Novell EDIRECTORY 8.8 - GUIDE User manual

Novell
www.novell.com
Novell Confidential
Manual (ENU) 21 December 2004
eDirectoryTM
8.8
September 30, 2005
INSTALLATION GUIDE

Novell Confidential
Manual (ENU) 21 December 2004
Legal Notices
Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express
or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to revise this publication and to
make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc. makes no representations orwarranties with respect to any software, and specifically disclaims any express or implied warranties
of merchantability or fitness for any particular purpose. Further, Novell, Inc.reserves the right to make changesto any and all parts of Novell software,
at any time, without any obligation to notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the trade laws of other countries.
You agree tocomplywith all export control regulationsand to obtain anyrequired licenses orclassificationtoexport, re-export,orimport deliverables.
You agree not to export or re-export to entities on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the
U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. Please refer to
www.novell.com/info/exports/ for more information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any
necessary export approvals.
Copyright © 2003-2005Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, storedon a retrieval system, or
transmitted without the express written consent of the publisher.
Novell, Inc. hasintellectual property rightsrelating to technology embodied inthe product thatis described inthis document. Inparticular, and without
limitation, these intellectual property rights may include one or more of the U.S. patents listed at http://www.novell.com/company/legal/patents/ and
one or more additional patents or pending patent applications in the U.S. and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Novell eDirectory 8.8 Installation Guide
September 30, 2005
Online Documentation: To access the online documentation for this and other Novell products, and to get updates, see
www.novell.com/documentation.

3
Novell Confidential
Manual (ENU) 21 December 2004
Novell Trademarks
Client32 is a trademark of Novell, Inc.
eDirectory is a trademark of Novell, Inc.
NetWare is a registered trademark of Novell, Inc. in the United States and other countries.
NetWare Core Protocol and NCP are trademarks of Novell, Inc.
NMAS is a trademark of Novell, Inc.
Novell is a registered trademark of Novell, Inc. in the United States and other countries.
Novell Client is a trademark of Novell, Inc.
Novell Directory Services and NDS are registered trademarks of Novell, Inc. in the United States and other countries.
Ximiam is a registerd trademark of Novell, Inc. in the United States and other countries.
ZENworks is a registered trademark of Novell, Inc. in the United States and other countries.
Third-Party Materials
All third-party trademarks are the property of their respective owners.
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org).

4 Novell eDirectory 8.8 Installation Guide
Novell Confidential
Manual (ENU) 21 December 2004

About This Book 5
Novell Confidential
Manual (ENU) 21 December 2004
About This Book
This Installation Guide describes how to install Novell®eDirectoryTM 8.8. It is intended for
network administrators, and contains the following sections:
 Chapter 1, “Installing or Upgrading Novell eDirectory on NetWare,” on page 7
 Chapter 2, “Installing or Upgrading Novell eDirectory on Windows,” on page 13
 Chapter 3, “Installing or Upgrading Novell eDirectory on Linux,” on page 23
 Chapter 4, “Installing or Upgrading Novell eDirectory on Solaris,” on page 47
 Chapter 5, “Installing or Updating Novell eDirectory on AIX,” on page 63
 Chapter 6, “Installing or Upgrading Novell eDirectory on HP-UX,” on page 77
 Chapter 7, “Relocating the DIB,” on page 91
 Chapter 8, “Configuring Novell eDirectory on Linux, Solaris, AIX, or HP-UX Systems,” on
page 93
 Chapter 9, “Installing iManager Plug-ins,” on page 99
 Chapter 10, “Uninstalling Novell eDirectory,” on page 101
 Appendix A, “Linux, Solaris, AIX, and HP-UX Packages for Novell eDirectory,” on page 105
 Appendix B, “Server Health Checks,” on page 109
 Appendix C, “Configuring OpenSLP for eDirectory,” on page 115
Additional Documentation
For documentation on managing and administering eDirectory, see the Novell eDirectory 8.8
Administration Guide (http://www.novell.com/documentation/edir88/index.html).
Documentation Updates
For the most recent version of the Novell eDirectory 8.8 Installation Guide, see the Novell
eDirectory 8.8 Documentation (http://www.novell.com/documentation/edir88/index.html) Web
site.
Documentation Conventions
In this documentation, a greater-than symbol(>) is used to separate actions within a step and items
within a cross-reference path.
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party
trademark.
When a single pathname can be written with a backslash for some platforms or a forward slash for
other platforms, the pathname is presented with a backslash. Users of platforms that require a

6 Novell eDirectory 8.8 Installation Guide
Novell Confidential
Manual (ENU) 21 December 2004
forward slash, such as Linux* and UNIX*, should use forward slashes as required by your
software.

