Procedure

1. Create a private key and a certificate signing request (CSR). Skip this step if you want to create them using an external utility.

   • If your host is reachable only by one name, enter:

     # dsctl instance_name tls generate-server-cert-csr -s "CN=server.example.com,O=example_organization"

   • If your host is reachable by multiple names:

     # dsctl instance_name tls generate-server-cert-csr -s "CN=server.example.com,O=example_organization" server.example.com server.example.net

     If you specify the host names as the last parameter, the command adds the Subject Alternative Name (SAN) extension with the DNS:server.example.com, DNS:server.example.net entries to the CSR.

   The string specified in the -s subject parameter must be a valid subject name according to RFC 1485. The CN field in the subject is required, and you must set it to one of the fully-qualified domain names (FQDN) of the server. The command stores the CSR in the /etc/dirsrv/slapd-instance_name/Server-Cert.csr file.

2. Submit the CSR to the certificate authority (CA) to get a certificate issued. For further details, see your CA’s documentation.

3. Import the server certificate issued by the CA to the NSS database:

   • If you created the private key using the dsctl tls generate-server-cert-csr command, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com security certificate add --file /root/instance_name.crt --name "server-cert" --primary-cert

     Remember the name of the certificate you set in the --name _certificate_nickname parameter. You require it in a later step.

   • If you created the private key using an external utility, import the server certificate and the private key:

     # dsctl instance_name tls import-server-key-cert /root/server.crt /root/server.key

     Note that the command requires you to specify the path to the server certificate first and then the path to the private key. This method always sets the nickname of the certificate to Server-Cert.

4. Import the CA certificate to the NSS database:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security ca-certificate add --file /root/ca.crt --name "Example CA"

5. Set the trust flags of the CA certificate:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security ca-certificate set-trust-flags "Example CA" --flags "CT,,"

   This configures Directory Server to trust the CA for TLS encryption and certificate-based authentication.

6. Enable TLS and set the LDAPS port:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-securePort=636 nsslapd-security=on

7. Open the LDAPS port in the firewalld service:

   # firewall-cmd --permanent --add-port=636/tcp
   # firewall-cmd --reload

8. Enable the RSA cipher family, set the NSS database security device, and the server certificate name:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security rsa set --tls-allow-rsa-certificates on --nss-token "internal (software)" --nss-cert-name Server-Cert

   By default, the name of the security device in the NSS database is internal (software)

9. Optional: Disable the plain text LDAP port:

   # dsconf inst security disable_plain_port

10. Restart the instance

    # dsctl instance_name restart

Procedure

1. Navigate to Server → Security → Certificate Management → Certificate Signing Request, and click Create Certificate Signing Request.

2. Set a name for certificate signing request (CSR), common name (CN), and organization (O):

   

   If your host is reachable by multiple names, set the alternative names in the Subject Alternative Names filed.

3. Click Create Certificate Signing Request.

4. View the CSR text and copy it:

   1. Click Node options icon for the CSR you want to view and select View CSR.
   2. Copy the CSR content.
5. Submit the CSR file to the certificate authority (CA) to get a certificate issued. For further details, see your CA’s documentation.
6. When you get the certificate from your CA, navigate to Server → Security → Certificate Management → TLS Certificates, and click Add Server Certificate.

7. Set a unique nickname for the server certificate, upload the issued certificate, and click Add Certificate.

   Remember the certificate nickname, because a later step requires it.

8. Navigate to Server → Security → Certificate Management → Trusted Certificate Authorities, and click Add CA Certificate.
9. Set a unique nickname for the CA certificate, upload the CA certificate file, and click Add Certificate.

10. Optional: If you did not enable TLS encryption during the Directory Server instance installation, enable it:

    1. Navigate to Server → Security Settings, and enable the security switch.
    2. On the pop-up window, click Enable Security.
    3. Click Save Configuration on the Security Setting page.

11. Configure the Server Certificate Name on the Security Configuration page:

    1. Navigate to Server → Security → Security Configuration.
    2. Select the server certificate nickname in the Server Certificate Name drop-down list, and click Save Configuration.
    3. Optional: If you do not see the certificate nickname in the drop-down list, refresh the Security Settings page and perform the previous step again.
12. Optional: If you want to use an LDAPS port other than 636, navigate to the Server → Server Settings, set the LDAPS port, and click Save.

13. Open the LDAPS port in the firewalld service:

    # firewall-cmd --permanent --add-port=636/tcp
    # firewall-cmd --reload

14. Optional: Navigate to Server → Security → Security Configuration, check Require Secure Connections checkbox, and click Save Configuration.

    Directory Server disables the plain text LDAP port.

15. Click Actions in the top right corner, and select Restart Instance.

Procedure

1. Use the following command to change the NSS database password:

   # certutil -d /etc/dirsrv/slapd-instance_name/ -W
   Enter Password or Pin for "NSS Certificate DB":
   Enter a password which will be used to encrypt your keys.
   The password should be at least 8 characters long,
   and should contain at least one non-alphabetic character.
   
   Enter new password:
   Re-enter password:
   Password changed successfully.

2. If you use a password file to start Directory Server automatically without prompting for the NSS database password, replace the old password with the new one in the /etc/dirsrv/slapd-instance_name/pin.txt:

   • If you use the NSS software cryptography module, which is the default:

     Internal (Software) Token:password

   • If you use a Hardware Security Module (HSM):

     name_of_the_token:password

Procedure

1. Create the /etc/dirsrv/slapd-instance_name/pin.txt file with the following content:

   • If you use the NSS software cryptography module, which is the default:

     Internal (Software) Token:password

   • If you use a Hardware Security Module (HSM):

     name_of_the_token:password

2. Set the file permissions:

   # chown dirsrv:root /etc/dirsrv/slapd-instance_name/pin.txt
   # chmod 400 /etc/dirsrv/slapd-instance_name/pin.txt

Procedure

1. If you do not have a local copy of the CA certificate used by Directory Server:

   1. List the certificates in the server’s network security services (NSS) database:

      # certutil -d /etc/dirsrv/slapd-instance_name/ -L
      
      Certificate Nickname                       Trust Attributes
                                                 SSL,S/MIME,JAR/XPI
      
