Netscape NETSCAPE DIRECTORY SERVER 6.01 User manual

Configuration, Command, and
File Reference
Netscape Directory Server
Version6.01
January 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by
Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed
by the license agreement for the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is
prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without
notice.
THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE
LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY
ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,
PROFITS, USE, OR DATA.
The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2002 Netscape
Communications Corporation. All rights reserved.
Portions of the Software copyright © 1995 PEER Networks, Inc. All rights reserved. The Software contains the Taligent International
Classes from Taligent, Inc. and IBM Corp. Portions of the Software copyright ©1992-1998 Regents of the University of Michigan. All
rights reserved. The software contains encryption software from RSA Security Inc. Copyright © 1994 RSA Data Security, Inc. All
rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and
other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications
Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their
respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full
compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation
to the U.S. government is with restricted rights as described in the license agreement for that Software.

3
Contents
About This Reference Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
DirectoryServerOverview .............................................................. 15
PrerequisiteReading ................................................................... 16
WhatIsInThisReferenceGuide? ........................................................ 16
ConventionsUsedInThisReferenceGuide................................................ 17
RelatedInformation .................................................................... 17
Chapter 1 Introduction ........................................................19
OverviewofDirectoryServerManagement................................................ 19
DirectoryServerConfiguration .......................................................... 20
DirectoryServerInstanceFileReference................................................... 20
MigratingDirectoryServer .............................................................. 20
UsingDirectoryServerCommand-LineUtilities............................................ 20
UsingDirectoryServerCommand-LineScripts............................................. 21
Chapter 2 CoreServerConfigurationReference ...................................23
ServerConfiguration-Overview......................................................... 23
LDIFConfigurationFiles-Location.................................................... 25
SchemaConfigurationFiles-Location.................................................. 25
HowtheServerConfigurationisOrganized............................................. 25
ConfigurationAttributes........................................................... 25
ConfigurationofPlug-inFunctionality............................................... 26
ConfigurationofDatabases ........................................................ 27
ConfigurationofIndexes........................................................... 27
MigrationofPre-DirectoryServer6.xConfigurationFilestoLDIFFormat................... 28
AccessingandModifyingServerConfiguration ............................................ 28
AccessControlForConfigurationEntries............................................... 28
ChangingConfigurationAttributes .................................................... 29
ModifyingConfigurationEntriesUsingLDAP........................................ 30
RestrictionstoModifyingConfigurationEntries ...................................... 31

4 Netscape Directory Server Configuration, Command, and File Reference • January 2002
RestrictionstoModifyingConfigurationAttributes.................................... 31
ConfigurationChangesRequiringServerRestart...................................... 31
CoreServerConfigurationAttributesReference............................................ 32
cn=config........................................................................... 33
nsIdleTimeout(IdleTimeout)....................................................... 33
nsslapd-accesscontrol(EnableAccessControl)........................................ 34
nsslapd-accesslog(AccessLog) ..................................................... 34
nsslapd-accesslog-level ............................................................ 35
nsslapd-accesslog-list.............................................................. 36
nsslapd-accesslog-logbuffering(LogBuffering) ....................................... 36
nsslapd-accesslog-logexpirationtime(AccessLogExpirationTime) ...................... 36
nsslapd-accesslog-logexpirationtimeunit (Access Log Expiration Time Unit) . . . . . . . . . . . . . . 37
nsslapd-accesslog-logging-enabled(AccessLogEnableLogging)........................ 37
nsslapd-accesslog-logmaxdiskspace (Access Log Maximum Disk Space) . . . . . . . . . . . . . . . . . 38
nsslapd-accesslog-logminfreediskspace (Access Log Minimum Free Disk Space) . . . . . . . . . . 38
nsslapd-accesslog-logrotationtime(AccessLogRotationTime).......................... 39
nsslapd-accesslog-logrotationtimeunit(AccessLogRotationTimeUnit).................. 39
nsslapd-accesslog-maxlogsize(AccessLogMaximumLogSize)......................... 40
nsslapd-accesslog-maxlogsperdir (Access Log Maximum Number of Log Files) . . . . . . . . . . . 40
nsslapd-attribute-name-exceptions .................................................. 41
nsslapd-auditlog(AuditLog)....................................................... 41
nsslapd-auditlog-list .............................................................. 42
nsslapd-auditlog-logexpirationtime(AuditLogExpirationTime) ....................... 42
nsslapd-auditlog-logexpirationtimeunit (Audit Log Expiration Time Unit) . . . . . . . . . . . . . . . 43
nsslapd-auditlog-logging-enabled(AuditLogEnableLogging) ......................... 43
nsslapd-auditlog-logmaxdiskspace (Audit Log Maximum Disk Space) . . . . . . . . . . . . . . . . . . . 44
nsslapd-auditlog-logminfreediskspace (Audit Log Minimum Free Disk Space) . . . . . . . . . . . . 44
nsslapd-auditlog-logrotationtime(AuditLogRotationTime) ........................... 45
nsslapd-auditlog-logrotationtimeunit (Audit Log Rotation Time Unit) . . . . . . . . . . . . . . . . . . . 45
nsslapd-auditlog-maxlogsize(AuditLogMaximumLogSize) .......................... 46
nsslapd-auditlog-maxlogsperdir (Audit Log Maximum Number of Log Files) . . . . . . . . . . . . . 46
nsslapd-certmap-basedn(CertificateMapSearchBase) ................................ 47
nsslapd-config.................................................................... 47
nsslapd-ds4-compatible-schema .................................................... 47
nsslapd-enquote-sup-oc(EnableSuperiorObjectClassEnquoting) ...................... 48
nsslapd-errorlog(ErrorLog)........................................................ 49
nsslapd-errorlog-level(ErrorLogLevel) ............................................. 50
nsslapd-errorlog-list............................................................... 51
nsslapd-errorlog-logexpirationtime(ErrorLogExpirationTime) ........................ 51
nsslapd-errorlog-logexpirationtimeunit(ErrorLogExpirationTimeUnit) ................ 51
nsslapd-errorlog-logging-enabled(EnableErrorLogging) .............................. 52
nsslapd-errorlog-logmaxdiskspace(ErrorLogMaximumDiskSpace).................... 52
nsslapd-errorlog-logminfreediskspace (Error Log Minimum Free Disk Space) . . . . . . . . . . . . . 53

