Installing Red Hat Directory Server

Procedure

1. Use a browser to connect to the web console running on port 9090 on the Directory Server host:

   https://server.example.com:9090

2. Log in as the root user or as a user with sudo privileges.
3. Select the Red Hat Directory Server entry.

4. Create a new instance:

   • If no instance exists on the server, click the Create New Instance button.
   • If the server already runs existing instances, select Actions and click Create New Instance.

5. Complete the fields of the Create New Server Instance form:

   • Instance Name: Sets the name of the instance. Note that you cannot change the name of an instance after it has been created.
   • Port: Sets the port number of the LDAP protocol. The port must not be in use by another instance or service. The default port is 389.
   • Secure Port: Sets the port number of the LDAPS protocol. The port must not be in use by another instance or service. The default port is 636.

   • Create Self-Signed TLS Certificate DB: Enables TLS encryption in the instance, and creates a self-signed certificate.

     For increased security, Red Hat recommends that you create the new instance with the self-signed certificate and TLS enabled. Note that you can replace the self-signed certificate with a certificate issued by a Certificate Authority (CA) at a later date.

   • Directory Manager DN: Sets the distinguished name (DN) of the administrative user of the instance. The default value is cn=Directory Manager.
   • Directory Manager Password: Sets the password of the administrative user of the instance.
   • Confirm Password: Must be set to the same value as in the Directory Manager Password field.

   • Create Database: Select this field to automatically create a suffix during instance creation.

     Important

     If you do not create a suffix during instance creation, you must create it later manually before you can store data in this instance.

     If you enabled this option, fill the addition fields:

     • Database Suffix: Sets the suffix for the back end.
     • Database Name: Sets the name of the back end database.
     • Database Initialization: Set this field to Create Suffix Entry.

6. Click Create Instance.

   The new instance starts and is configured to start automatically when the system boots.

7. Open the required ports in the firewall:

   # firewall-cmd --permanent --add-port={389/tcp,636/tcp}

8. Reload the firewall configuration:

   # firewall-cmd --reload

Procedure

1. Enable the redhat-ds:12 module and install Directory Server packages:

   # dnf module enable redhat-ds:12
   # dnf install 389-ds-base cockpit-389-ds

Procedure

1. Use the dscreate create-template command to create a template .inf file. For example, to store the template in the /root/instance_name.inf file, enter:

   # dscreate create-template /root/instance_name.inf

   The created file contains all available parameters including descriptions.

2. Edit the file that you created in the previous step:

   1. Uncomment the parameters that you want to set to customize the installation.

      All parameters have defaults. However, customize certain parameters for a production environment. For example, set at least the following parameters in the [slapd] section:

      instance_name = instance_name
      root_password = password

      By default, Directory Server creates an instance with the Berkeley Database (BDB). To install an instance with the LMDB backend that is a Technology Preview starting with Directory Server 12.5, set the following parameters:

      db_lib = mdb
      mdb_max_size = 21474836480

      Note that mdb_max_size must be an integer value that depends on your directory size. For more details, see nsslapd-mdb-max-size attribute description.

   2. To use the instance behind a load balancer with GSSAPI authentication, set the full_machine_name parameter in the [general] section to the fully-qualified domain name (FQDN) of the load balancer instead of the FQDN of the Directory Server host:

      full_machine_name = loadbalancer.example.com

   3. Uncomment the strict_host_checking parameter in the [general] section and set it to False:

      strict_host_checking = False

   4. To automatically create a suffix during instance creation, set the following parameters in the [backend-userroot] section:

      create_suffix_entry = True
      suffix = dc=example,dc=com

      Important

      If you do not create a suffix during instance creation, you must create it later manually before you can store data in this instance.

   5. Optional: Uncomment other parameters and set them to appropriate values for your environment. For example, use these parameters to specify replication options, such as authentication credentials and changelog trimming, or set different ports for the LDAP and LDAPS protocols.