      Example CA                                 C,,
      Server-Cert                                u,u,u

   2. Use the nickname of the CA certificate in the NSS database to export the CA certificate:

      # certutil -d /etc/dirsrv/slapd-instance_name/ -L -n "Example CA" -a > /tmp/ds-ca.crt

2. Copy the CA certificate to the /etc/pki/ca-trust/source/anchors/ directory:

   # cp /tmp/ds-ca.crt /etc/pki/ca-trust/source/anchors/

3. Rebuild the CA trust database:

   # update-ca-trust

Procedure

1. Optional: Display the TLS protocols that are currently enabled in Directory Server:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security get | egrep -i "sslVersionMin|sslVersionMax"
   sslversionmin: TLS1.2
   sslversionmax: TLS1.3

2. Set the minimum TLS protocol. For example, to set it to TLS 1.3, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security set --tls-protocol-min="TLS1.3"

   Note that you cannot set the parameter to a value lower than TLS 1.2, which is the minimum of all RHEL system-wide crypto policy profiles.

3. Not recommended: Set the highest supported TLS protocol:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security set --tls-protocol-max="TLS1.3"

   If you set --tls-protocol-max to a value lower than in --tls-protocol-min, then Directory Server sets the maximum protocol to the same value as the minimum.

   To always use the strongest supported encryption protocol as the maximum supported TLS version, do not set --tls-protocol-max.

4. Restart the instance:

   # dsctl instance_name restart

Verification

1. Display the supported TLS protocols:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security get | egrep -i "sslVersionMin|sslVersionMax"
   sslversionmin: TLS1.3
   sslversionmax: TLS1.3

2. Use the openssl utility to establish a secure client connection using a specific TLS protocol:

   # echo | openssl s_client -connect server.example.com:636 -tls1_3
   ...
   New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
   ...

Procedure

1. Navigate to Server → Security.
2. Set the minimum TLS protocol in the Minimum TLS Version field.
3. Not recommended: Set the highest supported TLS protocol in the Maximum TLS Version field.
4. Click Save Settings.
5. Click Actions in the top right corner, and select Restart Instance.

Procedure

1. Set the nsslapd-require-secure-binds configuration parameter to on:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-require-secure-binds=on

2. Optional: If you want to use LDAPS, disable the plain text LDAP port:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security disable_plain_port

3. Restart the instance:

   # dsctl instance_name restart

Procedure

1. Navigate to Server → Security → Security Configuration, select the Require Secure Connections option, and click Save Configuration.
2. Optional: If you want to use LDAPS, navigate to Server → Server Settings → General Settings, and set LDAP Port to 0 to disable the plain text LDAP port. Click Save.
3. Click Actions in the top right corner, and select Restart Instance.

Procedure

1. Display the list of enabled ciphers:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security ciphers list
   default

   The default keyword indicates that only the ciphers enabled in the network security services (NSS) are enabled.

2. If you need to enable weak ciphers, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security set --allow-insecure-ciphers on

3. Update the nsSSL3Ciphers parameter. For example, to enable only the TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 and TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ciphers, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security ciphers set -- "-all,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,+TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"

   Use -- to avoid that the shell interprets the - character in -all as an option to the command. Do not use a \ character to escape -all because it can create an error and this results in a different cipher selection.

4. Restart the instance:

   # dsctl instance_name restart

Procedure

1. If you need to enable weak ciphers:

   1. Navigate to Server → Security → Security Configuration.
   2. Select Allow Weak Ciphers.
   3. Click Save Settings.
2. Navigate to Server → Security → Cipher Preferences.

3. Update the cipher settings. For example, to enable only the TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 and TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ciphers:

   1. Select No Ciphers in the Cipher Suite field.
   2. Enter TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 in the Allow Specific Ciphers field.
4. Click Save Settings.
5. Click Actions → Restart Instance.

Procedure

1. Use the following command to change the trust flags of a CA certificate:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security ca-certificate set-trust-flags "Example CA" --flags "trust_flags"

Procedure

1. Navigate to Server → Security → Certificate Management → Trusted Certificate Authorities.
2. Click …​ icon next to the CA certificate, and select Edit Trust Flags.

3. Select the trust flags.

   
4. Click Save

Verification

1. Navigate to Server → Security → Certificate Management → Trusted Certificate Authorities.
2. Click > next to the CA certificate to display the trust flags.

Procedure

1. Create a private key and a certificate signing request (CSR). Skip this step if you want to create them using an external utility.

   • If your host is reachable only by one name, enter:

     # dsctl instance_name tls generate-server-cert-csr -s "CN=server.example.com,O=example_organization"

   • If your host is reachable by multiple names:

     # dsctl instance_name tls generate-server-cert-csr -s "CN=server.example.com,O=example_organization" server.example.com server.example.net

     If you specify the host names as the last parameter, the command adds the Subject Alternative Name (SAN) extension with the DNS:server.example.com, DNS:server.example.net entries to the CSR.

   The string specified in the -s subject parameter must be a valid subject name according to RFC 1485. The CN field in the subject is required, and you must set it to one of the fully-qualified domain names (FQDN) of the server. The command stores the CSR in the /etc/dirsrv/slapd-instance_name/Server-Cert.csr file.

2. Submit the CSR to the certificate authority (CA) to get a certificate issued. For further details, see your CA’s documentation.
3. Store both the CA certificate and the server certificate in the /root/ directory.

4. Import the server certificate issued by the CA to the NSS database, using one of the following options:

   • If you created the private key using the dsctl tls generate-server-cert-csr command, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com security certificate add --file /root/instance_name.crt --name "server-cert" --primary-cert

     Remember the name of the certificate you set in the --name _certificate_nickname parameter. You require it in a later step.

   • If you created the private key using an external utility, import the server certificate and the private key:

     # dsctl instance_name tls import-server-key-cert /root/server.crt /root/server.key

     Note that the command requires you to specify the path to the server certificate first and then the path to the private key. This method always sets the nickname of the certificate to Server-Cert.