5
nsslapd-errorlog-logrotationtime(ErrorLogRotationTime) ............................ 53
nsslapd-errorlog-logrotationtimeunit(ErrorLogRotationTimeUnit) .................... 54
nsslapd-errorlog-maxlogsize(MaximumErrorLogSize) ............................... 54
nsslapd-errorlog-maxlogsperdir(MaximumNumberofErrorLogFiles) ................. 55
nsslapd-groupevalnestlevel ........................................................ 55
nsslapd-instancedir(InstanceDirectory) ............................................. 56
nsslapd-ioblocktimeout(IOBlockTimeOut) ......................................... 56
nsslapd-lastmod(TrackModificationTime) .......................................... 56
nsslapd-listenhost(ListentoIPAddress)............................................. 57
nsslapd-localhost(LocalHost) ...................................................... 57
nsslapd-localuser(LocalUser) ...................................................... 58
nsslapd-maxbersize(MaximumMessageSize)........................................ 58
nsslapd-maxdescriptors(MaximumFileDescriptors) .................................. 58
nsslapd-maxthreadsperconn(MaximumThreadsPerConnection)....................... 60
nsslapd-nagle .................................................................... 60
nsslapd-outbound-ldap-io-timeout.................................................. 60
nsslapd-plug-in................................................................... 61
nsslapd-port(PortNumber) ........................................................ 61
nsslapd-privatenamespaces ........................................................ 61
nsslapd-readonly(ReadOnly) ...................................................... 62
nsslapd-referral(Referral).......................................................... 62
nsslapd-referralmode(ReferralMode) ............................................... 63
nsslapd-reservedescriptors(ReservedFileDescriptors) ................................ 63
nsslapd-return-exact-case(ReturnExactCase) ........................................ 65
nsslapd-rootdn(ManagerDN)...................................................... 66
nsslapd-rootpw(RootPassword) ................................................... 66
nsslapd-rootpwstoragescheme(RootPasswordStorageScheme) ........................ 67
nsslapd-schemacheck(SchemaChecking) ............................................ 67
nsslapd-securelistenhost ........................................................... 68
nsslapd-securePort(EncryptedPortNumber) ........................................ 68
nsslapd-security(Security) ......................................................... 69
nsslapd-sizelimit(SizeLimit) ....................................................... 69
nsslapd-threadnumber(ThreadNumber) ............................................ 70
nsslapd-timelimit(TimeLimit) ..................................................... 70
nsslapd-versionstring ............................................................. 71
passwordChange(PasswordChange) ............................................... 71
passwordCheckSyntax(CheckPasswordSyntax) ..................................... 72
passwordExp(PasswordExpiration) ................................................ 72
passwordHistory(PasswordHistory)................................................ 73
passwordInHistory(NumberofPasswordstoRemember) ............................. 73
passwordLockout(AccountLockout)................................................ 74
passwordLockoutDuration(LockoutDuration) ....................................... 74
passwordMaxAge(PasswordMaximumAge) ........................................ 75

