrieves monitoring information
11 pwdhash options
Syntax monitor
 Hostportbinddnbindpwdbindcert
 Restart-slapd Restarts the Directory Server
Restoreconfig Restores Administration Server configuration
Saveconfig Saves Administration Server configuration
 Stop-slapd Stops the Directory Server
Start-slapd Starts the Directory Server
Suffix2instance Maps a suffix to a backend name
Vlvindex Creates virtual list view indexes
 Restores a database from a backup
1 bak2db.pl Restores a database from backup
Perl scripts
Options Either the -nor the -soption must be specified
 19 cl-dump.pl command options
3 db2bak.pl Creates a backup of a database
Creates a backup of the database
Cl-dump.pl Dumps and decodes the changelog
 4 db2index.pl Creates and generates indexes
5 db2ldif.pl Exports database contents to Ldif
 22 db2ldif.pl options
Fixup-memberof.pl Regenerate memberOf attributes
 24 ldif2db.pl options
Ldif2db.pl Import
23 fixup-memberof.pl options
 24 ldif2db.pl options
25 Information extracted from access logs
Logconv.pl Log converter
 26 logconv.pl options
 28 ns-accountstatus.pl options
Ns-accountstatus.pl Establishes account status
27 logconv.pl options to display occurrences
 Ns-inactivate.pl Inactivates an entry or group of entries
Ns-activate.pl Activates an entry or group of entries
Activates an entry or group of entries
29 ns-activate.pl options
 31 ns-newpwdpolicy.pl options
Repl-monitor.pl Monitors replication status
Shows in-progress status of replication
32 repl-monitor.pl options
 Where
 33 schema-reload.pl options
Schema-reload.pl Reload schema files dynamically
Schemadirectory script uses the default schema directory
Verify-db.pl Check for corrupt databases
 Usage information
Command, then it uses the default database directory
34 verify-db.pl option
 Contacting HP
How to contact HP technical support
Information to collect before contacting HP
HP authorized resellers
 Support and other resources
Related information
HP-UX Directory Server documentation set
 Typographic conventions
Troubleshooting resources
HP-UX documentation set
This document uses the following typographical conventions
 TIP
 Exports the contents of the database to Ldif
Finding and executing the ns-slapd command-line utilities
Overview of ns-slapd
Utilities for exporting databases db2ldif
 Table A-1 db2ldif options
Utilities for restoring and backing up databases ldif2db
Imports Ldif files to the database
Table A-2 ldif2db options
 Utilities for creating and regenerating indexes db2index
Utilities for restoring and backing up databases archive2db
Utilities for restoring and backing up databases db2archive
 Table A-5 db2index options
 247
Glossary
 Glossary
Bind rule
 249
CoS definition
 GSS-API
 251
Ldap
 NIS
 253
Proxy
 Sasl
 255
Superuser
 256
 257
Symbols
Statistics for monitoring and optimizing directory
 Read-only monitoring configuration entries
Suffix and replication configuration entries
 259
 Index
 261
Database link plug-in configuration attributes
 Distributed numeric assignment plug-in configuration
 263
Ldap
 NsDS5ReplicaChangesSentSinceStartup attribute
 265
Page
 267
 Index
 269
 Index
 271