irectory server runtime activities are controlled using configuration parameters. This chapter details the configuration parameters used with the directory server and includes the following topics:
slapd.conf or slapd.dynamic_ldbm.conf file.
Changing Parameter Values Using slapd.conf
The slapd.conf file is a simple ASCII file that is read only when the directory server is started. To modify this file directly:
Note that you should only change those parameters that are not supported in slapd.dynamic_ldbm.conf. Currently this is only the index parameter. For more information on slapd.dynamic_ldbm.conf, see "Changing Parameter Values Using slapd.dynamic_ldbm.conf".
The location of all of the directory server's configuration files is documented in "Introducing the Directory Server Configuration Files".
slapd.conf File Format
The slapd.conf file begins with several include statements that include the standard attribute and object class definitions. The remainder of slapd.conf consists of a series of general configuration parameters that apply to the directory server as a whole, followed by a database definition that contains information specific to the database.
Note
General parameters may be repeated within the database definition. The last
instance of any repeated parameter takes precedence over all other duplicated
parameters. The only restriction is that all non-database parameters must
appear in the file before any database-specific parameters.
Comment lines begin with a pound symbol (#). Blank lines and comment lines are ignored by ns-slapd. A line beginning with white space is considered a continuation of the previous line.
Entry arguments are separated by white space. If a parameter value contains white space, then it must be enclosed in double quotation marks (for example, "like this"). If a parameter value contains a double quotation mark (") or a backslash (\), the character must be preceded (escaped) by a backslash character.
The general format of the slapd.conf file is:
# comment - slapd.at.conf contains common attribute # definitions, slapd.oc.conf contains common # object class definitions. include /usr/ns-home/ns-slapd/config/slapd.at.conf include /usr/ns-home/ns-slapd/config/slapd.oc.conf # The first parameters apply to ns-slapd as a whole <general parameter> <general parameter> ... # The database ldbm parameter that follows must appear as a separator # between the general and the database parameters. database ldbm <database parameter> <database parameter> ...
slapd.dynamic_ldbm.conf is used to contain those server parameters that can be changed dynamically; that is, when they are changed from the server manager, they do not require a restart of the directory server. This file is included into slapd.conf using the dynamicconf parameter.
slapd.dynamic_ldbm.conf currently only supports the index parameter. It is a flat ASCII file that contains a simple listing of index parameters. For more information on indexing, see "Creating Indexes Using slapd.dynamic_ldbm.conf".
Validating Your Server Settings
You can perform a limited validation of your slapd.conf file using the server manager. This validation ensures that valid parameters are placed in your slapd.conf file by performing the same parsing of the file that ns-slapd performs when it reads the file.
Note
This function does not ensure that the values set for your server parameters are
valid. That is, this function does not exercise the parameters in any way, other
than to ensure that they can be successfully parsed by ns-slapd. Some of the
problems this function will uncover are:
slapd.conf, slapd.at.conf, or slapd.oc.conf does not exist
Table 14.1 Directory server general parameters.
Port Number
Description
TCP/IP port number used for non-SSL communications. This selected port must
be unique on the host system; make sure no other application is attempting to
use the same port number. Note that for UNIX systems, specifying a port
number of less than 1024 requires that the administration server run as root,
because it must start the directory server with root privileges.
Default value
389
Valid range
1 to 65535
slapd.conf syntax
port <integer>
Example
port 389
Encryption Enabled
Description
Specifies whether the directory server is to accept SSL communications on its
encrypted port.
Default value
No (
off)
Valid range
on | off
slapd.conf syntax
security <Boolean>
Example
security off
Encryption Ciphers
Description
Specifies the type of encryption the directory server will use when using SSL
communications. For more information on the ciphers supported by the
directory server, refer to "Managing SSL".
Default value
N/A
Valid range
For domestic versions, any combination of the following:
RC4-40 MD5
RC2-40 MD5
RC4-128 MD5
Triple DES-168 SHA
DES-56 SHA
clear MD5
RC4-40 MD5
RC2-40 MD5
clear MD5
x
SSL3ciphers <cipher>[,<cipher>, <cipher>, . . .]