6 Netscape Directory Server Configuration, Command, and File Reference • January 2002
passwordMaxFailure(MaximumPasswordFailures) .................................. 75
passwordMinAge(PasswordMinimumAge)......................................... 75
passwordMinLength(PasswordMinimumLength) ................................... 76
passwordMustChange(PasswordMustChange)...................................... 76
passwordResetFailureCount(ResetPasswordFailureCountAfter) ...................... 77
passwordStorageScheme(PasswordStorageScheme).................................. 77
passwordUnlock(UnlockAccount) ................................................. 78
passwordWarning(SendWarning).................................................. 78
cn=changelog5 ...................................................................... 79
nsslapd-changelogdir ............................................................. 79
nsslapd-changelogmaxage(MaxChangelogAge) ..................................... 80
nsslapd-changelogmaxentries(MaxChangelogRecords)............................... 80
cn=encryption ...................................................................... 81
nssslsessiontimeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
nssslclientauth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
nsssl2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ............. 82
nsssl3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ............. 82
nsssl3ciphers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
cn=features ......................................................................... 84
cn=mappingtree .................................................................... 84
SuffixConfigurationAttributesUndercn="dc=example,dc=com".......................... 85
nsslapd-state ..................................................................... 85
nsslapd-backend.................................................................. 85
Replication Attributes Under cn=replica, cn=“dc=example,dc=com”,
cn=mappingtree,cn=config ........................................................... 86
cn............................................................................... 86
nsDS5Flags ...................................................................... 87
nsDS5ReplicaBindDN ............................................................. 87
nsDS5ReplicaChangeCount ........................................................ 88
nsDS5ReplicaId................................................................... 88
nsDS5ReplicaLegacyConsumer ..................................................... 88
nsDS5ReplicaName ............................................................... 89
nsDS5ReplicaPurgeDelay .......................................................... 89
nsDS5ReplicaReferral ............................................................. 90
nsDS5ReplicaRoot ................................................................ 90
nsDS5ReplicaTombstonePurgeInterval .............................................. 90
nsDS5ReplicaType ................................................................ 91
nsState .......................................................................... 91
Replication Attributes Under cn=ReplicationAgreementName,cn=replica,
cn="dc=example,dc=com",cn=mappingtree,cn=config................................... 91
description....................................................................... 92
nsDS5ReplicaBindDN ............................................................. 92
nsDS5ReplicaBindMethod ......................................................... 93

7
nsDS5ReplicaChangesSentSinceStartup .............................................. 93
nsDS5ReplicaCredentials .......................................................... 93
nsDS5ReplicaHost ................................................................ 94
nsDS5ReplicaLastInitEnd .......................................................... 94
nsDS5ReplicaLastInitStart.......................................................... 94
nsDS5ReplicaLastInitStatus ........................................................ 95
nsDS5ReplicaLastUpdateEnd....................................................... 95
nsDS5ReplicaLastUpdateStart ...................................................... 96
nsDS5ReplicaLastUpdateStatus..................................................... 96
nsDS5ReplicaPort................................................................. 96
nsDS5ReplicaRefresh.............................................................. 97
nsDS5ReplicaRoot ................................................................ 97
nsDS5ReplicaTimeout ............................................................. 97
nsDS5ReplicaTransportInfo ........................................................ 98
nsDS5ReplicaUpdateInProgress .................................................... 98
nsDS5ReplicaUpdateSchedule ...................................................... 99
nsDS50ruv ....................................................................... 99
cn=monitor ......................................................................... 99
connection ....................................................................... 99
currentConnections .............................................................. 100
totalConnections................................................................. 100
dTableSize ...................................................................... 100
readWaiters ..................................................................... 100
opsInitiated ..................................................................... 100
opsCompleted................................................................... 100
entriesSent ...................................................................... 100
bytesSent ....................................................................... 100
currentTime..................................................................... 100
startTime ....................................................................... 100
nbackEnds ...................................................................... 100
backendMonitorDN.............................................................. 101
cn=replication...................................................................... 101
cn=SNMP ......................................................................... 101
nssnmpenabled.................................................................. 101
nssnmporganization ............................................................. 101
nssnmplocation.................................................................. 102
nssnmpcontact .................................................................. 102
nssnmpdescription............................................................... 102
nssnmpmasterhost ............................................................... 103
nssnmpmasterport ............................................................... 103
cn=tasks........................................................................... 103
cn=uniqueidgenerator .............................................................. 104
nsstate.......................................................................... 104