      Note

      By default, new instances that you create include a self-signed certificate and TLS enabled. For increased security, do not disable this feature. Note that you can replace the self-signed certificate with a certificate issued by a Certificate Authority (CA) at a later date.

Procedure

1. Pass the .inf file to the dscreate from-file command to create the new instance:

   # dscreate from-file /root/instance_name.inf
   Starting installation ...
   Validate installation settings ...
   Create file system structures ...
   Create self-signed certificate database ...
   Perform SELinux labeling ...
   Perform post-installation tasks ...
   Completed installation for instance: slapd-instance_name

   The dscreate utility automatically starts the instance and configures RHEL to start the service when the system boots.

2. Open the required ports in the firewall:

   # firewall-cmd --permanent --add-port={389/tcp,636/tcp}

3. Reload the firewall configuration:

   # firewall-cmd --reload

Procedure

1. Create the Kerberos principal for the load balancer, for example ldap/loadbalancer.example.com_@_EXAMPLE.COM. The procedure to create the service principal depends on your Kerberos installation. For details, see your Kerberos server’s documentation.
2. Optional: You can add further principals to the keytab file. For example, to enable users to connect to the Directory Server instance behind the load balancer directly using Kerberos authentication, add additional principals for the Directory Server host. For example, ldap/server1.example.com@EXAMPLE.COM.
3. Copy the service keytab file to the Directory Server host, and store it, for example, in the /etc/dirsrv/slapd-instance_name/ldap.keytab file.

4. Add the path to the service keytab to the /etc/sysconfig/slapd-instance_name file:

   KRB5_KTNAME=/etc/dirsrv/slapd-instance_name/ldap.keytab

5. Restart the Directory Server instance:

   # dsctl instance_name restart

Procedure

1. Enable the FIPS mode for the network security services (NSS) database:

   # modutil -dbdir /etc/dirsrv/slapd-instance_name/ -fips true

2. Restart the instance:

   # dsctl instance_name restart

Procedure

1. Make sure you enabled correct repositories. For details, see Enabling Directory Server repositories.

2. Update the Directory Server packages and their dependencies to the latest available version:

   # dnf update 389-ds-base cockpit-389-ds

   The update process automatically restarts the dirsrv services for all instances on the server.

Procedure

1. Start the migration from BDB to LMDB:

   # dsctl instance_name dblib bdb2mdb
   ...
   Backends importation 0.000000% (userroot)
   Backends importation 100%

   The command sets the nsslapd-backend-implement global configuration parameter to mdb and calculates the database size that you can adjust by setting the nsslapd-mdb-max-size parameter value.

2. Remove the migration .ldif file and the old database:

   # dsctl instance_name dblib cleanup
   cleanup dbmapdir=/var/lib/dirsrv/slapd-instance_name/db dbhome=/dev/shm/slapd-instance_name dblib=mdb

Procedure

1. Export all your databases to an LDIF file as described in Exporting data using the command line while the server is offline.

2. Determine the LMDB database maximum size by clarifying the existing databases size and adding a safety margin of 20%. Skip this step if you migrate back from LMDB to BDB.

   1. Clarify the existing databases size:

      # du -hs /var/lib/dirsrv/slapd-instance_name/db/*/ 
      1.8GB

   2. Add the safety margin of 20%:

      1.8 GB + 20% = 2.16 GB

      You require the maximum database size in the future steps.

3. Change the database type to LMDB on the instance and restart the instance:

   # dsconf instance_name backend config set --db-lib mdb
   Successfully updated database configuration
   
   # dsctl instance_name restart
   Instance "instance_name" has been restarted

   When you migrate back from LMDB to BDB, set the --db-lib option to bdb.

4. Set the LMDB maximum size to the value you calculated in the previous steps (2.16 GB) in bytes and restart the instance:

   # dsconf instance_name backend config set --mdb-max-size 2319282339
   Successfully updated database configuration
   
   # dsctl instance_name restart
   Instance "instance_name" has been restarted

   The command sets the nsslapd-mdb-max-size configuration parameter value.