5. Import the CA certificate to the NSS database:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security ca-certificate add --file /root/ca.crt --name "Example CA"

6. Set the trust flags of the CA certificate:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security ca-certificate set-trust-flags "Example CA" --flags "CT,,"

   This configures Directory Server to trust the CA for TLS encryption and certificate-based authentication.

7. Stop the instance:

   # dsctl instance_name stop

8. Edit the /etc/dirsrv/slapd-instance_name/dse.ldif file, and remove the following entries including their attributes:

   • cn=AES,cn=encrypted attribute keys,cn=database_name,cn=ldbm database,cn=plugins,cn=config
   • cn=3DES,cn=encrypted attribute keys,cn=database_name,cn=ldbm database,cn=plugins,cn=config
   Important

   Remove the entries for all databases. If any entry that contains the nsSymmetricKey attribute is left in the /etc/dirsrv/slapd-instance_name/dse.ldif file, Directory Server will fail to start.

9. Start the instance:

   # dsctl instance_name start

Procedure

1. Create a /etc/dirsrv/slapd-instance_name/certmap.conf file to map information from the certificate to Directory Server users:

   certmap default         default
   default:DNComps         dc
   default:FilterComps     mail,cn
   default:VerifyCert      on
   
   certmap example         cn=Example CA
   example:DNComps

   With this configuration, for certificates issued by cn=Example CA, Directory Server does not generate a base DN from the subject of the certificate because the DNComps parameter is set empty for this issuer. Additionally, the settings for the FilterComps and VerifyCert are inherited from the default entry.

   Certificates that have a different issuer DN than cn=Example CA will use the settings from the default entry and generate the base DN based on the cn attributes in the subject of the certificate. This enables Directory Server to start the search under a specific DN, without searching the whole directory.

   For all certificates, Directory Server generates the search filter using the mail and the cn attribute from the certificate’s subject. However, if the mail attribute does not exist in the subject, Directory Server will automatically use the value of the certificate’s e attribute in the subject.

2. Enable certificate-based authentication. For example, to configure certificate-based authentication as optional, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security set --tls-client-auth="allowed"

   Use the --tls-client-auth=required option to configure certificate-based authentication as mandatory.

3. Optional: If you configured certificate-based authentication as required, enable the nsslapd-require-secure-binds parameter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-require-secure-binds=on

   This setting ensures that users cannot bypass the certificate-based authentication by using an unencrypted connection.

4. Optional: If Directory Server should use the identity from the certificate instead of the credentials in the bind request, configure Directory Server to use the EXTERNAL simple authentication and security layer (SASL) mechanism:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-force-sasl-external=on

   With this setting, Directory Server ignores any other bind method than the identity in the certificate.

5. Restart the instance:

   # dsctl instance_name restart

Procedure

1. If the certificate is not in DER format, convert it. For example, to convert a certificate from privacy enhanced mail (PEM) to DER, enter:

   # openssl x509 -in /home/user_name/certificate.pem -out /home/user_name/certificate.der -outform DER

2. Add the certificate to the user’s userCertificate attribute:

   # ldapmodify -D "cn=Directory Manager" -W -H ldaps://server.example.com -x
   
   dn: uid=user_name,ou=People,dc=example,dc=com
   changetype: modify
   add: userCertificate
   userCertificate:< file:///home/user_name/example.der

Verification

1. Authenticate as the user using certificate-based authentication:

   1. Set the following environment variables to the corresponding paths to the CA certificate, the user key, and the user certificate:

      LDAPTLS_CACERT=/home/user_name/CA.crt
      LDAPTLS_KEY=/home/user_name/user.key
      LDAPTLS_CERT=/home/user_name/user.der

      Alternatively, set the TLS_CACERT, TLS_KEY, and TLS_CERT parameters in the ~/.ldaprc file of the current user.

   2. Connect to the server:

      # ldapwhoami -H ldaps://server.example.com -Y EXTERNAL
      dn: uid=example,ou=people,dc=example,dc=com

Procedure

1. Create the ou=services entry if it does not exist:

   # ldapadd -D "cn=Directory Manager" -W -H ldaps://server1.example.com -x
   
   dn: ou=services,dc=example,dc=com
   objectClass: organizationalunit
   objectClass: top
   ou: services

2. Create accounts for both servers, such as cn=server1,ou=services,dc=example,dc=com and cn=server1,ou=services,dc=example,dc=com:

   # ldapadd -D "cn=Directory Manager" -W -H ldaps://server1.example.com -x
   
   dn: cn=server1,ou=services,dc=example,dc=com
   objectClass: top
   objectClass: person
   objectClass: inetOrgPerson
   sn: server1
   cn: server1
   userPassword: password
   userCertificate:< file:///root/server1.der
   
   adding new entry "cn=server1,ou=services,dc=example,dc=com"
   
   dn: cn=server2,ou=services,dc=example,dc=com
   objectClass: top
   objectClass: person
   objectClass: inetOrgPerson
   sn: server2
   cn: server2
   userPassword: password
   userCertificate:< file:///root/server2.der
   
   adding new entry "cn=server2,ou=services,dc=example,dc=com"

3. Create a group, such as cn=repl_servers,dc=groups,dc=example,dc=com:

   # dsidm -D "cn=Directory Manager" ldaps://server1.example.com -b "dc=example,dc=com" group create --cn "repl_servers"

4. Add the two replication accounts as members to the group:

   # dsidm -D "cn=Directory Manager" ldaps://server1.example.com -b "dc=example,dc=com" group add_member repl_servers "cn=server1,ou=services,dc=example,dc=com"
   
   # dsidm -D "cn=Directory Manager" ldaps://server1.example.com -b "dc=example,dc=com" group add_member repl_servers "cn=server2,ou=services,dc=example,dc=com"

Procedure

1. On server2.example.com, enable replication for the dc=example,dc=com suffix:

   # dsconf -D "cn=Directory Manager" ldaps://server2.example.com replication enable --suffix "dc=example,dc=com" --role "supplier" --replica-id 2 --bind-dn "cn=replication manager,cn=config" --bind-passwd "password"

   This command configures the server2.example.com host as a supplier for the dc=example,dc=com suffix, and sets the replica ID of this host to 2. Additionally, the command creates a temporary cn=replication manager,cn=config user with the specified password and allows this account to replicate changes for the suffix to this host.