8 Netscape Directory Server Configuration, Command, and File Reference • January 2002
ConfigurationQuickReferenceTables ................................................... 104
LDIFConfigurationFiles ............................................................ 104
ConfigurationChangesRequiringServerRestart ....................................... 107
Chapter 3 Plug-in Implemented Server Functionality Reference . . . . . . . . . . . . . . . . . . . . 109
Overview ............................................................................ 109
ObjectClassesforPlug-inConfiguration............................................... 110
ServerPlug-inFunctionalityReference ................................................... 110
7-bitcheckPlug-in.................................................................. 111
ACLPlug-in ....................................................................... 111
ACLpreoperationPlug-in ........................................................... 112
BinarySyntaxPlug-in ............................................................... 112
BooleanSyntaxPlug-in.............................................................. 113
CaseExactStringSyntaxPlug-in ..................................................... 113
CaseIgnoreStringSyntaxPlug-in .................................................... 114
ChainingdatabasePlug-in........................................................... 114
ClassofServicePlug-in ............................................................. 115
CountryStringSyntaxPlug-in ....................................................... 115
DistinguishedNameSyntaxPlug-in .................................................. 116
GeneralizedTimeSyntaxPlug-in ..................................................... 116
IntegerSyntaxPlug-in .............................................................. 117
InternationalizationPlug-in.......................................................... 117
ldbmdatabasePlug-in .............................................................. 118
LegacyReplicationPlug-in .......................................................... 119
MultimasterReplicationPlug-in...................................................... 119
OctetStringSyntaxPlug-in .......................................................... 120
CLEARPasswordStoragePlug-in .................................................... 120
CRYPTPasswordStoragePlug-in .................................................... 121
NS-MTA-MD5PasswordStorageSchemePlug-in....................................... 121
SHAPasswordStorageSchemePlug-in ............................................... 122
SSHAPasswordStorageSchemePlug-in .............................................. 122
PostalAddressStringSyntaxPlug-in.................................................. 123
PTAPlug-in ....................................................................... 124
ReferentialIntegrityPostoperationPlug-in............................................. 124
RetroChangelogPlug-in ............................................................ 125
RolesPlug-in ...................................................................... 126
TelephoneSyntaxPlug-in ........................................................... 127
UIDUniquenessPlug-in............................................................. 127
URIPlug-in........................................................................ 128
ListofAttributesCommontoallPlug-ins ................................................ 129
nsslapd-pluginPath ................................................................. 129
nsslapd-pluginInitfunc .............................................................. 129
nsslapd-pluginType ................................................................ 130

9
nsslapd-pluginEnabled.............................................................. 130
nsslapd-pluginId ................................................................... 131
nsslapd-pluginVersion .............................................................. 131
nsslapd-pluginVendor .............................................................. 131
nsslapd-pluginDescription........................................................... 132
AttributesAllowedbyCertainPlug-ins .................................................. 132
nsslapd-plugin-depends-on-type ..................................................... 132
nsslapd-plugin-depends-on-named ................................................... 133
DatabasePlug-inAttributes ............................................................ 133
Database Attributes Under cn=config,cn=ldbm database,cn=plugins,cn=config . . . . . . . . . . . . . 134
nsLookthroughLimit ............................................................. 134
nsslapd-allidsthreshold . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
nsslapd-cache-autosize ........................................................... 135
nsslapd-cache-autosize-split....................................................... 135
nsslapd-dbcachesize.............................................................. 136
nsslapd-db-checkpoint-interval .................................................... 136
nsslapd-db-circular-logging ....................................................... 137
nsslapd-db-durable-transactions ................................................... 138
nsslapd-db-home-directory ....................................................... 138
nsslapd-db-idl-divisor ............................................................ 140
nsslapd-db-logbuf-size ........................................................... 140
nsslapd-db-logdirectory .......................................................... 141
nsslapd-db-logfile-size............................................................ 141
nsslapd-db-page-size............................................................. 142
nsslapd-db-transaction-batch-val .................................................. 142
nsslapd-db-transaction-logging .................................................... 143
nsslapd-dbncache................................................................ 144
nsslapd-import-cachesize ......................................................... 144
nsslapd-mode ................................................................... 145
Database Attributes Under cn=monitor,cn=ldbm database, cn=plugins,cn=config . . . . . . . . . . . 145
dbcachehits ..................................................................... 145
dbcachetries..................................................................... 145
dbcachehitratio .................................................................. 145
dbcachepagein .................................................................. 145
dbcachepageout ................................................................. 145
dbcacheroevict .................................................................. 146
dbcacherwevict.................................................................. 146
Database Attributes Under cn=NetscapeRoot,cn=ldbm database, cn=plugins,cn=config and
cn=UserRoot,cn=ldbmdatabase,cn=plugins,cn=config.................................. 146
nsslapd-cachesize ................................................................ 146
nsslapd-cachememsize ........................................................... 147
nsslapd-directory ................................................................ 147
nsslapd-readonly ................................................................ 148

