Netscape NETSCAPE DIRECTORY SERVER 6.01 User manual

Configuration, Command, and
File Reference
Netscape Directory Server
Version6.01
January 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by
Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed
by the license agreement for the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is
prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without
notice.
THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE
LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY
ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,
PROFITS, USE, OR DATA.
The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2002 Netscape
Communications Corporation. All rights reserved.
Portions of the Software copyright © 1995 PEER Networks, Inc. All rights reserved. The Software contains the Taligent International
Classes from Taligent, Inc. and IBM Corp. Portions of the Software copyright ©1992-1998 Regents of the University of Michigan. All
rights reserved. The software contains encryption software from RSA Security Inc. Copyright © 1994 RSA Data Security, Inc. All
rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and
other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications
Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their
respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full
compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation
to the U.S. government is with restricted rights as described in the license agreement for that Software.

3
Contents
About This Reference Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
DirectoryServerOverview .............................................................. 15
PrerequisiteReading ................................................................... 16
WhatIsInThisReferenceGuide? ........................................................ 16
ConventionsUsedInThisReferenceGuide................................................ 17
RelatedInformation .................................................................... 17
Chapter 1 Introduction ........................................................19
OverviewofDirectoryServerManagement................................................ 19
DirectoryServerConfiguration .......................................................... 20
DirectoryServerInstanceFileReference................................................... 20
MigratingDirectoryServer .............................................................. 20
UsingDirectoryServerCommand-LineUtilities............................................ 20
UsingDirectoryServerCommand-LineScripts............................................. 21
Chapter 2 CoreServerConfigurationReference ...................................23
ServerConfiguration-Overview......................................................... 23
LDIFConfigurationFiles-Location.................................................... 25
SchemaConfigurationFiles-Location.................................................. 25
HowtheServerConfigurationisOrganized............................................. 25
ConfigurationAttributes........................................................... 25
ConfigurationofPlug-inFunctionality............................................... 26
ConfigurationofDatabases ........................................................ 27
ConfigurationofIndexes........................................................... 27
MigrationofPre-DirectoryServer6.xConfigurationFilestoLDIFFormat................... 28
AccessingandModifyingServerConfiguration ............................................ 28
AccessControlForConfigurationEntries............................................... 28
ChangingConfigurationAttributes .................................................... 29
ModifyingConfigurationEntriesUsingLDAP........................................ 30
RestrictionstoModifyingConfigurationEntries ...................................... 31