   The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

2. On server1.example.com:

   1. Enable replication:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com replication enable --suffix="dc=example,dc=com" --role="supplier" --replica-id="1"

   2. Create a temporary replication agreement which uses the temporary account from the previous step for authentication:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt create --suffix="dc=example,dc=com" --host="server1.example.com" --port=636 --conn-protocol=LDAPS --bind-dn="cn=Replication Manager,cn=config" --bind-passwd="password" --bind-method=SIMPLE --init temporary_agreement

Verification

1. Verify that the initialization was successful:

   # dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt init-status --suffix "dc=example,dc=com" temporary_agreement
   Agreement successfully initialized.

Procedure

1. On server1.example.com:

   1. Remove the temporary replication agreement:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt delete --suffix="dc=example,dc=com" temporary_agreement

   2. Add the cn=repl_servers,dc=groups,dc=example,dc=com bind group to the replication settings:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com replication set --suffix="dc=example,dc=com" --repl-bind-group "cn=repl_servers,dc=groups,dc=example,dc=com"

   3. Configure Directory Server to automatically check for changes in the bind group:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com replication set --suffix="dc=example,dc=com" --repl-bind-group-interval=0

2. On server2.example.com:

   1. Remove the temporary replication manager account:

      # dsconf -D "cn=Directory Manager" ldaps://server2.example.com replication delete-manager --suffix="dc=example,dc=com" --name="Replication Manager"

   2. Add the cn=repl_servers,dc=groups,dc=example,dc=com bind group to the replication settings:

      # dsconf -D "cn=Directory Manager" ldaps://server2.example.com replication set --suffix="dc=example,dc=com" --repl-bind-group "cn=repl_servers,dc=groups,dc=example,dc=com"

   3. Configure Directory Server to automatically check for changes in the bind group:

      # dsconf -D "cn=Directory Manager" ldap://server2.example.com replication set --suffix="dc=example,dc=com" --repl-bind-group-interval=0

   4. Create the replication agreement with certificate-based authentication:

      dsconf -D "cn=Directory Manager" ldaps://server2.example.com repl-agmt create --suffix="dc=example,dc=com" --host="server1.example.com" --port=636 --conn-protocol=LDAPS --bind-method="SSLCLIENTAUTH" --init server2-to-server1

3. On server1.example.com, create the replication agreement with certificate-based authentication:

   dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt create --suffix="dc=example,dc=com" --host="server2.example.com" --port=636 --conn-protocol=LDAPS --bind-method="SSLCLIENTAUTH" --init server1-to-server2

Verification

1. Verify on each server that the initialization was successful:

   # dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt init-status --suffix "dc=example,dc=com" server1-to-server2
   Agreement successfully initialized.
   
   # dsconf -D "cn=Directory Manager" ldaps://server2.example.com repl-agmt init-status --suffix "dc=example,dc=com" server2-to-server1
   Agreement successfully initialized.

Procedure

1. Export the changelog, for example, to the /tmp/changelog.ldif file:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication export-changelog to-ldif -o /tmp/changelog.ldif -r "dc=example,dc=com"

2. Enable change log encryption for the dc=example,dc=com suffix:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication --suffix "dc=example,dc=com" --encrypt

3. Import the changelog from the /tmp/changelog.ldif file:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication import-changelog from-ldif -r "dc=example,dc=com" /tmp/changelog.ldif

4. Restart the instance:

   # dsctl instance_name restart

Verification

1. Make a change in the LDAP directory, such as updating an entry.

2. Stop the instance:

   # dsctl instance_name stop

3. List the suffixes and their corresponding databases:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list
   dc=example,dc=com (userroot)

   Note the name of the database for which you enabled changelog encryption.

4. Enter the following command to display parts of the changelog:

   # dbscan -f /var/lib/dirsrv/slapd-instance_name/db/userroot/replication_changelog.db | tail -50

   If the changelog is encrypted, you see only encrypted data.

5. Start the instance.

   # dsctl instance_name start

Procedure

1. Create the cn=backup_users,ou=groups,dc=example,dc=com group:

   # dsidm -D "cn=Directory manager" ldap://server.example.com -b "dc=example,dc=com" group create --cn backup_users

2. Add an access control instruction (ACI) that allows members of the cn=backup_users,ou=groups,dc=example,dc=com group to create backup tasks:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com
   
   dn: cn=config
   changetype: modify
   add: aci
   aci: (target = "ldap:///cn=backup,cn=tasks,cn=config")(targetattr="*")
    (version 3.0 ; acl "permission: Allow backup_users
     group to create backup tasks" ; allow (add, read, search) groupdn
     = "ldap:///cn=backup_users,ou=groups,dc=example,dc=com";)
   -
   add: aci
   aci: (target = "ldap:///cn=config")(targetattr = "nsslapd-bakdir ||
     objectClass") (version 3.0 ; acl "permission: Allow backup_users
     group to access bakdir attribute" ; allow (read,search)
     groupdn = "ldap:///cn=backup_users,ou=groups,dc=example,dc=com";)

3. Create a user:

   1. Create a user account:

      # dsidm -D "cn=Directory manager" ldap://server.example.com -b "dc=example,dc=com" user create --uid="example" --cn="example" --uidNumber="1000" --gidNumber="1000" --homeDirectory="/home/example/" --displayName="Example User"

   2. Set a password on the user account:

      # dsidm -D "cn=Directory manager" ldap://server.example.com -b "dc=example,dc=com" account reset_password "uid=example,ou=People,dc=example,dc=com" "password"

4. Add the uid=example,ou=People,dc=example,dc=com user to the cn=backup_users,ou=groups,dc=example,dc=com group:

   # dsidm -D "cn=Directory manager" ldap://server.example.com -b "dc=example,dc=com" group add_member backup_users uid=example,ou=People,dc=example,dc=com