10 Netscape Directory Server Configuration, Command, and File Reference • January 2002
nsslapd-require-index ............................................................ 148
nsslapd-suffix ................................................................... 148
Database Attributes Under cn=database,cn=monitor,cn=ldbm database, cn=plugins,cn=config 149
nsslapd-db-abort-rate ............................................................ 149
nsslapd-db-active-txns............................................................ 149
nsslapd-db-cache-hit ............................................................. 149
nsslapd-db-cache-try ............................................................. 149
nsslapd-db-cache-region-wait-rate ................................................. 149
nsslapd-db-cache-size-bytes ....................................................... 149
nsslapd-db-clean-pages........................................................... 149
nsslapd-db-commit-rate .......................................................... 150
nsslapd-db-deadlock-rate ......................................................... 150
nsslapd-db-dirty-pages ........................................................... 150
nsslapd-db-hash-buckets.......................................................... 150
nsslapd-db-hash-elements-examine-rate ............................................ 150
nsslapd-db-hash-search-rate....................................................... 150
nsslapd-db-lock-conflicts ......................................................... 150
nsslapd-db-lock-region-wait-rate .................................................. 150
nsslapd-db-lock-request-rate ...................................................... 150
nsslapd-db-lockers ............................................................... 150
nsslapd-db-log-bytes-since-checkpoint.............................................. 150
nsslapd-db-log-region-wait-rate ................................................... 151
nsslapd-db-log-write-rate ......................................................... 151
nsslapd-db-longest-chain-length ................................................... 151
nsslapd-db-page-create-rate ....................................................... 151
nsslapd-db-page-read-rate ........................................................ 151
nsslapd-db-page-ro-evict-rate ..................................................... 151
nsslapd-db-page-rw-evict-rate..................................................... 151
nsslapd-db-page-trickle-rate....................................................... 151
nsslapd-db-page-write-rate........................................................ 151
nsslapd-db-pages-in-use .......................................................... 151
nsslapd-db-txn-region-wait-rate ................................................... 151
Database Attributes Under cn=default indexes,cn=config,cn=ldbm database,
cn=plugins,cn=config ............................................................... 152
nsSystemIndex .................................................................. 152
nsIndexType .................................................................... 152
nsMatchingRule ................................................................. 153
cn.............................................................................. 153
description...................................................................... 154
Database Attributes Under cn=monitor,cn=Netscaperoot,cn=ldbm database,
cn=plugins,cn=config ............................................................... 154
dbfilenamenumber............................................................... 154
dbfilecachehit ................................................................... 154

11
dbfilecachemiss.................................................................. 154
dbfilepagein..................................................................... 154
dbfilepageout ................................................................... 155
Database Attributes Under cn=index,cn=Netscaperoot,cn=ldbm database, cn=plugins,cn=config
andcn=index,cn=UserRoot,cn=ldbmdatabase,cn=plugins,cn=config ..................... 155
DatabaseLinkPlug-inAttributes(chainingattributes) ..................................... 156
Database Link Attributes Under cn=config,cn=chaining database, cn=plugins,cn=config . . . . . 157
nsActiveChainingComponents .................................................... 157
nsMaxResponseDelay ............................................................ 157
nsMaxTestResponseDelay ........................................................ 158
nsTransmittedControls ........................................................... 158
Database Link Attributes Under cn=default instance config,cn=chaining database,
cn=plugins,cn=config ............................................................... 159
nsAbandonedSearchCheckInterval................................................. 159
nsBindConnectionsLimit.......................................................... 159
nsBindRetryLimit................................................................ 160
nsBindTimeout .................................................................. 160
nsCheckLocalACI................................................................ 160
nsConcurrentBindLimit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
nsConcurrentOperationsLimit ..................................................... 161
nsConnectionLife ................................................................ 161
nsOperationConnectionsLimit ..................................................... 162
nsProxiedAuthorization .......................................................... 162
nsReferralOnScopedSearch........................................................ 163
nsSizeLimit ..................................................................... 163
nsTimeLimit .................................................................... 163
Database Link Attributes Under cn=database link instance name,
cn=chainingdatabase,cn=plugins,cn=config ........................................... 164
nsFarmServerURL ............................................................... 164
nsMultiplexorBindDN............................................................ 164
nsMultiplexorCredentials ......................................................... 165
nshoplimit ...................................................................... 165
Database Link Attributes Under cn=monitor,cn=database instance name,
cn=chainingdatabase,cn=plugins,cn=config ........................................... 166
nsAddCount .................................................................... 166
nsDeleteCount .................................................................. 166
nsModifyCount.................................................................. 166
nsRenameCount ................................................................. 166
nsSearchBaseCount .............................................................. 166
nsSearchOneLevelCount.......................................................... 166
nsSearchSubtreeCount............................................................ 166
nsAbandonCount................................................................ 166
nsBindCount .................................................................... 166

