dsconfbackend
Manage database suffixes and backends
dsconfbackup
Manage online backups
dsconfchaining
Manage database chaining and database links
dsconfconfig
Manage the server configuration
dsconfdirectory_manager
Manage the Directory Manager account
dsconflogging
Manage the server logs
dsconfmonitor
Monitor the state of the instance
dsconfplugin
Manage plug-ins available on the server
dsconfpwpolicy
Manage the global password policy settings
dsconflocalpwp
Manage the local user and subtree password policies
dsconfreplication
Manage replication for a suffix
dsconfrepl-agmt
Manage replication agreements
dsconfrepl-winsync-agmt
Manage Winsync agreements
dsconfrepl-tasks
Manage replication tasks
dsconfrepl-conflict
Manage replication conflicts
dsconfsasl
Manage SASL mappings
dsconfsecurity
Manage security settings
dsconfschema
Manage the directory schema
COMMAND'dsconfbackend'
usage: dsconf [-v] [-j] instance backend [-h]
{suffix,index,vlv-index,attr-encrypt,config,monitor,import,export,create,delete,get-tree,compact-db}
...
POSITIONALARGUMENTS'dsconfbackend'dsconfbackendsuffix
Manage backend suffixes
dsconfbackendindex
Manage backend indexes
dsconfbackendvlv-index
Manage VLV searches and indexes
dsconfbackendattr-encrypt
Manage encrypted attribute settings
dsconfbackendconfig
Manage the global database configuration settings
dsconfbackendmonitor
Displays global database or suffix monitoring information
dsconfbackendimport
Online import of a suffix
dsconfbackendexport
Online export of a suffix
dsconfbackendcreate
Create a backend database
dsconfbackenddelete
Delete a backend database
dsconfbackendget-tree
Display the suffix tree
dsconfbackendcompact-db
Compact the database and the replication changelog
COMMAND'dsconfbackendsuffix'
usage: dsconf [-v] [-j] instance backend suffix [-h]
{list,get,get-dn,get-sub-suffixes,set} ...
POSITIONALARGUMENTS'dsconfbackendsuffix'dsconfbackendsuffixlist
List active backends and suffixes
dsconfbackendsuffixget
Display the suffix entry
dsconfbackendsuffixget-dn
Display the DN of a backend
dsconfbackendsuffixget-sub-suffixes
Display sub-suffixes
dsconfbackendsuffixset
Set configuration settings for a specific backend
COMMAND'dsconfbackendsuffixlist'
usage: dsconf [-v] [-j] instance backend suffix list [-h] [--suffix]
[--skip-subsuffixes]
OPTIONS'dsconfbackendsuffixlist'--suffix
Displays the suffixes without backend name
--skip-subsuffixes
Displays the list of suffixes without sub-suffixes
COMMAND'dsconfbackendsuffixget'
usage: dsconf [-v] [-j] instance backend suffix get [-h] [selector]
selector
The backend database name to search for
COMMAND'dsconfbackendsuffixget-dn'
usage: dsconf [-v] [-j] instance backend suffix get-dn [-h] [dn]
dn The DN to the database entry in cn=ldbm database,cn=plugins,cn=config
COMMAND'dsconfbackendsuffixget-sub-suffixes'
usage: dsconf [-v] [-j] instance backend suffix get-sub-suffixes
[-h] [--suffix] be_name
be_name
The backend name or suffix
OPTIONS'dsconfbackendsuffixget-sub-suffixes'--suffix
Displays the list of suffixes without backend name
COMMAND'dsconfbackendsuffixset'
usage: dsconf [-v] [-j] instance backend suffix set [-h] [--enable-readonly]
[--disable-readonly]
[--enable-orphan]
[--disable-orphan]
[--require-index]
[--ignore-index]
[--add-referral ADD_REFERRAL]
[--del-referral DEL_REFERRAL]
[--enable] [--disable]
[--cache-size CACHE_SIZE]
[--cache-memsize CACHE_MEMSIZE]
[--dncache-memsize DNCACHE_MEMSIZE]
[--state STATE]
be_name
be_name
The backend name or suffix
OPTIONS'dsconfbackendsuffixset'--enable-readonly
Enables read-only mode for the backend database
--disable-readonly
Disables read-only mode for the backend database
--enable-orphan
Disconnect a subsuffix from its parent suffix.
