10.4. Exporting and Importing an Encrypted Database
Exporting and importing encrypted databases is similar to exporting and importing regular databases. However, the encrypted information must be decrypted when you export the data and re-encrypted when you reimport it to the database.
10.4.1. Exporting an Encrypted Database
To export data from an encrypted database, pass the
-E
parameter to the dsconf
command.
For example, to export the complete
userRoot
database with decrypted attributes:
# dsconf -D "cn=Directory Manager" ldap://server.example.com backend export -E userRoot
Alternatively, you can export only a specific subtree. For example, to export all data from the
ou=People,dc=example,dc=com
entry:
# dsconf -D "cn=Directory Manager" ldap://server.example.com backend export -E -s "ou=People,dc=example,dc=com" userRoot
For further details about using
dsconf
to export data, see Section 6.2.1.1.1, “Exporting a Databases Using the dsconf backend export
Command”.
10.4.2. Importing an LDIF File into an Encrypted Database
To import data to a database when attribute encryption is enabled:
- Stop the Directory Server instance:
# dsctl instance_name stop
- If you replaced the certificate database between the last export and this import, edit the
/etc/dirsrv/slapd-instance_name/dse.ldif
file, and remove the following entries including their attributes:cn=AES,cn=encrypted attribute keys,cn=database_name,cn=ldbm database,cn=plugins,cn=config
cn=3DES,cn=encrypted attribute keys,cn=database_name,cn=ldbm database,cn=plugins,cn=config
Important
Remove the entries for all databases. If any entry that contains thensSymmetricKey
attribute is left in the/etc/dirsrv/slapd-instance_name/dse.ldif
file, Directory Server will fail to start. - Import the LDIF file. For example, to import the
/tmp/example.ldif
into theuserRoot
database:# dsctl instance_name ldif2db --encrypted userRoot /tmp/example.ldif
The--encrypted
parameter enables the script to encrypt attributes configured for encryption during the import. - Start the instance:
# dsctl instance_name start