Configuration Choices

During Directory Server configuration, you are prompted for basic information. Decide how you are going to configure these basic parameters before you begin the configuration process. You are prompted for the following information, depending on the type of configuration that you decide to perform.

• Port number

• Users and groups to run the server as

• Your directory suffix

• Several different authentication user IDs

• The administration domain

Choosing Unique Port Numbers

Port numbers can be any number from 1 to 65535. Keep the following in mind when choosing a port number for your Sun ONE Directory Server.

• The standard Sun ONE Directory Server (LDAP) port number is 389.

• Port 636 is reserved for LDAP over SSL. Therefore, do not use port number 636 for your standard LDAP configuration, even if 636 is not already in use. You can also use LDAP over TLS on the standard LDAP port.

• Port numbers between 1 and 1024 have been assigned to various services by the Internet Assigned Numbers Authority. Do not use port numbers below 1024 other than 389 or 636 for directory services as they will conflict with other services. Additionally, port numbers below 1024 are accessible by root only.

• Sun ONE Directory Server must run as root when using either port 389 or 636.

• Make sure the ports you choose are not already in use. Additionally, if you are using both LDAP and LDAPS communications, make sure the port numbers chosen for these two types of access are not identical.

If the LDAP naming service clients are using SSL encryption, you must use the default port numbers 389 and 636, so that the server runs as root. See Transport Layer Security (TLS) for more information.

For information on how to set up LDAP over SSL (LDAPS) for the Sun ONE Directory Server, see the administration guide for the version of Sun ONE Directory Server that you are using.

Choosing User and Group

For security reasons, it is always best to run production servers with normal user privileges. That is, you do not want to run Directory Server with root privileges. However, you will have to run Directory Server with root privileges if you are using the default Directory Server ports. If Directory Server is to be started by Administration Server, Administration Server must run either as root or as the same user as Sun ONE Directory Server.

You must therefore decide what user accounts you will use for the following purposes.

• The user and group under which you will run Sun ONE Directory Server

  If you will not be running the Sun ONE Directory Server as root, it is strongly recommended that you create a user account for all Sun ONE servers. You should not use any existing operating system account, and must not use the nobody account. Also you should create a common group for the Sun ONE Directory Server files; again, you must not use the nobody group.

• The user and group under which you will run Administration Server

  For configurations that use the default port numbers, this must be root. However, if you use ports over 1024, then you should create a user account for all Sun ONE servers, and run Administration Server as this account.

  As a security precaution, when Administration Server is being run as root, it should be shut it down when it is not in use.

You should use a common group for all Sun ONE servers, such as gid servers, to ensure that files can be shared between servers when necessary.

Before you can install Sun ONE Directory Server and Administration Server, you must make sure that the user and group accounts you use exist on your system.

Defining Authentication Entities

As you configure Sun ONE Directory Server and Administration Server, you will be asked for various user names, distinguished names (DN), and passwords. This list of login and bind entities will differ depending on the type of configuration that you are performing.

• Directory Manager DN and password

  The Directory Manager DN is the special directory entry to which access control does not apply. Think of the directory manager as your directory's super user. (In former releases of Sun ONE Directory Server, the Directory Manager DN was known as the root DN).

  The default Directory Manager DN is cn=Directory Manager. Because the Directory Manager DN is a special entry, the Directory Manager DN does not have to conform to any suffix configured for your Sun ONE Directory Server. Therefore, you must not manually create an actual Sun ONE Directory Server entry that has the same DN as the directory manager DN.

  The Directory Manager password must be at least 8 characters long, and is limited to ASCII letters, digits, and symbols.

  ---

  Note –

  Consider using the same Directory Manager DN and password for all of your LDAP servers, especially if you have set the replicas to follow referrals to the master server during client add and modify operations.

  ---

• Configuration Directory Administrator ID and password

  The configuration directory administrator is the person responsible for managing all the Sun ONE servers accessible through Sun ONE Server Console. If you log in with this user ID, then you can administer any Sun ONE server that you can see in the server topology area of Sun ONE Server Console.

  For security, the configuration directory administrator should not be the same as the directory manager. The default configuration directory administrator ID is admin.

• The Administration Server User and password

  You are prompted for this only during custom configurations. The Administration Server user is the special user that has all privileges for the local Administration Server. Authentication as this person allows you to administer all the Sun ONE servers stored on this server.

  Administration Server user ID and password is used only when the Sun ONE Directory Server is down and you are unable to log in as the configuration directory administrator. The existence of this user ID means that you can access Administration Server and perform disaster recovery activities such as starting Sun ONE Directory Server, reading log files, and so forth.

