Setting the Server as Read-Only

Each suffix in your directory can be placed in read-only mode independently and can return a specific referral if one is defined. Directory Server also provides a read-only mode for the server that applies to all suffixes and can return a global referral when one is defined.

The server read-only mode is designed to allow administrators to prevent modifications to the directory contents while performing tasks such as reindexing the suffixes. For this reason, server read-only mode does not apply to the following configuration branches:

• cn=config

• cn=monitor

• cn=schema

These branches should be protected at all times by access control instructions (ACIs) against modifications by non-administration users, regardless of the read-only setting (see Chapter 6, Directory Server Access Control). Global read-only mode prevents update operations on all other suffixes in the directory, including update operations initiated by the Directory Manager.

Read-only mode also interrupts replication on a suffix if it is enabled. A master replica no longer has any changes to replicate, although it continues to replicate any changes that were made before read-only mode was enabled. A consumer replica does not receive updates until read-only mode is disabled. A master in a multi master replication environment does not have any changes to replicate and is not able to receive updates from the other masters.

To Enable or Disable the Server Read-Only Mode

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

1. Enable the global read-only mode.

   $ dsconf set-server-prop -h host -p port read-write-mode:read-only

2. When you are ready, disable the read-only mode.

   $ dsconf set-server-prop -h host -p port read-write-mode:read-write