Novell EDIRECTORY 8.8 - GUIDE User manual

Novell
www.novell.com
Novell Confidential
Manual (ENU) 21 December 2004
eDirectoryTM
8.8
September 30, 2005
INSTALLATION GUIDE

Novell Confidential
Manual (ENU) 21 December 2004
Legal Notices
Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express
or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to revise this publication and to
make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc. makes no representations orwarranties with respect to any software, and specifically disclaims any express or implied warranties
of merchantability or fitness for any particular purpose. Further, Novell, Inc.reserves the right to make changesto any and all parts of Novell software,
at any time, without any obligation to notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the trade laws of other countries.
You agree tocomplywith all export control regulationsand to obtain anyrequired licenses orclassificationtoexport, re-export,orimport deliverables.
You agree not to export or re-export to entities on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the
U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. Please refer to
www.novell.com/info/exports/ for more information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any
necessary export approvals.
Copyright © 2003-2005Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, storedon a retrieval system, or
transmitted without the express written consent of the publisher.
Novell, Inc. hasintellectual property rightsrelating to technology embodied inthe product thatis described inthis document. Inparticular, and without
limitation, these intellectual property rights may include one or more of the U.S. patents listed at http://www.novell.com/company/legal/patents/ and
one or more additional patents or pending patent applications in the U.S. and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Novell eDirectory 8.8 Installation Guide
September 30, 2005
Online Documentation: To access the online documentation for this and other Novell products, and to get updates, see
www.novell.com/documentation.

3
Novell Confidential
Manual (ENU) 21 December 2004
Novell Trademarks
Client32 is a trademark of Novell, Inc.
eDirectory is a trademark of Novell, Inc.
NetWare is a registered trademark of Novell, Inc. in the United States and other countries.
NetWare Core Protocol and NCP are trademarks of Novell, Inc.
NMAS is a trademark of Novell, Inc.
Novell is a registered trademark of Novell, Inc. in the United States and other countries.
Novell Client is a trademark of Novell, Inc.
Novell Directory Services and NDS are registered trademarks of Novell, Inc. in the United States and other countries.
Ximiam is a registerd trademark of Novell, Inc. in the United States and other countries.
ZENworks is a registered trademark of Novell, Inc. in the United States and other countries.
Third-Party Materials
All third-party trademarks are the property of their respective owners.
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org).

4 Novell eDirectory 8.8 Installation Guide
Novell Confidential
Manual (ENU) 21 December 2004

About This Book 5
Novell Confidential
Manual (ENU) 21 December 2004
About This Book
This Installation Guide describes how to install Novell®eDirectoryTM 8.8. It is intended for
network administrators, and contains the following sections:
 Chapter 1, “Installing or Upgrading Novell eDirectory on NetWare,” on page 7
 Chapter 2, “Installing or Upgrading Novell eDirectory on Windows,” on page 13
 Chapter 3, “Installing or Upgrading Novell eDirectory on Linux,” on page 23
 Chapter 4, “Installing or Upgrading Novell eDirectory on Solaris,” on page 47
 Chapter 5, “Installing or Updating Novell eDirectory on AIX,” on page 63
 Chapter 6, “Installing or Upgrading Novell eDirectory on HP-UX,” on page 77
 Chapter 7, “Relocating the DIB,” on page 91
 Chapter 8, “Configuring Novell eDirectory on Linux, Solaris, AIX, or HP-UX Systems,” on
page 93
 Chapter 9, “Installing iManager Plug-ins,” on page 99
 Chapter 10, “Uninstalling Novell eDirectory,” on page 101
 Appendix A, “Linux, Solaris, AIX, and HP-UX Packages for Novell eDirectory,” on page 105
 Appendix B, “Server Health Checks,” on page 109
 Appendix C, “Configuring OpenSLP for eDirectory,” on page 115
Additional Documentation
For documentation on managing and administering eDirectory, see the Novell eDirectory 8.8
Administration Guide (http://www.novell.com/documentation/edir88/index.html).
Documentation Updates
For the most recent version of the Novell eDirectory 8.8 Installation Guide, see the Novell
eDirectory 8.8 Documentation (http://www.novell.com/documentation/edir88/index.html) Web
site.
Documentation Conventions
In this documentation, a greater-than symbol(>) is used to separate actions within a step and items
within a cross-reference path.
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party
trademark.
When a single pathname can be written with a backslash for some platforms or a forward slash for
other platforms, the pathname is presented with a backslash. Users of platforms that require a

6 Novell eDirectory 8.8 Installation Guide
Novell Confidential
Manual (ENU) 21 December 2004
forward slash, such as Linux* and UNIX*, should use forward slashes as required by your
software.

