Chapter 3. Backing up and restoring Red Hat Directory Server

Prerequisites

• The dirsrv user has write permissions in the destination directory.

  Note that Directory Server uses its own private directories by default. As a result, backups and exports under directories /var/tmp/, /tmp/, and /root/ fail unless you disabled the PrivateTmp systemd directive.

• The Directory Server instance is running.

Prerequisites

• The dirsrv user has write permissions in the destination directory.

  Note that Directory Server uses its own private directories by default. As a result, backups and exports under directories /var/tmp/, /tmp/, and /root/ fail unless you disabled the PrivateTmp systemd directive.

• The Directory Server instance is not running.

Prerequisites

• The dirsrv user has write permissions in the destination directory.

  Note that Directory Server uses its own private directories by default. As a result, backups and exports under /var/tmp/, /tmp/, and /root/ directories fail unless you disabled the PrivateTmp systemd directive.

• You are logged in to the instance in the web console.

Procedure

• Perform backup of Directory Server while the instance is running or is offline as described in Backing up all databases using the command line while the instance is running or Backing up all databases using the command line while the instance is offline.

Verification

• Find backed up configuration files in the backup directory:

  # ls /var/lib/dirsrv/slapd-<instance_name>/bak/<example_backup>/config_files/

  Note

  Directory Server does not automatically restore backed up configuration files. You need to restore these files manually.

Prerequisites

• You have a Directory Server backup.
• The dirsrv user has read permissions in the backup directory.
• The Directory Server instance is running.

Prerequisites

• You have a Directory Server backup.
• The dirsrv user has read permissions in the backup directory.
• The Directory Server instance is not running.

Prerequisites

• A backup is stored in the /var/lib/dirsrv/slapd-<instance_name>/bak/ directory.
• The dirsrv user has read permissions in the backup directory.
• You are logged in to the instance in the web console.

• The consumer servers are also restored.

  For the very unlikely situation, that all databases are restored from backups taken at exactly the same time (so that the data are in sync), the consumers remain synchronized with the supplier, and it is not necessary to do anything else. Replication resumes without interruption.

• Only the supplier is restored.

  If only the supplier is restored or if the consumers are restored from backups taken at different times, reinitialize the consumers for the supplier to update the data in the database.

• Changelog entries have not yet expired on the supplier server.

  If the supplier’s changelog has not expired since the database backup was taken, then restore the local consumer and continue with normal operations. This situation occurs only if the backup was taken within a period of time that is shorter than the value set for the maximum changelog age attribute, nsslapd-changelogmaxage, in the cn=changelog,cn=<database_name>,cn=ldbm database,cn=plugins,cn=config entry.

  Directory Server automatically detects the compatibility between the replica and its changelog. If a mismatch is detected, the server removes the old changelog file and creates a new, empty one.

• Changelog entries have expired on the supplier server since the time of the local backup.

  If changelog entries have expired, reinitialize the consumer.

Prerequisites

• You have a Directory Server backup.
• The dirsrv user has read permissions in the /var/lib/dirsrv/slapd-<instance_name>/bak/ backup directory.
• The Directory Server instance is not running.

Verification

• Verify that the server restored the server configuration:

  # dsconf <instance_name> config get

Prerequisites

• The entry ou=groups,dc=example,dc=com exists in the database.

Verification

• Display the ACIs set on the cn=config entry:

  # ldapsearch -o ldif-wrap=no -LLLx -D "cn=Directory Manager" -W -H ldap://server.example.com -b cn=config aci=* aci -s base
  dn: cn=config
  aci: (target = "ldap:///cn=backup,cn=tasks,cn=config")(targetattr="*")(version 3.0 ; acl "permission: Allow backup_users group to create backup tasks" ; allow (add, read, search) groupdn = "ldap:///cn=backup_users,ou=groups,dc=example,dc=com";)
  aci: (target = "ldap:///cn=config")(targetattr = "nsslapd-bakdir || objectClass")(version 3.0 ; acl "permission: Allow backup_users group to access bakdir attribute" ; allow (read,search) groupdn = "ldap:///cn=backup_users,ou=groups,dc=example,dc=com";)
  ...

Prerequisites

• You enabled members of the cn=backup_users,ou=groups,dc=example,dc=com group to perform backups.
• The user you use to perform the backup is a member of the cn=backup_users,ou=groups,dc=example,dc=com group.

Procedure

• Create a backup task using one of the following methods:

  • Using the dsconf backup create command:

    # dsconf -D "uid=example,ou=People,dc=example,dc=com" ldap://server.example.com backup create

  • By manually creating the task:

    # ldapadd -D "uid=example,ou=People,dc=example,dc=com" -W -H ldap://server.example.com
    
    dn: cn=backup-2021_07_23_12:55_00,cn=backup,cn=tasks,cn=config
    changetype: add
    objectClass: extensibleObject
    nsarchivedir: /var/lib/dirsrv/slapd-<instance_name>/bak/backup-2021_07_23_12:55_00
    nsdatabasetype: ldbm database
    cn: backup-2021_07_23_12:55_00

Verification

• Verify that the backup was created:

  # ls -l /var/lib/dirsrv/slapd-instance_name/bak/
  total 0
  drwx------. 3 dirsrv dirsrv 108 Jul 23 12:55 backup-2021_07_23_12_55_00
  ...