Museum

Home

Lab Overview

Retrotechnology Articles

Online Manuals

⇒

Media Vault

Software Library

Restoration Projects

Artifacts Sought

Configuration Parameters


irectory server runtime activities are controlled using configuration parameters. This chapter details the configuration parameters used with the directory server and includes the following topics:
  • Changing Configuration Parameter Values (see page 308)

  • Validating Your Server Settings (see page 311)

  • General Server Parameters (see page 311)

  • Database Parameters (see page 341)

 

Changing Configuration Parameter Values

 You can change parameter values through the server manager. Alternatively, you can change these parameter values by directly editing the slapd.conf or slapd.dynamic_ldbm.conf file.

  

Changing Parameter Values Using the Server Manager

 You can change most server parameter values from the server manager. To do so, follow these steps:
  1. From the server selector, click the directory server you want to manage.

  2. From the server manager, select System Settings at the top of the server manager screen.

  3. From the list of options at the left of the screen, click View All Server Settings. A table showing the directory server parameters is displayed.

  4. Scroll through the table of parameters until you find the parameter you want to modify. Click the parameter name.

  5. Locate the field in the form that is specific to the parameter, and modify it as required. When you are finished, click OK at the bottom of the form. Your changes are written to a temporary copy of slapd.conf.

  6. Repeat steps 3 through 5 until you are finished modifying parameter values.

  7. Click the Apply button at the top of the server manager screen. A new form is displayed that lets you either apply or undo your changes. Apply writes the temporary copy of slapd.conf to the primary copy. Undo discards the temporary slapd.conf file and restores the parameter values in the server manager to their original state.

  8. Stop and then restart the directory server.

 

Changing Parameter Values Using slapd.conf

The slapd.conf file is a simple ASCII file that is read only when the directory server is started. To modify this file directly:

  1. Edit the file with the ASCII editor of your choice.

  2. Stop and then restart the directory server.

Note that you should only change those parameters that are not supported in slapd.dynamic_ldbm.conf. Currently this is only the index parameter. For more information on slapd.dynamic_ldbm.conf, see "Changing Parameter Values Using slapd.dynamic_ldbm.conf" on page 310.

The location of all of the directory server's configuration files is documented in "Introducing the Directory Server Configuration Files" on page 30.

 

slapd.conf File Format

The slapd.conf file begins with several include statements that include the standard attribute and object class definitions. The remainder of slapd.conf consists of a series of general configuration parameters that apply to the directory server as a whole, followed by a database definition that contains information specific to the database.

    Note
    General parameters may be repeated within the database definition. The last instance of any repeated parameter takes precedence over all other duplicated parameters. The only restriction is that all non-database parameters must appear in the file before any database-specific parameters.
Comment lines begin with a pound symbol (#). Blank lines and comment lines are ignored by ns-slapd. A line beginning with white space is considered a continuation of the previous line.

 Entry arguments are separated by white space. If a parameter value contains white space, then it must be enclosed in double quotation marks (for example, "like this"). If a parameter value contains a double quotation mark (") or a backslash (\), the character must be preceded (escaped) by a backslash character.

 The general format of the slapd.conf file is:

 


# comment - slapd.at.conf contains common attribute


# definitions, slapd.oc.conf contains common


# object class definitions.


include /usr/ns-home/ns-slapd/config/slapd.at.conf


include /usr/ns-home/ns-slapd/config/slapd.oc.conf





# The first parameters apply to ns-slapd as a whole


<general parameter>


<general parameter>


...


# The database ldbm parameter that follows must appear as a separator


# between the general and the database parameters.


database ldbm


<database parameter>


<database parameter>


...
 

Changing Parameter Values Using slapd.dynamic_ldbm.conf

 slapd.dynamic_ldbm.conf is used to contain those server parameters that can be changed dynamically; that is, when they are changed from the server manager, they do not require a restart of the directory server. This file is included into slapd.conf using the dynamicconf parameter.

 slapd.dynamic_ldbm.conf currently only supports the index parameter. It is a flat ASCII file that contains a simple listing of index parameters. For more information on indexing, see "Creating Indexes Using slapd.dynamic_ldbm.conf" on page 162.

 

Validating Your Server Settings

You can perform a limited validation of your slapd.conf file using the server manager. This validation ensures that valid parameters are placed in your slapd.conf file by performing the same parsing of the file that ns-slapd performs when it reads the file.
    Note
    This function does not ensure that the values set for your server parameters are valid. That is, this function does not exercise the parameters in any way, other than to ensure that they can be successfully parsed by ns-slapd. Some of the problems this function will uncover are:

  • slapd.conf, slapd.at.conf, or slapd.oc.conf does not exist

    •
  • a single line in any of the configuration file contains more than 101 words

    •
  • parameters that have no parameter value

    •
  • port values that are out of range

    •
    To perform this validation, go to Server Preferences | Validate Server Preferences.
 

General Server Parameters

 Table 14.1 describes the server parameters that apply to general directory server operations.

Table 14.1 Directory server general parameters

Parameter

 		Description
Port Number

 Integer specifying the TCP/IP port number used for non-SSL communications. See page 315.

Encryption Enabled

 Boolean specifying whether the server is to use SSL communications. See page 315.

Encryption Ciphers

 String specifying the type of encryption supported by this server. See page 316.

Encrypted Port Number

 Integer specifying the TCP/IP port number used for SSL communications. See page 317.

Audit Log

 String specifying the file used to store changes made to each database as well as the machine data area. See page 317.

Access Log

 String specifying the file used to log information about each database access. See page 318.

Error Log

 String specifying the file used to log error messages generated by ns-slapd. See page 318.

Size Limit in Entries

 Integer specifying the maximum number of entries to return from a search operation. See page 319.

Time Limit in Seconds

 Integer specifying the maximum number of seconds ns-slapd will spend performing a search request. See page 319.

Look Through Limit in Entries

 Integer specifying the maximum number of entries that ns-slapd will check before returning a resource limit error. See page 321.

Schema Checking

 Boolean indicating whether the schema will be enforced during entry insertion or modification. See page 322.

Track Modifies

 Boolean indicating whether ns-slapd will maintain modification attributes for entries. See page 322.