   Note

   Skip this step if you migrate back from LMDB to BDB.

5. Import all databases from the LDIF file as described in Importing data using the command line while the server is offline.

Procedure

1. On the Directory Server 12 host, enable replication, but do not create a replication agreement. For details about enabling replication, see the Configuring and managing replication documentation for Red Hat Directory Server 12.

2. On the Directory Server 11 host, enable replication and create a replication agreement that points to the Directory Server 12 host. For more information, see the Multi-Supplier Replication section in the Red Hat Directory Server 11 Administrator Guide.

   Important

   If you used a custom configuration on the Directory Server 11 host, do not replace the dse.ldif configuration file on the Directory Server 12 host with the file from the Directory Server 11 host, because the dse.ldif layout changes between versions. Instead, use the dsconf utility or the web console to add the custom configuration for each parameter and plug-in that you require.

3. Optional: Set up further Directory Server 12 hosts with replication agreements between Directory Server 12 hosts.
4. Configure your clients to use only Directory Server 12 hosts.
5. On the Directory Server 11 host, remove the replication agreements that point to Directory Server 12 host. See Removing a Directory Server Instance from the Replication Topology in the Red Hat Directory Server 11 Administration Guide.
6. Uninstall the Directory Server 11 hosts. See Uninstalling Directory Server in the Red Hat Directory Server 11 Installation Guide.

Procedure

1. Perform the following steps on the existing Directory Server 11 host:

   1. Stop and disable the dirsrv service:

      # dsctl DS11_instance_name stop
      # systemctl disable dirsrv@DS11_instance_name

   2. Export the backend. For example, to export the userRoot database and store it in the /var/lib/dirsrv/slapd-DS11_instance_name/migration.ldif file, run:

      # dsctl DS11_instance_name db2ldif userroot /var/lib/dirsrv/slapd-DS11_instance_name/migration.ldif

   3. Copy the following files to the new host where you want to install Directory Server 12:

      • The /var/lib/dirsrv/slapd-DS11_instance_name/migration.ldif file that you exported in the previous step.

      • The /etc/dirsrv/slapd-DS11_instance_name/dse.ldif configuration file.

        Important

        Do not replace the dse.ldif configuration file on the Directory Server 12 host with the file from the Directory Server 11 host because the dse.ldif layout changes different versions. Store the dse.ldif file for the reference.

      • The /etc/dirsrv/slapd-DS11_instance_name/schema/99user.ldif file, if you use a custom schema.

      • If you want to migrate an instance with TLS enabled and reuse the same host name for the Directory Server 12 installation, copy the following files to the new host:

        • /etc/dirsrv/slapd-DS11_instance_named/cert9.db
        • /etc/dirsrv/slapd-DS11_instance_name/key4.db
        • /etc/dirsrv/slapd-DS11_instance_name/pin.txt
   4. If you want to use the same host name and IP on the Directory Server 12 host, disconnect the old server from the network.

2. Perform the following steps on the new Directory Server 12 host:

   1. Optional: Configure TLS encryption:

      • If the new installation uses a different host name than the Directory Server 11 instance, see the Enabling TLS-encrypted connections to Directory Server section in the Securing Red Hat Directory Server documentation.

      • To use the same host name as the previous Directory Server 11 installation:

        1. Stop the instance:

           # dsctl DS12_instance_name stop

        2. Remove the Network Security Services (NSS) databases and the password file for Directory Server, if they already exist:

           # rm /etc/dirsrv/slapd-DS12_instance_name/cert*.db /etc/dirsrv/slapd-DS12_instance_name/key*.db /etc/dirsrv/slapd-DS12_instance_name/pin.txt

        3. Place the cert9.db, key4.db, and pin.txt files that you copied from the Directory Server 11 host in the /etc/dirsrv/slapd-DS12_instance_name/ directory:

