Museum

Home

Lab Overview

Retrotechnology Articles

Online Manuals

⇒

Media Vault

Software Library

Restoration Projects

Artifacts Sought

Managing Your Directory Server


his chapter describes basic directory server management. Specifically, this chapter describes:
  • Log File Rotation

  • Monitoring Your Server's Activities (see page 218)

  • Managing the Root DN (see page 230)

  • Tuning Your Server's Performance (see page 231)

  • Managing Network Settings (see page 232)

  • Managing LDAP Settings (see page 233)

  • Managing SSL (see page 234)

 

Viewing the Error Log

 The Server Status | View Error Log form contains the following fields:
    Number of entries:
    Lets you specify the number of messages to view. If this field is blank, all available messages are shown. Specify an integer, n, to view the n most recent messages.
    Only show entries with:
    Provides a searching capability. Only those messages containing the string entered in this field are displayed. When you specify a search string in this field along with an integer, n, in the Number of entries field the server manager searches only the n most recent messages for the specified search string.
 

Viewing the Access Log

 The Server Status | View Access Log form contains the following fields:
    Number of entries:
    Lets you specify the number of messages to view. If this field is blank, all available messages are shown. Specify an integer, n, to view the n most recent messages.
    Only show entries with:
    Provides a searching capability. Only those messages containing the string entered in this field are displayed. When you specify a search string in this field along with an integer, n, in the Number of entries field, the server manager searches only the n most recent messages for the specified search string.
 

Turning Off the Access Log

 You can estimate that every 2,000 accesses to your server will grow your access log by approximately 1 MB. Because the access log can grow very quickly, you might want to turn access logging off if you find that it is not useful to you.

To turn access logging off, leave the Access Log parameter in the server manager blank. You can find the Access Log parameter in the server manager by going to Server Preferences |Network. For more information on this form, see "Managing Network Settings" on page 232.

Alternatively, you can turn off access logging by editing slapd.conf directly. To do so, set the accesslog parameter as follows:


	accesslog ""
For information on changing server parameters from slapd.conf, see "Changing Parameter Values Using slapd.conf" on page 309.

 

Log File Rotation

The directory server does not support automatic rotation of log files. You should therefore examine your log files at least once a week to ensure that they are not getting too large. If the files are getting large, you should back up and then delete the current log files, and then clear the contents of the primary files. Do the following:

  1. Shut down the server.

  2. Make a copy of the log file you are rotating.

  3. Empty or truncate the contents of the primary copy of the log file you are rotating.

  4. Restart the server.

  5. Back up the log file copy you made in step 2 for future reference.

The ns-slapd log files can be found at


	<NSHOME>/slapd-<serverID>/logs/errors
and

 

	<NSHOME>/slapd-<serverID>/logs/access
 

Monitoring Your Server's Activities

 You can monitor your directory server's current activities from either the server manager or from the command line. For information on how to monitor your server's activity from the command line, refer to "Monitoring Your Server from the Command Line" on page 222.

To monitor your directory server's current activities from the server manager, use the Server Status | Monitor Current Activity form. If the server is currently not running, this form reflects that fact and no further information is given.

If the server is currently on, this form provides server monitor information in the following tables:

  • Server Resource Usage Since Startup

  • Current Server Resource Usage

  • Connection Resource Usage

There is also a small table at the top of the form that includes:
  • Server Version--identifies the current server version level

    •
  • Config DN--identifies the server's machine data tree DN. For information on machine data, see "Machine data" on page 272.

  • Data Version--provides identification information for the server's data area. This is shown only if a change log is configured for the server. Usually the information shown here is only relevant if your server is supplying replicated trees to consumer servers. The following information is supplied in the following order:

    •
    • Server host name.

      •
    • Server port number.

      •
    • Database generation number; a unique identifier that is created only when you create your directory database without a machine data entry in the LDIF file.

      •
    • Current change log number. This is the number corresponding to the last change made to your directory. This number starts at one and increments by one for each change made to the database.

      •
To update the information shown on this form, click the Redisplay button.

  

Server Resource Usage Since Startup

 This table provides the following time information:
    Local startup time
    Day and time that the server was started.
    GMT startup time
    Day and time that the server was started. The value shown is in Greenwich Mean Time.
    The following resource-specific information is then provided:

    Table 10.1

    Resource

         		Usage since startup

         		Average per minute
    Connections

         		Total number of connections to this server since server startup.

         		Average number of connections per minute since server startup.
    Operations Initiated

         		Total number of operations initiated since server startup. Operations are any client requests for server action, such as searches, adds, and modifies in the directory tree. It is likely that multiple operations will be initiated for each connection.