SSL_RSA_EXPORT_WITH_RC4_40_MD5
SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
SSL_RSA_WITH_RC4_128_MD5
SSL_RSA_WITH_3DES_EDE_CBC_SHA
SSL_RSA_WITH_DES_CBC_SHA
SSL_RSA_WITH_NULL_MD5
SSL_RSA_EXPORT_WITH_RC4_40_MD5
SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
SSL_RSA_WITH_NULL_MD5
SSL3cipher SSL_RSA_EXPORT_WITH_RC4_40_MD5,SSL_RSA_
EXPORT_WITH_RC2_CBC_40_MD5
636
1 to 65535
secure-port <integer>
secure-port 636
<NSHOME>/slapd-<serverID>/logs/audit
auditlog <filename>
auditlog /usr/ns-home/slapd-<serverID>/logs/audit
<NSHOME>/slapd-<serverID>/logs/access
accesslog <filename>
accesslog /usr/ns-home/slapd-<serverID>/logs/access
ns-slapd. These messages can describe error conditions, but
more often they will contain informative conditions such as:
<NSHOME>/slapd-<serverID>/logs/error
errorlog <filename>
errorlog /usr/ns-home/slapd-<serverId>/logs/error
ns-slapd returns any entries it has located that match the
search request, as well as an exceeded size limit error.
ns-slapd will
return every matching entry to the client regardless of the number found. To set
this no limit value from within slapd.conf, specify a negative value on the
parameter. A value of zero (0) causes no entries to be returned for searches.
2000
slapd.conf is the same as leaving the
parameter blank in the server manager; it causes no limit to be used. Note,
however, that you cannot specify a negative integer for this field in the server
manager; nor can you specify a null value in slapd.conf.
sizelimit <integer>
sizelimit 2000
ns-slapd returns any entries it has located that match the
search request, as well as an exceeded time limit error.
ns-slapd will wait
indefinitely for the search to complete. To set this no limit value from within
slapd.conf, specify a negative value on the parameter. A value of zero (0)
causes no time to be allowed for searches.
slapd.conf is the same as leaving the
parameter blank in the server manager; it causes no limit to be used. Note,
however, that you cannot specify a negative integer for this field in the server
manager; nor can you specify a null value in slapd.conf.
timelimit <integer>
timelimit 3600
ns-slapd will check when
seeking candidate entries in response for a search request. If this limit is
reached, ns-slapd returns any entries it has located that match the search
request, as well as an exceeded size limit error. For a general discussion of the
searching algorithm, refer to "The Searching Algorithm".
ns-slapd will
check every candidate entry it can find. To set this no limit value from within
slapd.conf, specify a negative value on the parameter. A value of zero (0)
causes no candidate entries to be checked for searches.
slapd.conf is the same as leaving the
parameter blank in the server manager; it causes no limit to be used. Note,
however, that you cannot specify a negative integer for this field in the server
manager, nor can you specify a null value in slapd.conf.
lookthroughlimit <integer>
lookthroughlimit 5000
objectclass
and attribute parameters.
slapd.conf, slapd.at.conf, or slapd.oc.conf.
on
on|off
schemacheck <Boolean>
schemacheck on
ns-slapd maintains the modification attributes for directory
server entries. These attributes include:
modifiersname--The distinguished name of the person who last modified the entry.
modifytimestamp--The timestamp for when the entry was last modified.
creatorsname--The distinguished name of the person who initially created the entry.
createtimestamp--The timestamp for when the entry was created.
on
on|off
lastmod <Boolean>
lastmod off
loglevel parameter is not included in slapd.conf).
1--function calls are traced and logged
2--debug packet handling
4--heavy trace debugging
8--connection management
16--print out packets sent and received
32--search filter processing
64--configuration file processing
128--access control list processing
1024--print communication with shell back ends
2048--print entry parsing debugging
4096--print house keeping thread debugging
8192--log replication processes
loglevel <integer>
loglevel 8192
ou=People, o=Airius.com
ou=Groups, o=Airius.com
ldap://<server location>
ldaps://<server location>
referral <url>
referral ldap://ldap.aceindustry.com
updatedn <"DN">
updatedn "cn=Replication Admin, o=Airius.com"
updatepw <{encryption method} encrypted password>
updatepw {crypt} 9EKo74BXRKnL
updateSSLclient <certificate subject DN>
updateSSLclient "cn=master.airius.com, o=airius.com"
<NSHOME>/slapd-<serverID>/changelogdb
changelogdir <directory>
changelogdir /usr/ns-home/slapd-local/changelogdb
changelogsuffix <suffix>
changelogsuffix cn=changelog
changelogmaxentries <integer>
changelogmaxentries 5000
changelogmaxage <integer> <Age ID>
changelogmaxage 30 d
crypt|sha|""
passwdhash <string>
passwdhash sha
slapd.conf; it is
not configurable from the server manager.