Installing or Upgrading Novell eDirectory on NetWare 7
Novell Confidential
Manual (ENU) 21 December 2004
1Installing or Upgrading Novell eDirectory on
NetWare
Use the following information to install or upgrade Novell®eDirectoryTM 8.8 on a NetWare®
server:
 “System Requirements” on page 7
 “Prerequisites” on page 7
 “Hardware Requirements” on page 8
 “Forcing the Backlink Process to Run” on page 9
 “Updating the eDirectory Schema for NetWare” on page 9
 “Installing or Upgrading Novell eDirectory on NetWare” on page 10
System Requirements
 You can upgrade to eDirectory 8.8 on the following version of NetWare:
 NetWare 6.5 with Support Pack 3 or later (http://support.novell.com/filefinder/18197/
index.html)
 Administrative rights to the eDirectory tree so you can modify the schema.
For information on hardware requirements, see “Hardware Requirements” on page 8.
Prerequisites
 If you are installing into an eDirectory tree that has NetWare and Windows servers, each
NetWare server must be running:
 NetWare 5.1 with Support Pack 8 (http://support.novell.com/filefinder/9331/index.html)
or later
 NetWare 6.0 with Support Pack 5 (http://support.novell.com/filefinder/13659/
index.html) or later
 NetWare 6.5 with Support Pack 3 (http://support.novell.com/filefinder/18197/
index.html) or later
Each Windows server must be running eDirectory 8.7.3 or later.
 (Conditional) NICI 2.7 and eDirectory 8.8 support key sizes up to 4096 bits. If you want to
use a 4 KB key size, every server must be upgraded to eDirectory 8.8. In addition, every
workstation using the management utilities, for example, iManager and ConsoleOne, must
have NICI 2.7 installed on it.

8 Novell eDirectory 8.8 Installation Guide
Novell Confidential
Manual (ENU) 21 December 2004
When you upgrade your Certificate Authority (CA) server to eDirectory 8.8, the key size will
not change; it will be 2 KB. The only way to create a 4 KB key size is recreate the CA on an
eDirectory 8.8 server. In addition, you would have to change the default from 2 KB to 4 KB
for the key size, during the CA creation.
 (Conditional) (to verify) If you are upgrading a NetWare server as a nonadministrator user,
ensure that you have met the following prerequisites:
 A NetWare server in the eDirectory 8.8 tree installed as the tree admin
Ensure that you have the following rights:
 Supervisor rights to the container the server is being installed into.
 All Attributes rights: read, compare, and write rights over the W0.KAP.Security object.
 Entry rights: browse rights over Security container object.
 All Attributes rights: read and compare rights over Security container object.
As a nonadministrator user, you can only upgrade a NetWare server.
Hardware Requirements
Hardware requirements depend on the specific implementation of eDirectory.
For example, a base installation of eDirectory with the standard schema requires about 74 MB of
disk space for every 50,000 users. However, if you add a new set of attributes or completely fill in
every existing attribute, the object size grows. These additions affect thedisk space, processor, and
memory needed.
Two factors increase performance: more cache memory and faster processors.
For best results, cache as much of the DIB Set as the hardware allows.
eDirectory scales well on a single processor. However, Novell eDirectory 8.7 took advantage of
multiple processors. Adding processors improves performance in some areas—for example,
logins and having multiple threads active on multiple processors. eDirectory itself isnot processor
intensive, but it is I/O intensive.
The following table illustrates typical system requirements for eDirectory for NetWare:
Requirements for processors might be greater than the table indicates, depending upon additional
services available on the computer as well as the number of authentications, reads, and writes that
the computer is handling. Processes such as encryption and indexing can be processor intensive.
Of course, faster processors improve performance. Additional memory also improves
performance because eDirectory can then cache more of the directory into memory.
Objects Processor Memory Hard Disk
100,000 Pentium* III 450-700 MHz (single) 384 MB 144 MB
1 million Pentium III 450-700 MHz (dual) 2 GB 1.5 GB
10 million Pentium III 450-700 MHz (2 to 4) 2+ GB 15 GB