Installing or Upgrading Novell eDirectory on NetWare 7
Novell Confidential
Manual (ENU) 21 December 2004
1Installing or Upgrading Novell eDirectory on
NetWare
Use the following information to install or upgrade Novell®eDirectoryTM 8.8 on a NetWare®
server:
 “System Requirements” on page 7
 “Prerequisites” on page 7
 “Hardware Requirements” on page 8
 “Forcing the Backlink Process to Run” on page 9
 “Updating the eDirectory Schema for NetWare” on page 9
 “Installing or Upgrading Novell eDirectory on NetWare” on page 10
System Requirements
 You can upgrade to eDirectory 8.8 on the following version of NetWare:
 NetWare 6.5 with Support Pack 3 or later (http://support.novell.com/filefinder/18197/
index.html)
 Administrative rights to the eDirectory tree so you can modify the schema.
For information on hardware requirements, see “Hardware Requirements” on page 8.
Prerequisites
 If you are installing into an eDirectory tree that has NetWare and Windows servers, each
NetWare server must be running:
 NetWare 5.1 with Support Pack 8 (http://support.novell.com/filefinder/9331/index.html)
or later
 NetWare 6.0 with Support Pack 5 (http://support.novell.com/filefinder/13659/
index.html) or later
 NetWare 6.5 with Support Pack 3 (http://support.novell.com/filefinder/18197/
index.html) or later
Each Windows server must be running eDirectory 8.7.3 or later.
 (Conditional) NICI 2.7 and eDirectory 8.8 support key sizes up to 4096 bits. If you want to
use a 4 KB key size, every server must be upgraded to eDirectory 8.8. In addition, every
workstation using the management utilities, for example, iManager and ConsoleOne, must
have NICI 2.7 installed on it.

8 Novell eDirectory 8.8 Installation Guide
Novell Confidential
Manual (ENU) 21 December 2004
When you upgrade your Certificate Authority (CA) server to eDirectory 8.8, the key size will
not change; it will be 2 KB. The only way to create a 4 KB key size is recreate the CA on an
eDirectory 8.8 server. In addition, you would have to change the default from 2 KB to 4 KB
for the key size, during the CA creation.
 (Conditional) (to verify) If you are upgrading a NetWare server as a nonadministrator user,
ensure that you have met the following prerequisites:
 A NetWare server in the eDirectory 8.8 tree installed as the tree admin
Ensure that you have the following rights:
 Supervisor rights to the container the server is being installed into.
 All Attributes rights: read, compare, and write rights over the W0.KAP.Security object.
 Entry rights: browse rights over Security container object.
 All Attributes rights: read and compare rights over Security container object.
As a nonadministrator user, you can only upgrade a NetWare server.
Hardware Requirements
Hardware requirements depend on the specific implementation of eDirectory.
For example, a base installation of eDirectory with the standard schema requires about 74 MB of
disk space for every 50,000 users. However, if you add a new set of attributes or completely fill in
every existing attribute, the object size grows. These additions affect thedisk space, processor, and
memory needed.
Two factors increase performance: more cache memory and faster processors.
For best results, cache as much of the DIB Set as the hardware allows.
eDirectory scales well on a single processor. However, Novell eDirectory 8.7 took advantage of
multiple processors. Adding processors improves performance in some areas—for example,
logins and having multiple threads active on multiple processors. eDirectory itself isnot processor
intensive, but it is I/O intensive.
The following table illustrates typical system requirements for eDirectory for NetWare:
Requirements for processors might be greater than the table indicates, depending upon additional
services available on the computer as well as the number of authentications, reads, and writes that
the computer is handling. Processes such as encryption and indexing can be processor intensive.
Of course, faster processors improve performance. Additional memory also improves
performance because eDirectory can then cache more of the directory into memory.
Objects Processor Memory Hard Disk
100,000 Pentium* III 450-700 MHz (single) 384 MB 144 MB
1 million Pentium III 450-700 MHz (dual) 2 GB 1.5 GB
10 million Pentium III 450-700 MHz (2 to 4) 2+ GB 15 GB

