Previous Contents Index DocHome Next |
Directory Server 5.0 Configuration, Command, and File Reference |
Chapter 2 Core Server Configuration Reference
Introduction
The configuration information for iPlanet Directory Server 5.0 is stored as LDAP entries within the directory itself. Therefore, changes to the server configuration must be implemented through the use of the server itself rather than by simply editing configuration files. The principal advantage of this method of configuration storage is that it allows a directory administrator to reconfigure the server via LDAP while it is still running, and avoids having to shut it down.This chapter gives details of how the configuration is organized, how to alter it, and provides an alphabetical reference for all attributes. The material is divided into the following sections:
Server Configuration - Overview
Accessing and Modifying Server Configuration
Server Configuration - Overview
When you install the iPlanet Directory Server 5.0, its default configuration is stored as a series of LDAP entries within the directory, under the subtree cn=config. When the server is started, the contents of the cn=config subtree are read from a file in LDIF format: dse.ldif. This dse.ldif file contains all of the server configuration information. It is worth noting that the latest version of this file is called dse.ldif, the version prior to the last modification is called dse.ldif.bak, and the latest file with which the server successfully started is called dse.ldif.startOK. Many of the features of the iPlanet Directory Server 5.0 are designed as discrete modules that plug into the core server. The details of the internal configuration for each plug-in are contained in separate entries under cn=plugins,cn=config. For example, the configuration of the Telephone Syntax plug-in is contained in the entry:cn=Telephone Syntax,cn=plugins,cn=config
Similarly, database-specific configuration is stored under:
cn=ldbm database,cn=plugins,cn=config and cn=chaining database,cn=plugins,cn=config
The following diagram shows how the configuration data fits within the cn=config Directory Information Tree.
This overview is divided into the following sections:
LDIF Configuration Files - Location
Schema Configuration Files - Location
How the Server Configuration is Organized
Migration of Pre-Directory Server 5.0 Configuration Files to LDIF Format
LDIF Configuration Files - Location
The Directory Server configuration data is automatically output to files in LDIF format that are located in the following directory:/usr/iplanet/servers/slapd-serverID/config
where serverID is the server identifier that you defined when you installed your Directory Server. Thus, if you specified a server identifier of phonebook for example, then your configuration LDIF files are all stored under:
/usr/iplanet/servers/slapd-phonebook/config
For the purposes of this chapter, all examples use phonebook for the server identifier where appropriate.
Schema Configuration Files - Location
Schema configuration is also stored in LDIF format and these files are located in the following directory:/usr/iplanet/servers/slapd-phonebook/config/schema
For a full list of the LDIF configuration files that are supplied with Directory Server, see Table 2-4 under Configuration Quick Reference Tables at the end of this chapter.
How the Server Configuration is Organized
The dse.ldif file contains all configuration information including directory specific entries created by the directory at server startup, as well as directory specific entries related to the database, also created by the directory at server startup. The file includes the Root DSE (named by "") and the entire contents of cn=config.When the server generates the dse.ldif file it lists the entries in hierarchical order. It does so in the order that the entries appear in the directory under cn=config.This section provides an overview of configuration attributes, plug-in functionality configuration, database configuration, and index configuration.
Configuration Attributes
Within a configuration entry, each attribute is represented as an attribute name. The value of the attribute corresponds to the attribute's configuration.Code Example 2-1 gives an example of part of the dse.ldif file for a Directory Server and shows, amongst other things, that schema checking has been turned on. This is represented by the attribute nsslapd-schemacheck, which takes the value on.
Code Example 2-1    Extract of dse.ldif File
Configuration of Plug-in Functionality
The configuration for each part of Directory Server plug-in functionality has its own separate entry and set of attributes under the subtree cn=plugins,cn=config. The code example Code Example 2-2, "Configuration Entry for Telephone Syntax Plug-in" on page 26 shows an example of the configuration entry for a plug-in, in this case the Telephone Syntax plug-in.
Code Example 2-2    Configuration Entry for Telephone Syntax Plug-in
Some of these attributes are common to all plug-ins and some may be particular to a specific plug-in. You can check which attributes are currently being used by a given plug-in by performing an ldapsearch on the cn=config subtree.
For a list of plug-ins supported by iPlanet Directory Server 5.0, general plug-in configuration information, the plug-in configuration attribute reference, and a list of plug-ins requiring restart see Chapter 3 "Plug-in Implemented Server Functionality Reference".
Configuration of Databases
The cn=NetscapeRoot and cn=UserRoot subtrees contain configuration data for, or if we prefer, the definition of, the databases containing the o=NetscapeRoot and o=UserRoot suffixes, respectively. The cn=NetscapeRoot subtree contains the configuration data used by the iPlanet Administration Server for authentication and all actions that cannot be performed through LDAP (such as start/stop), and the cn=UserRoot subtree contains all the configuration data for the first user-defined database created during server installation. The cn=UserRoot subtree is called UserRoot by default. However, this is not hard-coded, and, given the fact that there will be multiple database instances, this name will be changed and defined by the user as and when new databases are added.
Configuration of Indexes
Configuration information for indexing is stored as entries in the Directory Server under the three following information tree nodes:
cn=index,cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config
For more information regarding indexes in general see the iPlanet Directory Server Administrator's Guide and for information regarding the index configuration attributes see , "Database Attributes Under cn=default indexes,cn=config,cn=ldbm database, cn=plugins,cn=config" on page 158. The attributes are presented here as this node is the first to appear in our representation of the configuration attributes that is based on the cn=config information tree.cn=index,cn=UserRoot,cn=ldbm database,cn=plugins,cn=config
cn=default indexes,cn=config,cn=ldbm database, cn=plugins,cn=config
Migration of Pre-Directory Server 5.0 Configuration Files to LDIF Format
The iPlanet Directory Server 5.0 will only recognize configuration files that are in the LDIF format, which means that the slapd.conf and slapd.ldbm.conf configuration files from 4.x versions of Netscape Directory Server must be converted to LDIF format. Netscape Directory Server 4.x configurations can be migrated to the new LDIF format using the tool migrateInstance5 tool.For more information see Chapter 5, "Migrating From Previous Versions" in the iPlanet Directory Server Installation Guide and the Innosoft Distributed Directory Server Transition Guide.
Accessing and Modifying Server Configuration
This section discusses access control for configuration entries and describes the various ways in which the server configuration can be viewed and modified. It also covers restrictions to the kinds of modification that can be made and discusses attributes that require the server to be restarted for changes to take effect.This section has been divided into the following sections:
Access Control For Configuration Entries
When the Directory Server is installed, a default set of Access Control Instructions (ACIs) is implemented for all entries under cn=config. Code Example 2-3 shows an example of these default ACIs.
Code Example 2-3    Default ACIs in dse.ldif
These default ACIs allow all LDAP operations to be carried out on all configuration attributes by the following users:
Members of the Configuration Administrators Group,
For more information on Access Control see Chapter 5 of the iPlanet Directory Server Administrator's Guide.The user acting as the Administrator, who has the uid admin that can be configured at installation time,
Members of local Directory Administrators Group
The local Directory Administrator (root DN)
The SIE (Server Instance Entry) Group that is usually assigned using the Set Access Permissions from the main topology view in the main console.
Changing Configuration Attributes
You can view and change server attribute values in one of three ways. You make the changes by using LDAP through iPlanet Console, by performing ldapsearch and ldapmodify commands or by manually editing the dse.ldif file.
Note If you edit the dse.ldif file you must stop the server beforehand, otherwise your changes will be lost. Editing the dse.ldif file is recommended only for changes to attributes which cannot be altered dynamically. "Configuration Changes Requiring Server Restart" for further information.
The following sections describe how to modify entries using LDAP (both via iPlanet Console and over the command line), the restrictions to modifying entries, the restrictions to modifying attributes and the configuration changes requiring restart.
Modifying Configuration Entries Using LDAP
The configuration entries in the directory can be searched and modified using LDAP either via the iPlanet Console or by performing ldapsearch and ldapmodify operations in the same way as other Directory entries. The advantage of using LDAP to modify entries is that you can make the changes while the server is running. You must remember to specify the port number when modifying configuration entries as the server is not necessarily running on port 389. For further information see Chapter 4, "Managing Directory Entries" in the iPlanet Directory Server Administrator's Guide. However, certain changes do require the server to be restarted before they are taken into account. See "Configuration Changes Requiring Server Restart" for further information.