         		Average number of operations per minute since server startup.
    Operations Completed

         		Total number of operations completed by the server since server startup.

         		Average number of operations per minute since server startup.
    Entries sent to clients

         		Total number of entries sent to clients since server startup. Entries are sent to clients as the result of search requests.

         		Average number of entries sent to clients per minute since server startup.
    Bytes sent to clients

         		Total number of bytes sent to clients since server startup.

         		Average number of bytes sent to clients per minute since server startup.
 

Current Server Resource Usage

 This table provides the following time information:
    Current local time
    Current time on the server.
    Current GMT time
    Current time on the server. The value shown is in Greenwich Mean Time.
    The following resource-specific information is then provided:

    Table 10.2

    Resource

         		Current total
    Active Threads

         		Current number of active threads. Each thread represents a single operation currently active in the server. Additional threads may also be created by internal server housekeeping tasks, such as replication.
    Open Connections

         		Total number of open connections. Each connection can account for multiple operations, and therefore multiple threads.
    Remaining available connections

         		Total number of remaining connections that the server can concurrently open. This number is based on the number of currently open connections, and the total number of concurrent connections that the server is allowed to open. The latter value is determined by the operating system, and is expressed as the number of file descriptors available to a task. Refer to your operating system documentation for more information on file descriptors.
    Threads waiting to write to client

         		Total number of threads waiting to write to the client. This happens anytime the server must pause while sending data to a client. Reasons for this are a slow network, a slow client, or an extremely large amount of information being sent to the client.
    Threads waiting to read from client

         		Total number of threads waiting to read from the client. This happens if the server starts to receive a request from the client and then the transmission of that request is halted for some reason. Generally, threads waiting to read are an indication of a slow network or a slow client.
    Thread Concurrency

         		Meaningful on Solaris 2.x only. Provides an indication of the level of thread concurrency.
    Databases in use

         		Total number of databases being serviced by the server. Currently, this value is always 1.
 

Connection Resource Usage

 This table provides information on the amount of resources in use by each currently open connection. Values are:
    Time opened
    Indicates the time on the server when the connection was initially opened.
    Operations
    Indicates the number of operations initiated by this connection, and the number of those operations completed by the server.
    Bind DN
    Indicates the distinguished name used by the client to connect to the server. If the client has not authenticated to the server, not bound is shown in this field.
    Read/Write
    Indicates whether the server is currently blocked for read or write access to the client. Possible values are:
  • Not blocked--Indicates that the server is idle, actively sending data to the client, or actively reading data from the client.

    •
  • Blocked--Indicates that the server is trying to send data to the client or read data from the client, but the server cannot. The probable cause for being blocked is a slow network or a slow client.

    •
 

Monitoring Your Server from the Command Line

 You can monitor your directory server's current activities from any LDAP client by performing a search against

 

	objectClass=*
and a search base of

 

	cn=monitor
and a scope of

 

	base
For example:

 

	ldapsearch -h directory.airius.com -s base 
	 -b "cn=monitor" (objectclass=*)
For information on searching the directory server, see "Using ldapsearch" on page 177.

When you monitor your server's activities in this way, you see the following information:


version:


Identifies the directory server's current version number.





threads:


Current number of active threads. Each thread represents a single operation 
currently active in the server. Additional threads may also be created by 
internal server housekeeping tasks, such as replication or writing to logs.





connection: fd: opentime: opsinitiated: opscompleted: binddn: [rw]


Provides the following summary information for each open connection:
  • fd--The file descriptor used for this connection.

    •
  • opentime--The time this connection was opened.

    •
  • opsinitiated--The number of operations initiated by this connection.

    •
  • opscompleted--The number of operations completed.

    •
  • binddn--The distinguished name used by this connection to connect to the directory server.

    •
  • rw--Optional field that is shown if the connection is blocked for read or write.

    •
currentconnections: Identifies the number of connections currently in service by the directory server.

totalconnections: Identifies the number of connections handled by the directory server since it started.

dtablesize: Shows the number of file descriptors available to the directory server. Note that each connection requires one file descriptor, one descriptor is required for every open index, one descriptor is required for log file management, and one descriptor is required for ns-slapd itself. Essentially, this value lets you know about how many more concurrent connections can be serviced by the directory server.