Installing or Upgrading Novell eDirectory on NetWare 9
Novell Confidential
Manual (ENU) 21 December 2004
Forcing the Backlink Process to Run
Because the internal eDirectory identifiers change when upgrading to Novell eDirectory, the
backlink process must update backlinked objects for them to be consistent.
Backlinks keep track of external references to objects on other servers. For each external reference
on a server, the backlink process ensures that the real object exists in the correct location and
verifies all backlink attributes on the master of the replica. The backlink process occurs two hours
after the database is open and then every 780 minutes (13 hours). The interval is configurable from
2 minutes to 10,080 minutes (7 days).
After migrating to eDirectory, we recommend that you force the backlink to run by issuing the
following commands from the server console. Running the backlink process is especially
important on servers that do not contain a replica.
1 At the server console, enter set dstrace=on.
2 Enter set dstrace=+blink.
3 Enter set dstrace=*b.
4 When the process is complete, enter set dstrace=off.
Updating the eDirectory Schema for NetWare
When upgrading a NetWare server to eDirectory 8.8, you might need to update the eDirectory
schema by running DSRepair on the server that has the master replica of the root partition.
IMPORTANT: If the master replica of the root partition resides on a Windows server, follow the instructionsin
“Updating the eDirectory Schema for Windows” on page 15.
To update the schema:
1 Copy the appropriate dsrepair.nlm file from the product CD (or downloaded and expanded
file) to the sys:\system directory of the server that contains the master replica of the Tree
partition.
2 At the server console of the master replica of the root partition, load dsrepair.nlm.
3 Select Advanced Options Menu > Global Schema Operations.
4 Enter the Administrator’s name (for example, Admin.VMP) and password.
NOTE: In eDirectory 8.8 and later, you can have case sensitive passwords for all the utilities. Refer to
Novell eDirectory 8.8 What’s New Guide (http://www.novell.com/documentation/edir88/index.html) for
more information.
5 Select Post NetWare 5 Schema Update > Yes.
dsrepair.nlm updates the schema and posts the results to the dsrepair.log file.
Ignore errors associated with adding object classes. dsreapir.nlm is simply applying the Post
NetWare 5 Schema Update changes to each object.
6 Copy the appropriate patch version of dsrepair.nlm to each NetWare server in the eDirectory
tree.
Usethe table inStep 1 as a reference. Having a correct version on each server ensures that the
schema needed for eDirectory is properly maintained when dsrepair.nlm is run in the future.

10 Novell eDirectory 8.8 Installation Guide
Novell Confidential
Manual (ENU) 21 December 2004
If you use an earlier version of dsreapir.nlm and select Rebuild Operational Schema, schema
enhancements made by the Post NetWare 5 Schema Update will be lost. To resolve lost
schema enhancements, run dsrepair.nlm according to the following table.
This action resynchronizes the schema from the root of the tree.
7 Close dsrepair.nlm before installing eDirectory on the server.
If dsrepair.nlm is loaded, the server might not restart.
Installing or Upgrading Novell eDirectory on NetWare
This section contains the following information:
 “Installing or Upgrading Novell eDirectory 8.8 on NetWare” on page 10
 “Server Health Checks” on page 11
 “Installing NMAS Server Software” on page 11
 “Installing NMAS Client Software” on page 12
 “Installing into a Tree with Dotted Name Containers” on page 12
Installing or Upgrading Novell eDirectory 8.8 on NetWare
1 At the server console, enter nwconfig.nlm.
2 Select Product Options > Install a Product Not Listed.
3 Press F3 and specify the path to the NW directory where the installation program can find the
nds8.ips file.
 If you downloaded eDirectory from the Web, enter the path to the NW directory you
extracted from the downloaded file (for example, sys:\edir\nw).
 Ifyou are installingfrom a CD,mount the CD asavolumeand enter volume_name:NW
(for example, edir_88:NW).
For information on mounting a CD as a volume, see “CD-ROMs as Logical Volumes”
(http://www.novell.com/documentation/lg/nw6p/nss_enu/data/htxx7fd6.html) in the
Novell Storage Services Administration Guide.
4 Follow the on-screen prompts concerning license agreements, the Readme file, and tips.
5 Enter the administrator’s login name (for example, Admin.VMP) and password.
IMPORTANT: This window might close before you enter this information. If it does, toggle (Alt+Esc) to
the screen and enter the information. Otherwise, the installation will not be complete.
If You Are Running DSREPAIR.NLM From
Here Then
A serverthat holds a writable replica of the
root partition Reapply the Post NetWare 5 Schema Update to your eDirectory tree.
From any other server Select Advanced Options > Global Schema
Operations > Request Schema from Tree.