Note As with any set of configuration files, care should be taken when changing or deleting nodes in the cn=config subtree, as this risks affecting iPlanet Directory Server functionality.
The entire configuration, including attributes that always take default values, can be viewed by performing an ldapsearch operation on the cn=config subtree:
ldapsearch -b cn=config -D bindDN -w password where bindDN is the DN chosen for the Directory Manager when the server was installed and password is the password chosen for Directory Manager. For more information on using ldapsearch see Chapter 6 "Command-Line Utilities."
Previously we saw an example of the configuration entry for the Telephone Syntax plug-in where the plug-in is enabled. If you wanted to disable this feature you might use the following series of commands to implement this change.
ldapmodify -D bindDN -w password
dn: cn=Telephone Syntax,cn=plugins,cn=config
changetype: modify
replace: nsslapd-pluginEnabled
nsslapd-pluginEnabled: offDisabling the Telephone Syntax Plug-in"> Code Example 2-4    Disabling the Telephone Syntax Plug-in
ldapmodify -D bindDN -w password
dn: cn=Telephone Syntax,cn=plugins,cn=config
changetype: modify
replace: nsslapd-pluginEnabled
nsslapd-pluginEnabled: off
Restrictions to Modifying Configuration Entries
Certain restrictions apply when modifying server attributes:
Restrictions to Modifying Configuration Attributes
In the same way, certain restrictions apply when modifying server attributes:
If an attribute is added to cn=config, the server will ignore it.
If an invalid value is entered for an attribute, this will be ignored by the server.
Since ldapdelete is used for deleting entire entries you should use ldapmodify if you want to remove an attribute from an entry.
Configuration Changes Requiring Server Restart
Some configuration attributes cannot be altered dynamically while the server is running. In these cases the server needs to be shut down and restarted for the changes to take effect. The modifications should be made either through the Directory Server Console or by manually editing the dse.ldif file. Table 2-5 under Configuration Quick Reference Tables at the end of this chapter contains a list of these attributes.
Core Server Configuration Attributes Reference
This section guides you through all the core server functionality configuration attributes. For server functionality implemented via plug-ins, see the section "Configuration Quick Reference Tables". For implementing your own server functionality, contact iPlanet Professional Services.For information on where to find the server configuration and how to change it, see "Server Configuration - Overview" and "Accessing and Modifying Server Configuration". For a list of the server features that are plug-ins and the attributes that apply to them, see Table 2-1, under Configuration Quick Reference Tables at the end of this chapter.
The configuration information which is stored in the dse.ldif file is organized as an information tree under the general configuration entry cn=config as shown below:
The list of configuration tree nodes covered in this section is as follows:
The cn=plugins node is covered in the "Configuration Quick Reference Tables" section. We arrange the attributes alphabetically and provide a full description for each, giving the DN of its directory entry, its default value, the valid range of values, and an example of its use.
Some of the entries and attributes described in this chapter may change in future releases of the product.
cn=config
General configuration entries are stored under the cn=config entry. The cn=config entry is an instance of the nsslapdConfig object class, which in turn inherits from extensibleObject object class. For attributes to be taken into account by the server, both of these object classes (in addition to the top object class) must be present in the entry. General configuration entries are presented in this section.
nsslapd-accesscontrol (Enable Access Control)
Turns access control on and off. If this attribute has a value off, then any valid bind attempt (including an anonymous bind) results in full access to all information stored in the Directory Server.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-accesslog (Access Log)
Specifies the path and filename of the log used to record each database access. The following information is recorded by default in the log file:
IP address of the client machine that accessed the database
For more information on turning access logging off, see Chapter 13, "Monitoring Logging and Statistics" in the iPlanet Directory Server Administrator's Guide.operations performed (for example, search, add, modify)
result of the access (for example, the number of entries returned)
For access logging to be enabled this attribute must have a valid path and file name and the nsslapd-accesslog-logging-enabled configuration attribute must be switched to on. The table below lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of access logging.
Attributes in dse.ldif
Value
Logging enabled or disabled
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-accesslog: /usr/iplanet/servers/slapd-serverID/logs/access
nsslapd-accesslog-level
Controls what is logged to the access log.
nsslapd-accesslog-list
This read-only attribute which cannot be set provides a list of access log files used in access log rotation.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-accesslog-logbuffering (Log Buffering)
When set to off, the server writes all access log entries directly to disk.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-accesslog-logexpirationtime (Access Log Expiration Time)
Specifies the maximum age that a log file is allowed to reach before it is deleted. This attribute supplies only the number of units. The units are provided by the nsslapd-accesslog-logexpirationtimeunit attribute.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-accesslog-logexpirationtimeunit (Access Log Expiration Time Unit)
Specifies the units for nsslapd-accesslog-logexpirationtime attribute. If the unit is unknown by the server, then the log will never expire.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-accesslog-logging-enabled (Access Log Enable Logging)
Disables and enables accesslog logging but only in conjunction with the nsslapd-accesslog attribute that specifies the path and filename of the log used to record each database access.For access logging to be enabled this attribute must be switched to on and the nsslapd-accesslog configuration attribute must have a valid path and filename. The table below lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of access logging.
Attributes in dse.ldif
Value
Logging Enabled or Disabled
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-accesslog-logmaxdiskspace (Access Log Maximum Disk Space)
Specifies the maximum amount of disk space in megabytes that the access logs are allowed to consume. If this value is exceeded, the oldest access log is deleted.When setting a maximum disk space, consider the total number of log files that can be created due to log file rotation. Also remember that there are 3 different log files (access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the access log.
Entry DN
Valid Range
Default Value
500 (A value of -1 means that the disk space allowed to the access log is unlimited in size).
Syntax
Example
nsslapd-accesslog-logminfreediskspace (Access Log Minimum Free Disk Space)
Specifies the minimum allowed free disk space in megabytes. When the amount of free disk space falls below the value specified on this attribute, the oldest access log is deleted until enough disk space is freed to satisfy this attribute
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-accesslog-logrotationtime (Access Log Rotation Time)
Specifies the time between access log file rotations. The access log will be rotated when this time interval is up, regardless of the current size of the access log. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-accesslog-logrotationtimeunit attribute.Although it is not recommended for performance reasons to specify no log rotation as the log will grow indefinitely, you have two ways of specifying this. Either you set the nsslapd-accesslog-maxlogsperdir attribute value to 1 or the nsslapd-accesslog-logrotationtime attribute to -1. The server checks the nsslapd-accesslog-maxlogsperdir attribute first and if this attribute value is larger than 1, the server then checks the nsslapd-accesslog-logrotationtime attribute. See , "nsslapd-accesslog-maxlogsperdir (Access Log Maximum Number of Log Files)" on page 41 for more information.
Entry DN
Valid Range
-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means that the time between access log file rotation is unlimited.
Default Value
Syntax
Example
nsslapd-accesslog-logrotationtimeunit (Access Log Rotation Time Unit)
Specifies the units for the nsslapd-accesslog-logrotationtime attribute.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-accesslog-maxlogsize (Access Log Maximum Log Size)
Specifies the maximum access log size in megabytes. When this value is reached, the access log is rotated. That is, the server starts writing log information to a new log file. If you set nsslapd-accesslog-maxlogsperdir attribute to 1, the server ignores this attribute.When setting a maximum log size, consider the total number of log files that can be created due to log file rotation. Also remember that there are 3 different log files (access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the access log.
Entry DN
Valid Range
-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means the log file is unlimited in size.