        4. Set the correct permissions for the NSS databases and the password file:

           # chown dirsrv:root /etc/dirsrv/slapd-DS12_instance_name/cert9.db /etc/dirsrv/slapd-DS12_instance_name/key4.db /etc/dirsrv/slapd-DS12_instance_name/pin.txt
           
           # chmod 600 /etc/dirsrv/slapd-DS12_instance_name/cert9.db /etc/dirsrv/slapd-DS12_instance_name/key4.db /etc/dirsrv/slapd-DS12_instance_name/pin.txt

        5. Start the instance:

           # dsctl DS12_instance_name start

   2. If you used a custom schema, place the 99user.ldif file into the /etc/dirsrv/slapd-DS12_instance_name/schema/ directory, set appropriate permissions, and restart the instance:

      # cp /etc/dirsrv/slapd-DS11_instance_name/schema/99user.ldif /etc/dirsrv/slapd-DS12_instance_name/schema/
      
      # chmod 644 /etc/dirsrv/slapd-DS12_instance_name/schema/99user.ldif
      
      # chown root:root /etc/dirsrv/slapd-DS12_instance_name/schema/99user.ldif
      
      # dsctl DS12_instance_name restart

   3. Place the /var/lib/dirsrv/slapd-DS11_instance_name/migration.ldif file that you copied from the Directory Server 11 host in the /var/lib/dirsrv/slapd-DS12_instance_name/ldif/ directory and set the correct permissions:

      # cp /var/lib/dirsrv/slapd-DS11_instance_name/migration.ldif /var/lib/dirsrv/slapd-DS12_instance_name/ldif/
      
      # chown dirsrv:dirsrv /var/lib/dirsrv/slapd-DS12_instance_name/ldif/migration.ldif

   4. Import the migration.ldif file to restore the userRoot database with all entries:

      # dsconf -D 'cn=Directory Manager' ldap://server.example.com backend import userRoot /var/lib/dirsrv/slapd-DS12_instance_name/ldif/migration.ldif

      Note that Directory Server requires the LDIF file you want to import in the /var/lib/dirsrv/slapd-DS12_instance_name/ directory.

      Important

      If you used a custom configuration on the Directory Server 11 host, do not replace the dse.ldif configuration file on the Directory Server 12 host with the file from the Directory Server 11 host. Instead, use the dsconf utility or the web console to add the custom configuration manually for each parameter and plug-in that you require.

Procedure

1. On the Directory Server 12 host, enable replication, but do not create a replication agreement. For details about enabling replication, see the Configuring and managing replication in the Red Hat Directory Server 12 documentation.

2. On the Directory Server 10 host, enable replication and create a replication agreement that points to the Directory Server 12 host. For details about enabling replication, see chapter 15 "Managing Replication" in the Red Hat Directory Server 10 Administration Guide.

   Important

   If you used a custom configuration on the Directory Server 10 host, do not replace the dse.ldif configuration file on the Directory Server 12 host with the file from previous versions, because the dse.ldif layout changes between versions. Instead, use the dsconf utility or the web console to add the custom configuration for each parameter and plug-in that you require.

3. Optional: Set up further Directory Server 12 hosts with replication agreements between the Directory Server 12 hosts.
4. Configure your clients to use only the Directory Server 12 hosts.

5. On the Directory Server 10 host, remove the replication agreements that point to the Directory Server 12 host:

   # ldapmodify -D "cn=Directory Manager" -W -x -p 389 -h server_ds_10.example.com
   dn: cn=agreement-to-DS-12-server,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping
   tree,cn=config
   changetype: delete

6. Uninstall the Directory Server 10 hosts. See the chapter 4.8 "Uninstalling Directory Server" in the Red Hat Directory Server 10 Installation Guide.