For more information on file descriptors, refer to your operating system documentation.

writewaiters: Identifies the number of threads waiting to write data to a client.

readwaiters: Identifies the number of threads waiting to read data from a client.

opsinitiated: Identifies the number of operations ns-slapd has initiated since it started.

opscompleted: Identifies the number of operations ns-slapd has completed since it started.

entriessent: Identifies the number of entries sent to clients since ns-slapd started.

bytessent: Identifies the number of bytes sent to clients since ns-slapd started.

currentime: Identifies the time when this snapshot of ns-slapd was taken. The time is displayed in Greenwich mean time (GMT) in UTC format.

starttime: Identifies the time when ns-slapd started. The time is displayed in Greenwich mean time (GMT) in UTC format.

nbackends: Identifies the number of back ends (databases) ns-slapd services. Currently this value is always one.

concurrency: Solaris 2.x only. Indicates the current level of thread concurrency.

 

Monitoring Database Activity

 You can monitor your directory server's current activities from the server manager or from the command line. For information on how to monitor your database's activities from the command line, refer to "Monitoring the Database from the Command Line" on page 228.

To monitor you server from the server manager, do the following:

  1. Go to Server Status | Monitor DB Activity

  2. Select the database that you want to monitor

  3. Click O.K.

There is a small table at the top of the form that provides:

    Database
    Identifies the type of database that you are monitoring.
    Monitor DN
    Identifies the distinguished name that you can use to obtain these results using the ldapsearch client.
The remainder of the form consists of the following tables:

  • General Information Table

  • Database Cache Information Table

  • Database File-Specific Table

 

General Information Table

 In the General Information table, you are given the following fields:
    Readonly Status
    Indicates whether the database is currently in read-only mode. Your database is in read-only mode when your readonly slapd.conf parameter is set to on.
    Entry Cache Hits
    Indicates the total number of successful entry cache lookups. That is, the total number of times the a server could process a search request by obtaining data from the cache rather than by going to disk.
    Entry Cache Tries
    Indicates the total number of entry cache lookups since the directory server was last started. That is, this is the total number of search operations performed against your server since server startup.
    Entry Cache Hit Ratio
    Ratio that indicates the number of entry cache tries to successful entry cache lookups. This number is based on the total lookups and hits since the server was last started. The closer this value is to 100% the better. Whenever a search operation attempts to find an entry that is not resident in the entry cache, the directory server has to perform a disk access to obtain the entry. Thus, as this ratio drops towards zero, the number of disk accesses is increasing and directory server search performance is dropping.
    To improve this ratio, you can try to increase the number of entries that the directory server will maintain in the entry cache by increasing the value on the Maximum Entries in Cache slapd.conf parameter. Note that the maximum value that you can set on Maximum Entries in Cache is dependent upon the amount of real memory on your machine as well as the value set for the Maximum DB Cache size in Bytes parameter. That is, Maximum Entries in Cache + Maximum DB Cache size in Bytes should never be greater than the amount of available memory on your machine.
    You should use caution when changing Maximum Entries in Cache or Maximum DB Cache size in Bytes. Your ability to improve server performance with these parameters is dependent on the size of your database, the amount of physical memory available on your machine, and whether directory searches are random. If your database will not fit into memory, and if searches are random (that is, if your directory clients are searching for random and widely scattered directory data), then attempting to increase the values set on these parameters will not help directory performance, and may in fact harm performance overall.
    Current Number of Entries in Entry Cache
    Indicates the total number of directory entries that are currently resident in the entry cache.
    Maximum Number of Entries in Entry Cache
    Indicates the maximum number of directory entries that are allowed to be maintained in the entry cache. This value is managed by the Maximum Entries in Cache slapd.conf parameter.
 

Database Cache Information Table

 In the Database Cache Information table, you are given the following information:
    Hits
    Indicates the number of times the database cache successfully supplied a requested page.
    Tries
    Indicates the number of times the database cache was asked for a page.
    Hit Ratio
    Indicates the ratio of database cache hits to database cache tries. The closer this value is to 100 percent, the better. Whenever a directory operation attempts to find a portion of the database that is not resident in the database cache, the directory server has to perform a disk access to obtain the appropriate database page. Thus, as this ratio drops towards zero, the number of disk accesses is increasing and directory server performance is dropping.
    To improve this ratio, you can try to increase the number of entries that the directory server will maintain in the entry cache by increasing the value on the Maximum DB Cache size in Bytes slapd.conf parameter. Note that the maximum value that you can set on Maximum DB Cache size in Bytes is dependent upon the amount of real memory on your machine as well as the value set for the Maximum Entries in Cache parameter. That is, Maximum Entries in Cache + Maximum DB Cache size in Bytes should never be greater than the amount of available memory on your machine.
    Note, too, that you should use caution when changing Maximum Entries in Cache or Maximum DB Cache size in Bytes. Your ability to improve server performance with these parameters is dependent on the size of your database, the amount of physical memory available on your machine, and whether directory searches are random. If your database will not fit into memory, and if searches are random (that is, if your directory clients are searching for random and widely scattered directory data), then attempting to increase the values set on these parameters will not help directory performance, and may in fact harm performance overall.
    Pages Read In
    Indicates the number of pages read from disk into the database cache.
    Pages Written Out
    Indicates the number of pages written from the cache back to disk. A database page is written out to disk whenever a read-write page has been modified and then subsequently evicted from the cache. Pages are evicted from the database cache when the cache is full and a directory operation requires a database page that is not currently stored in cache.
    Read-Only Page Evicts
    Indicates the number of read-only pages thrown out of the cache to make room for new pages.
    Read-Write Page Evicts
    Indicates the number of read-write pages thrown out of the cache to make room for new pages. This value differs from Pages Written Out in that these are evicted read-write pages that have not been modified.
 