--disable-orphan
Let the subsuffix be connected to its parent suffix.
--require-index
Allows only indexed searches
--ignore-index
Allows all searches even if they are unindexed
--add-referralADD_REFERRAL
Adds an LDAP referral to the backend
--del-referralDEL_REFERRAL
Removes an LDAP referral from the backend
--enable
Enables the backend database
--disable
Disables the backend database
--cache-sizeCACHE_SIZE
Sets the maximum number of entries to keep in the entry cache
--cache-memsizeCACHE_MEMSIZE
Sets the maximum size in bytes that the entry cache can grow to
--dncache-memsizeDNCACHE_MEMSIZE
Sets the maximum size in bytes that the DN cache can grow to
--stateSTATE
Changes the backend state to: "backend", "disabled", "referral", or "referral on update"
COMMAND'dsconfbackendindex'
usage: dsconf [-v] [-j] instance backend index [-h]
{add,set,get,list,delete,reindex} ...
POSITIONALARGUMENTS'dsconfbackendindex'dsconfbackendindexadd
Add an index
dsconfbackendindexset
Update an index
dsconfbackendindexget
Display an index entry
dsconfbackendindexlist
Display the index
dsconfbackendindexdelete
Delete an index
dsconfbackendindexreindex
Re-index the database for a single index or all indexes
COMMAND'dsconfbackendindexadd'
usage: dsconf [-v] [-j] instance backend index add [-h]
--index-type INDEX_TYPE
[--matching-rule MATCHING_RULE]
[--reindex] --attr ATTR
be_name
be_name
The backend name or suffix
OPTIONS'dsconfbackendindexadd'--index-typeINDEX_TYPE
Sets the indexing type (eq, sub, pres, or approx)
--matching-ruleMATCHING_RULE
Sets the matching rule for the index
--reindex
Re-indexes the database after adding a new index
--attrATTR
Sets the attribute name to index
COMMAND'dsconfbackendindexset'
usage: dsconf [-v] [-j] instance backend index set [-h] --attr ATTR
[--add-type ADD_TYPE]
[--del-type DEL_TYPE]
[--add-mr ADD_MR]
[--del-mr DEL_MR]
[--reindex]
be_name
be_name
The backend name or suffix
OPTIONS'dsconfbackendindexset'--attrATTR
Sets the indexed attribute to update
--add-typeADD_TYPE
Adds an index type to the index (eq, sub, pres, or approx)
--del-typeDEL_TYPE
Removes an index type from the index: (eq, sub, pres, or approx)
--add-mrADD_MR
Adds a matching-rule to the index
--del-mrDEL_MR
Removes a matching-rule from the index
--reindex
Re-indexes the database after editing the index
COMMAND'dsconfbackendindexget'
usage: dsconf [-v] [-j] instance backend index get [-h] --attr ATTR be_name
be_name
The backend name or suffix
OPTIONS'dsconfbackendindexget'--attrATTR
Sets the index name to display
COMMAND'dsconfbackendindexlist'
usage: dsconf [-v] [-j] instance backend index list [-h] [--just-names]
be_name
be_name
The backend name or suffix
OPTIONS'dsconfbackendindexlist'--just-names
Displays only the names of indexed attributes
COMMAND'dsconfbackendindexdelete'
usage: dsconf [-v] [-j] instance backend index delete [-h] [--attr ATTR]
be_name
be_name
The backend name or suffix
OPTIONS'dsconfbackendindexdelete'--attrATTR
Sets the name of the attribute to delete from the index
COMMAND'dsconfbackendindexreindex'
usage: dsconf [-v] [-j] instance backend index reindex [-h] [--attr ATTR]
[--wait]
be_name
be_name
The backend name or suffix
OPTIONS'dsconfbackendindexreindex'--attrATTR
Sets the name of the attribute to re-index. Omit this argument to re-index all attributes
--wait Waits for the index task to complete and reports the status
COMMAND'dsconfbackendvlv-index'
usage: dsconf [-v] [-j] instance backend vlv-index [-h]
{list,get,add-search,edit-search,del-search,add-index,del-index,reindex}
...
