第 2 章 启用组成员来备份目录服务器，并将备份作为组成员之一执行

流程

1. 创建 cn=backup_users,ou=groups,dc=example,dc=com 组：

   # dsidm -D "cn=Directory manager" ldap://server.example.com -b "dc=example,dc=com" group create --cn backup_users

   Copy to Clipboard Toggle word wrap

2. 添加一个访问控制指令(ACI)，允许 cn=backup_users,ou=groups,dc=example,dc=com 组的成员创建备份任务：

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com
   
   dn: cn=config
   changetype: modify
   add: aci
   aci: (target = "ldap:///cn=backup,cn=tasks,cn=config")(targetattr="*")
    (version 3.0 ; acl "permission: Allow backup_users
     group to create backup tasks" ; allow (add, read, search) groupdn
     = "ldap:///cn=backup_users,ou=groups,dc=example,dc=com";)
   -
   add: aci
   aci: (target = "ldap:///cn=config")(targetattr = "nsslapd-bakdir ||
     objectClass") (version 3.0 ; acl "permission: Allow backup_users
     group to access bakdir attribute" ; allow (read,search)
     groupdn = "ldap:///cn=backup_users,ou=groups,dc=example,dc=com";)

   Copy to Clipboard Toggle word wrap

3. 创建用户：

   1. 创建用户帐户：

      # dsidm -D "cn=Directory manager" ldap://server.example.com -b "dc=example,dc=com" user create --uid="example" --cn="example" --uidNumber="1000" --gidNumber="1000" --homeDirectory="/home/example/" --displayName="Example User"

      Copy to Clipboard Toggle word wrap

   2. 在用户帐户中设置密码：

      # dsidm -D "cn=Directory manager" ldap://server.example.com -b "dc=example,dc=com" account reset_password "uid=example,ou=People,dc=example,dc=com" "password"

      Copy to Clipboard Toggle word wrap

4. 将 uid=example,ou=People,dc=example,dc=com 用户添加到 cn=backup_users,ou=groups,dc=example,dc=com 组：

   # dsidm -D "cn=Directory manager" ldap://server.example.com -b "dc=example,dc=com" group add_member backup_users uid=example,ou=People,dc=example,dc=com

   Copy to Clipboard Toggle word wrap