Database File-Specific Table

 A table is available for each file that makes up your database. Each of the tables provide the following information for that file:
    Cache Hits
    Number of times that a search result resulted in a cache hit on this specific file. That is, a search that required data from this file was performed and the required data was successfully obtained from the cache.
    Cache Misses
    Number of times that a search result failed to result in a cache hit on this specific file. That is, a search that required data from this file was performed and the required data could not be found in the cache.
    Pages Read In
    Indicates the number of pages brought to the cache from this file.
    Pages Written Out
    Indicates the number of pages for this file that was written from cache to disk.
 

Monitoring the Database from the Command Line

 You can monitor your directory server's database activities from any LDAP client by performing a search against

 

	objectClass=*
and a search base of

 

	cn=monitor-back,<your suffix>
and a scope of

 

	base
For example:

 

	ldapsearch -h directory.airius.com -s base 
	 -b "cn=monitor-back,o=airius.com" (objectclass=*)
For information on searching the directory server, see "Using ldapsearch" on page 177.

When you monitor your server's activities in this way, you see the following information:


database:


Identifies the type of database that you are currently monitoring.





readonly


Indicates whether the database is in read-only mode. 0 indicates that the 
server is not in read-only mode, 1 indicates that it is in read-only mode. 





entrycachehits


Provides the same information as is described in "Entry Cache Hits" on 
page 225.




entrycachetries


Provides the same information as is described in "Entry Cache Tries" on 
page 225.




entrycachehitratio


Provides the same information as is described in "Entry Cache Hit Ratio" on 
page 225.




currententrycachesize


Provides the same information as is described in "Current Number of Entries 
in Entry Cache" on page 226.




maxentrycachesize


Provides the same information as is described in "Maximum Number of 
Entries in Entry Cache" on page 226.




dbchehits


Provides the same information as is described in "Hits" on page 226.




dbcachetries


Provides the same information as is described in "Tries" on page 226.




dbcachehitratio


Provides the same information as is described in "Hit Ratio" on page 226.




dbcachepagein


Provides the same information as is described in "Pages Read In" on 
page 227.




dbcachepageout


Provides the same information as is described in "Pages Written Out" on 
page 227.




dbcacheroevict


Provides the same information as is described in "Read-Only Page Evicts" 
on page 227.




dbcacherwevict


Provides the same information as is described in "Read-Write Page Evicts" 
on page 227.
Next is displayed the following information for each file that makes up your database:

 

dbfilename-<number>


Indicates the name of the file. <number> provides a sequential integer 
identifier (starting at 0) for the file. All associated statistics for the file are 
given this same numerical identifier.





dbfilecachehit-<number>


Provides the same information as is described in "Cache Hits" on page 227.




dbfilecachemiss-<number>


Provides the same information as is described in "Cache Misses" on 
page 227.




dbfilepagein-<number>


Provides the same information as is described in "Pages Read In" on 
page 228.




dbfilepageout-<number>


Provides the same information as is described in "Pages Written Out" on 
page 228.
 

Managing the Root DN

 The Root DN is the privileged database user; that is, access control information does not apply to this user.

The password for this user is defined on the Root Password parameter. You can select one of two different password encryption schemes to store this parameter value, or you can choose to store the value in clear text. If you choose to store the value in clear text, you can use the server manager to manage groups, access control lists, and replication without performing any special authentication. While convenient, this strategy creates some obvious security risks in that anyone gaining access to your server manager can discover your Root DN password and have full access to your directory.

If you choose to use an encrypted password, then you must supply that password whenever you manage groups, access control, or replication from the server manager.

You can set your root DN and password and the encryption scheme used for this password from the Server Preferences| Manager Preferences form. After you make any changes to this form, you must click OK, confirm your changes, and restart the server.