Log Level

 Integer representing the level at which debugging statements and operation statistics will be logged. See page 323.

Referral

 String specifying an LDAP URL to pass back to a client when
ns-slapd cannot find a local database to handle a request. See page 324.

Supplier DN

 String specifying the distinguished name used to update local replicated entries. See page 325.

Supplier Password

 		String specifying the password the consumer server expects the supplier server to use when binding. See page 325.

Supplier SSL Clients

 String specifying the subject name(s) or the certificate(s) that correspond to the supplier DN defined for the consumer server. See page 325.

Changelog DB Directory

 String specifying the suffix for the change log database. See page 326

Changelog Suffix

 String displaying the suffix for the change log database. See page 327

Max Changelog Records

 		Integer representing the maximum number of records the change log may contain. See page 327.

Max Changelog Age

 		Integer and ID specifying the maximum allowable age of any entry in the change log. See page 327.

Password Storage Scheme

 String specifying the type of encryption used for password storage. See page 328.

Certificate and Key Directory

 String specifying the path to the SSL directory. This parameter can only be updated by editing slapd.conf; it cannot be edited in the server manager. See page 328.

Encryption Alias

 		String representing the encryption alias for this server's certificate. See page 329.

attribute

 String associating a syntax with an attribute name. This parameter can only be updated by editing slapd.conf; it cannot be edited in the server manager. See page 329.

objectClass

 List of strings defining a new object class to be added to the database schema. This parameter can only be updated by editing slapd.conf; it cannot be edited in the server manager. See page 330.

threadnumber

 Number of threads obtained by the directory server at startup time. This parameter can only be updated by editing slapd.conf; it cannot be edited in the server manager. See page 331.

maxthreadsperconn

 Maximum number of threads allowed for use by each connection. This parameter can only be updated by editing slapd.conf; it cannot be edited in the server manager. See page 331.

NLS

 String that displays the directory where the files to support internationalization are kept. See page 332.

Password Maximum Age

 Integer representing the number of days after which user passwords will expire. See page 332.

Password Expiration

 Boolean indicating whether user passwords will expire after a given number of days. See page 332.

Password Minimum Length

 Integer representing the minimum number of characters that must be used in directory server passwords. See page 333.

Password History

 Boolean indicating whether users can reuse passwords. See page 333.

Number of Passwords to Remember

 Integer representing the number of passwords the directory server stores in history. See page 334.

Password Change

 Keyword indicating whether users may or must change their passwords. See page 334.

Check Password Syntax

 Boolean indicating whether the password syntax will be checked before the password is saved. See page 335.

Send Warning

 Integer representing the number days before a user's password is due to expire that the user will be sent a warning message. See page 335.

Account Lockout

 Boolean indicating whether users will be locked out of the directory after a given number of failed bind attempts. See page 335.

Maximum Password Failures

 Integer representing the number failed bind attempts after which a user will be locked out of the directory. See page 336.

Reset Password Failure Count After

 Integer representing the amount of time in minutes after which the password failure counter will be reset. See page 336.

Unlock Account

 Boolean indicating whether users will be locked out of the directory until the administrator resets the password after an account lockout. See page 337.

Lockout Duration

 Integer representing the amount of time in minutes that users will be locked out of the directory after an account lockout. See page 337.

NT Synchronization Service Enabled

 Turns on the NT Synchronization Service server plug-ins. See page 338.

NT Synchronization Service Port Number

 Indicates the port that the directory server will use to for non-LDAP communications with the NT Synchronization Service. See page 338.

orcauto

 Indicates whether a server will automatically use online consumer (replica) creation in the event that an inconsistency is detected between the databases on the supplier and the consumer servers. See page 339.

sslClientAuth

 Indicates whether the server requests SSL client authentication for clients binding over SSL. See page 339.

ioblocktimeout

 Specifies the amount of time the server will wait for a client to read data that the client has requested. See page 340.

ntsynchUseSSL

 Indicates whether the NT synchronization service uses SSL when synchronizing data with the directory. See page 340.

 

Port Number

    Description
    TCP/IP port number used for non-SSL communications. This selected port must be unique on the host system; make sure no other application is attempting to use the same port number. Note that for UNIX systems, specifying a port number of less than 1024 requires that the administration server run as root, because it must start the directory server with root privileges.
    Default value
    389
    Valid range
    1 to 65535
    slapd.conf syntax
    port <integer>
    Example
    port 389
 

Encryption Enabled
    Description
    Specifies whether the directory server is to accept SSL communications on its encrypted port.
    Default value
    No (off)
    Valid range
    on | off
    slapd.conf syntax
    security <boolean>
    Example
    security off
 

Encryption Ciphers
    Description
    Specifies the type of encryption the directory server will use when using SSL communications. For more information on the ciphers supported by the directory server, refer to "Managing SSL" on page 234.
    Default value
    N/A
    Valid range
For domestic versions, any combination of the following:

  • RC4-40 MD5

    •
  • RC2-40 MD5

    •
  • RC4-128 MD5

    •
  • Triple DES-168 SHA

    •
  • DES-56 SHA

    •
  • clear MD5

    •
    For export versions, any combination of the following:
  • RC4-40 MD5

    •
  • RC2-40 MD5

    •
  • clear MD5

    •
    slapd.conf syntax
    SSL3ciphers <cipher>[,<cipher>, <cipher>, . . .]
where <cipher> is any of the following:
  • SSL_RSA_EXPORT_WITH_RC4_40_MD5

    •
  • SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5

    •
  • SSL_RSA_WITH_RC4_128_MD5

    •
  • SSL_RSA_WITH_3DES_EDE_CBC_SHA

    •
  • SSL_RSA_WITH_DES_CBC_SHA

    •
  • SSL_RSA_WITH_NULL_MD5

    Export versions can use only the following ciphers:
  • SSL_RSA_EXPORT_WITH_RC4_40_MD5

    •
  • SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5

    •
  • SSL_RSA_WITH_NULL_MD5

Note that white spaces are not allowed in the list of ciphers.
    Example
    SSL3cipher SSL_RSA_EXPORT_WITH_RC4_40_MD5,SSL_RSA_
    EXPORT_WITH_RC2_CBC_40_MD5
 