Default Value
Syntax
Example
nsslapd-accesslog-maxlogsperdir (Access Log Maximum Number of Log Files)
Specifies the total number of access logs that can be contained in the directory where the access log is stored. If you are using log file rotation, then each time the access log is rotated, a new log file is created. When the number of files contained in the access log directory exceeds the value stored on this attribute, then the oldest version of the log file is deleted. For performance reasons it is not recommended that you set this value to 1, as the server will not rotate the log and it will grow indefinitely.If the value for this attribute is higher than 1, then you need to check the nsslapd-accesslog-logrotationtime attribute to establish whether or not log rotation is specified. If the nsslapd-accesslog-logrotationtime attribute has a value of -1 then there is no log rotation. See , "nsslapd-accesslog-logrotationtime (Access Log Rotation Time)" on page 40 for more information.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-attribute-name-exceptions
Allows non-standard characters in attribute names to be used for backwards compatibility with older servers.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-auditlog (Audit Log)
Specifies the pathname and filename of the log used to record changes made to each database.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-auditlog: /usr/iplanet/servers/slapd-serverID/logs/audit
For audit logging to be enabled this attribute must have a valid path and file name and the nsslapd-auditlog-logging-enabled configuration attribute must be switched to on. The table below lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of audit logging.
Attributes in dse.ldif
Value
Logging enabled or disabled
nsslapd-auditlog-list
Provides a list of audit log files.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-auditlog-logexpirationtime (Audit Log Expiration Time)
Specifies the maximum age that a log file is allowed to be before it is deleted. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-auditlog-logexpirationtimeunit attribute.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-auditlog-logexpirationtimeunit (Audit Log Expiration Time Unit)
Specifies the units for the nsslapd-auditlog-logexpirationtime attribute. If the unit is unknown by the server, then the log will never expire.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-auditlog-logging-enabled (Audit Log Enable Logging)
Turns audit logging on and off.
Entry DN
Valid Range
Default Value
Syntax
Example
For audit logging to be enabled this attribute must have a valid path and file name and the nsslapd-auditlog-logging-enabled configuration attribute must be switched to on. The table below lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of audit logging.
Attributes in dse.ldif
Value
Logging enabled or disabled
nsslapd-auditlog-logmaxdiskspace (Audit Log Maximum Disk Space)
Specifies the maximum amount of disk space in megabytes that the audit logs are allowed to consume. If this value is exceeded, the oldest audit log is deleted.When setting a maximum disk space, consider the total number of log files that can be created due to log file rotation. Also remember that there are three different log files (access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations with the total amount of disk space that you want to be used by the audit log.
Entry DN
Valid Range
-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means that the disk space allowed to the audit log is unlimited in size.
Default Value
Syntax
Example
nsslapd-auditlog-logminfreediskspace (Audit Log Minimum Free Disk Space)
Specifies the minimum permissible free disk space in megabytes. When the amount of free disk space falls below the value specified on this attribute, the oldest audit log is deleted until enough disk space is freed to satisfy this attribute.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-auditlog-logrotationtime (Audit Log Rotation Time)
Specifies the time between audit log file rotations. The audit log will be rotated when this time interval is up, regardless of the current size of the audit log. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-auditlog-logrotationtimeunit attribute. If you set the nsslapd-auditlog-maxlogsperdir attribute to 1, the server ignores this attribute.Although it is not recommended for performance reasons to specify no log rotation as the log will grow indefinitely, you have two ways of specifying this. Either you set the nsslapd-auditlog-maxlogsperdir attribute value to 1 or the nsslapd-auditlog-logrotationtime attribute to -1. The server checks the nsslapd-auditlog-maxlogsperdir attribute first and if this attribute value is larger than 1, the server then checks the nsslapd-auditlog-logrotationtime attribute. See , "nsslapd-auditlog-maxlogsperdir (Audit Log Maximum Number of Log Files)" on page 47 for more information.
Entry DN
Valid Range
-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means that the time between audit log file rotation is unlimited.
Default Value
Syntax
Example
nsslapd-auditlog-logrotationtimeunit (Audit Log Rotation Time Unit)
Specifies the units for the nsslapd-auditlog-logrotationtime attribute.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-auditlog-maxlogsize (Audit Log Maximum Log Size)
Specifies the maximum audit log size in megabytes. When this value is reached, the audit log is rotated. That is, the server starts writing log information to a new log file. If you set nsslapd-auditlog-maxlogsperdir to 1, the server ignores this attribute.When setting a maximum log size, consider the total number of log files that can be created due to log file rotation. Also remember that there are 3 different log files (access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the audit log.
Entry DN
Valid Range
-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means the log file is unlimited in size.
Default Value
Syntax
Example
nsslapd-auditlog-maxlogsperdir (Audit Log Maximum Number of Log Files)
Specifies the total number of audit logs that can be contained in the directory where the audit log is stored. If you are using log file rotation, then each time the audit log is rotated, a new log file is created. When the number of files contained in the audit log directory exceeds the value stored on this attribute, then the oldest version of the log file is deleted. The default is 1 log. If you accept this default, the server will not rotate the log and it will grow indefinitely.If the value for this attribute is higher than 1, then you need to check the nsslapd-auditlog-logrotationtime attribute to establish whether or not log rotation is specified. If the nsslapd-auditlog-logrotationtime attribute has a value of -1 then there is no log rotation. See , "nsslapd-auditlog-logrotationtime (Audit Log Rotation Time)" on page 46 for more information.
Entry DN
Valid range
Default value
Syntax
Example
nsslapd-certmap-basedn (Certificate Map Search Base)
This attribute can be used when client authentication is performed using SSL certificates in order to avoid limitation of the security subsystem certificate mapping, configured in certmap.conf. Depending on the certmap.conf configuration, the certificate mapping may be done using a directory subtree search based at the root DN. Note that if the search is based at the root DN then the nsslapd-certmap-basedn attribute may force the search to be based at some entry other than the root. For further information see Chapter 11, "Managing SSL" in the iPlanet Directory Server Administrator's Guide.
nsslapd-config
This read-only attribute is the config DN.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-ds4-compatible-schema
Makes the schema in cn=schema compatible with 4.x versions of Directory Server.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-enquote-sup-oc (Enable Superior Object Class Enquoting)
Controls whether quoting in the objectclasses attributes contained in the cn=schema entry will conform to the quoting specified by internet draft RFC 2252. By default, the Directory Server places single quotes around the superior object class identified on the objectclasses attributes contained in cn=schema. RFC 2252 indicates that this value should not be quoted.That is, the Directory Server publishes objectclasses attributes in the cn=schema entry as follows:
objectclasses: ( 2.5.6.6 NAME 'person' DESC 'Standard ObjectClass' SUP 'top' MUST ( objectclass $ sn $ cn ) MAY ( aci $ description $ seealso $ telephonenumber $ userpassword ) )
However, RFC 2252 indicates that this attribute should be published as follows:
objectclasses: ( 2.5.6.6 NAME 'person' DESC 'Standard ObjectClass' SUP top MUST ( objectclass $ sn $ cn ) MAY ( aci $ description $ seealso $ telephonenumber $ userpassword ) )
Notice the absence of single quotes around the word top.
Turning this attribute on will cause the Directory Server Resource Kit LDAP clients to no longer function, as they require the schema as defined in RFC 2252.
Turning this attribute off causes the Directory Server to conform to RFC 2252, but doing so may interfere with some earlier LDAP clients. Specifically, any client written using the Netscape Java LDAP SDK 4.x will no longer be able to correctly read and modify schema. This includes the 4.x version of the iPlanet Console. Please note that turning this attribute on or off does not affect the 5.0 iPlanet Console.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-errorlog (Error Log)
Specifies the pathname and filename of the log used to record error messages generated by the Directory Server. These messages can describe error conditions, but more often they will contain informative conditions such as:This log will contain differing amounts of information depending on the current setting of the Log Level attribute. See "nsslapd-errorlog-level (Error Log Level)" for more information.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-errorlog: /usr/iplanet/servers/slapd-serverID/logs/error
For error logging to be enabled this attribute must have a valid path and file name and the nsslapd-errorlog-logging-enabled configuration attribute must be switched to on. The table below lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of error logging.
