8.2. 상태 점검을 사용하여 문제 확인

프로세스

• 상태 점검을 실행하려면 다음을 입력합니다.

  # dsctl <instance_name> healthcheck
  Beginning lint report, this could take a while ...
  Checking Backends ...
  Checking Config ...
  Checking Encryption ...
  Checking FSChecks ...
  Checking ReferentialIntegrityPlugin ...
  Checking MonitorDiskSpace ...
  Checking Replica ...
  Checking Changelog ...
  Checking NssSsl ...
  Healthcheck complete.
  1 Issue found!  Generating report ...

  Copy to Clipboard Toggle word wrap

  출력을 JSON 형식으로 표시하려면 --json 매개변수를 명령에 전달합니다.

  # dsctl --json <instance_name> healthcheck

  Copy to Clipboard Toggle word wrap

  예 8.1. 상태 점검에 대한 가능한 보고서

  [1] DS Lint Error: DSELE0001
  --------------------------------------------------------------------------------
  Severity: MEDIUM
  Affects:
   -- cn=encryption,cn=config
  
  Details:
  -----------
  This Directory Server may not be using strong TLS protocol versions. TLS1.0 is known to
  have a number of issues with the protocol. Please see:
  
  https://tools.ietf.org/html/rfc7457
  
  It is advised you set this value to the maximum possible.
  
  Resolution:
  -----------
  There are two options for setting the TLS minimum version allowed.  You,
  can set "sslVersionMin" in "cn=encryption,cn=config" to a version greater than "TLS1.0"
  You can also use 'dsconf' to set this value.  Here is an example:
  
      # dsconf slapd-instance_name security set --tls-protocol-min=TLS1.2
  
  You must restart the Directory Server for this change to take effect.
  
  Or, you can set the system wide crypto policy to FUTURE which will use a higher TLS
  minimum version, but doing this affects the entire system:
  
      # update-crypto-policies --set FUTURE
  
  
  ===== End Of Report (1 Issue found) =====

  Copy to Clipboard Toggle word wrap

  예 8.2. JSON 형식의 상태 점검 보고서 사용 가능

  [
      {
          "dsle": "DSELE0001",
          "severity": "MEDIUM",
          "items": [
              "cn=encryption,cn=config"
          ],
          "detail": "This Directory Server may not be using strong TLS protocol versions. TLS1.0 is known to\nhave a number of issues with the protocol. Please see:\n\nhttps://tools.ietf.org/html/rfc7457\n\nIt is advised you set this value to the maximum possible.",
          "fix": "There are two options for setting the TLS minimum version allowed.  You,\ncan set \"sslVersionMin\" in \"cn=encryption,cn=config\" to a version greater than \"TLS1.0\"\nYou can also use 'dsconf' to set this value.  Here is an example:\n\n    # dsconf slapd-instance_name security set --tls-protocol-min=TLS1.2\n\nYou must restart the Directory Server for this change to take effect.\n\nOr, you can set the system wide crypto policy to FUTURE which will use a higher TLS\nminimum version, but doing this affects the entire system:\n\n    # update-crypto-policies --set FUTURE"
      }
  ]

  Copy to Clipboard Toggle word wrap