Procedure

1. Perform the following steps on the existing Directory Server 10 host:

   1. Stop and disable the dirsrv service:

      # dsctl DS10_instance_name stop
      # systemctl disable dirsrv@DS10_instance_name

   2. Export the backend. For example, to export the userRoot database and store it in the /tmp/userRoot.ldif file:

      # db2ldif -Z DS10_instance_name -n userRoot -a /tmp/userRoot.ldif

   3. Copy the following files to the new Directory Server 12 host:

      • The LDIF file userRoot.ldif that you exported in the previous step.
      • The /etc/dirsrv/slapd-DS10_instance_name/schema/99user.ldif file if you use a custom schema.

      • The /etc/dirsrv/slapd-DS10_instance_name/dse.ldif configuration file.

        Important

        Do not replace the dse.ldif configuration file on the Directory Server 12 host with the file from the Directory Server 10 host because the dse.ldif layout changes between versions. Store the dse.ldif file for the reference.

      • If you want to migrate an instance with TLS enabled and reuse the same host name for the Directory Server 12 installation, copy:

        • /etc/dirsrv/slapd-DS10_instance_name/cert8.db
        • /etc/dirsrv/slapd-DS10_instance_name/key3.db
        • /etc/dirsrv/slapd-DS10_instance_name/pin.txt
   4. If you want to use the same host name and IP on the Directory Server 12 host, disconnect the old server from the network.

2. Perform the following steps on the new Directory Server 12 host:

   1. Optional: Configure TLS encryption:

      • If the new installation uses a different host name than the Directory Server 10 instance, see the Enabling TLS-encrypted connections to Directory Server section in the Securing Red Hat Directory Server documentation.

      • If you want to use the same host name as the previous Directory Server 10 installation:

        1. Stop the instance:

           # dsctl DS12_instance_name stop

        2. Remove the Network Security Services (NSS) databases and the password file for Directory Server, if they already exist:

           # rm /etc/dirsrv/slapd-DS12_instance_name/cert*.db /etc/dirsrv/slapd-DS12_instance_name/key*.db /etc/dirsrv/slapd-DS12_instance_name/pin.txt

        3. Move the cert8.db, key3.db, and pin.txt files that you copied from the Directory Server 10 host to the /etc/dirsrv/slapd-DS12_instance_name/ directory.

        4. Set the correct permissions for the NSS databases and the password file:

           # chown dirsrv:root /etc/dirsrv/slapd-DS12_instance_name/cert8.db /etc/dirsrv/slapd-DS12_instance_name/key3.db /etc/dirsrv/slapd-DS12_instance_name/pin.txt
           
           # chmod 600 /etc/dirsrv/slapd-DS12_instance_name/cert8.db /etc/dirsrv/slapd-DS12_instance_name/key3.db /etc/dirsrv/slapd-DS12_instance_name/pin.txt

        5. Start the instance:

           # dsctl DS12_instance_name start

   2. If you used a custom schema, place the 99user.ldif file in the /etc/dirsrv/slapd-DS12_instance_name/schema/ directory, set appropriate permissions, and restart the instance:

      # cp /etc/dirsrv/slapd-DS10_instance_name/schema/99user.ldif /etc/dirsrv/slapd-DS12_instance_name/schema/
      
      # chmod 644 /etc/dirsrv/slapd-DS12_instance_name/schema/99user.ldif
      
      # chown root:root /etc/dirsrv/slapd-DS12_instance_name/schema/99user.ldif
      
      # dsctl DS12_instance_name restart

   3. Place the /tmp/userRoot.ldif file you prepared on the Directory Server 10 host in the /var/lib/dirsrv/slapd-DS12_instance_name/ldif/ directory and set the correct permissions:

      # cp /tmp/userRoot.ldif /etc/dirsrv/slapd-DS12_instance_name/ldif/
      
      # chown dirsrv:dirsrv /var/lib/dirsrv/slapd-DS12_instance_name/ldif/userRoot.ldif

   4. Import the userRoot.ldif file to restore the userRoot backend with all entries:

      # dsconf -D 'cn=Directory Manager' ldap://server.example.com backend import userRoot /var/lib/dirsrv/slapd-instance_name/ldif/userRoot.ldif

      Note that Directory Server 12 can import LDIF files only from the /var/lib/dirsrv/slapd-DS12_instance_name/ directory.