Procedure

1. Create the cn=export_users,ou=groups,dc=example,dc=com group:

   # dsidm -D "cn=Directory manager" ldap://server.example.com -b "dc=example,dc=com" group create --cn export_users

2. Add an access control instruction (ACI) that allows members of the cn=export_users,ou=groups,dc=example,dc=com group to create export tasks:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com
   
   dn: cn=config
   changetype: modify
   add: aci
   aci: (target = "ldap:///cn=export,cn=tasks,cn=config")
    (targetattr="*") (version 3.0 ; acl "permission:
     Allow export_users group to export data" ;
     allow (add, read, search) groupdn
     = "ldap:///cn=export_users,ou=groups,dc=example,dc=com";)
   -
   add: aci
   aci: (target = "ldap:///cn=config")(targetattr =
     "objectclass || cn || nsslapd-suffix || nsslapd-ldifdir")
     (version 3.0 ; acl "permission: Allow export_users
     group to access ldifdir attribute" ; allow
     (read,search) groupdn = "ldap:///cn=export_users,ou=groups,dc=example,dc=com";)

3. Create a user:

   1. Create a user account:

      # dsidm -D "cn=Directory manager" ldap://server.example.com -b "dc=example,dc=com" user create --uid="example" --cn="example" --uidNumber="1000" --gidNumber="1000" --homeDirectory="/home/example/" --displayName="Example User"

   2. Set a password on the user account:

      # dsidm -D "cn=Directory manager" ldap://server.example.com -b "dc=example,dc=com" account reset_password "uid=example,ou=People,dc=example,dc=com" "password"

4. Add the uid=example,ou=People,dc=example,dc=com user to the cn=export_users,ou=groups,dc=example,dc=com group:

   # dsidm -D "cn=Directory manager" ldap://server.example.com -b "dc=example,dc=com" group add_member export_users uid=example,ou=People,dc=example,dc=com

Procedure

1. Enable the FIPS mode for the network security services (NSS) database:

   # modutil -dbdir /etc/dirsrv/slapd-instance_name/ -fips true

2. Restart the instance:

   # dsctl instance_name restart

Verification

1. Display the value of the passwordmaxfailure setting:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com pwpolicy get passwordmaxfailure
   passwordmaxfailure: 2

2. Attempt to bind using an invalid password one more time than the value set in passwordmaxfailure:

   # ldapsearch -H ldap://server.example.com -D "uid=example,ou=People,dc=example,dc=com" -w invalid-password -b "dc=example,dc=com" -x
   ldap_bind: Invalid credentials (49)
   
   # ldapsearch -H ldap://server.example.com -D "uid=example,ou=People,dc=example,dc=com" -w invalid-password -b "dc=example,dc=com" -x
   ldap_bind: Invalid credentials (49)
   
   # ldapsearch -H ldap://server.example.com -D "uid=example,ou=People,dc=example,dc=com" -w invalid-password -b "dc=example,dc=com" -x
   ldap_bind: Constraint violation (19)
   	additional info: Exceed password retry limit. Please try later.

   With legacy passwords disabled, Directory Server locked the account after the second attempt, and further tries are blocked with an ldap_bind: Constraint violation (19) error.

Procedure

1. Optional: Identify whether the legacy password policy is enabled or disabled:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config get passwordLegacyPolicy
   passwordLegacyPolicy: on

2. Enable the password lockout policy and set the maximum number of failures to 2:

   # [command]`dsconf -D "cn=Directory Manager" ldap://server.example.com pwpolicy set --pwdlockout on --pwdmaxfailures=2

   With the legacy password policy enabled, Directory Server will lock accounts after the third failed attempt to bind (value of the --pwdmaxfailures parameter + 1).

   The dsconf pwpolicy set command supports the following parameters:

   • --pwdlockout: Enables or disables the account lockout feature. Default: off.

   • --pwdmaxfailures: Sets the maximum number of allowed failed bind attempts before Directory Server locks the account. Default: 3.

     Note that this lockout happens one attempt later if the legacy password policy setting is enabled. Default: 3.

   • --pwdresetfailcount: Sets the time in seconds before Directory Server resets the passwordRetryCount attribute in the user’s entry. Default: 600 seconds (10 minutes).
   • --pwdlockoutduration: Sets the time of accounts being locked in seconds. This parameter is ignored if you set the --pwdunlock parameter to off. Default: 3600 seconds (1 hour).
   • --pwdunlock: Enables or disables whether locked accounts should be unlocked after a certain amount of time or stay disabled until an administrator manually unlocks them. Default: on.

Procedure

1. Optional: Identify whether the legacy password policy is enabled or disabled:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config get passwordLegacyPolicy
   passwordLegacyPolicy: on

   This setting is not available in the web console.

2. Navigate to Database → Password Policies → Global Policy → Account Lockout.
3. Select Enable Account Lockout.

4. Configure the lockout settings:

   • Number of Failed Logins That Locks out Account: Sets the maximum number of allowed failed bind attempts before Directory Server locks the account.
   • Time Until Failure Count Resets: Sets the time in seconds before Directory Server resets the passwordRetryCount attribute in the user’s entry.
   • Time Until Account Unlocked: Sets the time of accounts beging locked in seconds. This parameter is ignored if you disable Do Not Lockout Account Forever.
   • Do Not Lockout Account Forever: Enables or disables whether locked accounts should be unlocked after a certain amount of time or stay disabled until an administrator manually unlocks them.
5. Click Save.

Procedure

1. Navigate to Server → Server Settings → Advanced Settings.
2. Set the Allow Anonymous Access parameter to off.
3. Click Save.