Installing or Upgrading Novell eDirectory on NetWare 11
Novell Confidential
Manual (ENU) 21 December 2004
NOTE: In eDirectory 8.8 and later, you can have case sensitive passwords for all the utilities. Refer to
Novell eDirectory 8.8 What’s New Guide (http://www.novell.com/documentation/edir88/index.html) for
more information.
6 In the LDAP Configuration screen, specify which LDAP ports to use, then click Next.
For more information, see “Communicating with eDirectory through LDAP” on page 18.
7 Select the NMASTM login method you want to install, then click Next.
See “Installing NMAS Server Software” on page 11 and “Installing NMAS Client Software”
on page 12 for more information.
8 Click Finish to start the eDirectory installation.
9 To complete the installation, remove any diskettes or CDs when prompted, then click Yes to
restart the server.
Server Health Checks
With eDirectory 8.8, when you upgrade eDirectory, two server health checks are conducted by
default to ensure that the server is safe for the upgrade:
 “Basic Server Health” on page 110
 “Partitions and Replica Health” on page 110
Based on the results obtained from the health checks, the upgrade will either continue or exit as
follows:
 If all the health checks are successful, the upgrade will continue.
 If there are minor errors, the upgrade will prompt you to continue or exit.
 If there are critical errors, the upgrade will exit.
See Appendix B, “Server Health Checks,” on page 109 for a list of minor and critical error
conditions.
Skipping Server Health Checks
To skip server health checks, enter No when you prompted to perform the health check.
For more information, see Appendix B, “Server Health Checks,” on page 109.
Installing NMAS Server Software
Novell Modular Authentication ServiceTM (NMAS) server components are installed automatically
when you run the eDirectory installation program. You will need to select the login methods you
want to install.
Selectthe login methods that you want to install into eDirectory by checking the appropriate check
boxes. When you select a login method, a description of the component appears in the Description
box. For more information on login methods, see “Managing Login and Post-Login Methods and
Sequences” (http://www.novell.com/documentation/lg/nmas23/admin/data/a53vj9a.html) in the
Novell Modular Authentication Service Administration Guide.
Click Select All if you want to install all the login methods into eDirectory. Click Clear All if you
want to clear all selections.
The NDS login method is installed by default.

12 Novell eDirectory 8.8 Installation Guide
Novell Confidential
Manual (ENU) 21 December 2004
Installing NMAS Client Software
The NMAS client software must be installed on each client workstation where you want to use the
NMAS login methods.
1 At a Windows client workstation, insert the Novell eDirectory 8.8 CD.
2 From the NMAS directory, run nmasinstall.exe.
3 Select the NMAS Client Components checkbox.
Optionally, you can select the NICI checkbox if you want to install this component.
4 Click OK and follow the on-screen instructions.
5 Reboot the client workstation after the installation completes.
Installing into a Tree with Dotted Name Containers
You can install a NetWare server into an eDirectory tree that has containers with dots in the names
(for example, O=novell.com or C=u.s.a). Using containers with dotted names requires that those
dots be escaped with the backslash character. To escape a dot, simply put a backslash in front of
any dot in a container name. For example:
O=novell\.com
You cannot start a name with a dot. For example, you cannot create a container named “.novell”
because it starts with a dot (‘.’).
IMPORTANT: If your tree has containers with dotted names, you much escape those names when logging
into utilities such as iMonitor, iManager, and DHost iConsole. For example, if your tree has “novell.com” as the
name of the O, enter username.novell\.com in the Username field when logging in to iMonitor (see Figure 1).
Figure 1 iMonitor Login Screen