      Important

      If you used a custom configuration on the Directory Server 10 host, do not replace the dse.ldif configuration file on the Directory Server 12 host with the file from previous versions. Instead, use the dsconf utility or the web console to add the custom configuration manually for each parameter and plug-in that you require.

Procedure

1. Go to the Red Hat Directory Server download page.

2. Select PassSync Installer for RHDS 11 and 12 from the list and click Download Now button.

   NOTE

   The PassSync package is deprecated starting with Red Hat Directory Server 12.6.

3. Copy the installer to every writable Active Directory domain controller (DC).

Procedure

1. Log in to the Active Directory DC with a user that has permissions to install software on the DC.
2. Double-click the RedHat-PassSync-ds12.*-x86_64.msi file to install it.
3. The Red Hat Directory Password Sync Setup appears. Click Next.

4. Fill the fields according to your Directory Server environment. For example:

   

   Fill the following information of the Directory Server host into the fields:

   • Host Name: Sets the name of the Directory Server host. Alternatively, you can set the field to the IPv4 or IPv6 address of the Directory Server host.
   • Port Number: Sets the LDAPS port number.
   • User Name: Sets the distinguished name (DN) of the synchronization user account.
   • Password: Sets the password of the synchronization user.
   • Cert Token: Sets the password of the server certificate copied from the Directory Server host.
   • Search Base: Sets the DN of the Directory Server entry that contains the synchronized user accounts.
5. Click Next to start the installation.
6. Click Finish.

7. Reboot the Windows DC.

   Important

   Without rebooting the DC, the PasswordHook.dll library is not enabled and password synchronization fails.

8. Enable replication in Directory Server and create a WinSync agreement.

Procedure

1. Log in to the Active Directory domain controller with a user that has permissions to install software on the DC.
2. Double-click the RedHat-PassSync-ds12.*-x86_64.msi file.
3. Click Next to begin installing.
4. Click the Modify button.
5. The setup displays the configuration set during the previous installation. Click Next to keep the existing settings.
6. Click Next to start the installation.
7. Click Finish.

8. Reboot the Windows DC.

   Important

   Without rebooting the DC, the PasswordHook.dll library is not enabled and password synchronization will fail.

1. Open the Control Panel
2. Click Programs and then Programs and Features

3. Select the Red Hat Directory Password Sync entry, and click the Uninstall button.

   
4. Click Yes to confirm.

Procedure

1. Optional: Create a backup of the Directory Server directories:

   1. Stop the instance:

      # dsctl instance_name stop

   2. Copy the /var/lib/dirsrv/slapd-instance_name/ directory:

      # cp -rp /var/lib/dirsrv/slapd-instance_name/ /root/var-lib-dirsrv-instance_name.bak/

      This directory contains the database, as well as the backup and export directory.

   3. Copy the /etc/dirsrv/slapd-instance_name/ directory:

      # cp -rp /etc/dirsrv/slapd-instance_name/ /root/etc-dirsrv-instance_name.bak/

2. Remove the instance:

   # dsctl instance_name remove --do-it
   Removing instance ...
   Completed instance removal

Procedure

1. Optional: Create a backup of the Directory Server directories.

   1. Click the Actions button, and select Stop instance.

   2. Copy the /var/lib/dirsrv/slapd-instance_name/ directory:

      # cp -rp /var/lib/dirsrv/slapd-instance_name/ /root/var-lib-dirsrv-instance_name.bak/

      This directory contains the database, as well as the backup and export directory.