4 Netscape Directory Server Configuration, Command, and File Reference • January 2002
RestrictionstoModifyingConfigurationAttributes.................................... 31
ConfigurationChangesRequiringServerRestart...................................... 31
CoreServerConfigurationAttributesReference............................................ 32
cn=config........................................................................... 33
nsIdleTimeout(IdleTimeout)....................................................... 33
nsslapd-accesscontrol(EnableAccessControl)........................................ 34
nsslapd-accesslog(AccessLog) ..................................................... 34
nsslapd-accesslog-level ............................................................ 35
nsslapd-accesslog-list.............................................................. 36
nsslapd-accesslog-logbuffering(LogBuffering) ....................................... 36
nsslapd-accesslog-logexpirationtime(AccessLogExpirationTime) ...................... 36
nsslapd-accesslog-logexpirationtimeunit (Access Log Expiration Time Unit) . . . . . . . . . . . . . . 37
nsslapd-accesslog-logging-enabled(AccessLogEnableLogging)........................ 37
nsslapd-accesslog-logmaxdiskspace (Access Log Maximum Disk Space) . . . . . . . . . . . . . . . . . 38
nsslapd-accesslog-logminfreediskspace (Access Log Minimum Free Disk Space) . . . . . . . . . . 38
nsslapd-accesslog-logrotationtime(AccessLogRotationTime).......................... 39
nsslapd-accesslog-logrotationtimeunit(AccessLogRotationTimeUnit).................. 39
nsslapd-accesslog-maxlogsize(AccessLogMaximumLogSize)......................... 40
nsslapd-accesslog-maxlogsperdir (Access Log Maximum Number of Log Files) . . . . . . . . . . . 40
nsslapd-attribute-name-exceptions .................................................. 41
nsslapd-auditlog(AuditLog)....................................................... 41
nsslapd-auditlog-list .............................................................. 42
nsslapd-auditlog-logexpirationtime(AuditLogExpirationTime) ....................... 42
nsslapd-auditlog-logexpirationtimeunit (Audit Log Expiration Time Unit) . . . . . . . . . . . . . . . 43
nsslapd-auditlog-logging-enabled(AuditLogEnableLogging) ......................... 43
nsslapd-auditlog-logmaxdiskspace (Audit Log Maximum Disk Space) . . . . . . . . . . . . . . . . . . . 44
nsslapd-auditlog-logminfreediskspace (Audit Log Minimum Free Disk Space) . . . . . . . . . . . . 44
nsslapd-auditlog-logrotationtime(AuditLogRotationTime) ........................... 45
nsslapd-auditlog-logrotationtimeunit (Audit Log Rotation Time Unit) . . . . . . . . . . . . . . . . . . . 45
nsslapd-auditlog-maxlogsize(AuditLogMaximumLogSize) .......................... 46
nsslapd-auditlog-maxlogsperdir (Audit Log Maximum Number of Log Files) . . . . . . . . . . . . . 46
nsslapd-certmap-basedn(CertificateMapSearchBase) ................................ 47
nsslapd-config.................................................................... 47
nsslapd-ds4-compatible-schema .................................................... 47
nsslapd-enquote-sup-oc(EnableSuperiorObjectClassEnquoting) ...................... 48
nsslapd-errorlog(ErrorLog)........................................................ 49
nsslapd-errorlog-level(ErrorLogLevel) ............................................. 50
nsslapd-errorlog-list............................................................... 51
nsslapd-errorlog-logexpirationtime(ErrorLogExpirationTime) ........................ 51
nsslapd-errorlog-logexpirationtimeunit(ErrorLogExpirationTimeUnit) ................ 51
nsslapd-errorlog-logging-enabled(EnableErrorLogging) .............................. 52
nsslapd-errorlog-logmaxdiskspace(ErrorLogMaximumDiskSpace).................... 52
nsslapd-errorlog-logminfreediskspace (Error Log Minimum Free Disk Space) . . . . . . . . . . . . . 53

5
nsslapd-errorlog-logrotationtime(ErrorLogRotationTime) ............................ 53
nsslapd-errorlog-logrotationtimeunit(ErrorLogRotationTimeUnit) .................... 54
nsslapd-errorlog-maxlogsize(MaximumErrorLogSize) ............................... 54
nsslapd-errorlog-maxlogsperdir(MaximumNumberofErrorLogFiles) ................. 55
nsslapd-groupevalnestlevel ........................................................ 55
nsslapd-instancedir(InstanceDirectory) ............................................. 56
nsslapd-ioblocktimeout(IOBlockTimeOut) ......................................... 56
nsslapd-lastmod(TrackModificationTime) .......................................... 56
nsslapd-listenhost(ListentoIPAddress)............................................. 57
nsslapd-localhost(LocalHost) ...................................................... 57
nsslapd-localuser(LocalUser) ...................................................... 58
nsslapd-maxbersize(MaximumMessageSize)........................................ 58
nsslapd-maxdescriptors(MaximumFileDescriptors) .................................. 58
nsslapd-maxthreadsperconn(MaximumThreadsPerConnection)....................... 60
nsslapd-nagle .................................................................... 60
nsslapd-outbound-ldap-io-timeout.................................................. 60
nsslapd-plug-in................................................................... 61
nsslapd-port(PortNumber) ........................................................ 61
nsslapd-privatenamespaces ........................................................ 61
nsslapd-readonly(ReadOnly) ...................................................... 62
nsslapd-referral(Referral).......................................................... 62
nsslapd-referralmode(ReferralMode) ............................................... 63
nsslapd-reservedescriptors(ReservedFileDescriptors) ................................ 63
nsslapd-return-exact-case(ReturnExactCase) ........................................ 65
nsslapd-rootdn(ManagerDN)...................................................... 66
nsslapd-rootpw(RootPassword) ................................................... 66
nsslapd-rootpwstoragescheme(RootPasswordStorageScheme) ........................ 67
nsslapd-schemacheck(SchemaChecking) ............................................ 67
nsslapd-securelistenhost ........................................................... 68
nsslapd-securePort(EncryptedPortNumber) ........................................ 68
nsslapd-security(Security) ......................................................... 69
nsslapd-sizelimit(SizeLimit) ....................................................... 69
nsslapd-threadnumber(ThreadNumber) ............................................ 70
nsslapd-timelimit(TimeLimit) ..................................................... 70
nsslapd-versionstring ............................................................. 71
passwordChange(PasswordChange) ............................................... 71
passwordCheckSyntax(CheckPasswordSyntax) ..................................... 72
passwordExp(PasswordExpiration) ................................................ 72
passwordHistory(PasswordHistory)................................................ 73
passwordInHistory(NumberofPasswordstoRemember) ............................. 73
passwordLockout(AccountLockout)................................................ 74
passwordLockoutDuration(LockoutDuration) ....................................... 74
passwordMaxAge(PasswordMaximumAge) ........................................ 75