Encrypted Port Number
    Description
    TCP/IP port number used for SSL communications. This selected port must be unique on the host system; make sure no other application is attempting to use the same port number. Note that for UNIX systems, specifying a port number of less than 1024 requires that the administration server run as root, because it must start the directory server with root privileges.
    Default value
    636
    Valid range
    1 to 65535
    slapd.conf syntax
    secure-port <integer>
    Example
    secure-port 636
 

Audit Log
    Description
    Specifies the pathname and filename of the log used to record changes made to each database as well as to the machine data area.
    Default value
    <NSHOME>/slapd-<serverID>/logs/audit
    Valid range
    Any valid filename
    slapd.conf syntax
    auditfile <filename>
    Example
    auditfile /usr/ns-home/slapd-<serverID>/logs/audit
 

Access Log
    Description
    Specifies the path and filename of the log used to record each database access. The following information is recorded in the log file:
    • IP

    • of the client machine that accessed the database

      •
    • operations performed (for example, search, add, modify)

      •
    • result of the access (for example, the number of entries returned)

      •
    To turn access logging off, leave this parameter blank. For more information on turning access logging off, see "Turning Off the Access Log" on page 216.
    Default value
    <NSHOME>/slapd-<serverID>/logs/access
    Valid range
    Any valid filename
    slapd.conf syntax
    accesslog <filename>
    Example
    accesslog /usr/ns-home/slapd-<serverID>/logs/access
 

Error Log
    Description
    Specifies the pathname and filename of the log used to record error messages generated by ns-slapd. These messages can describe error conditions, but more often they will contain informative conditions such as:
    • server startup and shutdown times

      •
    • port number the server uses

      •
This log will contain differing amounts of information depending on the current setting of the Log Level parameter. See "Log Level" on page 323 for more information on the Log Level parameter.

    Default value
    <NSHOME>/slapd-<serverID>/logs/error
    Valid range
Any valid filename
    slapd.conf syntax
    errorlog <filename>
    Example
    errorlog /usr/ns-home/slapd-<serverId>/logs/error
 

Size Limit in Entries
    Description
    Specifies the maximum number of entries to return from a search operation. If this limit is reached, ns-slapd returns any entries it has located that match the search request, as well as an exceeded size limit error.
    A null string on this parameter causes no limit to be used; ns-slapd will return every matching entry to the client regardless of the number found. To set this no limit value from within slapd.conf, specify a negative value on the parameter. A value of zero (0) causes no entries to be returned for searches.
    Default value
    2000
    Valid range
    -1 to 231-1
    A value of -1 on this parameter in slapd.conf is the same as leaving the parameter blank in the server manager; it causes no limit to be used. Note, however, that you cannot specify a negative integer for this field in the server manager; nor can you specify a null value in slapd.conf.
    slapd.conf syntax
    sizelimit <integer>
    Example
    sizelimit 2000
 

Time Limit in Seconds
    Description
    Specifies the maximum number of seconds allocated for a search request. If this limit is reached, ns-slapd returns any entries it has located that match the search request, as well as an exceeded time limit error.
    A null string on this parameter causes no limit to be used; ns-slapd will wait indefinitely for the search to complete. To set this no limit value from within slapd.conf, specify a negative value on the parameter. A value of zero (0) causes no time to be allowed for searches.
    Default value
    3600
    Valid range
    -1 to 231-1
    A value of -1 on this parameter in slapd.conf is the same as leaving the parameter blank in the server manager; it causes no limit to be used. Note, however, that you cannot specify a negative integer for this field in the server manager; nor can you specify a null value in slapd.conf.
    slapd.conf syntax
    timelimit <integer>
    Example
    timelimit 3600
 

Look Through Limit in Entries
    Description
    Specifies the maximum number of entries that ns-slapd will check when seeking candidate entries in response for a search request. If this limit is reached, ns-slapd returns any entries it has located that match the search request, as well as an exceeded size limit error. For a general discussion of the searching algorithm, refer to "The Searching Algorithm" on page 152.
    A null string on this parameter causes no limit to be used; ns-slapd will check every candidate entry it can find. To set this no limit value from within slapd.conf, specify a negative value on the parameter. A value of zero (0) causes no candidate entries to be checked for searches.
    Default value
    5000
    Valid range
    -1 to 231-1
    A value of -1 on this parameter in slapd.conf is the same as leaving the parameter blank in the server manager; it causes no limit to be used. Note, however, that you cannot specify a negative integer for this field in the server manager, nor can you specify a null value in slapd.conf.
    slapd.conf syntax
    lookthroughlimit <integer>
    Example
    lookthroughlimit 5000
 

Schema Checking
    Description
    Specifies whether the database schema will be enforced during entry insertion or modification. The database schema defines the type of information allowed in the database. You can extend the default schema using the objectclass and attribute parameters. For information on how to extend your schema, see Chapter 4, "Managing Directory Server Databases."
    Note
    Schema checking works only when database modifications are made using an LDAP client, such as ldapmodify or the directory server gateway. Schema checking is not performed when importing a database from LDIF. If you are creating your database using LDIF, you will manually have to verify that your entries conform to the schema. Make sure that the attributes and object classes you create in your LDIF statements are both spelled correctly and are identified in slapd.conf, slapd.at.conf, or slapd.oc.conf.
    Default value
    on
    Valid range
    on|off
    slapd.conf syntax
    schemacheck <Boolean>
    Example
    schemacheck on
 

Track Modifies
    Description
    Specifies whether ns-slapd maintains the modification attributes for directory server entries. These attributes include:

    • modifiersname--The distinguished name of the person who last modified the entry.

      •
    • modifytimestamp--The timestamp for when the entry was last modified.

      •
    • creatorsname--The distinguished name of the person who initially created the entry.

      •
    • createtimestamp--The timestamp for when the entry was created.