Attributes in dse.ldif
Value
Logging enabled or disabled
nsslapd-errorlog-level (Error Log Level)
Specifies the level of logging to be used by the Directory Server. The log level is additive; that is, specifying a value of 3 causes both levels 1 and 2 to be performed.To turn logging off, remove the nsslapd-errorlog-level attribute from dse.ldif and restart the Directory Server.
nsslapd-errorlog-list
This read-only attribute provides a list of error log files.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-errorlog-logexpirationtime (Error Log Expiration Time)
Specifies the maximum age that a log file is allowed to reach before it is deleted. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-errorlog-logexpirationtimeunit attribute.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-errorlog-logexpirationtimeunit (Error Log Expiration Time Unit)
Specifies the units for the nsslapd-errorlog-logexpirationtime attribute. If the unit is unknown by the server, then the log will never expire.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-errorlog-logging-enabled (Enable Error Logging)
Turns error logging on and off.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-errorlog-logmaxdiskspace (Error Log Maximum Disk Space)
Specifies the maximum amount of disk space in megabytes that the error logs are allowed to consume. If this value is exceeded, the oldest error log is deleted.When setting a maximum disk space, consider the total number of log files that can be created due to log file rotation. Also remember that there are 3 different log files (access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the error log.
Entry DN
Valid Range
-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means that the disk space allowed to the error log is unlimited in size.
Default Value
Syntax
Example
nsslapd-errorlog-logminfreediskspace (Error Log Minimum Free Disk Space)
Specifies the minimum allowed free disk space in megabytes. When the amount of free disk space falls below the value specified on this attribute, the oldest error log is deleted until enough disk space is freed to satisfy this attribute.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-errorlog-logrotationtime (Error Log Rotation Time)
Specifies the time between error log file rotations. The error log will be rotated when this time interval is up, regardless of the current size of the error log. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-errorlog-logrotationtimeunit (Error Log Rotation Time Unit) attribute.Although it is not recommended for performance reasons to specify no log rotation as the log will grow indefinitely, you have two ways of specifying this. Either you set the nsslapd-errorlog-maxlogsperdir attribute value to 1 or the nsslapd-errorlog-logrotationtime attribute to -1. The server checks the nsslapd-errorlog-maxlogsperdir attribute first and if this attribute value is larger than 1, the server then checks the nsslapd-errorlog-logrotationtime attribute. See , "nsslapd-errorlog-maxlogsperdir (Maximum Number of Error Log Files)" on page 58 for more information.
Entry DN
Valid Range
-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means that the time between error log file rotation is unlimited).
Default Value
Syntax
Example
nsslapd-errorlog-logrotationtimeunit (Error Log Rotation Time Unit)
Specifies the units for nsslapd-errorlog-logrotationtime (Error Log Rotation Time). If the unit is unknown by the server, then the log will never expire.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-errorlog-maxlogsize (Maximum Error Log Size)
Specifies the maximum error log size in megabytes. When this value is reached, the error log is rotated. That is, the server starts writing log information to a new log file. If you set nsslapd-errorlog-maxlogsperdir to 1, the server ignores this attribute.When setting a maximum log size, consider the total number of log files that can be created due to log file rotation. Also remember that there are 3 different log files (access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the error log.
Entry DN
Valid Range
-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means the log file is unlimited in size.
Default Value
Syntax
Example
nsslapd-errorlog-maxlogsperdir (Maximum Number of Error Log Files)
Specifies the total number of error logs that can be contained in the directory where the error log is stored. If you are using log file rotation, then each time the error log is rotated, a new log file is created. When the number of files contained in the error log directory exceeds the value stored on this attribute, then the oldest version of the log file is deleted. The default is 1 log. If you accept this default, the server will not rotate the log and it will grow indefinitely.If the value for this attribute is higher than 1, then you need to check the nsslapd-errorlog-logrotationtime attribute to establish whether or not log rotation is specified. If the nsslapd-errorlog-logrotationtime attribute has a value of -1 then there is no log rotation. See , "nsslapd-errorlog-logrotationtime (Error Log Rotation Time)" on page 56 for more information.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-groupevalnestlevel
Specifies the number of levels of nesting that the access control system will perform for group evaluation.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-idletimeout (Idle Timeout)
Specifies the amount of time in seconds after which an idle LDAP client connection is closed by the server. A value of 0 indicates that the server will never close idle connections.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-instancedir (Instance Directory)
Specifies the full path to the directory where this server instance is installed. The serverID from installation time is the default ID.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-ioblocktimeout (IO Block Time Out)
Specifies the amount of time in milliseconds after which the connection to a stalled LDAP client is closed. An LDAP client is considered to be stalled when it has not made any I/O progress for read or write operations.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-lastmod (Track Modification Time)
Specifies whether the Directory Server maintains the modification attributes for Directory Server entries. These attributes include:
modifiersnameThe distinguished name of the person who last modified the entry.
modifytimestampThe timestamp, in GMT format, for when the entry was last modified.
creatorsnameThe distinguished name of the person who initially created the entry.
createtimestampThe timestamp for when the entry was created in GMT format.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-listenhost (Listen to IP Address)
Allows multiple Directory Server instances to run on a multihomed machine (or makes it possible to limit listening to one interface of a multihomed machine). Provide the hostname which corresponds to the IP interface you want to specify as a value for this attribute. Directory Server will only respond to requests sent to the interface that corresponds to the hostname provided on this attribute.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-localhost (Local Host)
This read-only attribute specifies the host machine on which the Directory Server runs.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-localuser (Local User)
UNIX installations only. Specifies the user that the Directory Server runs as. The group that the user runs as is derived from this attribute, by examining the groups that the user is a member of. Should the user change, then all the files in the installation directory will need to be owned by this user.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-maxbersize (Maximum Message Size)
Defines the maximum size in bytes allowed for an incoming message. This limits the size of LDAP requests that can be handled by the Directory Server. Limiting the size of requests prevents some kinds of denial of service attacks.The limit applies to the total size of the LDAP request. For example, if the request is to add an entry, and the entry in the request is larger than two megabytes, then the add request is denied. Care should be taken when changing this attribute and we recommend contacting iPlanet Professional Services before doing so.
Entry DN
Valid Range
0 - 2GB (2,147,483,647 bytes) where a value of 0 indicates that the default value should be used.
Default Value
Syntax
Example
nsslapd-maxdescriptors (Maximum File Descriptors)
Not applicable to directory installations on NT and AIX.This attribute sets the maximum, platform-dependent number of file descriptors that the Directory Server will try to use. A file descriptor is used whenever a client connects to the server, and for some server activities such as index maintenance. The number of available file descriptors for TCP/IP connections is the total for the nsslapd-maxdescriptors attribute minus the number of file descriptors used by the server as specified in the nsslapd-reservedescriptors attribute for non-client connections, such as index management and managing replication. (see , "nsslapd-reservedescriptors (Reserved File Descriptors)" on page 66).
The number that you specify here should not be greater than the total number of file descriptors that your operating system allows the ns-slapd process to use. This number will differ depending on your operating system. Some operating systems allow you to configure the number of file descriptors available to a process. See your operating system documentation for details on file descriptor limits and configuration. It is worth noting that the included idsktune program can be used to suggest changes to the system kernel or TCP/IP tuning attributes, including increasing the number of file descriptors if necessary. You should consider increasing the value on this attribute if the Directory Server is refusing connections because it is out of file descriptors. When this occurs, the following message is written to the Directory Server's error log file:
Not listening for new connections -- too many fds open
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-maxthreadsperconn (Maximum Threads Per Connection)
Defines the maximum number of threads that a connection should use. For normal operations where a client binds and only performs one or two operations before unbinding, you should use the default value. For situations where a client binds and simultaneously issues many requests, you should increase this value to allow each connection enough resources to perform all the operations. This attribute is not available from the server console.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-nagle
When the value of this attribute is off, the TCP_NODEDELAY option is set so that LDAP responses (such as entries or result messages) are sent back to a client immediately. When the attribute is turned on, default TCP behavior applies, namely the sending of data is delayed, in the hope that this will enable additional data to be grouped into one packet of the underlying network MTU size (typically 1500 bytes for Ethernet).