6 Netscape Directory Server Configuration, Command, and File Reference • January 2002
passwordMaxFailure(MaximumPasswordFailures) .................................. 75
passwordMinAge(PasswordMinimumAge)......................................... 75
passwordMinLength(PasswordMinimumLength) ................................... 76
passwordMustChange(PasswordMustChange)...................................... 76
passwordResetFailureCount(ResetPasswordFailureCountAfter) ...................... 77
passwordStorageScheme(PasswordStorageScheme).................................. 77
passwordUnlock(UnlockAccount) ................................................. 78
passwordWarning(SendWarning).................................................. 78
cn=changelog5 ...................................................................... 79
nsslapd-changelogdir ............................................................. 79
nsslapd-changelogmaxage(MaxChangelogAge) ..................................... 80
nsslapd-changelogmaxentries(MaxChangelogRecords)............................... 80
cn=encryption ...................................................................... 81
nssslsessiontimeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
nssslclientauth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
nsssl2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ............. 82
nsssl3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ............. 82
nsssl3ciphers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
cn=features ......................................................................... 84
cn=mappingtree .................................................................... 84
SuffixConfigurationAttributesUndercn="dc=example,dc=com".......................... 85
nsslapd-state ..................................................................... 85
nsslapd-backend.................................................................. 85
Replication Attributes Under cn=replica, cn=“dc=example,dc=com”,
cn=mappingtree,cn=config ........................................................... 86
cn............................................................................... 86
nsDS5Flags ...................................................................... 87
nsDS5ReplicaBindDN ............................................................. 87
nsDS5ReplicaChangeCount ........................................................ 88
nsDS5ReplicaId................................................................... 88
nsDS5ReplicaLegacyConsumer ..................................................... 88
nsDS5ReplicaName ............................................................... 89
nsDS5ReplicaPurgeDelay .......................................................... 89
nsDS5ReplicaReferral ............................................................. 90
nsDS5ReplicaRoot ................................................................ 90
nsDS5ReplicaTombstonePurgeInterval .............................................. 90
nsDS5ReplicaType ................................................................ 91
nsState .......................................................................... 91
Replication Attributes Under cn=ReplicationAgreementName,cn=replica,
cn="dc=example,dc=com",cn=mappingtree,cn=config................................... 91
description....................................................................... 92
nsDS5ReplicaBindDN ............................................................. 92
nsDS5ReplicaBindMethod ......................................................... 93

7
nsDS5ReplicaChangesSentSinceStartup .............................................. 93
nsDS5ReplicaCredentials .......................................................... 93
nsDS5ReplicaHost ................................................................ 94
nsDS5ReplicaLastInitEnd .......................................................... 94
nsDS5ReplicaLastInitStart.......................................................... 94
nsDS5ReplicaLastInitStatus ........................................................ 95
nsDS5ReplicaLastUpdateEnd....................................................... 95
nsDS5ReplicaLastUpdateStart ...................................................... 96
nsDS5ReplicaLastUpdateStatus..................................................... 96
nsDS5ReplicaPort................................................................. 96
nsDS5ReplicaRefresh.............................................................. 97
nsDS5ReplicaRoot ................................................................ 97
nsDS5ReplicaTimeout ............................................................. 97
nsDS5ReplicaTransportInfo ........................................................ 98
nsDS5ReplicaUpdateInProgress .................................................... 98
nsDS5ReplicaUpdateSchedule ...................................................... 99
nsDS50ruv ....................................................................... 99
cn=monitor ......................................................................... 99
connection ....................................................................... 99
currentConnections .............................................................. 100
totalConnections................................................................. 100
dTableSize ...................................................................... 100
readWaiters ..................................................................... 100
opsInitiated ..................................................................... 100
opsCompleted................................................................... 100
entriesSent ...................................................................... 100
bytesSent ....................................................................... 100
currentTime..................................................................... 100
startTime ....................................................................... 100
nbackEnds ...................................................................... 100
backendMonitorDN.............................................................. 101
cn=replication...................................................................... 101
cn=SNMP ......................................................................... 101
nssnmpenabled.................................................................. 101
nssnmporganization ............................................................. 101
nssnmplocation.................................................................. 102
nssnmpcontact .................................................................. 102
nssnmpdescription............................................................... 102
nssnmpmasterhost ............................................................... 103
nssnmpmasterport ............................................................... 103
cn=tasks........................................................................... 103
cn=uniqueidgenerator .............................................................. 104
nsstate.......................................................................... 104

