Chapter 12. Encrypting the replication changelog

Procedure

1. Export the changelog, for example, to the /tmp/changelog.ldif file:

   # dsconf <instance_name> replication export-changelog to-ldif -o /tmp/changelog.ldif -r "dc=example,dc=com"

   Copy to Clipboard Toggle word wrap

2. Enable change log encryption for the dc=example,dc=com suffix:

   # dsconf <instance_name> replication --suffix "dc=example,dc=com" --encrypt

   Copy to Clipboard Toggle word wrap

3. Import the changelog from the /tmp/changelog.ldif file:

   # dsconf <instance_name> replication import-changelog from-ldif -r "dc=example,dc=com" /tmp/changelog.ldif

   Copy to Clipboard Toggle word wrap

4. Restart the instance:

   # dsctl <instance_name> restart

   Copy to Clipboard Toggle word wrap

Verification

1. Make a change in the LDAP directory, such as updating an entry.

2. Stop the instance:

   # dsctl <instance_name> stop

   Copy to Clipboard Toggle word wrap

3. List the suffixes and their corresponding databases:

   # dsconf <instance_name> backend suffix list
   dc=example,dc=com (userroot)

   Copy to Clipboard Toggle word wrap

   Note the name of the database for which you enabled changelog encryption.

4. Enter the following command to display parts of the changelog:

   # dbscan -f /var/lib/dirsrv/slapd-<instance_name>/db/userroot/replication_changelog.db | tail -50

   Copy to Clipboard Toggle word wrap

   If the changelog is encrypted, you see only encrypted data.

5. Start the instance.

   # dsctl <instance_name> start

   Copy to Clipboard Toggle word wrap