      •
If you are using your directory server with the NT user synchronization, then this parameter must be turned on.
    Default value
    on
    Valid range
    on|off
    slapd.conf syntax
    lastmod <Boolean>
    Example
    lastmod off
 

Log Level
    Description
    Specifies the level of logging to be used by the directory server. The log level is additive; that is, specifying a value of 3 causes both levels 1 and 2 to be performed.
    To turn off logging, remove the loglevel parameter from slapd.conf and restart the directory server.
    Default value
    Logging is turned off (the loglevel parameter is not included in slapd.conf).
    Valid range
1--function calls are traced and logged

 2--debug packet handling

 4--heavy trace debugging

 8--connection management

 16--print out packets sent and received

 32--search filter processing

 64--configuration file processing

 128--access control list processing

 1024--print communication with shell back ends

 2048--print entry parsing debugging

 4096--print house keeping thread debugging

 8192--log replication processes
    slapd.conf syntax
    loglevel <integer>
    Example
    loglevel 8192
 

Referral
    Description
    Specifies the default LDAP URL to pass back when the receives a request for an entry that is not a member of the local tree, that is, an entry whose suffix does not match the value specified on any of the Suffix parameters (the Suffix parameter is described on page 342). For example, suppose the local database contains only entries: 

	ou=People, o=Airius.com
    but the request is for this entry: 

	ou=Groups, o=Airius.com
    In this case, the referral would be passed back to the client in an attempt to allow the LDAP client to locate a database that contains the requested entry.
    Note that if a smart referral can be found to return as a result of the request, the server will return that referral instead of the value specified on this parameter.
    Note that only one referral is allowed per directory server instance.
    For more information on managing referrals, see "Managing Referrals" on page 274.
    Default value
    null string
    Valid range
    Any LDAP URL of the form: 

	ldap://<server location>
    If you want to use SSL communications, the Referral parameter should be of the form: 

	ldaps://<server location>
    slapd.conf syntax
    referral <url>
    Example
    referral ldap://ldap.aceindustry.com
 

Supplier DN
    Specifies the distinguished name that supplier servers use to update your server with replicated data. For more information on replication, refer to Chapter 11, "Managing Replication and Referrals".
    Default value
    null string
    Valid range
    Any valid distinguished name representing an entry in the local directory tree.
    slapd.conf syntax
    updatedn <"DN">
    Example
    updatedn "cn=Replication Admin, o=Airius.com"
 

Supplier Password
    The password the consumer server expects the supplier server to use when binding. The supplier password is only required if the consumer server is not configured to accept certificate-based authentication.
    Default value
    null string
    Valid range
    Any valid password of 8 or more characters. Possible Encryption methods are described in "Password Storage Scheme" on page 328.
    slapd.conf syntax
    updatepw <{encryption method} encrypted password>
    Example
    updatepw {crypt} 9EKo74BXRKnL
 

Supplier SSL Clients
    The subject name(s) of the certificate(s) that correspond to the supplier DN defined for the consumer server. If a client sends a certificate with a subject name that matches any of the subject names configured for this parameter, the client is automatically authenticated as the supplier DN. This parameter is only used when the consumer server is configured to accept certificate-based authentication and when a supplier DN is defined. Note that the value of this parameter must match the certificate subject name exactly; differences in case or whitespace are significant.
    Default value
    null string
    Valid range
    Any valid certificate subject DN.
    slapd.conf syntax
    updateSSLclient <certificate subject DN>
    Example
    updateSSLclient "cn=master.airius.com, o=airius.com"
 

Changelog DB Directory
    Description
    Specifies the name of the directory in which the change log database is stored. Netscape recommends that this database be stored in: 

	<NSHOME>/slapd-<serverID>/changelogdb
    The change log is used to record modifications made to a supplier server's database. When the supplier server's directory is modified, and entry is written to the change log that contains:
  • A number that uniquely identifies the modification. This number is sequential with respect to other entries in the the change log.

    •
  • The modification action; that is, exactly how the directory was modified.

    •
When the supplier server updates a consumer server, the supplier uses the change log information to determine if any modifications have occurred that need to be propagated to the consumer server. If so, the supplier server modifies the consumer server based on the modification(s) recorded in the change log.

 This parameter must be set to a valid directory name before replication can occur. For more information on replication, refer to Chapter 11, "Managing Replication and Referrals."

    Default value
    null string
    Valid range
    Any valid file name
    slapd.conf syntax
    changelogdir <directory>
    Example
    changelogdir /usr/ns-home/slapd-local/changelogdb
 

Changelog Suffix
    Description
    Specifies the suffix used for the change log directory. For information on the change log directory, see "Changelog DB Directory".
    Default value
    null string
    Valid range
    Any valid string
    slapd.conf syntax
    changelogsuffix <suffix>
    Example
    changelogsuffix cn=changelog
 

Max Changelog Records
    Description
    Specifies the maximum number of records the change log may contain. If this parameter is absent, there is no maximum number of records the change log can contain. For information on the change log, see "Changelog DB Directory."
    Default value
    none
    Valid range
    0 to maximum integer
    slapd.conf syntax
    changelogmaxentries <integer>
    Example
    changelogmaxentries 5000
 

Max Changelog Age
    Description
    Specifies the maximum age of any entry in the change log. The change log contains a record for each directory modification and is used when synchronizing consumer servers. Each record contains a timestamp. Any record with a timestamp that is older than the value specified in this parameter will be removed. If this parameter is absent, there is no age limit on change log records. For information on the change log, see "Changelog DB Directory."
    Default
    none
    Valid range
    0 to maximum integer
    slapd.conf syntax
    changelogmaxage <integer> <Age ID>
    where Age ID is "s" for seconds, "m" for minutes, "h" for hours, "d" for days, or "w" for weeks.
    Example
    changelogmaxage 30 d
 

Password Storage Scheme
    Description
    Specifies the type of encryption used to store directory server passwords. A null string entered in the form of two double quotation marks ("") indicates that passwords are to be stored in plain text.
    The following encryption types are available:

    • sha is the Secure Hash Algorithm. It is the most secure of the choices and is the one Netscape recommends.

      •
    • crypt is the UNIX crypt algorithm. It is provided for compatibility with UNIX passwords.