   3. Copy the /etc/dirsrv/slapd-instance_name/ directory:

      # cp -rp /var/lib/dirsrv/slapd-instance_name/ /root/etc-dirsrv-instance_name.bak/

2. Click the Actions button, and select Remove this instance.
3. Select Yes, I am sure, and click Remove Instance to confirm.

Procedure

1. Remove all instances from the replication topology. If your instance is not a member of a replication topology skip this step.

2. Remove all instances from the server. For each instance, enter:

   # dsctl instance_name remove --do-it

3. Remove the Directory Server packages:

   # dnf module remove redhat-ds

4. Optional: Disable the dirsrv-12-for-rhel-8-x86_64-rpms repository:

   # subscription-manager repos --disable=dirsrv-12-for-rhel-8-x86_64-rpms
   Repository 'dirsrv-12-for-rhel-8-x86_64-rpms' is disabled for this system.

5. Optional: Remove the Red Hat Directory Server subscription from the system:

   Important

   If you remove a subscription that provides additional products than Directory Server, you will not be able to install or update packages for these products.

   • List the subscriptions attached to the host:

     # subscription-manager list --consumed
     Subscription Name:   Example Subscription
     ...
     Pool-ID:             5ab6a8df96b03fd30aba9a9c58da57a1
     ...

   • Remove the subscription using the pool id from the previous step:

     # subscription-manager remove --pool=5ab6a8df96b03fd30aba9a9c58da57a1
     2 local certificates have been deleted.
     The entitlement server successfully removed these pools:
        5ab6a8df96b03fd30aba9a9c58da57a1
     The entitlement server successfully removed these serial numbers:
        1658239469356282126

Procedure

1. Select the Directory Server instance.

2. Click the Actions button and select the action to execute:

   • Start Instance
   • Stop Instance

   • Restart Instance

     

Procedure

1. Optionally: Display the current port numbers for the instance:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-port nsslapd-securePort

2. Change the LDAP port:

   1. Set the new port for the LDAP protocol. For example, to set it to 1389, run:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-port=1389

   2. Set the ldap_port_t type for the LDAP port you assigned in the previous step:

      # semanage port -a -t ldap_port_t -p tcp 1389

3. Change the LDAPS port:

   1. Set the new port for the LDAPS protocol. For example, to set it to 1636, run:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-securePort=1636

   2. Set the ldap_port_t type for the LDAPS port you assigned in the previous step:

      # semanage port -a -t ldap_port_t -p tcp 1636

4. Restart the instance:

   # dsctl instance_name restart

Verification

1. Verify that Directory Server now uses the new LDAP port by the command:

   # dsconf instance_name config get nsslapd-port

2. Verify that Directory Server now uses the new LDAPS port number by the command:

   # dsconf instance_name config get nsslapd-securePort

Procedure

1. Change the LDAP port:

   1. Open the Server Setting menu.
   2. On the Server Setting tab, enter the new port number into the LDAP Port field.
2. Click Save.

3. Change the LDAPS port:

   1. Open the Server Setting menu.
   2. On the General Settings tab, enter the new port number into the LDAPS Port field.
   3. Click Save.
4. Restart the instance by clicking Action and selecting Restart Instance.

Verification

1. Verify in the server setting that the changed port is reflected .

1. --uri ldap://server.example.com
2. --uri = ldaps://server.example.com
3. --uri = ldapi://%%2fvar%%2frun%%2fslapd-instance_name.socket

1. never: The utilities do not request or check the server certificate.
2. allow: The utilities ignore certificate errors and the connection is established anyway.

3. hard: The utilities terminate the connection on certificate errors.

   • --saslmech

1. The Directory Server considers the ~/.dsrc file as a remote connection and checks whether the /etc/openldap/ldap.conf configuration file and system-wide settings contain both the instance name and the LDAP URL.
2. The Directory Server considers the ~/.dsrc file as a local connection and uses the nsslapd-certdir setting from the local dse.ldif file to secure the connection if the ~/.dsrc file contains only the specified instance name, or if the ~/.dsrc file does not exist. The server uses the default path /etc/dirsrv/slapd-instance_name/ to store the Network Security Services (NSS) database of the instance if nsslapd-certdir is not present.