  

Tuning Your Server's Performance

 There are several server parameters available to you that allow you to manage server performance. You can view them all together from the server manager by going to Server Preferences |Performance Tuning.

 The performance parameters shown on this form are shown in two different groups:

  • Server parameters--These let you manage your server's performance by limiting the amount of resources the server puts into client search requests. The values set on these three parameters are a hard limit on the resources that the server will apply to each request. Note that LDAP clients can cause the server to actually use smaller values for Size Limit and Time Limit. The three server performance parameters are:

    •
    • Size Limit in Entries in Entries--Sets the maximum number of entries the server will return to the client in response to a search operation. Refer to page 319 for more information on this parameter.

    • Time Limit in Seconds in Seconds--Sets the maximum amount of real time the server spends performing a search request. Refer to page 319 for more information on this parameter.

    • Look Through Limit in Entries in Entries--Sets the maximum number of entries the server will check in response to a search request. Refer to page 321 for more information on this parameter.

    For a better understanding of how these parameters impact your server's searching performance, refer to "The Searching Algorithm" on page 152.

  • Database parameters--These influence server performance primarily on searches by defining the amount of memory available to the server. The two database performance parameters are:

    • Maximum Entries in Cache--Sets the number of entries ns-slapd will keep in memory. Refer to page 346 for more information on this parameter.

    • Maximum DB Cache size in Bytes--Sets the amount of memory available for each open index file. Indexes and index files are described in Chapter 7, "Managing Indexes." For more information on this parameter, see "Maximum DB Cache size in Bytes" on page 346.

    Note that if you are creating a very large database from LDIF, then you want to set this parameter as large as possible. The larger this parameter is, the faster your database will be created. As a rule of thumb, determine how much free memory you have on your system, divide that number by two, reduce this number by about 1 MB, and set that number on this parameter. For example, if you have 50 MB of free memory on your system, divide by 2 (25 MB) and reduce by 1 MB (24 MB). Set your Maximum DB Cache size in bytes parameter to 24 MB.

    When you are done creating your database, be sure to set this parameter back to some lower value before you run your server in a production environment (default is 100,000).

 

Managing Network Settings

 The Server Preferences | Network form allows you to view and change the parameters relevant to the server's network settings and log files. After you make any changes to this form, you must click OK, confirm your changes, and restart the server.

You can manage the following parameters from this form:
  • Port Number--Sets the port used for non-SSL communications. For more information on this parameter, refer to page 315.

  • Encrypted Port Number--Sets the port used for SSL communications. For more information on this parameter, refer to page 317.

  • NT Synchronization Service Enabled--Enables directory server to NT synchronization. Turning this on causes the directory server to start verifying changes made to NT user and group information, and to transmit changes made to NT user and group information to the NT Primary Domain Controller. For information on how directory server to PDC synchronization occurs, see "How Synchronization Occurs" on page 281.

  • NT Synchronization Service Port Number--Defines the non-LDAP port over which the directory server will communicate with the NT synchronization service. For more information the NT synchronization service, see Chapter 12, "NT Directory Synchronization."

  • Access Log--Sets the location used for the access log. For more information on this parameter, refer to page 318. For information on managing log files, refer to "Log File Rotation" on page 217.

  • Error Log--Sets the location used for the error log. For more information on this parameter, refer to page 318.

 

Managing LDAP Settings

 Use the Server Preferences | LDAP form to view and change parameters relevant to general LDAP settings. After you make any changes to this form, you must click OK, confirm your changes, and restart the server.

 You can manage the following parameters from this form:
  • Referral--Sets the LDAP referral used for client requests that are out of bounds for the directory tree(s) serviced by your directory server. This is the referral returned if no relevant smart referrals can be defined for the server. For more information on referrals, see "Managing Referrals" on page 274.

  • Audit Log--Specifies the path and filename of the log used to record changes made to each database as well as to the machine data area. For more information on this parameter, see page 317.

  • Log Level--Sets the type of logging used by the directory server. Because changing these values from the defaults will cause your error log to grow very rapidly, it is recommended that you do not change your logging level unless you are asked to by Netscape Customer Support. For more information on this parameter, refer to page 323.

  • Track Modifies--Specifies whether modification attributes are maintained for directory server entries. For more information on this parameter, refer to page 322.

  • Schema Checking--Specifies that schema checking is performed when directory entries are created or modified. For more information on this parameter, refer to "Schema Checking" on page 50.

 

Managing SSL

 To provide secure communications over the network, the Netscape Directory Server provides the LDAPS communications protocol. LDAPS is the standard LDAP protocol, but it runs on top of Secure Sockets Layer (SSL).