      •
    Default value
    sha
    Valid range
    crypt|sha|""
    slapd.conf syntax
    passwdhash <string>
    Example
    passwdhash sha
 

Certificate and Key Directory
    Description
    Specifies the location of the SSL directory. This directory contains Secure Socket Layer-related files. This parameter is configurable only from slapd.conf; it is not configurable from the server manager.
    Default value
    <NSHOME>/slapd-<serverID>/ssl
    Valid range
    Currently this directory must be set to the default.
    slapd.conf syntax
    security-path <string>
    Example
    security-path /usr/ns-home/slapd-directory/ssl
 

Encryption Alias
    Description
    The encryption alias you want to use for this server's certificate. You create the encryption alias when you create your server's certificate database. For more information on creating certificate databases, see the "Enabling SSL Encryption" section in Managing Netscape Servers.
    Default value
    none
    Valid range
    Any valid string
    slapd.conf syntax
    encryption-alias <string>
    Example
    encryption-alias secure-LDAP
 

attribute
    Description
    Associates a syntax with an attribute name. By default, an attribute is assumed to have syntax cis. This parameter also allows you to specify one or more optional alternate names for the attribute.
    This parameter is intended to allow the extension of the standard schema when schema checking is turned on.
    For details on extending the schema, refer to Chapter 4, "Managing Directory Server Databases."
    This parameter is not available from the server manager.
    Valid range
    Possible syntaxes are:
    • bin--binary

      •
    • ces--case exact string (case must be matched during comparison)

      •
    • cis--case ignore string (case is ignored during comparison)

      •
    • tel--telephone number (identical to cis, but blanks and dashes [-] are ignored during comparisons)

      •
    • dn--distinguished name

      •
    slapd.conf syntax
    attribute <name> [<name2> <syntax>]
    Example
    attribute commonName cn cis
 

objectClass
    Description
    Used to define the schema rules for the specified object class. This parameter is intended to allow the extension of the standard schema when schema checking is turned on.
    This parameter is not available from the server manager.
    slapd.conf syntax
    objectClass <name>
    oid <oid number>
    superior <superior object class>
    requires <list of attributes>
    allows <list of attributes>
    Example
    objectClass person
    requires
    objectClass,
    sn,
    cn
    allows
    description,
    seeAlso,
    telephoneNumber,
    userPassword,
    subtreeACI
 

threadnumber
    Description
    Defines the number of operation threads that the directory server will create during start up.
    This parameter is not available from the server manager.
    Default value
    20
    Valid range
    1 to the number of threads supported by your system
    slapd.conf syntax
    threadnumber <number threads>
    Example
    threadnumber 20
 

maxthreadsperconn
    Description
    Defines the maximum number of threads that a connection should use. For normal operations where a client binds and only performs one or two operations before unbinding, you should use the default value. For situations where a client binds and does many operations, you should increase this value to allow each connection enough resources to perform all the operations.
    A value of 0 turns off maxthreadsperconn and causes the server to allow each connection to obtain as many threads as the connection requires, up to the value set by threadnumber.
    This parameter is not available from the server manager.
    Default value
    5
    Valid range
    0 to threadnumber
    slapd.conf syntax
    maxthreadsperconn <number of threads>
    Example
    maxthreadsperconn 5
 

NLS
    Description
    Used to define the directory where the internationalization files are kept.
    This parameter is not available from the server manager.
    Default value
    <NSHOME>/nls
    Valid range
    N/A
    slapd.conf syntax
    NLS "<directory>"
    Example
    NLS "/usr/ns-home/nls"
 

Password Maximum Age
    Description
    Indicates the number of days after which user passwords will expire. To use this parameter, you must enable password expiration using the Password Expiration parameter.
    This parameter is not stored in slapd.conf; it is stored in and configurable through the passwordLockout attribute of the root DSE entry.
    For more information on password policies, see "Understanding Password Policies" on page 139.
    Default Value
    100
    Valid Range
    1 to 24,855 days
 

Password Expiration
    Description
    Indicates whether user passwords will expire after a given number of days. By default, user passwords do not expire. Once password expiration is enabled, you can set the number of days after which the password will expire using the Password Maximum Age parameter.
    This parameter is not stored in slapd.conf; it is stored in and configurable through the passwordExp attribute of the root DSE entry. For more information on password policies, see "Understanding Password Policies" on page 139.
    Default Value
    Off
 

Password Minimum Length
    Description
    Specifies the minimum number of characters that must be used in directory server passwords. In general, shorter passwords are easier to crack, so you are recommended to set a password length of at least 6 or 7 characters. This is long enough to be difficult to crack, but short enough that users can remember the password without writing it down.
    This parameter is not stored in slapd.conf; it is stored in and configurable through the passwordMinLength attribute of the root DSE entry.
    For more information on password policies, see "Understanding Password Policies" on page 139.
    Default Value
    6 characters
    Valid Range
    2 to 512 characters
 

Password History
    Description
    Enables password history. Password history refers to whether users are allowed to reuse passwords. By default, password history is disabled and users can reuse passwords. You can modify the No Password History parameter so that the directory stores a given number of old passwords and prevents users from reusing any of the stored passwords. You set the number of old passwords the directory server stores using the Number of Passwords to Remember parameter.
    This parameter is not stored in slapd.conf; it is stored in and configurable through the passwordKeepHistory attribute of the root DSE entry.
    For more information on password policies, see "Understanding Password Policies" on page 139.
    Default Value
    Off
 

Number of Passwords to Remember
    Description
    Indicates the number of passwords the directory server stores in history. Passwords that are stored in history cannot be reused by users. By default, the password history feature is disabled. That is, the directory server does not store any old passwords and so users can reuse passwords. You can enable password history by using the Password History parameter.
    This parameter is not stored in slapd.conf; it is stored in and configurable through the passwordInHistory attribute of the root DSE entry.
    For more information on password policies, see "Understanding Password Policies" on page 139.
    Default Value
    6 passwords
    Valid Range
    2 to 24 passwords
 

Password Change
    Description
    Indicates whether users may or must change their passwords. Options are
  • may, which indicates that users may change their own passwords.

    •
  • must, which indicates that users must change their passwords the first time they bind to the directory or after their passwords are reset by the administrator.

    •
  • no, which indicates that users may not change their own passwords.