Entry DN
Valid range
Default value
Syntax
Example
nsslapd-plug-in
This read-only attribute lists the syntaxes and matching rules loaded by the server.
nsslapd-port (Port Number)
TCP/IP port number used for LDAP communications. If you want to run SSL/TLS over this port you can do so by through the Start TLS extended operation. This selected port must be unique on the host system; make sure no other application is attempting to use the same port number. On UNIX systems, specifying a port number of less than 1024 requires the Directory Server to run as root.If you are changing the port number for a configuration directory, you must also update the corresponding Server Instance Entry in the configuration directory. Please note that you need to restart the server for the port number change to be taken into account.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-privatenamespaces
Contains the list of the private naming contexts cn=config, cn=schema and cn=monitor.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-readonly (Read Only)
Specifies whether the whole server is in read-only mode, meaning that neither data in the database(s) nor configuration information can be modified. Any attempt to modify a database in read-only mode returns an error indicating that the server is unwilling to perform the operation.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-referral (Referral)
This multi valued attribute specifies the LDAP URL(s) to be returned by the suffix, when the server receives a request for an entry not belonging to the local tree, that is, an entry whose suffix does not match the value specified on any of the suffix attributes. For example, suppose the database contains only entries:but the request is for this entry:
In this case, the referral would be passed back to the client in an attempt to allow the LDAP client to locate a database that contains the requested entry. Although only one referral is allowed per Directory Server instance, this referral can have multiple values.
Note If you want to use SSL and TLS communications, the Referral attribute should be in the following form:
For more information on managing referrals, see Chapter 2, "Configuring Directory Databases" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
Valid LDAP URL in the following format: ldap://server-location
Default Value
Syntax
Example
nsslapd-referralmode (Referral Mode)
When set this attribute will send back the referral for any request on any suffix.
Entry DN
Valid Range
Valid LDAP URL in the following format: ldap://server-location
Default Value
Syntax
Example
nsslapd-reservedescriptors (Reserved File Descriptors)
Not applicable to directory installations on NT and AIX.This read-only attribute specifies the number of file descriptors that Directory Server reserves for managing non-client connections, such as index management and managing replication. The number of file descriptors that the server reserves for this purpose subtracts from the total number of file descriptors available for servicing LDAP client connections (see , "nsslapd-maxdescriptors (Maximum File Descriptors)" on page 62).
Most installations of Directory Server should never need to change this attribute. However, consider increasing the value on this attribute if all of the following are true:
The server is replicating to a large number of consumer servers (more than 10) and/or the server is maintaining a large number of index files (more than 30).
Increasing the value on this attribute may result in more LDAP clients being unable to access your directory. Therefore, when you increase the value on this attribute, you should also increase the value on the nsslapd-maxdescriptors attribute. Note that you may not be able to increase the nsslapd-maxdescriptors value if your server is already using the maximum number of file descriptors that your operating system allows a process to use (see your operating system documentation for details). If this is the case, then reduce the load on your server by causing LDAP clients to search alternative directory replicas.The server is servicing a large number of LDAP connections.
You are seeing error messages reporting that the server is unable to open file descriptors (the actual error message will differ depending on the operation that the server is attempting to perform), but these error messages are NOT related to managing client LDAP connections.
To assist you in computing the number of file descriptors you set for this attribute we suggest you use the following formula:
NldbmBackends
NglobalIndex
Total number of configured indexes for all databases including system indexes.
(By default 8 system indexes and 17 additional indexes per database).
ReplicationDescriptor
(where NSupplierReplica is number of replicas in the server that can act as a supplier (hub or master)).
ChainingBackendDescriptors
NchainingBackend * nsOperationConnectionsLimit
(where nsOperationConnectionsLimit is configurable in database link (chaining) configuration and 10 by default).
PTADescriptors
SSLDescriptors
5 (4 files + 1 listensocket) if SSL is configured, 0 if SSL is not configured.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-return-exact-case (Return Exact Case)
Returns the exact case of attribute type names as requested by the client. Some client applications require attribute names to exactly match the case of the attribute as it is listed in the schema when the attribute is returned by the Directory Server, as the result of a search or modify operation. However, most client applications ignore the case of attributes, therefore, by default this attribute is disabled. Do not modify it unless you have legacy clients that can check the case of attribute names in results returned from the server.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-rootdn (Manager DN)
Specifies the distinguished name of an entry that is not subject to access control restrictions, administrative limit restrictions for operations on the directory or resource limits in general. The attributes nsslapd-sizelimit, nsslapd-timelimit, and nsslapd-schemacheck do not apply to this DN either.For information on changing the Root DN, see Chapter 4, "Managing Directory Entries" in the iPlanet Directory Server Administrator's Guide
.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-rootpw (Root Password)
Allows you to specify the password associated with the "Manager DN". When you provide the root password it will be encrypted according to the encryption method you selected for , "nsslapd-rootpwstoragescheme (Root Password Storage Scheme)" on page 70. When viewed from the server console, this attribute shows the value:***** When viewed from the dse.ldif file, this attribute shows the encryption method followed by the encrypted string of the password. Please note that the example below is what you view, not what you type.
Entry DN
Valid Range
Any valid password encrypted by any one of the encryption methods which are described in "passwordStorageScheme (Password Storage Scheme)".
Default Value
Syntax
Example
nsslapd-rootpwstoragescheme (Root Password Storage Scheme)
Available only from the server console. This attribute indicates the encryption method used for the root password.
Entry DN
Valid Range
Any encryption method as described in , "passwordStorageScheme (Password Storage Scheme)" on page 81.
Default Value
Syntax
Example
nsslapd-schemacheck (Schema Checking)
Specifies whether the database schema will be enforced during entry insertion or modification. When this attribute has a value of on, Directory Server will not check the schema of existing entries until they are modified.The database schema defines the type of information allowed in the database. You can extend the default schema using the objectclasses and attribute types. For information on how to extend your schema using the Directory Server Console, see Chapter 9, "Extending the Directory Schema" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-securelistenhost
Allows multiple Directory Server instances to run, using secure SSL / TLS connections, on a multihomed machine (or makes it possible to limit listening to one interface of a multihomed machine). Provide the hostname which corresponds to the IP interface you want to specify as a value for this attribute. Directory Server will only respond to requests sent to the interface that corresponds to the hostname provided on this attribute.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-securePort (Encrypted Port Number)
TCP/IP port number used for SSL/TLS communications. This selected port must be unique on the host system; make sure no other application is attempting to use the same port number. For UNIX systems, specifying a port number of less than 1024 requires that Directory Server runs as root.The default value 636 is only used if the server has been configured with a private key and a certificate; otherwise it does not listen on this port.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-security (Security)
Specifies whether the Directory Server is to accept SSL/TLS communications on its encrypted port. This attribute should be set to on, if you want secure connections.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-sizelimit (Size Limit)
Specifies the maximum number of entries to return from a search operation. If this limit is reached, ns-slapd returns any entries it has located that match the search request, as well as an exceeded size limit error.When no limit is set, ns-slapd will return every matching entry to the client regardless of the number found. To set a no limit value whereby the Directory Server will wait indefinitely for the search to complete, specify a value of -1 for this attribute in the dse.ldif file.
This limit applies to everyone regardless of their organization.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-threadnumber (Thread Number)
Defines the number of operation threads that the Directory Server will create during startup. The nsslapd-threadnumber value should be increased if you have many directory clients performing time-consuming operations such as add or modify, as this ensures that there are other threads available for servicing short-lived operations such as simple searches. This attribute is not available from the server console.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-timelimit (Time Limit)
Specifies the maximum number of seconds allocated for a search request. If this limit is reached, the Directory Server returns any entries it has located that match the search request, as well as an exceeded time limit error.When no limit is set ns-slapd will return every matching entry to the client regardless of the time it takes. To set a no limit value whereby the Directory Server will wait indefinitely for the search to complete, specify a value of -1 for this attribute in the dse.ldif file. A value of zero (0) causes no time to be allowed for searches. The smallest time limit is 1 second.
Entry DN
Valid range
-1 to the maximum 32 bit integer value (2147483647) in seconds
Default value
Syntax
Example
nsslapd-versionstring
Specifies the server version number.