<NSHOME>/slapd-<serverID>/ssl
security-path <string>
security-path /usr/ns-home/slapd-directory/ssl
encryption-alias <string>
encryption-alias secure-LDAP
cis. This parameter also allows you to specify one or more
optional alternate names for the attribute.
bin--binary
ces--case exact string (case must be matched during comparison)
cis--case ignore string (case is ignored during comparison)
tel--telephone number (identical to cis, but blanks and dashes [-] are ignored during comparisons)
dn--distinguished name
attribute <name> [<name2> <syntax>]
attribute commonName cn cis
objectClass <name>
oid <oid number>
superior <superior object class>
requires <list of attributes>
allows <list of attributes>
objectClass person
requires
objectClass,
sn,
cn
allows
description,
seeAlso,
telephoneNumber,
userPassword,
subtreeACI
20
1 to the number of threads supported by your system
threadnumber <number threads>
threadnumber 20
5
0 to threadnumber
maxthreadsperconn <number of threads>
maxthreadsperconn 5
<NSHOME>/nls
NLS "<directory>"
NLS "/usr/ns-home/nls"
slapd.conf; it is stored in and configurable
through the passwordLockout attribute of the root DSE entry.
100
1 to 24,855 days
slapd.conf; it is stored in and configurable
through the passwordExp attribute of the root DSE entry.
Off
slapd.conf; it is stored in and configurable
through the passwordMinLength attribute of the root DSE entry.
6 characters
2 to 512 characters
slapd.conf; it is stored in and configurable
through the passwordKeepHistory attribute of the root DSE entry.
Off
slapd.conf; it is stored in and configurable
through the passwordInHistory attribute of the root DSE entry.
6 passwords
2 to 24 passwords
slapd.conf; it is stored in and configurable
through the passwordChange attribute of the root DSE entry.
may
may | must | no
slapd.conf; it is stored in and configurable
through the passwordCheckSyntax attribute of the root DSE entry.
Off
slapd.conf; it is stored in and configurable
through the passwordWarning attribute of the root DSE entry.
1 day
1 to 24,855 days
slapd.conf; it is stored in and configurable
through the passwordLockout attribute of the root DSE entry.
On
slapd.conf; it is stored in and configurable
through the passwordMaxFailure attribute of the root DSE entry.
3 bind failures
1 to 32,767 bind failures
slapd.conf; it is stored in and configurable
through the passwordresetduration attribute of the root DSE entry.
10 minutes
1 to 35,791,394 minutes
slapd.conf; it is stored in and configurable
through the passwordunlock attribute of the root DSE entry.
Off
slapd.conf; it is stored in and configurable
through the passwordlockoutduration attribute of the root DSE entry.
60 minutes
1 to 35,791,394 minutes
No
Yes | No
ntsynch on|off
ntsynch on
5005
ntsynch-port <integer>
ntsynch-port 5005
on, then online
consumer creation is turned off.
off
orcauto <Boolean>
ntsynch-port on
Suffix
Description
Specifies the distinguished name suffix used for the local database. Incoming
queries must have a suffix matching this value. Queries for entries using a suffix
other than the value specified in this parameter will be referred to the LDAP
server identified on the Referral
parameter.
Multiple suffixes can be configured for your local database if multiple root
points are used in your database. Note that two suffixes always exist for a
directory server database. The first is the suffix you configure when you initially
install the directory server, and this suffix represents your directory tree's root
point. The second suffix is used for machine data. See "Machine data" for more
information.
A suffix must always be set for your directory tree in order for clients to
successfully access the tree.
For information on setting suffixes for your directory, see "Setting Suffixes for
Your Database".
Valid range
Any valid distinguished name.
slapd.conf syntax
suffix <string>
Example
suffix "o=airius.com"
Note that if the suffix DN contains a comma, the comma must be escaped by a
single backslash (on NT) or double backslashes (on Unix). For example, to set
a suffix of Airius Bolivia, S.A., you would enter
suffix "o=Airius Bolivia\, S.A."
on NT or
suffix "o=Airius Bolivia\\, S.A."
on Unix.
DB Directory
Description
Specifies the directory containing the database and associated index files.
Default value
<NSHOME>/slapd-<serverID>/db
Valid range
Currently this directory must be set to the default.
slapd.conf syntax
directory <string>
Example
directory /usr/ns-home/slapd-myserver/db
Root DN
Description
Specifies the distinguished name of an entry that is not subject to access control
or administrative limit restrictions for operations on the database. Size Limit in
Entries, Time Limit in Seconds, and Look Through Limit in Entries also do not
apply to this DN.