Procedure

1. Enable replication of password policy attributes:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com pwpolicy set --pwdisglobal="on"

2. If you use fractional replication, display the list of attributes that are excluded from replication:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt get --suffix "dc=example,dc=com" example-agreement | grep "nsDS5ReplicatedAttributeList"

   Using the default settings, no output is shown, and Directory Server replicates the account lockout attributes. However, if the command returns a list of excluded attributes, such as in the following example, verify the attribute list:

   nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE accountUnlockTime passwordRetryCount retryCountResetTime example1 example2

   In this example, the accountUnlockTime, passwordRetryCount, and retryCountResetTime lockout policy attributes are excluded from replication, along with two other attributes.

3. If the output of the previous command lists any of the account lockout attributes, update the fractional replication settings to only include attributes other than the lockout policy attributes:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt set --suffix "dc=example,dc=com" --frac-list "example1 example2" example-agreement

Verification

1. Attempt to perform a search as a user using an invalid password:

   # ldapsearch -H ldap://server.example.com -D "uid=example,ou=People,dc=example,dc=com" -w "invalid-password" -b "dc=example,dc=com" -x
   ldap_bind: Invalid credentials (49)

2. Display the passwordRetryCount attribute of the user:

   # ldapsearch -H ldap://server.example.com -D "cn=Directory Manager" -W -b "uid=example,ou=People,dc=example,dc=com" -x passwordRetryCount
   ...
   dn: uid=example,ou=People,dc=example,dc=com
   passwordRetryCount: 1

3. Run the previous command on a different server in the replication topology. If the value of the passwordRetryCount attribute is the same, Directory Server replicated the attribute.

Procedure

1. Enable the Account Policy plug-in:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin account-policy enable

2. Configure the plug-in configuration entry:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin account-policy config-entry set "cn=config,cn=Account Policy Plugin,cn=plugins,cn=config" --always-record-login yes --state-attr lastLoginTime --alt-state-attr 1.1 --spec-attr acctPolicySubentry --limit-attr accountInactivityLimit

   This command uses the following options:

   • --always-record-login yes: Enables logging of the login time. This is required to use Class of Service (CoS) or roles with account policies, even if it does not have the acctPolicySubentry attribute set.
   • --state-attr lastLoginTime: Configures that the Account Policy plug-in stores the last login time in the lastLoginTime attribute of users.
   • --alt-state-attr 1.1: Disables using an alternative attribute to check if the primary one does not exist. By default, Directory Server uses the createTimestamp attribute as alternative. However, this causes that Directory Server logs out existing users automatically if their account do not have the lastLoginTime attribute set and createTimestamp is older than the configured inactivity period. Disabling the alternative attribute causes that Directory Server automatically adds the lastLoginTime attribute to user entries when they log in the next time.
   • --spec-attr acctPolicySubentry: Configures Directory Server to apply the policy to entries that have the acctPolicySubentry attribute set. You configure this attribute in the CoS entry.
   • --limit-attr accountInactivityLimit: Configures that the accountInactivityLimit attribute in the account inactivation policy entry stores the inactivity time.

3. Restart the instance:

   # dsctl instance_name restart

4. Create the account inactivation policy entry:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com -x
   
   dn: cn=Account Inactivation Policy,dc=example,dc=com
   objectClass: top
   objectClass: ldapsubentry
   objectClass: extensibleObject
   objectClass: accountpolicy
   accountInactivityLimit: 1814400
   cn: Account Inactivation Policy

   The value in the accountInactivityLimit attribute configures that Directory Server inactivates accounts 1814400 seconds (21 days) after the last log in.

5. Create the CoS template entry:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com -x
   
   dn: cn=TemplateCoS,dc=example,dc=com
   objectClass: top
   objectClass: ldapsubentry
   objectClass: extensibleObject
   objectClass: cosTemplate
   acctPolicySubentry: cn=Account Inactivation Policy,dc=example,dc=com

   This template entry references the account inactivation policy.

6. Create the CoS definition entry:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com -x
   
   dn: cn=DefinitionCoS,dc=example,dc=com
   objectClass: top
   objectClass: ldapsubentry
   objectclass: cosSuperDefinition
   objectclass: cosPointerDefinition
   cosTemplateDn: cn=TemplateCoS,dc=example,dc=com
   cosAttribute: acctPolicySubentry default operational-default

   This definition entry references the CoS template entry and causes that the acctPolicySubentry attribute appears in each user entry with a value set to cn=Account Inactivation Policy,dc=example,dc=com.

Verification

1. Set the lastLoginTime attribute of a user to a value that is older than the inactivity time you configured:

   # ldapmodify -H ldap://server.example.com -x -D "cn=Directory Manager" -W
   
   dn: uid=example,ou=People,dc=example,dc=com
   changetype: modify
   replace: lastLoginTime
   lastLoginTime: 20210101000000Z

2. Try to connect to the directory as a this user:

   # ldapsearch -H ldap://server.example.com -x -D "uid=example,ou=People,dc=example,dc=com" -W -b "dc=example,dc=com"
   ldap_bind: Constraint violation (19)
   	additional info: Account inactivity limit exceeded. Contact system administrator to reset.

   If Directory Server denies access and returns this error, account inactivity works.

Procedure

1. Enable the Account Policy plug-in:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin account-policy enable

2. Configure the plug-in configuration entry:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin account-policy config-entry set "cn=config,cn=Account Policy Plugin,cn=plugins,cn=config" --always-record-login yes --state-attr createTimestamp --alt-state-attr 1.1 --spec-attr acctPolicySubentry --limit-attr accountInactivityLimit

   This command uses the following options:

   • --always-record-login yes: Enables logging of the login time. This is required to use Class of Service (CoS) or roles with account policies, even if it does not have the acctPolicySubentry attribute set.
   • --state-attr createTimestamp: Configures that the Account Policy plug-in uses the value of the createTimestamp attribute to calculate whether an account is expired.
   • --alt-state-attr 1.1: Disables using an alternative attribute to check if the primary one does not exist.
   • --spec-attr acctPolicySubentry: Configures Directory Server to apply the policy to entries that have the acctPolicySubentry attribute set. You configure this attribute in the CoS entry.
   • --limit-attr accountInactivityLimit: Configures that the accountInactivityLimit attribute in the account expiration policy entry stores the maximum age.