Entry DN
Valid range
Default value
Syntax
Example
passwordChange (Password Change)
Indicates whether users may change their passwords.For more information on password policies, see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
Default Value
Syntax
Example
passwordCheckSyntax (Check Password Syntax)
Indicates whether the password syntax will be checked before the password is saved. The password syntax checking mechanism checks that the password meets or exceeds the password minimum length requirement and that the string does not contain any "trivial" words, such as the user's name or user ID or any attribute value stored in the uid, cn, sn, givenName, ou or mail attributes of the user's directory entry.For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
Default Value
Syntax
Example
passwordExp (Password Expiration)
Indicates whether user passwords will expire after a given number of seconds. By default, user passwords do not expire. Once password expiration is enabled, you can set the number of seconds after which the password will expire using the passwordMaxAge attribute.For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
Default Value
Syntax
Example
passwordHistory (Password History)
Enables password history. Password history refers to whether users are allowed to reuse passwords. By default, password history is disabled and users can reuse passwords. If you set this attribute to be on, the directory stores a given number of old passwords and prevents users from reusing any of the stored passwords. You set the number of old passwords the Directory Server stores using the passwordInHistory attribute.For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
Default Value
Syntax
Example
passwordInHistory (Number of Passwords to Remember)
Indicates the number of passwords the Directory Server stores in history. Passwords that are stored in history cannot be reused by users. By default, the password history feature is disabled. That is, the Directory Server does not store any old passwords and so users can reuse passwords. You can enable password history by using the passwordHistory attribute.To prevent users from rapidly cycling through the number of passwords that you are tracking, use the passwordMinAge attribute.
For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
Default Value
Syntax
Example
passwordLockout (Account Lockout)
Indicates whether users will be locked out of the directory after a given number of failed bind attempts. By default, users will not be locked out of the directory after a series of failed bind attempts. If you enable account lockout, you can set the number of failed bind attempts after which the user will be locked out using the passwordMaxFailure attribute.For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
Default Value
Syntax
Example
passwordLockoutDuration (Lockout Duration)
Indicates the amount of time in seconds during which users will be locked out of the directory after an account lockout. The account lockout feature protects against hackers who try to break into the directory by repeatedly trying to guess a user's password. You enable and disable the account lockout feature using the passwordLockout attribute.For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
1 to the maximum 32 bit integer value (2147483647) in seconds
Default Value
Syntax
Example
passwordMaxAge (Password Maximum Age)
Indicates the number of seconds after which user passwords will expire. To use this attribute, you must enable password expiration using the passwordExp attribute.For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
1 to the maximum 32 bit integer value (2147483647) in seconds
Default Value
Syntax
Example
passwordMaxFailure (Maximum Password Failures)
Indicates the number of failed bind attempts after which a user will be locked out of the directory. By default, account lockout is disabled. You can enable account lockout by modifying the passwordLockout attribute.For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
Default Value
Syntax
Example
passwordMinAge (Password Minimum Age)
Indicates the number of seconds that must pass before a user can change their password. Use this attribute in conjunction with the passwordInHistory (Number of Passwords to Remember) attribute to prevent users from quickly cycling through passwords so that they can use their old password again. A value of zero (0) indicates that the user can change the password immediately.For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
passwordMinLength (Password Minimum Length)
Specifies the minimum number of characters that must be used in Directory Server user password attributes. In general, shorter passwords are easier to crack, so you are recommended to set a password length of at least 6 or 7 characters. This is long enough to be difficult to crack, but short enough that users can remember the password without writing it down.For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
Default Value
Syntax
Example
passwordMustChange (Password Must Change)
Indicates whether users must change their passwords when they first bind to the Directory Server, or when the password has been reset by the "Manager DN".For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
Default Value
Syntax
Example
passwordResetFailureCount (Reset Password Failure Count After)
Indicates the amount of time in seconds after which the password failure counter will be reset. Each time an invalid password is sent from the user's account, the password failure counter is incremented. If the passwordLockout attribute is set to on, users will be locked out of the directory when the counter reaches the number of failures specified by the passwordMaxFailure attribute (within 600 seconds by default). After the amount of time specified by the passwordLockoutDuration attribute, the failure counter is reset to zero (0).For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
1 to the maximum 32 bit integer value (2147483647) in seconds
Default Value
Syntax
Example
passwordStorageScheme (Password Storage Scheme)
Specifies the type of encryption used to store Directory Server passwords. Enter the password in CLEAR for this attribute indicates that the password will appear in plain text.The following encryption types are supported by the Directory Server 5.0:
SSHA (Salted Secure Hash Algorithm) is the recommended method as it is the most secure.
For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.SHA (Secure Hash Algorithm). This is the method supported by 4.x Directory Servers.
CRYPT is the UNIX crypt algorithm. It is provided for compatibility with UNIX passwords.
Note You can no longer choose to encrypt passwords using the NS-MTA-MD5 password storage scheme. The storage scheme is still present but only for reasons of backward compatibility.
passwordUnlock (Unlock Account)
Indicates whether users will be locked out of the directory for a specified amount of time or until the administrator resets the password after an account lockout. The account lockout feature protects against hackers who try to break into the directory by repeatedly trying to guess a user's password. If this passwordUnlock attribute is set to off and the operational attribute accountUnlockTime has a value of 0, then the account will be locked indefinitely.For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
Default Value
Syntax
Example
passwordWarning (Send Warning)
Indicates the number of seconds before a user's password is due to expire that the user will receive a password expiration warning control on their next LDAP operation. Depending on the LDAP client, the user may also be prompted to change their password at the time the warning is sent.For more information on password policies see Chapter 7, "User Account Management" in the iPlanet Directory Server Administrator's Guide.
Entry DN
Valid Range
1 to the maximum 32 bit integer value (2147483647) in seconds
Default Value
Syntax
Example
cn=changelog5
Multi-master replication change log configuration entries are stored under the cn=changelog5 entry. The cn=changelog5,cn=config entry is an instance of the extensibleObject object class.For attributes to be taken into account by the server both of these object classes (in addition to the top object class) must be present in the entry.It is worth noting that two different types of change logs are maintained by iPlanet Directory Server5.0. The first type, which is stored here and referred to as changelog, is used by multi-master replication; the second change log, which is actually a plug-in and referred to as retro changelog, is intended for use by iPlanet Meta Directory. See , "Retro Changelog Plug-in" on page 134" of Chapter 3 "Plug-in Implemented Server Functionality Reference for further information regarding the Retro Changelog Plug-in. Multi-master replication changelog attributes are presented in this section.
nsslapd-changelogdir
This required attribute specifies the name of the directory in which the change log database will be created. Whenever a change log configuration entry is created it must contain a valid directory otherwise the operation will be rejected. The GUI proposes by default that this database be stored under:/usr/iplanet/servers/slapd-serverID/changelogdb
Note For performance reasons you will probably want to store this database on a different physical disk.
Entry DN
Valid Range
Default Value
Syntax
Example
nsslapd-changelogmaxage (Max Changelog Age)
Specifies the maximum age of any entry in the change log. The change log contains a record for each directory modification and is used when synchronizing consumer servers. Each record contains a timestamp. Any record with a timestamp that is older than the value specified in this attribute will be removed. If this attribute is absent, there is no age limit on change log records. For information on the change log, see "nsslapd-changelogdir."
nsslapd-changelogmaxentries (Max Changelog Records)
Specifies the maximum number of records the change log may contain. If this attribute is absent, there is no maximum number of records the change log can contain. For information on the change log, see "nsslapd-changelogdir".
Entry DN
Valid Range
0 (meaning that the only maximum limit is the disk size) to maximum integer (2147483647)
Default Value
Syntax
Example
nsslapd-changelogmaxentries: 5000
cn=encryption
Encryption related attributes are stored under the cn=encryption,cn=config entry. The cn=encryption,cn=config entry is an instance of the nsslapdEncryptionConfig object class. For encryption related attributes to be taken into account by the server this object class (in addition to the top object class) must be present in the entry. Encryption configuration attributes are presented in this section.
nssslsessiontimeout
Specifies the lifetime duration of an SSL session for both SSLv2 and SSLv3. The minimum timeout value is 5 seconds and if you enter a value below this, then it is automatically replaced by 5 seconds. Values outside the valid ranges are replaced by the default value of 100 seconds (SSLv2).