12 Netscape Directory Server Configuration, Command, and File Reference • January 2002
nsUnbindCount ................................................................. 167
nsCompareCount ................................................................ 167
nsOperationConnectionCount ..................................................... 167
nsBindConnectionCount.......................................................... 167
RetroChangelogPlug-inAttributes...................................................... 167
nsslapd-changelogdir ............................................................ 167
nsslapd-changelogmaxage(MaxChangelogAge) .................................... 168
Chapter 4 ServerInstanceFileReference....................................... 169
OverviewofDirectoryServerFiles ...................................................... 169
BackupFiles.......................................................................... 171
ConfigurationFiles .................................................................... 171
DatabaseFiles ........................................................................ 171
ldifFiles ............................................................................. 173
LockFiles ............................................................................ 173
LogFiles ............................................................................. 174
Chapter 5 Access Log and Connection Code Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
AccessLogContent ................................................................... 175
AccessLoggingLevels .............................................................. 176
DefaultAccessLoggingContent...................................................... 177
ConnectionNumber.............................................................. 178
FileDescriptor................................................................... 178
SlotNumber .................................................................... 178
OperationNumber............................................................... 179
MethodType.................................................................... 179
VersionNumber................................................................. 179
ErrorNumber ................................................................... 179
TagNumber .................................................................... 179
NumberofEntries ............................................................... 180
ElapsedTime.................................................................... 180
LDAPRequestType.............................................................. 180
LDAPResponseType ............................................................ 181
UnindexedSearchIndicator ....................................................... 181
ExtendedOperationOID ......................................................... 181
ChangeSequenceNumber ........................................................ 182
AbandonMessage ............................................................... 183
MessageID ..................................................................... 183
SASLMulti-StageBindLogging ................................................... 183
AccessLogContentforAdditionalAccessLoggingLevels ............................... 184
ConnectionDescription........................................................... 186
OptionsDescription.............................................................. 186

13
CommonConnectionCodes ............................................................ 186
LDAPResultCodes ................................................................... 187
Chapter 6 Migration from Earlier Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Migrationfrom4.xDirectoryServerto6.x ................................................ 191
ServerAttributes ................................................................... 192
DatabaseAttributes................................................................. 195
UpgradefromDirectoryServer5.0to6.x ................................................. 196
GeneralServerConfigurationAttributes............................................... 196
DatabaseAttributes................................................................. 200
DatabaseLinkAttributes ............................................................ 201
SNMPAttributes ................................................................... 202
Chapter 7 Command-LineUtilities..............................................203
Finding and Executing Command-Line Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Command-Line Utilities Quick Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
UsingSpecialCharacters ............................................................... 205
ldapsearch ........................................................................... 206
ldapmodify........................................................................... 211
ldapdelete............................................................................ 215
ldif .................................................................................. 217
Chapter 8 Command-LineScripts ..............................................219
FindingandExecutingCommand-LineScripts............................................ 219
Command-LineScriptsQuickReference ................................................. 220
ShellandBatchScripts................................................................. 222
bak2db(Restoredatabasefrombackup) ............................................... 223
db2bak(Createbackupofdatabase)................................................... 223
db2ldif(ExportdatabasecontentstoLDIF)............................................. 223
db2dsml(ExportdatabasecontentstoDSML) .......................................... 225
dsml2db(ImportDSMLdocumentcontentsintodatabase)............................... 226
getpwenc(Printencryptedpassword)................................................. 226
ldif2db(Import) .................................................................... 227
ldif2ldap(PerformimportoperationoverLDAP) ....................................... 228
monitor(Retrievemonitoringinformation) ............................................ 229
restart-slapd(RestarttheDirectoryServer)............................................. 229
restoreconfig(RestoreAdministrationServerConfiguration) ............................. 230
saveconfig(SaveAdministrationServerConfiguration).................................. 230
start-slapd(StarttheDirectoryServer) ................................................ 231
stop-slapd(StoptheDirectoryServer)................................................. 231
suffix2instance(MapSuffixtoBackendName) ......................................... 232
vlvindex(Createvirtuallistview(VLV)indexes) ....................................... 233