Installing or Upgrading Novell eDirectory on Windows 13
Novell Confidential
Manual (ENU) 21 December 2004
2Installing or Upgrading Novell eDirectory on
Windows
Use the following information to install or upgrade Novell®eDirectoryTM 8.8 on a Windows* 2000
or Windows Server 2003:
 “System Requirements” on page 13
 “Prerequisites” on page 14
 “Hardware Requirements” on page 14
 “Forcing the Backlink Process to Run” on page 15
 “Updating the eDirectory Schema for Windows” on page 15
 “Installing Novell eDirectory on Windows” on page 16
IMPORTANT: Novell eDirectory 8.8 lets you installeDirectory for Windows without the Novell ClientTM. If you
install eDirectory 8.8 on a machine already containing the Novell Client, eDirectorywill use the existing Client.
For more information, see “Installing or Updating Novell eDirectory 8.8 on Windows 2000 or Server 2003” on
page 16.
System Requirements
 One of the following:
 Windows 2000 Server with Service Pack 4 or later,Windows 2000 Advanced Server with
Service Pack 4 or later
 Windows Server 2003
IMPORTANT: Windows XP is not a supported Novell eDirectory 8.8 platform.
 An assigned IP address.
 A Pentium 200 with a minimum of 64 MB RAM (128 MB recommended) and a monitor color
palette set to a number higher than 16.
 (Optional) One or more workstations running one of the following:
 Novell Client for Windows 95/98 version 3.4
 Novell Client for Windows 2000/XP version 4.9
 Administrative rights to the Windows server and to all portions of the eDirectory tree that
contain domain-enabled User objects. For an installation into an existing tree, you need
administrative rights to the Tree object so that you can extend the schema and create objects.

14 Novell eDirectory 8.8 Installation Guide
Novell Confidential
Manual (ENU) 21 December 2004
Prerequisites
 Because NTFS provides a safer transaction process than a FAT file system provides, you can
install eDirectory only on an NTFS partition. Therefore, if you have only FAT file systems,
do one of the following:
 Create a new partition and format it as NTFS.
Use Disk Administrator. Refer to Windows Server User Guide for more information.
 Convert an existing FAT file system to NTFS, using the CONVERT command.
Refer to Windows Server User Guide for more information.
If your server only has a FAT file system and you forget or overlook this process, the
installation program prompts you to provide an NTFS partition.
 (Conditional) NICI 2.7 and eDirectory 8.8 support key sizes up to 4096 bits. If you want to
use a 4 KB key size, every server must be upgraded to eDirectory 8.8. In addition, every
workstation using the management utilities, for example, iManager and ConsoleOne, must
have NICI 2.7 installed on it.
When you upgrade your Certificate Authority (CA) server to eDirectory 8.8, the key size will
not change; it will be 2 KB. The only way to create a 4 KB key size is recreate the CA on an
eDirectory 8.8 server. In addition, you would have to change the default from 2 KB to 4 KB
for the key size, during the CA creation.
 If you are upgrading to eDirectory 8.8, make sure you have the latest NDS and eDirectory
patches installed on all non-eDirectory 8.8 servers in the tree. You can get NDS and
eDirectory patches from the Novell Support (http://support.novell.com) Web site.
 Make sure you have the latest Windows 2000 or 2003 Server Service Packs installed. The
latest updated Windows Service Pack needs to be installed after the installation of the
Windows SNMP service.
 If you are upgrading from a previous version of eDirectory, it must be eDirectory 8.7 or later.
 (Conditional) (to verify) If you are installing a secondary server into an existing tree as a
nonadministrator user, ensure that you have the following rights:
 Supervisor rights to the container the server is being installed into.
 Supervisor rights to the partition where you want to add the server.
NOTE: This is required for adding the replica when the replica count is less than 3.
 All Attributes rights: read, compare, and write rights over the W0.KAP.Security object.
 Entry rights: browse rights over Security container object.
 All Attributes rights: read and compare rights over Security container object.
Hardware Requirements
Hardware requirements depend on the specific implementation of eDirectory.
For example, a base installation of eDirectory with the standard schema requires about 74 MB of
disk space for every 50,000 users. However, if you add a new set of attributes or completely fill in
every existing attribute, the object size grows. These additions affect thedisk space, processor, and
memory needed.
Two factors increase performance: more cache memory and faster processors.