 To use LDAPS, you:
  1. Set up a certificate database for your directory. For information on creating a certificate database, see "Creating a Certificate Database" on page 234.

  2. Turn on SSL in your directory. For information on turning SSL on in your directory server, see "Activating SSL" on page 238.

For a complete description of SSL, internet security, certificates, how to setup certificate databases, and how to obtain certificates, see the Managing Netscape Servers manual.

    Note
    Unlike other Netscape servers, the directory server is capable of simultaneous SSL and non-SSL communications. This means that you do not have to choose between SSL or non-SSL communications for your directory server; you can use both at the same time.
 

Creating a Certificate Database

 This section describes how to create a certificate a certificate database for use with your Netscape Directory Server. This process is a necessary first step before you can turn on SSL in your directory. For information on activating SSL in your directory server, see "Activating SSL" on page 238.

 

Step 1: Create a new key-pair file

  1. On Unix, login as the user that you will run your directory server as. On NT, login as Administrator.

  2. Generate a key-pair file: 


		cd <NSHOME>/bin/admin/bin


		./sec-key (Unix)


		sec-key.exe (NT)
  1. When prompted for an alias, provide a unique string such as dir-server.

  2. When the progress meter appears, type random keys at different speeds (Unix) or move the mouse in random motions (NT) until the meter is full.

  3. Enter a new password (8 or more characters) for your key-pair file.

 

Step 2: Generate a certificate request for your server

  1. Go to thedirectory server's Server Administration page and choose "Keys & Certificates" | "Request Certificate"

  2. In the resulting form, indicate that this is a new certificate.

  3. Submit to Certificate Authority via: Select "CA Email Address." In this field, enter the email address of the person who is managing your Netscape Certificate Server. If that person is you, then enter your own email address.

  4. From the drop-down list, select the alias for the key-pair file that you created in Step 1: Create a new key-pair file (that is, dir-server.)

  5. Enter the password for your key-pair file.

  6. Provide the following information to the form:

    7. Requestor name: Enter your own name.

    Telephone number: Enter your own telephone number

    Common name: Enter the fully qualified hostname on which your directory server is running. For example, directory.airius.com.

    Email address: Enter your own email address.

    Organization: Enter the name of your organization (for example, Airius Corporation.

    Organizational Unit: Leave blank.

    Locality: Leave blank.

    State or Province: Leave blank.

    Country: Enter US.

  7. Click OK. The information you have provided is sent to the certificate authority. If you are using a Netscape Certificate Server, then do the following with it:

    1. Use your web browser to go to your certificate server's public operations page. For example, go to the URL https://certca.airius.com:444

    2. Click "Request a Server Certificate"

    3. In the email that requested the server certificate, copy the server request information including the headers. For example: 


-----BEGIN NEW CERTIFICATE REQUEST-----
MIIBBzCBsgIBADBPMQswCQYDVQQGEwJVUzEoMCYGA1UEChMfTmV0c2NhcGUgRGly
ZWN0b3J5IFB1YmxpY2F0aW9uczEWMBQGA1UEAxMNZHVtcC5tY29tLmNvbTBaMA0G
CSqGSIb3DQEBAQU2nfjiMEYCQQCksMR/aLGdfp4m0OiGcgijG5KgOsyRNvwGYW7k
fW+8mmijDtZRjYNjjcgpF3VnlsbxbclX9LVjjNLC57u37XZdAgEDoAAwDQYJKoZI
hvcNAQEEBQADQQCYUTnUtCVGyNrYGSfydclqiovxy1fRD1z23zg+eBPK7n85UyE4
/ki/r5zGZjDsMYr172ytfAFL7DeG83DWzr8Z


-----END NEW CERTIFICATE REQUEST-----


    


  1. Paste this request into the Server Certificate Request area.

    2. 

    


  2. Enter your contact information in the spaces provided.

    3. 

    


  3. Click "Submit Request."

    4.
 

Step 3: Install your server's certificate

 You will receive your server's certificate in email based on the contact information that you provided above. Depending on your certificate authority, this email will arrive anywhere from a few minutes to a few days after you submit your request. Once you receive your certificate, you must install it in your server's key-pair file:
  1. Go to your directory server's Server Administration page and choose "Keys & Certificates" | "Install Certificate."