    •
    This parameter is not stored in slapd.conf; it is stored in and configurable through the passwordChange attribute of the root DSE entry.
    For more information on password policies, see "Understanding Password Policies" on page 139.
    Default Value
    may
    Valid Range
    may | must | no
 

Check Password Syntax
    Description
    Indicates whether the password syntax will be checked before the password is saved. The password syntax checking mechanism checks that the password meets or exceeds the password minimum length requirement and that the string does not contain any "trivial" words, such as the user's name or user ID or any attribute value stored in the user's directory entry.
    This parameter is not stored in slapd.conf; it is stored in and configurable through the passwordCheckSyntax attribute of the root DSE entry.
    For more information on password policies, see "Understanding Password Policies" on page 139.
    Default Value
    Off
 

Send Warning
    Description
    Indicates the number days before a user's password is due to expire that the user will be sent a warning message. Depending on the LDAP client, the user may also be prompted to change their password at the time the warning is sent.
    This parameter is not stored in slapd.conf; it is stored in and configurable through the passwordWarning attribute of the root DSE entry.
    For more information on password policies, see "Understanding Password Policies" on page 139.
    Default Value
    1 day
    Valid Range
    1 to 24,855 days
 

Account Lockout
    Description
    Indicates whether users will be locked out of the directory after a given number of failed bind attempts. By default, users will not be locked out of the directory after a series of failed bind attempts. If you enable account lockout, you can set the number of failed bind attempts after which the user will be locked out using the Maximum Password Failures parameter.
    This parameter is not stored in slapd.conf; it is stored in and configurable through the passwordLockout attribute of the root DSE entry.
    For more information on password policies, see "Understanding Password Policies" on page 139.
    Default Value
    On
 

Maximum Password Failures
    Description
    Indicates the number failed bind attempts after which a user will be locked out of the directory. By default, account lockout is disabled. You can enable account lockout by modifying the Account Lockout parameter.
    This parameter is not stored in slapd.conf; it is stored in and configurable through the passwordMaxFailure attribute of the root DSE entry.
    For more information on password policies, see "Understanding Password Policies" on page 139.
    Default Value
    3 bind failures
    Valid Range
    1 to 32,767 bind failures
 

Reset Password Failure Count After
    Description
    Indicates the amount of time in minutes after which the password failure counter will be reset. Each time an invalid password is sent from the user's account, the password failure counter is incremented. If the account lockout feature is enabled, users will be locked out of the directory when the counter reaches the number of failures specified by the Maximum Password Failures parameter for the for the amount of time specified by the Lockout Duration parameter. You enable or disable the account lockout feature using the Account Lockout parameter.
    This parameter is not stored in slapd.conf; it is stored in and configurable through the passwordresetduration attribute of the root DSE entry.
    For more information on password policies, see "Understanding Password Policies" on page 139.
    Default Value
    10 minutes
    Valid Range
    1 to 35,791,394 minutes
 

Unlock Account
    Description
    Indicates whether users will be locked out of the directory until the administrator resets the password after an account lockout. The account lockout feature protects against hackers who try to break into the directory by repeatedly trying to guess a user's password. You enable and disable the account lockout feature using the Account Lockout parameter. Instead of locking users out forever, you can choose to lock users out for a specified amount of time using the Lockout Duration parameter.
    This parameter is not stored in slapd.conf; it is stored in and configurable through the passwordunlock attribute of the root DSE entry.
    For more information on password policies, see "Understanding Password Policies" on page 139.
    Default Value
    Off
 

Lockout Duration
    Description
    Indicates the amount of time in minutes that users will be locked out of the directory after an account lockout. The account lockout feature protects against hackers who try to break into the directory by repeatedly trying to guess a user's password. You enable and disable the account lockout feature using the Account Lockout parameter. Instead of locking out users for a specified amount of time, you can choose to lock users out until the administrator resets the password using the Unlock Account parameter.
    This parameter is not stored in slapd.conf; it is stored in and configurable through the passwordlockoutduration attribute of the root DSE entry.
    For more information on password policies, see "Understanding Password Policies" on page 139.
    Default Value
    60 minutes
    Valid Range
    1 to 35,791,394 minutes
 

NT Synchronization Service Enabled
    Description
    Indicates whether the NT Synchronization Service plug-ins are used by the directory server. These plug-ins cause the directory server to validate all NT Directory Data with the appropriate NT primary domain controller. These plug-ins also transfer NT user and group changes to the synchronization service for inclusion on NT user and group accounts.
    For more information on the NT synchronization service, see Chapter 12, "NT Directory Synchronization."
    Default Value
    No
    Valid Range
    Yes | No
    Slapd.conf Syntax
    ntsynch on|off
    Example
    ntsynch on
 

NT Synchronization Service Port Number
    Description
    Specifies the port number that directory server will use for non-LDAP communications with the NT Synchronization Service. This port is used to validate directory changes with the NT domain, and to transfer directory changes to NT. Note that for UNIX systems, specifying a port number of less than 1024 requires that administration server run as root, because it must start the directory server with root privileges.
    For more information on the NT synchronization service, see Chapter 12, "NT Directory Synchronization."
    Default Value
    5005
    Valid Range
    1 to 65535
    Slapd.conf Syntax
    ntsynch-port <integer>
    Example
    ntsynch-port 5005
 

orcauto
    Description
    Indicates whether a server will automatically use online consumer (replica) creation in the event that an inconsistency is detected between the databases on the supplier and the consumer servers. If this parameter is missing from slapd.conf, or if this parameter is set to anything other than on, then online consumer creation is turned off.
    Online consumer creation applies to both supplier-initiated replication and consumer-initiated replication. If supplier-initiated replication is used, then online consumer creation is either turned on or off for all consumer servers. Similarly, if consumer-initiated replication is used then then online consumer creation is either turned on or off for all supplier servers.
    Note that caution should be used before turning this feature on. For more information, see "Initializing Consumers" on page 257.
    This parameter is not available from the server manager.
    Default Value
    off
    Valid Range
    on | off
    Slapd.conf Syntax
    orcauto <Boolean>
    Example
    ntsynch-port on
 