8 Netscape Directory Server Configuration, Command, and File Reference • January 2002
ConfigurationQuickReferenceTables ................................................... 104
LDIFConfigurationFiles ............................................................ 104
ConfigurationChangesRequiringServerRestart ....................................... 107
Chapter 3 Plug-in Implemented Server Functionality Reference . . . . . . . . . . . . . . . . . . . . 109
Overview ............................................................................ 109
ObjectClassesforPlug-inConfiguration............................................... 110
ServerPlug-inFunctionalityReference ................................................... 110
7-bitcheckPlug-in.................................................................. 111
ACLPlug-in ....................................................................... 111
ACLpreoperationPlug-in ........................................................... 112
BinarySyntaxPlug-in ............................................................... 112
BooleanSyntaxPlug-in.............................................................. 113
CaseExactStringSyntaxPlug-in ..................................................... 113
CaseIgnoreStringSyntaxPlug-in .................................................... 114
ChainingdatabasePlug-in........................................................... 114
ClassofServicePlug-in ............................................................. 115
CountryStringSyntaxPlug-in ....................................................... 115
DistinguishedNameSyntaxPlug-in .................................................. 116
GeneralizedTimeSyntaxPlug-in ..................................................... 116
IntegerSyntaxPlug-in .............................................................. 117
InternationalizationPlug-in.......................................................... 117
ldbmdatabasePlug-in .............................................................. 118
LegacyReplicationPlug-in .......................................................... 119
MultimasterReplicationPlug-in...................................................... 119
OctetStringSyntaxPlug-in .......................................................... 120
CLEARPasswordStoragePlug-in .................................................... 120
CRYPTPasswordStoragePlug-in .................................................... 121
NS-MTA-MD5PasswordStorageSchemePlug-in....................................... 121
SHAPasswordStorageSchemePlug-in ............................................... 122
SSHAPasswordStorageSchemePlug-in .............................................. 122
PostalAddressStringSyntaxPlug-in.................................................. 123
PTAPlug-in ....................................................................... 124
ReferentialIntegrityPostoperationPlug-in............................................. 124
RetroChangelogPlug-in ............................................................ 125
RolesPlug-in ...................................................................... 126
TelephoneSyntaxPlug-in ........................................................... 127
UIDUniquenessPlug-in............................................................. 127
URIPlug-in........................................................................ 128
ListofAttributesCommontoallPlug-ins ................................................ 129
nsslapd-pluginPath ................................................................. 129
nsslapd-pluginInitfunc .............................................................. 129
nsslapd-pluginType ................................................................ 130