Installing or Upgrading Novell eDirectory on Windows 15
Novell Confidential
Manual (ENU) 21 December 2004
For best results, cache as much of the DIB Set as the hardware allows.
eDirectory scales well on a single processor. However, Novell eDirectory 8.8 takes advantage of
multiple processors. Adding processors improves performance in some areas—for example,
logins and having multiple threads active on multiple processors. eDirectoryitself isnot processor
intensive, but it is I/O intensive.
The following table illustrates typical system requirements for Novell eDirectory for Windows
2000:
Requirements for processors might be greater than the table indicates, depending upon additional
services available on the computer as well as the number of authentications, reads, and writes that
the computer is handling. Processes such as encryption and indexing can be processor intensive.
Forcing the Backlink Process to Run
Because the internal eDirectory identifiers change when upgrading to eDirectory, the backlink
process must update backlinked objects for them to be consistent.
Backlinks keep track of external references to objects on other servers. For each external reference
on a server, the backlink process ensures that the real object exists in the correct location and
verifies all backlink attributes on the master of the replica. The backlink process occurs two hours
after the database is open and then every 780 minutes (13 hours). The interval is configurable from
2 minutes to 10,080 minutes (7 days).
After migrating to eDirectory, we recommend that you force the backlink to run by completing the
following procedure. Running the backlink process is especially important on servers that do not
contain a replica.
1 Click Start > Settings > Control Panel > Novell eDirectory Services
2 In the Services tab, select ds.dlm.
3 Click Configure.
4 In the Trigger tab, click Backlinker.
For more information about the backlink process,referto the Novell eDirectory 8.8 Administration
Guide (http://www.novell.com/documentation/edir88/edir88/data/h0000005.html).
Updating the eDirectory Schema for Windows
To install eDirectory 8.8 into an existing tree, you might need to update the eDirectory schema by
running DSRepair on the server that contains the master replica of the root partition.
IMPORTANT: If the master replica of the root partition resides on a NetWareserver, followthe instructionsin
“Updating the eDirectory Schema for NetWare” on page 9.
Objects Processor Memory Hard Disk
10,000 Pentium III 450-700 MHz (single) 384 MB 144 MB
1 million Pentium III 450-700 MHz (dual) 2 GB 1.5 GB
10 million Pentium III 450-700 MHz (2 to 4) 2+ GB 15 GB

16 Novell eDirectory 8.8 Installation Guide
Novell Confidential
Manual (ENU) 21 December 2004
The eDirectory installation program checks the existing schema’s version. If the schema has not
been upgraded, the installation program instructs you to run DSRepair and then discontinues.
1 Copy patches\dsrepair\ntnds8\dsrepair.dll from the product CD to the directory where you
installed eDirectory (for example, c:\novell\nds).
2 Click Start > Settings > Control Panel > Novell eDirectory Services.
3 Select dsrepair.dlm in the Service list.
4 Enter -ins in the Startup Parameters field, then click Start.
After the schema has been updated, the Status field next to the dsrepair.dlm service will be
blank.
5 To see the results of the schema update, select dsrepair.dlm, then click Start.
6 Click File > Open Log File > Open.
The last entry in the log file will contain the results of the schema update.
Installing Novell eDirectory on Windows
This section contains the following information:
 “Installing or Updating Novell eDirectory 8.8 on Windows 2000 or Server 2003” on page 16
 “Server Health Checks” on page 18
 “Communicating with eDirectory through LDAP” on page 18
 “Installing NMAS Server Software” on page 21
 “Installing NMAS Client Software” on page 21
 “Installing into a Tree with Dotted Name Containers” on page 21
Installing or Updating Novell eDirectory 8.8 on Windows 2000 or Server 2003
You can install eDirectory 8.8 for Windows without the Novell Client. If you install eDirectory 8.8
on a machine already containing the Novell Client, eDirectory will use the existing Client, or
update it if it is not the latest version.
1 At the Windows server, log in as Administrator or as a user with administrative privileges.
2 To resolve tree names, make sure that SLP is correctly configured on your network and that
SLP DAs are stable.
For more information, see one of the following:
 Appendix C, “Configuring OpenSLP for eDirectory,” on page 115
 DHCP Options for Service Location Protocol (http://www.openslp.org/doc/rfc/
rfc2610.txt)
 OpenSLP Documentation (http://www.openslp.org/#Documentation)
3 If you have Autorun turned off, run setup.bat from the Novell eDirectory 8.8 CD or from the
downloaded file.
The installation program checks for thefollowing components before itinstalls eDirectory. If
a component is missing or is an incorrect version, the installation program automatically
launches an installation for that component.