  2. Certificate for: select "This Server."

  3. Message Text (with headers): Paste the encrypted message text that is included in the email that you received from your certificate authority. For example: 


-----BEGIN CERTIFICATE-----
MIICMjCCAZugAwIBAgICCEEwDQYJKoZIhvcNAQEFBQAwfDELMAkGA1UEBhMCVVMx
IzAhBgNVBAoTGlBhbG9va2FWaWxsZSBXaWRnZXRzLCBJbmMuMR0wGwYDVQQLExRX
aWRnZXQgTWFrZXJzICdSJyBVczEpMCcGA1UEAxMgVGVzdCBUZXN0IFRlc3QgVGVz
dCBUZXN0IFRlc3QgQ0EwHhcNOTgwMzEyMDIzMzU3WhcNOTgwMzI2MDIzMzU3WjBP
MQswCQYDVQQGEwJVUzEoMCYGA1UEChMfTmV0c2NhcGUgRGlyZWN0b3J5IFB1Ymxp
Y2F0aW9uczEWMBQGA1UEAxMNZHVgh49dq2itLmNvbTBaMA0GCSqGSIb3DQEBAQUA
A0kAMEYCQQCksMR/aLGdfp4m0OiGcgijG5KgOsyRNvwGYW7kfW+8mmijDtZRjYNj
jcgpF3VnlsbxbclX9LVjjNLC57u37XZdAgEDozYwNDARBglghkgBhvhCAQEEBAMC
APAwHwYDVR0jBBgwFoAU67URjwCaGqZuUpSpdLxlzweJKiMwDQYJKoZIhvcNAQEF
BQADgYEAJ+BVem3vBOP/BveNdLGfjlb9hucgmaMcQa98A/db8qimKT/ue9UGOJqL
bwbMKBBopsD56p2yV3PLJIsBgrcuSoBCuFFnxBnqSiTS/7YiYgCWqWaUAExJFmD6
6hBLseqkSWulk+hXHN7L/NrViO+7zNtKcaZLlFPf7d7j2MgX4Bo=
-----END CERTIFICATE-----
  1. Select the alias that you created in Step 1: Create a new key-pair file (that is, dir-server) and click OK to install the certificate.

 

Step 4: Trust your certificate authority

This process consists on obtaining your certificate authority's own certificate. How this is done will differ depending on the certificate authority that you are using. Some commercial certificate authorities provide a link off of their home web page that allows you to automatically down load the certificate. Others will mail it to you upon request.

 To obtain the certificate for a Netscape Certificate Server:

  1. Use your web browser to go to your certificate server's public operations page. For example, go to the URL https://certca.airius.com:444

  2. Click "Accept this Authority in Your Server."

  3. Individual or Whole: select "Display the whole chain for server import."

  4. Trust: select "I want to trust all certificate authorities that share the same root authority."

  5. Click "Present Certificate Chain."

  6. Copy the entire certificate, including the headers.

  7. Go to your directory server's Server Administration page and choose "Keys & Certificates" | "Install Certificate."

  8. Certificate for: select "Trusted Certificate Authority (CA)"

  9. Message Text (with headers): Paste the encrypted message text that you copied above.

  10. Select the alias that you created in Step 1: Create a new key-pair file (that is, dir-server) and click OK.

  11. Click "Add Certificate."

  12. Stop and restart your administration server.

 

Step 5: Confirm that your new certificates are installed

  1. Go to your directory server's Server Administration page and choose "Keys & Certificates" | "Manage Certificates"

  2. Scroll to the bottom of the list. You should find the certificates you installed (identified by the nicknames you specified). If you find both of these certificates, your server is ready for SSL configuration.

 

Activating SSL

To turn on SSL communications with your directory server:

  1. Create a certificate database as described in "Creating a Certificate Database" on page 234.

  2. In the directory server manager, go to "Server Preferences" | "Encryption On/Off"

  3. Encryption Enabled: click Yes.

  4. Select your encrypted port number. Default is 636. The encrypted port number that you specify must not be the same port number as you are using for normal LDAP communications.

  5. Encryption Alias: Enter the encryption alias that you created when you generated your certificate key-pair file (for example, dir-server).

  6. Click OK

  7. Click Apply

  8. Click "Apply Changes"

  9. Click "Server Off" (NOT "Server Restart")

  10. Start your server from the command line (Unix) or from the services tool (NT). Enter the certificate database password when you are prompted to do so.

If encryption is enabled for this server, you will see certificate information at the bottom of this form, including the server's certificate subject DN.

    Note
    Most of the time, you want your server to run with SSL enabled. You might, at other times, want to disable it. If you temporarily disable SSL, make sure you re-enable it before processing transactions that require confidentiality, authentication, or data integrity.
 

Setting Security Preferences

 You can choose the type of cipher to use for SSL. To do so, choose Server Preferences | Encryption Preferences in the server manager. After you make your changes, you must click OK, confirm your changes, and restart the server.