Installing or Upgrading Novell eDirectory on NetWare 9
Novell Confidential
Manual (ENU) 21 December 2004
Forcing the Backlink Process to Run
Because the internal eDirectory identifiers change when upgrading to Novell eDirectory, the
backlink process must update backlinked objects for them to be consistent.
Backlinks keep track of external references to objects on other servers. For each external reference
on a server, the backlink process ensures that the real object exists in the correct location and
verifies all backlink attributes on the master of the replica. The backlink process occurs two hours
after the database is open and then every 780 minutes (13 hours). The interval is configurable from
2 minutes to 10,080 minutes (7 days).
After migrating to eDirectory, we recommend that you force the backlink to run by issuing the
following commands from the server console. Running the backlink process is especially
important on servers that do not contain a replica.
1 At the server console, enter set dstrace=on.
2 Enter set dstrace=+blink.
3 Enter set dstrace=*b.
4 When the process is complete, enter set dstrace=off.
Updating the eDirectory Schema for NetWare
When upgrading a NetWare server to eDirectory 8.8, you might need to update the eDirectory
schema by running DSRepair on the server that has the master replica of the root partition.
IMPORTANT: If the master replica of the root partition resides on a Windows server, follow the instructionsin
“Updating the eDirectory Schema for Windows” on page 15.
To update the schema:
1 Copy the appropriate dsrepair.nlm file from the product CD (or downloaded and expanded
file) to the sys:\system directory of the server that contains the master replica of the Tree
partition.
2 At the server console of the master replica of the root partition, load dsrepair.nlm.
3 Select Advanced Options Menu > Global Schema Operations.
4 Enter the Administrator’s name (for example, Admin.VMP) and password.
NOTE: In eDirectory 8.8 and later, you can have case sensitive passwords for all the utilities. Refer to
Novell eDirectory 8.8 What’s New Guide (http://www.novell.com/documentation/edir88/index.html) for
more information.
5 Select Post NetWare 5 Schema Update > Yes.
dsrepair.nlm updates the schema and posts the results to the dsrepair.log file.
Ignore errors associated with adding object classes. dsreapir.nlm is simply applying the Post
NetWare 5 Schema Update changes to each object.
6 Copy the appropriate patch version of dsrepair.nlm to each NetWare server in the eDirectory
tree.
Usethe table inStep 1 as a reference. Having a correct version on each server ensures that the
schema needed for eDirectory is properly maintained when dsrepair.nlm is run in the future.

10 Novell eDirectory 8.8 Installation Guide
Novell Confidential
Manual (ENU) 21 December 2004
If you use an earlier version of dsreapir.nlm and select Rebuild Operational Schema, schema
enhancements made by the Post NetWare 5 Schema Update will be lost. To resolve lost
schema enhancements, run dsrepair.nlm according to the following table.
This action resynchronizes the schema from the root of the tree.
7 Close dsrepair.nlm before installing eDirectory on the server.
If dsrepair.nlm is loaded, the server might not restart.
Installing or Upgrading Novell eDirectory on NetWare
This section contains the following information:
 “Installing or Upgrading Novell eDirectory 8.8 on NetWare” on page 10
 “Server Health Checks” on page 11
 “Installing NMAS Server Software” on page 11
 “Installing NMAS Client Software” on page 12
 “Installing into a Tree with Dotted Name Containers” on page 12
Installing or Upgrading Novell eDirectory 8.8 on NetWare
1 At the server console, enter nwconfig.nlm.
2 Select Product Options > Install a Product Not Listed.
3 Press F3 and specify the path to the NW directory where the installation program can find the
nds8.ips file.
 If you downloaded eDirectory from the Web, enter the path to the NW directory you
extracted from the downloaded file (for example, sys:\edir\nw).
 Ifyou are installingfrom a CD,mount the CD asavolumeand enter volume_name:NW
(for example, edir_88:NW).
For information on mounting a CD as a volume, see “CD-ROMs as Logical Volumes”
(http://www.novell.com/documentation/lg/nw6p/nss_enu/data/htxx7fd6.html) in the
Novell Storage Services Administration Guide.
4 Follow the on-screen prompts concerning license agreements, the Readme file, and tips.
5 Enter the administrator’s login name (for example, Admin.VMP) and password.
IMPORTANT: This window might close before you enter this information. If it does, toggle (Alt+Esc) to
the screen and enter the information. Otherwise, the installation will not be complete.
If You Are Running DSREPAIR.NLM From
Here Then
A serverthat holds a writable replica of the
root partition Reapply the Post NetWare 5 Schema Update to your eDirectory tree.
From any other server Select Advanced Options > Global Schema
Operations > Request Schema from Tree.