  Normally, Administration Server user and password should be identical to the configuration directory administrator ID and password.

Choosing Your Directory Suffix

A directory suffix is the directory entry that represents the first entry in a directory tree. You need at least one directory suffix for the tree that contains your organization's data. It is common practice to select a directory suffix that corresponds to the DNS host name used by your organization. For example, if your organization uses the DNS name example.com, then select a suffix of dc=example,dc=com.

For more information on planning the suffixes for your directory service, see the deployment guide for the version of Sun ONE Directory Server that you are using.

Choosing the Location of the Configuration Directory

Many Sun ONE servers, including Sun ONE Directory Server, use an instance of Sun ONE Directory Server to store configuration information. This information is stored in the o=NetscapeRoot directory tree. This directory tree does not need to be held on the same Sun ONE Directory Server as your directory data. Your configuration directory is the Sun ONE Directory Server that contains the o=NetscapeRoot.

If you are installing Sun ONE Directory Server only to support other Sun ONE servers, then that Sun ONE Directory Server is your configuration directory. If you are installing Sun ONE Directory Server to use as part of a general directory service, then you will have multiple instances of Sun ONE Directory Server installed in your organization and you must decide which one will host the configuration directory tree, o=NetscapeRoot. You must make this decision before you install any Sun ONE servers (including Sun ONE Directory Server).

For ease of upgrades, you should use a Sun ONE Directory Server instance that is dedicated to supporting the o=NetscapeRoot tree; this server instance should perform no other function with regard to managing your enterprise's directory data. Also, do not use port 389 for this server instance because doing so could prevent you from installing a Sun ONE Directory Server on that host that can be used for management of your organization's directory data.

Because the configuration directory normally experiences very little traffic, you can allow its server instance to coexist on a machine with another more heavily loaded Sun ONE Directory Server instance. However, for very large sites that are installing a large number of Sun ONE servers, you may want to dedicate a low-end machine to the configuration directory so as to not hurt the performance of production servers. Sun ONE server configurations result in write activities to the configuration directory. For large enough sites, this write activity could result in a short-term performance hit to your other directory activities.

Also, as with any directory configuration, consider replicating the configuration directory to increase availability and reliability. For information about using replication to increase directory availability, refer to the deployment guide for the version of Sun ONE Directory Server that you are using.

If the configuration directory tree is corrupted, you might need to reinstall all other Sun ONE servers that are registered in that configuration directory. Remember the following guidelines when dealing with the configuration directory.

• Always back up your configuration directory after you install a new Sun ONE server.

• Never change the host name or port number used by the configuration directory.

• Never directly modify the configuration directory tree. Only the setup program for the various Sun ONE servers should ever modify the configuration.

Choosing the Location of the User Directory

Just as the configuration directory is the Directory Server instance used for server administration, the user directory is the Directory Server instance containing entries for users and groups in your organization. You cannot install a user directory until you have installed a configuration directory somewhere on your network.

The configuration directory can reside on the same Directory Server instance as the user directory. However, for most directory configurations, the user directory and the configuration directory should be two separate server instances. These server instances can be installed on the same machine. For best results, however, consider placing the configuration directory on a separate machine.

Between your user directory and your configuration directory, it is your user directory that will receive the overwhelming percentage of the directory traffic. For this reason, you should give the user directory the greatest computing resources. Because the configuration directory should receive very little traffic, it can be installed on a machine with very low-end resources.

Also, you should use the default directory ports (389 and 636) for the user directory. If your configuration directory is managed by a server instance dedicated to that purpose, you should use some non-standard port for the configuration directory.

Choosing the Administration Domain

The administration domain allows you to logically group Sun ONE servers together so that you can more easily distribute server administrative tasks. A common scenario is for two divisions in a company to want control of their individual Sun ONE servers. However, you may still want some centralized control of all the servers in your enterprise. Administration domains allow you to meet these conflicting goals.

Administration domains have the following qualities.

• All servers share the same configuration directory, regardless of the domain to which they belong

• Servers in two different domains may use two different user directories for authentication and user management

• The configuration directory administrator has complete access to all installed Sun ONE servers, regardless of the domain to which they belong

• Each administration domain can be configured with an administration domain owner. This owner has complete access to all the servers in the domain but does not have access to the servers in any other administration domain

• The administration domain owner can grant individual users administrative access on a server by server basis within the domain

For many configurations, you can have just one administration domain. In this case, choose a name that is representative of your organization. For other configurations, you may want different domains because of the demands at your site. In the latter case, try to name your administration domains after the organizations that control the servers in that domain.

For example, if you are an ISP with three customers for whom you are installing and managing Sun ONE servers, create three administration domains each named after a different customer.