14 Netscape Directory Server Configuration, Command, and File Reference • January 2002
PerlScripts ........................................................................... 234
bak2db.pl(Restoredatabasefrombackup) ............................................. 234
db2bak.pl(Createbackupofdatabase) ................................................ 234
db2index.pl(Createandgenerateindexes) ............................................. 235
db2ldif.pl(ExportdatabasecontentstoLDIF) .......................................... 236
ldif2db.pl(Import).................................................................. 237
migrateInstance6(MigratetoDirectoryServer5.0or6.x)................................. 239
ns-accountstatus.pl(Establishaccountstatus) .......................................... 240
ns-activate.pl(Activateanentryorgroupofentries) .................................... 241
ns-inactivate.pl(Inactivateanentryorgroupofentries) ................................. 241
Appendix A Using the ns-slapd and slapd.exe Command-Line Utilities . . . . . . . . . . . . . . 243
Overviewofns-slapdandslapd.exeCommands .......................................... 243
ns-slapd(UNIX).................................................................... 244
slapd.exe(WindowsNT) ............................................................ 244
FindingandExecutingthens-slapdandslapd.exeCommand-LineUtilities................... 244
ns-slapd and slapd.exe Command-Line Utilities for Exporting Databases . . . . . . . . . . . . . . . . . . . . . 245
db2ldif ............................................................................ 245
ns-slapd and slapd.exe Command-Line Utilities for Restoring and Backing up Databases . . . . . . . 247
ldif2db ............................................................................ 247
archive2db ........................................................................ 249
db2archive ........................................................................ 249
ns-slapd and slapd.exe Command-Line Utilities for Creating and Regenerating Indexes . . . . . . . . 250
db2index .......................................................................... 250
Glossary .................................................................... 253
Index ....................................................................... 269

15
About This Reference Guide
Netscape Directory Server (Directory Server), version 6.x, is a powerful and
scalable distributed directory server based on the industry-standard Lightweight
Directory Access Protocol (LDAP). Directory Server is the cornerstone for building
a centralized and distributed data repository that can be used in your intranet, over
your extranet with your trading partners, or over the public Internet to reach your
customers.
This Configuration, Command, and File Reference documents server configuration and
command-line utilities provided with Directory Server.
This chapter contains the following sections:
• Directory Server Overview (page 15)
• Prerequisite Reading (page 16)
• What Is In This Reference Guide? (page 16)
• Conventions Used In This Reference Guide (page 17)
• Related Information (page 17)
Directory Server Overview
The major components of Directory Server include:
•An LDAP server—The core of the directory service, provided by the ns-slapd
daemon, and compliant with the LDAP v3 Internet standards.
•Directory Server Console—An improved management console that
dramatically reduces the effort of setting up and maintaining your directory
service. Directory Server Console is part of Netscape Console, the common
management framework for Netscape servers.

Prerequisite Reading
16 Netscape Directory Server Configuration, Command, and File Reference • January 2002
•SNMP Agent—Permits you to monitor Directory Server in real time using the
Simple Network Management Protocol (SNMP).
•Online backup and restore—Allows you to create backups and restore from
backups while the server is running.
Prerequisite Reading
This reference guide does not describe many of the basic directory and
architectural concepts that you need to successfully design, implement, and
administer your directory service. Those concepts are described in the Netscape
Directory Server Administrator’s Guide. You should read that book before
continuing with this reference guide.
When you are familiar with directory server concepts and have done some
preliminary planning for your directory service, you can install the Directory
Server. The instructions for installing the various Directory Server components are
contained in the Netscape Directory Server Installation Guide.
Managing Servers with Netscape Console contains general background information
on how to use Netscape servers. You should read and understand the concepts in
that book before you attempt to administer the Directory Server.
What Is In This Reference Guide?
This book is a reference guide for the server configuration and the command-line
utilities. It is designed primarily for directory administrators and experienced
directory users who want to use the command line to access the directory. After
configuring your server, use this reference guide to help you maintain it.
You can also manage the Directory Server using the Directory Server Console, a
graphical user interface. The Netscape Directory Server Administrator’s Guide
describes how to do this and explains individual administration tasks more fully.