Installing or Upgrading Novell eDirectory on Windows 17
Novell Confidential
Manual (ENU) 21 December 2004
 NICI 2.7
For more information on the Novell International Cryptographic Infrastructure (NICI),
see the NICI 2.7 Administration Guide (http://www.novell.com/documentation/beta/
nici27x/index.html).
You might have to reboot the server after the NICI installation. The eDirectory
installation will continue after the reboot.
 Novell Client for Windows 2000/XP.
IMPORTANT: The Novell Client is updated automatically if you have an olderversion of the Client
already installed on the machine. For more information on the Client, see the Novell Client for
Windows (http://www.novell.com/documentation/lg/noclienu/index.html) online documentation.
4 View the license agreement, then click I Accept.
5 Select a language for the installation, then click Next.
6 Specify or confirm the installation path, then click Next.
7 Specify or confirm the DIB path, then click Next.
8 (New installations only) Select an eDirectory installation type, then click Next.
 Install eDirectory into an Existing Tree incorporates this server into your eDirectory
network. The server can be installed into any level of your tree.
 Createa New eDirectory Tree creates a new tree. Use this option if this is the first server
to go into the tree or if this server requires a separate tree. The resources available on the
new tree will not be available to users logged in to a different tree.
9 Provide information in the eDirectory Installation screen, then click Next.
 If you are installing a new eDirectory server, specify a Tree name, Server object context,
and Admin name and password for the new tree.
 If you are installing into an existing tree, specify the Tree name, Server object context,
and Admin name and password of the existing tree.
 If you are upgrading an eDirectory server, specify the Admin password.
NOTE: In eDirectory 8.8 and later, you can have case sensitive passwords forall the utilities. Refer
to Novell eDirectory 8.8 What’s New Guide (http://www.novell.com/documentation/edir88/
index.html) for more information.
For information on using dots in container names, see “Installing into a Tree with Dotted
Name Containers” on page 21.
10 (New installations only) In the HTTP Server Port Configuration page, specify the ports to use
for the eDirectory administrative HTTP server, then click Next.
IMPORTANT: MakesurethattheHTTPstackportsyousetduringtheeDirectoryinstallationaredifferent
than the HTTP stack ports you have used or will use for Novell iManager. For more information, see the
Novell iManager 2.5 Administration Guide (http://www.novell.com/documentation/imanager25/
index.html).
11 (New installations only) In the LDAP Configuration page, specify which LDAP ports to use,
then click Next.
For more information, see “Communicating with eDirectory through LDAP” on page 18.
12 Select the NMASTM login methods you want to install, then click Next.
See “Installing NMAS Server Software” on page 21 and “Installing NMAS Client Software”
on page 21 for more information.