9
nsslapd-pluginEnabled.............................................................. 130
nsslapd-pluginId ................................................................... 131
nsslapd-pluginVersion .............................................................. 131
nsslapd-pluginVendor .............................................................. 131
nsslapd-pluginDescription........................................................... 132
AttributesAllowedbyCertainPlug-ins .................................................. 132
nsslapd-plugin-depends-on-type ..................................................... 132
nsslapd-plugin-depends-on-named ................................................... 133
DatabasePlug-inAttributes ............................................................ 133
Database Attributes Under cn=config,cn=ldbm database,cn=plugins,cn=config . . . . . . . . . . . . . 134
nsLookthroughLimit ............................................................. 134
nsslapd-allidsthreshold . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
nsslapd-cache-autosize ........................................................... 135
nsslapd-cache-autosize-split....................................................... 135
nsslapd-dbcachesize.............................................................. 136
nsslapd-db-checkpoint-interval .................................................... 136
nsslapd-db-circular-logging ....................................................... 137
nsslapd-db-durable-transactions ................................................... 138
nsslapd-db-home-directory ....................................................... 138
nsslapd-db-idl-divisor ............................................................ 140
nsslapd-db-logbuf-size ........................................................... 140
nsslapd-db-logdirectory .......................................................... 141
nsslapd-db-logfile-size............................................................ 141
nsslapd-db-page-size............................................................. 142
nsslapd-db-transaction-batch-val .................................................. 142
nsslapd-db-transaction-logging .................................................... 143
nsslapd-dbncache................................................................ 144
nsslapd-import-cachesize ......................................................... 144
nsslapd-mode ................................................................... 145
Database Attributes Under cn=monitor,cn=ldbm database, cn=plugins,cn=config . . . . . . . . . . . 145
dbcachehits ..................................................................... 145
dbcachetries..................................................................... 145
dbcachehitratio .................................................................. 145
dbcachepagein .................................................................. 145
dbcachepageout ................................................................. 145
dbcacheroevict .................................................................. 146
dbcacherwevict.................................................................. 146
Database Attributes Under cn=NetscapeRoot,cn=ldbm database, cn=plugins,cn=config and
cn=UserRoot,cn=ldbmdatabase,cn=plugins,cn=config.................................. 146
nsslapd-cachesize ................................................................ 146
nsslapd-cachememsize ........................................................... 147
nsslapd-directory ................................................................ 147
nsslapd-readonly ................................................................ 148

10 Netscape Directory Server Configuration, Command, and File Reference • January 2002
nsslapd-require-index ............................................................ 148
nsslapd-suffix ................................................................... 148
Database Attributes Under cn=database,cn=monitor,cn=ldbm database, cn=plugins,cn=config 149
nsslapd-db-abort-rate ............................................................ 149
nsslapd-db-active-txns............................................................ 149
nsslapd-db-cache-hit ............................................................. 149
nsslapd-db-cache-try ............................................................. 149
nsslapd-db-cache-region-wait-rate ................................................. 149
nsslapd-db-cache-size-bytes ....................................................... 149
nsslapd-db-clean-pages........................................................... 149
nsslapd-db-commit-rate .......................................................... 150
nsslapd-db-deadlock-rate ......................................................... 150
nsslapd-db-dirty-pages ........................................................... 150
nsslapd-db-hash-buckets.......................................................... 150
nsslapd-db-hash-elements-examine-rate ............................................ 150
nsslapd-db-hash-search-rate....................................................... 150
nsslapd-db-lock-conflicts ......................................................... 150
nsslapd-db-lock-region-wait-rate .................................................. 150
nsslapd-db-lock-request-rate ...................................................... 150
nsslapd-db-lockers ............................................................... 150
nsslapd-db-log-bytes-since-checkpoint.............................................. 150
nsslapd-db-log-region-wait-rate ................................................... 151
nsslapd-db-log-write-rate ......................................................... 151
nsslapd-db-longest-chain-length ................................................... 151
nsslapd-db-page-create-rate ....................................................... 151
nsslapd-db-page-read-rate ........................................................ 151
nsslapd-db-page-ro-evict-rate ..................................................... 151
nsslapd-db-page-rw-evict-rate..................................................... 151
nsslapd-db-page-trickle-rate....................................................... 151
nsslapd-db-page-write-rate........................................................ 151
nsslapd-db-pages-in-use .......................................................... 151
nsslapd-db-txn-region-wait-rate ................................................... 151
Database Attributes Under cn=default indexes,cn=config,cn=ldbm database,
cn=plugins,cn=config ............................................................... 152
nsSystemIndex .................................................................. 152
nsIndexType .................................................................... 152
nsMatchingRule ................................................................. 153
cn.............................................................................. 153
description...................................................................... 154
Database Attributes Under cn=monitor,cn=Netscaperoot,cn=ldbm database,
cn=plugins,cn=config ............................................................... 154
dbfilenamenumber............................................................... 154
dbfilecachehit ................................................................... 154