sslClientAuth
    Description
    Indicates whether the server will request SSL client authentication from clients binding over SSL. Set this parameter to off if you are using LDAP clients that use the 1.0 LDAP Client SDK. This includes the 1.0 Netscape Certificate Server.
    This parameter is not available from the server manager.
    Default Value
    on
    Valid Range
    on | off
    Slapd.conf Syntax
    sslClientAuth <Boolean>
    Example
    sslClientAuth on
 

ioblocktimeout
    Description
    Specifies the amount of time the server will wait for a client to read data that the client has requested. This parameter is set to 1 hour to support online consumer creation. If you are not using online consumer creation, then you should set this parameter to a lower value (such as 5-10 minutes) to avoid problems in the event that your LDAP clients request data and then fail to read the data.
    Units are in milliseconds. 5 minutes is 300000 milliseconds.
    This parameter is not available from the server manager.
    Default Value
    3600000
    Valid Range
    1 to 35791394
    Slapd.conf Syntax
    ioblocktimeout <integer>
    Example
    ioblocktimeout 300000
 

ntsynchUseSSL
    Description
    Indicates whether the NT Synchronization Service is using SSL when synchronizing with the directory. If the synchronization is service is configured to not use SSL, then this parameter should be set to off.
    You are strongly recommended to use SSL when synchronizing NT data with the directory.
    This parameter is not available from the server manager.
    Default Value
    on
    Valid Range
    on | off
    Slapd.conf Syntax
    ntsynchUseSSL <Boolean>
    Example
    ntsynchUseSSL on
 

Database Parameters

 Table 14.2 describes the server parameters that apply to the directory server database.

Table 14.2 Directory server database parameters

Parameter

 		Description
Suffix

 String specifying the distinguished name suffix used for the local database. See page 342.

DB Directory

 String specifying the directory that contains the database and associated indexes. See page 344.

Root DN

 String specifying the distinguished name of an entry that is not subject to access control or administrative limit restrictions for operations on the database. See page 344.

Root Password

 String displaying the current root password. See page 344.

Root Password Storage Scheme

 String displaying the current root password encryption method used for the root password. See page 345.

Read-only

 Boolean indicating whether the database is in read-only mode. See page 345.

Maximum Entries in Cache

 Integer specifying the number of entries to be contained in the in-memory cache. See page 346.

Maximum DB Cache size in Bytes

 Integer specifying the size in bytes of the in-memory cache associated with each open index file. See page 346.

Attribute to be Indexed

 String specifying the indexes to maintain for a given attribute. See page 347.

database

 String marking the beginning of a new database instance definition within slapd.conf. This parameter can only be updated by editing slapd.conf; it cannot be edited in the server manager. See page 348.

mode

 Integer specifying the file protection used for newly created database index files. This parameter can only be updated by editing slapd.conf; it cannot be edited in the server manager. See page 348.

Database Checkpoint Interval

 The amount of time in seconds after which the directory server sends a checkpoint entry to the database transaction log. See page 348.

Database Durable Transactions

 Indicates whether database transaction log entries are immediately written to the disk. See page 349.

Database Transaction Log Directory

 Specifies the path and directory name of the directory containing the database transaction log. See page 349.

dynamicconf

 Specifies the path to the file containing dynamically changeable configuration parameters. See page 350.

 

Suffix

    Description
    Specifies the distinguished name suffix used for the local database. Incoming queries must have a suffix matching this value. Queries for entries using a suffix other than the value specified in this parameter will be referred to the LDAP server identified on the Referral parameter (the Referral parameter is described on page 324).
    Multiple suffixes can be configured for your local database if multiple root points are used in your database. Note that two suffixes always exist for a directory server database. The first is the suffix you configure when you initially install the directory server, and this suffix represents your directory tree's root point. The second suffix is used for machine data. See "Machine data" on page 272 for more information.
    A suffix must always be set for your directory tree in order for clients to successfully access the tree.
    For information on setting suffixes for your directory, see "Setting Suffixes for Your Database" on page 69.
    Valid range
    Any valid distinguished name.
    slapd.conf syntax
    suffix <string>
    Example
    suffix "o=airius.com"
    Note that if the suffix DN contains a comma, the comma must be escaped by a single backslash (on NT) or double backslashes (on Unix). For example, to set a suffix of Airius Bolivia, S.A., you would enter
    suffix "o=Airius Bolivia\, S.A."
    on NT or
    suffix "o=Airius Bolivia\\, S.A."
    on Unix.
 

DB Directory
    Description
    Specifies the directory containing the database and associated index files.
    Default value
    <NSHOME>/slapd-<serverID>/db
    Valid range
    Currently this directory must be set to the default.
    slapd.conf syntax
    directory <string>
    Example
    directory /usr/ns-home/slapd-myserver/db
 

Root DN
    Description
    Specifies the distinguished name of an entry that is not subject to access control or administrative limit restrictions for operations on the database. Size Limit in Entries, Time Limit in Seconds, and Look Through Limit in Entries also do not apply to this DN.
    For information on changing the Root DN, see "Managing the Root DN" on page 230.
    Valid range
    Any valid distinguished name.
    slapd.conf syntax
    rootdn <"string">
    Example
    rootdn "cn=Directory Manager, o=airius.com"
 

Root Password
    Description
    When viewed from the server manager, this parameter shows the value: "Not Displayed." When viewed from the slapd.conf file, this parameter shows the encryption method followed by the encrypted string.
    Warning
    If you configure a root DN at server installation time, you must also provide a root password. However, it is possible for the root password to be deleted from slapd.conf by direct editing of the file. In this situation, the root DN can only obtain the same access to your directory as you allow for anonymous access. Always make sure that a root password is defined in slapd.conf when a root DN is configured for your database.
    Valid range
    Any valid password. Possible encryption methods are described in "Password Storage Scheme" on page 328.
    slapd.conf syntax
    rootpw <{encryption method}encrypted password>
    Example
    rootpw {crypt}9Eko69APCJfF
 

Root Password Storage Scheme
    Description
    Available only from the server manager. This parameter indicates the encryption method used for the root password.
    Default value
    Clear text
    Valid range
    Any encryption method as described in "Password Storage Scheme" on page 328.
    slapd.conf syntax
    rootpw {encryption method}encrypted password
    Example
    rootpw {crypt}9Eko69APCJfF
 