3. Restart the instance:

   # dsctl instance_name restart

4. Create the account expiration policy entry:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com -x
   
   dn: cn=Account Expiration Policy,dc=example,dc=com
   objectClass: top
   objectClass: ldapsubentry
   objectClass: extensibleObject
   objectClass: accountpolicy
   accountInactivityLimit: 5184000
   cn: Account Expiration Policy

   The value in the accountInactivityLimit attribute configures that accounts expire 5184000 seconds (60 days) after they have been created.

5. Create the CoS template entry:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com -x
   
   dn: cn=TemplateCoS,dc=example,dc=com
   objectClass: top
   objectClass: ldapsubentry
   objectClass: extensibleObject
   objectClass: cosTemplate
   acctPolicySubentry: cn=Account Expiration Policy,dc=example,dc=com

   This template entry references the account expiration policy.

6. Create the CoS definition entry:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com -x
   
   dn: cn=DefinitionCoS,dc=example,dc=com
   objectClass: top
   objectClass: ldapsubentry
   objectclass: cosSuperDefinition
   objectclass: cosPointerDefinition
   cosTemplateDn: cn=TemplateCoS,dc=example,dc=com
   cosAttribute: acctPolicySubentry default operational-default

   This definition entry references the CoS template entry and causes that the acctPolicySubentry attribute appears in each user entry with a value set to cn=Account Expiration Policy,dc=example,dc=com.

Procedure

1. Enable the password expiration feature:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace passwordExp=on

2. Enable the Account Policy plug-in:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin account-policy enable

3. Configure the plug-in configuration entry:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin account-policy config-entry set "cn=config,cn=Account Policy Plugin,cn=plugins,cn=config" --always-record-login yes --always-record-login-attr lastLoginTime --state-attr non_existent_attribute --alt-state-attr passwordExpirationTime --spec-attr acctPolicySubentry --limit-attr accountInactivityLimit

   This command uses the following options:

   • --always-record-login yes: Enables logging of the login time. This is required to use Class of Service (CoS) or roles with account policies, even if it does not have the acctPolicySubentry attribute set.
   • --always-record-login-attr lastLoginTime: Configures that the Account Policy plug-in stores the last login time in the lastLoginTime attribute of users.
   • --state-attr non_existent_attribute: Sets the primary time attribute used to evaluate an account policy to a non-existent dummy attribute name.
   • --alt-state-attr `passwordExpirationTime: Configures the plug-in to use the passwordExpirationTime attribute as the alternative attribute to check.
   • --spec-attr acctPolicySubentry: Configures Directory Server to apply the policy to entries that have the acctPolicySubentry attribute set. You configure this attribute in the CoS entry.
   • --limit-attr accountInactivityLimit: Configures that the accountInactivityLimit attribute in the account policy entry stores the time when accounts are inactivated after their last password change.

4. Restart the instance:

   # dsctl instance_name restart

5. Create the account inactivation policy entry:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com -x
   
   dn: cn=Account Inactivation Policy,dc=example,dc=com
   objectClass: top
   objectClass: ldapsubentry
   objectClass: extensibleObject
   objectClass: accountpolicy
   accountInactivityLimit: 2419200
   cn: Account Inactivation Policy

   The value in the accountInactivityLimit attribute configures that Directory Server inactivates accounts 2419200 seconds (28 days) after the password was changed.

6. Create the CoS template entry:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com -x
   
   dn: cn=TemplateCoS,dc=example,dc=com
   objectClass: top
   objectClass: ldapsubentry
   objectClass: extensibleObject
   objectClass: cosTemplate
   acctPolicySubentry: cn=Account Inactivation Policy,dc=example,dc=com

   This template entry references the account inactivation policy.

7. Create the CoS definition entry:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com -x
   
   dn: cn=DefinitionCoS,dc=example,dc=com
   objectClass: top
   objectClass: ldapsubentry
   objectclass: cosSuperDefinition
   objectclass: cosPointerDefinition
   cosTemplateDn: cn=TemplateCoS,dc=example,dc=com
   cosAttribute: acctPolicySubentry default operational-default

   This definition entry references the CoS template entry and causes that the acctPolicySubentry attribute appears in each user entry with a value set to cn=Account Inactivation Policy,dc=example,dc=com.

Verification

1. Set the passwordExpirationTime attribute of a user to a value that is older than the inactivity time you configured:

   # ldapmodify -H ldap://server.example.com -x -D "cn=Directory Manager" -W
   
   dn: uid=example,ou=People,dc=example,dc=com
   changetype: modify
   replace: passwordExpirationTime
   passwordExpirationTime: 20210101000000Z

2. Try to connect to the directory as a this user:

   # ldapsearch -H ldap://server.example.com -x -D "uid=example,ou=People,dc=example,dc=com" -W -b "dc=example,dc=com"
   ldap_bind: Constraint violation (19)
   	additional info: Account inactivity limit exceeded. Contact system administrator to reset.

   If Directory Server denies access and returns this error, account inactivity works.

Procedure

1. Create the plug-in configuration entry and enable the setting:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin account-policy config-entry set "cn=config,cn=Account Policy Plugin,cn=plugins,cn=config" --always-record-login yes --state-attr lastLoginTime --alt-state-attr 1.1 --spec-attr acctPolicySubentry --limit-attr accountInactivityLimit --check-all-state-attrs yes

2. Restart the server to load the new plug-in configuration:

   # dsctl instance_name restart

   Warning

   The checkAllStateAttrs setting is designed to only work when the alternate state attribute is set to passwordExpiratontime. Setting it to createTimestamp can cause undesired results and entries might get locked out.

Procedure

1. Enable the Account Policy plug-in:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin account-policy enable

2. Create the plug-in configuration entry to record login times:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin account-policy config-entry set "cn=config,cn=Account Policy Plugin,cn=plugins,cn=config" --always-record-login yes --state-attr lastLoginTime

   This command uses the following options:

   • --always-record-login yes: Enables logging of the log in time.
   • --state-attr lastLoginTime: Configures that the Account Policy plug-in stores the last log in time in the lastLoginTime attribute of users.