Conventions Used In This Reference Guide
About This Reference Guide 17
Conventions Used In This Reference Guide
This section explains the conventions used in this book.
Monospaced font—Thistypefaceisusedforanytextthatappearsonthecomputer
screen or text that you should type. It is also used for filenames, functions, and
examples.
If you are using a Windows NT-based directory server, you should assume the NT
equivalent file paths whenever UNIX file paths are shown in this book.
All paths assume that the Directory Server is installed in the default location
/usr/netscape/servers. If you have installed your Directory Server in a different
location, adapt all paths specified in this book accordingly.
Related Information
The document set for Directory Server also contains the following guides:
•Netscape Directory Server Installation Guide. Procedures for installing Directory
Server as well as procedures for migrating your Directory Server.
•Netscape Directory Server Deployment Guide. Provides an overview for planning
your deployment of the Directory Server. Includes deployment examples.
•Netscape Directory Server Administrator’s Guide. Procedures for the day-to-day
maintenance of your directory service. Includes information on configuring
server-side plug-ins.
•Netscape Directory Server Schema Reference. Provides information about the
Netscape Directory Server schema.
•Netscape Directory Server Plug-In Programmer’s Guide. Describes how to write
server plug-ins in order to customize and extend the capabilities of Directory
Server.
For a list of documentation installed with Directory Server, open the
<server_root>/manual/en/slapd/index.htm file, where <server_root> is the
directory in which you installed Directory Server.
NOTE Notes and Warnings mark important information. Make sure you
read the information before continuing with a task.

Related Information
18 Netscape Directory Server Configuration, Command, and File Reference • January 2002
For the latest information about Directory Server, including current release notes,
complete product documentation, technical notes, and deployment information,
checkthissite:http://enterprise.netscape.com/docs

19
Chapter 1
Introduction
This chapter provides a brief overview of the configuration and administration
utilities provided to manage the Netscape Directory Server (Directory Server).
This chapter is divided into the following sections:
• Overview of Directory Server Management (page 19)
• Directory Server Configuration (page 20)
• Directory Server Instance File Reference (page 20)
• Migrating Directory Server (page 20)
• Using Directory Server Command-Line Utilities (page 20)
• Using Directory Server Command-Line Scripts (page 21)
Overview of Directory Server Management
Directory Server is based on an open-systems server protocol called the
Lightweight Directory Access Protocol (LDAP). The Directory Server is a robust,
scalable server designed to manage large scale directories to support
enterprise-wide directory of users and resources, extranets and e-commerce
applications over the Internet. The Directory Server runs as the ns-slapd process
or service (slapd on Windows NT) on your machine. The server manages the
directory databases and responds to client requests.
You can perform most Directory Server administrative tasks through Netscape
Console, the graphical user interface provided with the Directory Server. For
information on the general use of the Netscape Console see Managing Servers with
Netscape Console, and for details of how to use the console to manage the Directory
Server in particular, see Netscape Directory Server Administrator’s Guide.

Directory Server Configuration
20 Netscape Directory Server Configuration, Command, and File Reference • January 2002
This reference manual deals with the other methods of managing the Directory
Server, namely altering the server configuration attributes via the command line
and using the command-line utilities.
Directory Server Configuration
The format and method for storing configuration information for Directory Server
6.x mark a significant change from previous versions of the Directory Server. A full
explanation of these changes and a listing for all server attributes can be found in
Chapter 2, “Core Server Configuration Reference” and Chapter 3, “Plug-in
Implemented Server Functionality Reference”.
Directory Server Instance File Reference
Having an overview of the files and configuration information stored in each
instance of Directory Server is useful, as this helps administrators understand the
changes or absence of changes in the course of directory activity. From a security
standpoint, such an overview can help customers detect errors and intrusion as
they know what kind of changes to expect and what will be considered abnormal
behavior. See Chapter 4, “Server Instance File Reference” for further information.
Migrating Directory Server
In earlier versions of the Directory Server, all configuration parameters were stored
in text files. However, in Directory Server 6.x, configuration attributes are now
stored as LDAP configuration entries in the dse.ldif file. The mapping of
configuration parameters in Directory Server 4.1, 4.11, 4.12, and 4.13 to the
corresponding configuration entries and attributes in Directory Server 6.x is
described in Chapter 6, “Migration from Earlier Versions”.
Using Directory Server Command-Line Utilities
Directory Server comes with a set of configurable command-line utilities that you
can use to search and modify entries in the directory and administer the server.
Chapter 7, “Command-Line Utilities”describes these command-line utilities and
contains information on where the utilities are stored and how to access them. In