Read-only
    Description
    Specifies whether the database is in read-only mode. Any attempt to modify a database in read-only mode returns an error indicating that the server is unwilling to perform the operation.
    Default value
    off
    Valid range
    on|off
    slapd.conf syntax
    readonly <boolean>
    Example
    readonly off
 

Maximum Entries in Cache
    Description
    Specifies the number of entries the directory server will maintain in cache. Increasing this number uses more memory but can substantially improve search performance. The actual amount of memory required per additional entry depends on the nature of the data stored within the directory server. However, as a general guideline, you can estimate that each entry maintained in cache requires approximately 1 KB (1024 bytes) of memory.
    For more information on this parameter, see the Entry Cache Hit Ratio field description in "General Information Table" on page 225.
    Default value
    1000
    Valid range
    1 to the total number of database entries.
    slapd.conf syntax
    cachesize <integer>
    Example
    cachesize 1000
 

Maximum DB Cache size in Bytes
    Description
    Specifies the size in bytes of the in-memory cache. Increasing this number uses more memory but can substantially improve server performance, especially during modifications or when the indexes are being built. Do not increase this number beyond the available resources for your machine.
    For more information on this parameter, see the Entry Cache Hit Ratio field description in "General Information Table" on page 225.
    Default value
    1000000
    Valid range
    1 to maximum integer
    slapd.conf syntax
    dbcachesize <integer>
    Example
    dbcachesize 1000000
 

Attribute to be Indexed
    Description
    Specifies the indexes to maintain for the specified attribute(s). If only a list of attributes is provided, all possible indexes are maintained. If a value of default is provided in the place of a list of attributes, all attributes are indexed.
    Valid indexes are:

    • pres

      •
    • eq

    • approx

      •
    • sub

      •
    • none

      •
    For a complete description of indexing, refer to Chapter 7, "Managing Indexes."
    Default value
    Only default indexing is performed. This includes a presence index for subtreeACI.
    Valid range
    Any valid attribute and any valid index type. For a list of the commonly used attributes, see Appendix B, "Attributes" of the online Administrator's Guide.
    slapd.conf syntax
    index [<attribute list>|default] [<list of indexes>]
    Example
    index cn
    index sn,uid eq,sub,approx
    index default none
    This example causes all indexes to be maintained for the cn attribute; equality, substring, and approximate indexes for the sn and uid attributes; and no indexes for all other attributes.
 

database
    Description
    Marks the beginning of the database definition in the slapd.conf file. This parameter is not available from the server manager.
    Default value
    ldbm
    Valid range
    Currently only ldbm is supported.
    slapd.conf syntax
    database ldbm
 

mode
    Description
    Specifies the permissions used for newly created index files. This parameter is not available from the server manager.
    Default value
    0600
    Valid range
    Any four-digit octal number. However, mode 0600 is recommended. This allows read and write access for the owner of the index files (which is the user that ns-slapd runs as), and no access for other users.
    slapd.conf syntax
    mode <protection mode>
    Example
    mode 0600
 

Database Checkpoint Interval
    Description
    The amount of time in seconds after which the directory server sends a checkpoint entry to the database transaction log. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only. A checkpoint entry indicates which database operations have been physically written to the directory database. The checkpoint entries are used to determine where in the database transaction log to begin recovery after a system failure. The db_checkpoint_interval parameter is absent from slapd.conf. To change the checkpoint interval, you add the parameter to slapd.conf.
    For more information on database transaction logging, see "Managing Database Transaction Logging" on page 78.
    Default Value
    60 seconds
    Valid Range
    10 to 300 seconds
    Slapd.conf Syntax
    db_checkpoint_interval <integer>
    Example
    db_checkpoint_interval 120
 

Database Durable Transactions
    Description
    Indicates whether database transaction log entries are immediately written to the disk. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only. With durable transactions enabled, every directory change will always be physically recorded in the log file and therefore be able to be recovered in the event of a system failure. However, the durable transactions feature may also slow the performance of the directory server. When durable transactions is disabled, all transactions are logically written to the database transaction log but may not be physically written to disk immediately. If there was a system failure before a directory change was physically written to disk, that change would not be recoverable. The db_durable_transactions parameter is absent from slapd.conf. To disable durable transactions, you add the parameter to slapd.conf.
    For more information on database transaction logging, see "Managing Database Transaction Logging" on page 78.
    Default Value
    on
    Slapd.conf Syntax
    db_durable_transactions on|off
    Example
    db_durable_transactions off
 

Database Transaction Log Directory
    Description
    Specifies the path and directory name of the directory containing the database transaction log. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only. By default, the database transaction log is stored in the same directory as the directory entries themselves, <NSHOME>/slapd-<serverID>/db. For fault-tolerance and performance reasons you may want to move this log file to another physical disk. The db_logdirectory parameter is absent from slapd.conf. To change the location of the database transaction log, you add the parameter to slapd.conf.
    For more information on database transaction logging, see "Managing Database Transaction Logging" on page 78.
    Default Value
    <NSHOME>/slapd-<serverID>/db
    Valid Range
    Any valid path and directory name.
    Slapd.conf Syntax
    db_logdirectory "<directory name>"
    Example
    db_logdirectory "/logs/txnlog"
 

dynamicconf
    Description
    Specifies the path to slapd.dynamic_ldbm.conf, which is a file that contains slapd.conf server parameters that can be changed dynamically. Currently only the index parameter is supported in slapd.dynamic_ldbm.conf.
    For more information about slapd.dynamic_ldbm.conf, see "Changing Parameter Values Using slapd.dynamic_ldbm.conf" on page 310.
    Default Value
    <NSHOME>/slapd-<serverID>/config/slapd.dynamic_ldbm.conf
    Valid Range
    Any valid path and directory name.
    Slapd.conf Syntax
    dynamicconf <filename>
    Example
    dynamicconf /usr/ns-home/slapd-fire/config/slapd.dynamic_ldbm.conf

Typewritten Software • bear@typewritten.org • Edmonds, WA 98026