3. Restart the instance:

   # dsctl instance_name restart

Verification

1. Log in to Directory Server as a user. For example, run a search:

   # ldapsearch -H ldap://server.example.com -x -D "uid=example,ou=People,dc=example,dc=com" -W -b "dc=example,dc=com"

2. Display the lastLoginTime attribute of the user you used in the previous step:

   # ldapsearch -H ldap://server.example.com -x -D "cn=Directory Manager" -W -b "uid=example,ou=people,dc=example,dc=com" lastLoginTime
   ...
   dn: uid=example,ou=People,dc=example,dc=com
   lastLoginTime: 20210913091435Z

   If the lastLoginTime attribute exists and Directory Server updated its value, recording of the last login time works.

Procedure

1. Enable the RootDN Access Control plug-in:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin root-dn enable

2. Set the bind rules. For example, to allow the Directory Manager account to only log in between 6am and 9pm from the host with IP address 192.0.2.1, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin root-dn set --open-time=0600 --close-time=2100 --allow-ip="192.0.2.1"

   For the full list of parameters you can set and their descriptions, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin root-dn set --help

3. Restart the instance:

   # dsctl instance_name restart

Procedure

1. Navigate to Plugins → RootDN Access Control.
2. Enable the plug-in.

3. Fill the fields according to your requirements.

   
4. Click Save.
5. Click Actions in the top right corner, and select Restart Instance.

Procedure

1. Export the userRoot database:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com backend export -E userRoot

   The server stores the export in an LDIF file in the /var/lib/dirsrv/slapd-instance_name/ldif/ directory. The -E option decrypts attributes that are already encrypted during the export.

2. Enable AES encryption for the telephoneNumber attribute:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com backend attr-encrypt --add-attr telephoneNumber dc=example,dc=com

3. Stop the instance:

   # dsctl instance_name stop

4. Import the LDIF file:

   # dsctl instance_name ldif2db --encrypted userRoot /var/lib/dirsrv/slapd-instance_name/ldif/None-userroot-2022_01_24_10_28_27.ldif

   The --encrypted parameter enables the script to encrypt attributes configured for encryption during the import.

5. Start the instance:

   # dsctl instance_name start

Procedure

1. Export the userRoot database:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com backend export -E userRoot

   The server stores the export in an LDIF file in the /var/lib/dirsrv/slapd-instance_name/ldif/ directory. The -E option decrypts attributes that are already encrypted during the export.

2. In the web console, navigate to Database → Suffixes → suffix_entry → Encrypted Attributes.
3. Enter the attribute to encrypt, and click Add Attribute.
4. In the Actions menu, select Stop Instance.

5. On the command line, import the LDIF file:

   # dsctl instance_name ldif2db --encrypted userRoot /var/lib/dirsrv/slapd-instance_name/ldif/None-userroot-2022_01_24_10_28_27.ldif

   The --encrypted parameter enables the script to encrypt attributes configured for encryption during the import.

6. In the web console, open the Actions menu, and select Start Instance.

Procedure

1. Export the userRoot database:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com backend export -E userRoot

   The server stores the export in an LDIF file in the /var/lib/dirsrv/slapd-instance_name/ldif/ directory. The -E option decrypts attributes that are already encrypted during the export.

2. Create a private key and a certificate signing request (CSR). Skip this step if you want to create them using an external utility.

   • If your host is reachable only by one name, enter:

     # dsctl instance_name tls generate-server-cert-csr -s "CN=server.example.com,O=example_organization"

   • If your host is reachable by multiple names:

     # dsctl instance_name tls generate-server-cert-csr -s "CN=server.example.com,O=example_organization" server.example.com server.example.net

     If you specify the host names as the last parameter, the command adds the Subject Alternative Name (SAN) extension with the DNS:server.example.com, DNS:server.example.net entries to the CSR.

   The string specified in the -s subject parameter must be a valid subject name according to RFC 1485. The CN field in the subject is required, and you must set it to one of the fully-qualified domain names (FQDN) of the server. The command stores the CSR in the /etc/dirsrv/slapd-instance_name/Server-Cert.csr file.

3. Submit the CSR to the certificate authority (CA) to get a certificate issued. For further details, see your CA’s documentation.

4. Import the server certificate issued by the CA to the NSS database:

   • If you created the private key using the dsctl tls generate-server-cert-csr command, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com security certificate add --file /root/instance_name.crt --name "server-cert" --primary-cert

     Remember the name of the certificate you set in the --name _certificate_nickname parameter. You require it in a later step.

   • If you created the private key using an external utility, import the server certificate and the private key:

     # dsctl instance_name tls import-server-key-cert /root/server.crt /root/server.key

     Note that the command requires you to specify the path to the server certificate first and then the path to the private key. This method always sets the nickname of the certificate to Server-Cert.

5. Import the CA certificate to the NSS database:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security ca-certificate add --file /root/ca.crt --name "Example CA"

6. Set the trust flags of the CA certificate:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security ca-certificate set-trust-flags "Example CA" --flags "CT,,"

   This configures Directory Server to trust the CA for TLS encryption and certificate-based authentication.

7. Stop the instance:

   # dsctl instance_name stop

8. Edit the /etc/dirsrv/slapd-instance_name/dse.ldif file, and remove the following entries including their attributes:

   • cn=AES,cn=encrypted attribute keys,cn=database_name,cn=ldbm database,cn=plugins,cn=config
   • cn=3DES,cn=encrypted attribute keys,cn=database_name,cn=ldbm database,cn=plugins,cn=config
   Important

   Remove the entries for all databases. If any entry that contains the nsSymmetricKey attribute is left in the `/etc/dirsrv/slapd-instance_name/dse.ldif file, Directory Server will fail to start.

9. Import the LDIF file:

   # dsctl instance_name ldif2db --encrypted userRoot /var/lib/dirsrv/slapd-instance_name/ldif/None-userroot-2022_01_24_10_28_27.ldif

   The --encrypted parameter enables the script to encrypt attributes configured for encryption during the import.

10. Start the instance:

    # dsctl instance_name start