For information on changing the Root DN, see "Managing the Root DN".
Valid range
Any valid distinguished name.
slapd.conf syntax
rootdn <"string">
Example
rootdn "cn=Directory Manager, o=airius.com"
Root Password
Description
When viewed from the server manager, this parameter shows the value: "Not
Displayed." When viewed from the
slapd.conf file, this parameter shows the
encryption method followed by the encrypted string.
Warning
If you configure a root DN at server installation time, you must also provide a
root password. However, it is possible for the root password to be deleted from
slapd.conf by direct editing of the file. In this situation, the root DN can
only obtain the same access to your directory as you allow for anonymous
access. Always make sure that a root password is defined in slapd.conf
when a root DN is configured for your database.
Valid range
Any valid password. Possible encryption methods are described in "Password
Storage Scheme".
slapd.conf syntax
rootpw <{encryption method}encrypted password>
Example
rootpw {crypt}9Eko69APCJfF
Root Password Storage Scheme
Description
Available only from the server manager. This parameter indicates the
encryption method used for the root password.
Default value
Clear text
Valid range
Any encryption method as described in "Password Storage Scheme".
slapd.conf syntax
rootpw {encryption method}encrypted password
Example
rootpw {crypt}9Eko69APCJfF
Read-only
Description
Specifies whether the database is in read-only mode. Any attempt to modify a
database in read-only mode returns an error indicating that the server is
unwilling to perform the operation.
Default value
off
Valid range
on|off
slapd.conf syntax
readonly <Boolean>
Example
readonly off
Maximum Entries in Cache
Description
Specifies the number of entries the directory server will maintain in cache.
Increasing this number uses more memory but can substantially improve search
performance. The actual amount of memory required per additional entry
depends on the nature of the data stored within the directory server. However,
as a general guideline, you can estimate that each entry maintained in cache
requires approximately 1 KB (1024 bytes) of memory.
For more information on this parameter, see the Entry Cache Hit Ratio field
description in "General Information Table".
Default value
1000
Valid range
1 to the total number of database entries.
slapd.conf syntax
cachesize <integer>
Example
cachesize 1000
Maximum DB Cache size in Bytes
Description
Specifies the size in bytes of the in-memory cache. Increasing this number uses
more memory but can substantially improve server performance, especially
during modifications or when the indexes are being built. Do not increase this
number beyond the available resources for your machine.
For more information on this parameter, see the Entry Cache Hit Ratio field
description in "General Information Table".
Default value
1000000
Valid range
1 to maximum integer
slapd.conf syntax
dbcachesize <integer>
Example
dbcachesize 1000000
Attribute to be Indexed
Description
Specifies the indexes to maintain for the specified attribute(s). If only a list of
attributes is provided, all possible indexes are maintained. If a value of default
is provided in the place of a list of attributes, all attributes are indexed.
Valid indexes are:
index [<attribute list>|default] [<list of indexes>]
index cn
index sn,uid eq,sub,approx
index default none
cn attribute; equality,
substring, and approximate indexes for the sn and uid attributes; and no
indexes for all other attributes.
slapd.conf file. This
parameter is not available from the server manager.
ldbm
ldbm is supported.
database ldbm
ns-slapd runs as), and no access for other users.
mode <protection mode>
mode 0600
slapd.conf. To change the checkpoint interval, you add the parameter
to slapd.conf.
db_checkpoint_interval <integer>
db_checkpoint_interval 120
slapd.conf. To disable durable transactions, you add the parameter to
slapd.conf.
db_durable_transactions on|off
db_durable_transactions off
<NSHOME>/slapd-<serverID>/db. For fault-tolerance
and performance reasons you may want to move this log file to another
physical disk. The db_logdirectory parameter is absent from slapd.conf. To
change the location of the database transaction log, you add the parameter to
slapd.conf.
<NSHOME>/slapd-<serverID>/db
db_logdirectory "<directory name>"
db_logdirectory "/logs/txnlog"
slapd.dynamic_ldbm.conf, which is a file that
contains slapd.conf server parameters that can be changed dynamically.
Currently only the index parameter is supported in
slapd.dynamic_ldbm.conf.
slapd.dynamic_ldbm.conf, see "Changing
Parameter Values Using slapd.dynamic_ldbm.conf".
<NSHOME>/slapd-<serverID>/config/slapd.dynamic_ldbm.conf
dynamicconf <filename>
dynamicconf /usr/ns-home/slapd-fire/config/
slapd.dynamic_ldbm.conf