On the Encryption Preferences form, you choose the cipher that your server will use. A cipher is the algorithm used in encryption. Some ciphers are more secure or stronger than others. Generally speaking, the more bits a cipher uses during encryption, the harder it is to decrypt the data. (For a more complete discussion of algorithms and their strength, see the Managing Netscape Servers manual.)

When a client initiates an SSL connection with a server, it lets the server know what ciphers it prefers to use to encrypt information. In any two-way encryption process, both parties must use the same ciphers. Since there are a number of ciphers available, your server needs to be able to use the most popular ones.

To specify which ciphers your server can use, check them in the list. Unless you have a compelling reason to not use a specific cipher, you should check them all.

    Warning
You might not want to check none, MD5. If no other ciphers are available on the client side, the server will use this, and no encryption will occur.

Another reason you might not want to enable all ciphers is to prevent SSL connections with less than optimal encryption. That is, United States law prohibits the export of products with 128-bit encryption, so overseas clients might only be using 40-bit encryption, which is not as difficult to crack as 128-bit. Unchecking all 40-bit ciphers effectively restricts access to clients available only in the United States.

Domestic versions of the Directory Server provide the following SSL 3.0 ciphers:

  • RC4 cipher with 128-bit encryption and MD5 message authentication

    •
  • RC4 cipher with 40-bit encryption and MD5 message authentication

    •
  • RC2 cipher with 40-bit encryption and MD5 message authentication

    •
  • DES with 56-bit encryption and SHA message authentication

    •
  • Triple DES with 168-bit encryption and SHA message authentication

    •
  • No encryption, only MD5 message authentication

Export versions of the Directory Server provide the following SSL 3.0 ciphers:
  • RC4 cipher with 40-bit encryption and MD5 message authentication

    •
  • RC2 cipher with 40-bit encryption and MD5 message authentication

    •
  • No encryption, only MD5 message authentication

 

Using Certificate-Based Authentication

 Your LDAP clients can bind to the directory server using certificates rather than normal Bind DN/Password authentication. This kind of authentication provides two things for you:
  • Under some circumstances it is more convenient to provide a certificate for authentication purposes than to continually have to provide a bindDN/Password credentials. This is true for situations where you are using applications that prompt you once for your certificate database password, and then use that certificate for all subsequent bind or authentication operations.

    •
  • The use of certificate based authentication is more secure than non-certificate bind operations. This is because certificate-based authentication uses public-key cryptography. As a result, bind credentials cannot be intercepted across the network.

    •
Out of the box, the directory server allows you to use certificate-based authentication using the command line client tools and for replication communications.

 To set up certificate-based authentication, you must:
  1. Create a certificate database for both the client and the server. In the case of supplier-server to consumer-server replication, you need a certificate database for both servers.

  2. Obtain a certificate for both client and server.

  3. Map the certificate's distinguished name to a DN known by the directory server. This allows you to set access control for the client when it binds using this certificate. This mapping process is described in the "Mapping Client Certificates to LDAP" section in Managing Netscape Servers.

To find out how to create a certificate database and obtain a certificate for use by your:

  • server for replication purposes, see see "Creating a Certificate Database" on page 234.

  • command-line clients, follow the same general procedure as outlined in "Creating a Certificate Database" on page 234 to create a certificate database. Do not use the same security database as you use for your server, because you will potentially be moving the database to some location remote from the server. Therefore, when you generate your key-pair file, use a unique name such as client-key (where client is the alias for the file).

    • Once you have created your certificate database and obtained a certificate, move your certificate database to a convenient location for use with your clients. Remember that this database represents a security risk with regard to directory access. Therefore, be sure to place the database in as secure a location as possible, and set permissions to its directory location such that only you can access the database.

  • NT Synchronization Server. You can treat the synchronization service as you would any LDAP client and create a certificate database as described in the previous bullet.

    • Alternatively, you can simply use the same database for your synchronization service as you use for your directory server. If your directory server is running on the same machine as your synchronization service, enter the full path to the directory server's key-pair file. If the directory server is using the alias dir-server, then this file is at the following location:

    <NSHOME>/alias/dir-server-cert.db

    If your directory server is not on the same machine as your synchronization service, copy your directory server's key-pair file to a convienient location on your NT primary domain controller such as c:\certdb and then use that copy of the certificate database for your synchronizaton service. When you do this, make sure you copy over both your cert.db and your key.db file. That is, copy over:

    <NSHOME>/alias/dir-server-cert.db
    <NSHOME>/alias/dir-server-key.db

Typewritten Software • bear@typewritten.org • Edmonds, WA 98026