Entry DN
Valid Range
Default Value
0 which stands for 100 seconds in you are running SSLv2 and 24 hours if you are running SSLv3
Syntax
Example
nssslclientauth
Specifies, or not as the case may be, client authentication using SSL.
Entry DN
Valid Range
Default Value
Syntax
Example
nsssl2
Supports SSL version 2.
Entry DN
Valid Range
Default Value
Syntax
Example
nsssl3
Supports SSL version 3.
Entry DN
Valid Range
Default Value
Syntax
Example
nsssl3ciphers
This multi-valued attribute specifies the set of encryption ciphers the Directory Server will use during SSL communications. For more information on the ciphers supported by the Directory Server, refer to Chapter 11, "Managing SSL", in the iPlanet Directory Server Administrator's Guide
If you are using the Directory Server Console to set the cipher preferences, the values on the SSL 3.0 tab of the Cipher Preference dialog box correspond to the following:
Table 2-2    SSLv3 Ciphers
Cipher in Console
Corresponding SSLv3 Cipher
If you are using the Directory Server Console to set the cipher preferences, the values on the TLS tab of the Cipher Preference dialog box correspond to the following:
Table 2-3    TLS Ciphers
Cipher in Console
Corresponding TLS Cipher
cn=features
No attributes to document
cn=mapping tree
Configuration attributes for suffixes and replication are stored under cn=mapping tree,cn=config. Configuration attributes related to suffixes are found under the suffix subentrycn="dc=siroe,dc=com",cn=mapping tree,cn=config.
Replication configuration attributes are stored under cn=replica,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
with the replication agreement attributes under cn=replicationAgreementName,cn=replica,cn="dc=siroe,dc=com",cn=mapping tree,cn=config.
Suffix Configuration Attributes Under cn="dc=siroe,dc=com"
Suffix configuration attributes are stored under the cn="dc=siroe,dc=com" entry. The cn="dc=siroe,dc=com" entry is an instance of the nsMappingTree object class which inherits from the extensibleObject object class. For suffix configuration attributes to be taken into account by the server these object classes (in addition to the top object class) must be present in the entry. Suffix configuration attributes are presented in this section.
nsslapd-state
Determines how the suffix handles operations.
nsslapd-backend
Gives the name of the database or database link used to process requests. This attribute can be multi valued, with one database or database link per value. This attribute is required when the value of the nsslapd-state attribute is set to backend or referral on update.
Entry DN
Valid Range
Default Value
Syntax
Example
Replication Attributes Under cn=replica, cn="dc=siroe,dc=com", cn=mapping tree,cn=config
Replication configuration attributes are stored under cn=replica,cn="dc=siroe,dc=com",cn=mapping tree,cn=config. The cn=replica entry is an instance of the nsDS5Recplia object class. For replication configuration attributes to be taken into account by the server this object class (in addition to the top object class) must be present in the entry. Replication configuration attributes are presented in this section. For further information regarding replication see Chapter 8, "Managing Replication" in the iPlanet Directory Server Administrator's Guide.
cn
This attribute is used for naming. Once this attribute has been set it cannot be modified.
Entry DN
Valid Range
Default Value
Syntax
Example
nsDS5Flags
This attribute allows you to specify replica properties you will have previously defined in flags. At present only one flag exists, which allows you to specify whether your log changes or not.
Entry DN
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaBindDN
Specifies the DN to use when binding. This may be empty if certificate based authentication is used. This attribute can be modified.
Entry DN
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaChangeCount
This read-only attribute informs you of the total number of entries in the change log (whether they still remain to be replicated or not). When the change log is purged only the entries that are still to be replicated will be left. See "nsDS5ReplicaPurgeDelay" and "nsDS5ReplicaTombstonePurgeInterval" for more information regarding purge operation properties.
Entry DN
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaId
Specifies the unique ID for masters in a given replication environment.
Entry DN
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaLegacyConsumer
If this attribute is absent or has a value of false then it means that the replica is not a legacy consumer.
Entry DN
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaName
This read- only attribute specifies the name of the replica with a unique identifier for internal operations. This unique identifier is allocated by the server when the replica is created.This attribute is destined for internal use only.
Entry DN
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaPurgeDelay
This multi valued attribute specifies the period of time in seconds after which internal purge operations will be performed on the change log. When setting this attribute ensure that the purge delay is longer than the longest replication cycle in your replication policy, to avoid incurring conflict resolution problems and server divergence.
Entry DN
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaReferral
This multi valued attribute specifies the user-defined referrals. This should only be defined on a consumer. User referrals are only returned when a client attempts to modify data on a read-only consumer.
Entry DN
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaRoot
Specifies the DN at the root of a replicated area. This attribute must have the same value as the suffix of the database being replicated and cannot be modified.
Entry DN
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaTombstonePurgeInterval
Specifies the time interval in seconds between purge operation cycles. When setting this attribute bear in mind that the purge operation is time consuming.
Entry DN
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaType
Defines the type of replication relationship that exists between this replica and the others.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaType: 2
nsState
This attribute stores information on the state of the clock. It is destined for internal use only to ensure that the server cannot generate a change sequence number (csn) inferior to existing ones required for detecting backward clock errors.Replication Attributes Under cn=ReplicationAgreementName,cn=replica, cn="dc=siroe,dc=com", cn=mapping tree,cn=config
The replication attributes that concern the replication agreement are stored under cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config. Like the cn=replica entry, the cn=ReplicationAgreementName entry is an instance of the nsDS5Replica object class. For replication agreement configuration attributes to be taken into account by the server this object class (in addition to the top object class) must be present in the entry. Replication Agreements are configured only on supplier replicas. The replication agreement configuration attributes are presented in this section.
description
Free form text description of the replication agreement. This attribute can be modified.
Entry DN
Valid Range
Default Value
Syntax
Example
description: Replication Agreement between Server A and Server B.
nsDS5ReplicaBindDN
Specifies the DN to use when binding. The value of this attribute must be the same as the one in cn=replica on the consumer replica. This may be empty if certificate based authentication is used. This can also be modified.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaBindMethod
Specifies the method to use for binding. This attribute can be modified.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
SIMPLE (This bind method requires a DN and password) SSLCLIENTAUTH
Default Value
Syntax
Example
nsDS5ReplicaChangesSentSinceStartup
This read-only attribute provides you with the number of changes sent to this replica since the server started.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaCredentials
Specifies the credentials for the bind DN (specified in the nsDS5ReplicaBindDN attribute) on the remote server containing the consumer replica. The value for this attribute can be modified. Please note that when certificate based authentication is used this attribute may not have a value. Please note that the example below is what you view, not what you type.
nsDS5ReplicaHost
Specifies the hostname for the remote server containing the consumer replica. Once this attribute has been set it cannot be modified.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaLastInitEnd
This optional, read-only attribute states when the initialization of the consumer replica ended.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaLastInitStart
This optional, read-only attribute states when the initialization of the consumer replica started.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaLastInitStatus
This optional, read-only attribute provides status for the initialization of the consumer.
nsDS5ReplicaLastUpdateEnd
This read-only attribute states when the most recent replication schedule update ended.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaLastUpdateStart
This read-only attribute states when the most recent replication schedule update started.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaLastUpdateStart: YYYYMMDDhhmmssZ (20000902160000)
nsDS5ReplicaLastUpdateStatus
This read-only attribute provides the status for the most recent replication schedule updates.
nsDS5ReplicaPort
Specifies the port number for the remote server containing the replica. Once this attribute has been set it cannot be modified.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaRefresh
Allows you to initialize your replica. This attribute is absent by default. However, if you add this attribute with a value of start then the server re initialize the replica and remove the attribute value.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaRoot
Specifies the DN at the root of a replicated area. This attribute must have the same value as the suffix of the database being replicated and cannot be modified.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaTimeout
This allowed attribute specifies the number of seconds outbound LDAP operations will wait for a response from the remote replica before timing out and failing. If you see "Warning: timed out waiting" messages in the error log file, then you should increase the value of this attribute.You can find out the amount of time the operation actually lasted by examining the access log on the remote machine and then set the nsDS5ReplicaTimout attribute accordingly to optimize performance.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaTransportInfo
Specifies the type of transport used for transporting data to and from the replica. The attribute values can either be SSL which means that the connection is established over SSL, or LDAP, which means that regular LDAP connections are used. If this attribute is absent then regular LDAP connections are used. This attribute cannot be modified once set.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaUpdateInProgress
This read-only attribute states whether or not a replication schedule update is in progress.