18 Novell eDirectory 8.8 Installation Guide
Novell Confidential
Manual (ENU) 21 December 2004
13 Click Finish to complete the eDirectory installation.
Server Health Checks
With eDirectory 8.8, when you upgrade eDirectory, two server health checks are conducted by
default to ensure that the server is safe for the upgrade.
 “Basic Server Health” on page 110
 “Partitions and Replica Health” on page 110
Based on the results obtained from the health checks, the upgrade will either continue or exit as
follows:
 If all the health checks are successful, the upgrade will continue.
 If there are minor errors, the upgrade will prompt you to continue or exit.
 If there are critical errors, the upgrade will exit.
See Appendix B, “Server Health Checks,” on page 109 for a list of minor and critical error
conditions.
Skipping Server Health Checks
To skip server health checks, disable server health checks when prompted in the installation
Wizard
For more information, see Appendix B, “Server Health Checks,” on page 109.
Communicating with eDirectory through LDAP
When you install eDirectory, you must select a port that the LDAP server monitors so that it can
service LDAP requests. The following table lists options for various installations:
Port 389, the Industry-Standard LDAP Clear-Text Port
The connection through port 389 is not encrypted. All data sent on a connection made to this port
isclear.Therefore,a security riskexists. For example, LDAP passwordscanbeviewed ona simple
bind request.
An LDAP Simple Bind requires only a DN and a password. The password is in clear text. If you
use port 389, the entire packet is in clear text. By default, this option is disabled during the
eDirectory installation.
Because port 389 allows clear text, the LDAP server services Read and Write requests to the
Directory through this port. This openness is adequate for environments of trust, where spoofing
doesn’t occur and no one inappropriately captures packets.
Installation Option Result
eDirectory 8.8 Clear text (port 389) Selects port 389.
eDirectory 8.8 Encrypted (port 636) Selects port 636.
eDirectory 8.8 Require TLS for simple bind Keeps (on the LDAP Group object) a
parameter asked about during
installation.

Installing or Upgrading Novell eDirectory on Windows 19
Novell Confidential
Manual (ENU) 21 December 2004
To disallow clear passwordsand otherdata, select the Require TLS for Simple Bind with Password
option during installation.
As the following figure illustrates, the page gives defaultsof 389, 636, and Require TLS for Simple
Bind with Password.
Figure 2 Defaults for the LDAP Configuration Screen
Scenario: Require TLS for Simple Bind Is Enabled: Olga is using a client that asks for a
password. After Olga enters a password, the client connects to the server. However, the LDAP
server does not allow the connection to bind to the server over the clear-text port. Everyone is able
to view Olga’s password, but Olga is unable to get a bound connection.
The Require TLS for Simple Bind discourages users from sending observable passwords. If this
setting is disabled (that is, not checked), users are unaware that others can observe their passwords.
This option, which does not allow the connection, only applies to the clear-text port.
If you make a secure connection to port 636 and have a simple bind, the connection is already
encrypted. No one can view passwords, data packets, or bind requests.
Port 636, the Industry-Standard Secure Port
The connection through port 636 is encrypted. TLS (formerly SSL) manages the encryption. By
default, the eDirectory installation selects this port.
The following figure illustrates the selected port.

20 Novell eDirectory 8.8 Installation Guide
Novell Confidential
Manual (ENU) 21 December 2004
Figure 3 LDAP Server Connections Page in iManager
A connection to port 636 automatically instantiates a handshake. If the handshake fails, the
connection is denied.
IMPORTANT: This default selection mightcause a problem for your LDAP server. If a service already loaded
on the host server (before eDirectory was installed) uses port 636, you must specify another port.
Installations earlier than eDirectory 8.7 treated this conflict as a fatal error and unloaded nldap.nlm. The
eDirectory 8.7.3onwards installation loads nldap.nlm,placesan errormessage in the dstrace.log file, andruns
without the secure port.
Scenario: Port636 Is Already Used:Your server is running Active Directory*. Active Directory
is running an LDAP program, which uses port 636. You install eDirectory. The installation
program detects that port 636 is already used and doesn’t assign a port number for the Novell
LDAP server. TheLDAP serverloads and appearsto run. However, becausetheLDAP serverdoes
not duplicate or use a port that is already open, the LDAP server does not service requests on any
duplicated port.
If you are not certain that port 389 or 636 is assigned to the Novell LDAP server, run the ICE
utility. If the Vendor Version field does not specify Novell, you must reconfigure LDAP Server for
eDirectory and select a different port.See “Verifying That The LDAP Server Is Running” in the
Novell eDirectory 8.8 Administration Guide for more information.
Scenario: Active Directory Is Running: Active Directory is running. Clear-text port 389 is open.
You run the ICE command to port 389 and ask for the vendor version. The report displays
Microsoft*. You then reconfigure the Novell LDAP server by selecting another port, so that the
eDirectory LDAP server can service LDAP requests.
Novell iMonitor can also report that port 389 or 636 is already open. If the LDAP server isn’t
working, use Novell iMonitor to identify details. See “Verifying That The LDAP Server Is
Running” in the Novell eDirectory 8.8 Administration Guide for more information.