Procedure

1. For example, to create an LDIF file named /tmp/users.ldif that adds 100,000 generic users to the dc=example,dc=com suffix, enter:

   # dsctl instance_name ldifgen users --suffix "dc=example,dc=com" --number 100000 --generic --ldif-file=/tmp/users.ldif

   Note that the command creates the following organizational units (OU) and randomly assigns the users to these OUs:

   • ou=accounting
   • ou=product development
   • ou=product testing
   • ou=human resources
   • ou=payroll
   • ou=people

   • ou=groups

     For further details and other options you can use to create the LDIF file, enter:

     # dsctl instance_name ldifgen users --help

2. Optional: Add the test entries to the directory:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com -x -c -f /tmp/users.ldif

Procedure

1. For example, to create an LDIF file named /tmp/groups.ldif that adds 500 groups to the ou=groups,dc=example,dc=com entry, and each group has 100 members, enter:

   # dsctl instance_name ldifgen groups --number 500 --suffix "dc=example,dc=com" --parent "ou=groups,dc=example,dc=com" --num-members 100 --create-members --member-parent "ou=People,dc=example,dc=com" --ldif-file /tmp/groups.ldif example_group__

   Note that the command also creates LDIF statements to add the user entries in ou=People,dc=example,dc=com.

   For further details and other options you can use to create the LDIF file, enter:

   # dsctl instance_name ldifgen groups --help

2. Optional: Add the test entries to the directory:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com -x -c -f /tmp/groups.ldif

Procedure

1. For example, to create an LDIF file named /tmp/cos-definition.ldif that adds a classic CoS definition to the ou=cos-definitions,dc=example,dc=com entry, enter:

   # dsctl instance_name ldifgen cos-def Postal_Def --type classic --parent "ou=cos definitions,dc=example,dc=com" --cos-specifier businessCatagory --cos-template "cn=sales,cn=classicCoS,dc=example,dc=com" --cos-attr postalcode telephonenumber --ldif-file /tmp/cos-definition.ldif

   For further details and other options you can use to create the LDIF file, enter:

   # dsctl instance_name ldifgen cos-def --help

2. Optional: Add the test entries to the directory:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com -x -c -f /tmp/cos-definition.ldif

Procedure

1. For example, to create an LDIF file named /tmp/modifications.ldif:

   # dsctl instance_name ldifgen mod-load --num-users 1000 --create-users --parent="ou=People,dc=example,dc=com" --mod-attrs="sn" --add-users 10 --modrdn-users 100 --del-users 100 --delete-users --ldif-file=/tmp/modifications.ldif

   This command creates a file named /tmp/modifications.ldif file with the statements that do the following:

   • Create an LDIF file with 1000 ADD operations to create user entries in ou=People,dc=example,dc=com.
   • Modify all entries by changing their sn attributes.
   • Add additional 10 user entries.
   • Perform 100 MODRDN operations.
   • Delete 100 entries

   • Delete all remaining entries at the end

     For further details and other options you can use to create the LDIF file, enter:

     # dsctl instance_name ldifgen mod-load --help

2. Optional: Add the test entries to the directory:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com -x -c -f /tmp/modifications.ldif

Procedure

1. For example, to create an LDIF file named /tmp/nested.ldif that adds 600 users in total in different organizational units (OU) under the dc=example,dc=com entry, with each OU containing a maximum number of 100 users, enter:

   # dsctl instance_name ldifgen nested --num-users 600 --node-limit 100 --suffix "dc=example,dc=com" --ldif-file /tmp/nested.ldif

   For further details and other options you can use to create the LDIF file, enter:

   # dsctl instance_name ldifgen nested --help

2. Optional: Add the test entries to the directory:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com -x -c -f /tmp/nested.ldif