Entry DN
cn=ReplicationAgreementName,cn="dc=siroe,dc=com",cn=mapping tree,cn=config
Valid Range
Default Value
Syntax
Example
nsDS5ReplicaUpdateSchedule
This multi valued attribute specifies the replication schedule and can be modified.
nsDS50ruv
This attribute is responsible for managing the internal state of the replica via the replication update vector. It is always present and must not be changed.
cn=monitor
Monitoring read-only information is stored under cn=monitor,cn=config.The cn=monitor entry is an instance of the extensibleObject object class. For cn=monitor configuration attributes to be taken into account by the server this object class (in addition to the top object class) must be present in the entry. The cn=monitor read-only attributes are presented in this section.
connection
List of open connections given in the following format:connection=31:20010201164808Z:45:45::cn=directory manager where
31 is the connection number, 20010201164808Z is the date the connection was opened, 45 is the number of operations received, 45 is the number of completed operations, and cn=directory manager is the bind DN.
currentConnections
Number of current Directory Server connections.
totalConnections
Total number of Directory Server connections.
dTableSize
Size of the Directory Server descriptor table.
readWaiters
Number of connections where some requests are pending and not currently being serviced by a thread in Directory Server.
opsInitiated
Number of Directory Server operations initiated.
opsCompleted
Number of Directory Server operations completed.
entriesSent
Number of entries sent by Directory Server.
bytesSent
Number of bytes sent by Directory Server.
currentTime
Current time usually given in Greenwich Mean Time (indicated by GeneralizedTime syntax Z notation, for example 20010202131102Z).
startTime
Directory Server start time.
nbackEnds
Number of Directory Server backends.
backendMonitorDN
DN for each Directory Server backend.For further database monitoring information see , "Database Attributes Under cn=monitor,cn=ldbm database, cn=plugins,cn=config" on page 150, , "Database Attributes Under cn=database,cn=monitor,cn=ldbm database, cn=plugins,cn=config" on page 155, , "Database Attributes Under cn=monitor,cn=Netscaperoot,cn=ldbm database,cn=plugins,cn=config" on page 161 and , "Database Link Attributes Under cn=monitor,cn=database instance name,cn=chaining database, cn=plugins,cn=config" on page 172.
cn=replication
No attributes to document. When configuring legacy replication, it will be stored under this cn=replication node, which serves as a placeholder.
cn=SNMP
SNMP configuration attributes are stored under cn=SNMP,cn=config. The cn=SNMP entry is an instance of the nsSNMP object class. For SNMP configuration attributes to be taken into account by the server this object class (in addition to the top object class) must be present in the entry. SNMP configuration attributes are presented in this section.
nssnmpenabled
Specifies whether SNMP is enabled or not.
Entry DN
Valid Range
Default Value
Syntax
Example
nssnmporganization
Specifies the organization to which the Directory Server belongs.
Entry DN
Valid Range
Default Value
Syntax
Example
nssnmplocation
Specifies the location within the company or organization where the Directory Server resides.
Entry DN
Valid Range
Default Value
Syntax
Example
nssnmpcontact
Specifies the E-mail address of the person responsible for maintaining the Directory Server.
Entry DN
Valid Range
Default Value
Syntax
Example
nssnmpdescription
Provides a unique description of the Directory Server instance
Entry DN
Valid Range
Default Value
Syntax
Example
nssnmpmasterhost
This mandatory attribute specifies the hostname of the machine on which the master agent is installed. For UNIX only.
Entry DN
Valid Range
Default Value
Syntax
Example
nssnmpmasterport
Specifies the port number used to communicate with the master agent. For UNIX only.
Entry DN
Valid Range
Operating System dependent port number. Refer to your Operating System documentation for further information.
Default Value
Syntax
Example
cn=tasks
No attributes to document
cn=uniqueid generator
The uniqueid generator configuration attributes are stored under cn=uniqueid generator,cn=config. The cn=uniqueid generator entry is an instance of the extensible object class. For uniqueid generator configuration attributes to be taken into account by the server this object class (in addition to the top object class) must be present in the entry. Uniqueid generator configuration attributes are presented in this section.
nsstate
Saves the state of the uniqueid generator across server restarts. This attribute is maintained by the server. You should not edit it.
Entry DN
Valid Range
Default Value
Syntax
Example
Configuration Quick Reference Tables
This section provides quick reference tables for LDIF configuration files supplied with the Directory Server, object classes and schema used in server configuration, and attributes requiring server restart.
LDIF Configuration Files
Table 2-4 lists all the configuration files which are supplied with the Directory Server, including those for the schema of other iPlanet and Netscape servers. Each file is preceded by a number which indicates the order in which they should be loaded (in ascending numerical and then alphabetical order). See , "LDIF Configuration Files - Location" on page 24 for information on where these files are stored.
Table 2-4    Directory Server Configuration LDIF Files
Configuration Filename
Purpose
Contains front-end Directory Specific Entries created by the directory at server startup. These include the Root DSE (""), and the contents of cn=config and cn=monitor.
Contains LDAPv3 standard operational schema, such as "subschemaSubentry," LDAPv3 standard user and organization schema defined in RFC 2256 (based on X.520/X.521), inetOrgPerson and select other widely-used attributes, and the operational attributes used by iPlanet Directory Server 5.0 configuration. Modifying this file will cause interoperability problems. User defined attributes should be added using iPlanet Console.
Schema from RFC 2247 and related pilot schema: "Using Domains in LDAP/X500 Distinguished Names."
Schema from RFC 2927: "MIME Directory Profile for LDAP Schema." Contains the ldapSchemas operational attribute required for the attribute to show up in the subschema subentry.
Schema from RFC 2307: "An Approach for Using LDAP as a Network Information Service".
Contains new schema elements and the Nortel subscriber interoperability specification. Also contains the adminRole and memberOf attributes and inetAdmin class previously stored in 50ns-delegated-admin.ldif file.
Schema from RFC 2713: "Schema for Representing Java(tm) Objects in an LDAP Directory."
Contains pilot directory schema from FRC 1274 which is no longer recommended for new deployments. Please note that future RFCs which succeed RFC 1274 may deprecate some or all of 28pilot.ldif attribute types and classes.
Schema that contains objects classes and attributes common to the iPlanet Console framework.
Schema used by Netscape Compass Server to define personal interest profiles.
Contains additional configuration schema used by iPlanet Directory Server 4.12 and earlier versions of the directory, which is no longer applicable to iPlanet Directory Server 5.0. This schema is required for replicating between iPlanet Directory Server 4.12 and iPlanet Directory Server 5.0.
Legacy Netscape Schema used by iPlanet Administration Server for legacy servers.
Schema used by iPlanet Messaging Server to define mail users and mail groups.
Schema used by Netscape Mission Control Desktop to hold browser client preferences.
Schema used by Netscape Mission Control Desktop to set MCD "config()" preferences.
Schema used by Mission Control Desktop to define location independence.
Schema used by Mission Control Desktop to hold mail client preferences and messenger security preferences.
Schema used by iPlanet Messaging Server 4.0 for mailing list management.
Schema used for iPlanet Collabra Server to hold news group preferences.
User-defined schema maintained by Directory Server replication consumers which contains the attributes and object classes from the suppliers.
Configuration Changes Requiring Server Restart
Table 2-5 lists the configuration attributes that cannot be altered dynamically, while the server is still running. They require that the server be stopped and restarted to take effect. The table lists the configuration attributes concerned, with their full DNs, and provides a brief description of their functions.
Table 2-5    Configuration changes requiring server restart
Configuration attribute
Action requiring restart
Modifying the maximum number of entries supported by the change log.
Enabling or disabling client authentication.
Previous Contents Index DocHome Next
Copyright © 2001 Sun Microsystems, Inc. Some preexisting portions Copyright © 2001 Netscape Communications Corp. All rights reserved.
Last Updated March 23, 2001