POSITIONALARGUMENTS'dsconfbackendvlv-index'dsconfbackendvlv-indexlist
List VLV search and index entries
dsconfbackendvlv-indexget
Display a VLV search and indexes
dsconfbackendvlv-indexadd-search
Add a VLV search entry. The search entry is the parent entry of the VLV index entries, and it
specifies the search parameters that are used to match entries for those indexes.
dsconfbackendvlv-indexedit-search
Update a VLV search and index
dsconfbackendvlv-indexdel-search
Delete VLV search & index
dsconfbackendvlv-indexadd-index
Create a VLV index under a VLV search entry (parent entry, formatter_class=CustomHelpFormatter).
The VLV index specifies the attributes to sort
dsconfbackendvlv-indexdel-index
Delete a VLV index under a VLV search entry (parent entry)
dsconfbackendvlv-indexreindex
Index/re-index the VLV database index
COMMAND'dsconfbackendvlv-indexlist'
usage: dsconf [-v] [-j] instance backend vlv-index list [-h] [--just-names]
be_name
be_name
The backend name of the VLV index
OPTIONS'dsconfbackendvlv-indexlist'--just-names
Displays only the names of VLV search entries
COMMAND'dsconfbackendvlv-indexget'
usage: dsconf [-v] [-j] instance backend vlv-index get [-h] [--name NAME]
be_name
be_name
The backend name of the VLV index
OPTIONS'dsconfbackendvlv-indexget'--nameNAME
Displays the VLV search entry and its index entries
COMMAND'dsconfbackendvlv-indexadd-search'
usage: dsconf instance [-v] [-j] backend vlv-index add-search
[-h] --name NAME --search-base SEARCH_BASE --search-scope SEARCH_SCOPE
--search-filter SEARCH_FILTER
be_name
be_name
The backend name of the VLV index
OPTIONS'dsconfbackendvlv-indexadd-search'--nameNAME
Sets the name of the VLV search entry
--search-baseSEARCH_BASE
Sets the VLV search base
--search-scopeSEARCH_SCOPE
Sets the VLV search scope: 0 (base search), 1 (one-level search), or 2 (subtree search)
--search-filterSEARCH_FILTER
Sets the VLV search filter
COMMAND'dsconfbackendvlv-indexedit-search'
usage: dsconf [-v] [-j] instance backend vlv-index edit-search
[-h] --name NAME [--search-base SEARCH_BASE]
[--search-scope SEARCH_SCOPE] [--search-filter SEARCH_FILTER]
[--reindex]
be_name
be_name
The backend name of the VLV index to update
OPTIONS'dsconfbackendvlv-indexedit-search'--nameNAME
Sets the name of the VLV index
--search-baseSEARCH_BASE
Sets the VLV search base
--search-scopeSEARCH_SCOPE
Sets the VLV search scope: 0 (base search), 1 (one-level search), or 2 (subtree search)
--search-filterSEARCH_FILTER
Sets the VLV search filter
--reindex
Re-indexes all VLV database indexes
COMMAND'dsconfbackendvlv-indexdel-search'
usage: dsconf [-v] [-j] instance backend vlv-index del-search
[-h] --name NAME be_name
be_name
The backend name of the VLV index
OPTIONS'dsconfbackendvlv-indexdel-search'--nameNAME
Sets the name of the VLV search index
COMMAND'dsconfbackendvlv-indexadd-index'
usage: dsconf instance [-v] [-j] backend vlv-index add-index
[-h] --parent-name PARENT_NAME --index-name INDEX_NAME --sort SORT
[--index-it]
be_name
be_name
The backend name of the VLV index
OPTIONS'dsconfbackendvlv-indexadd-index'--parent-namePARENT_NAME
Sets the name or "cn" attribute of the parent VLV search entry
--index-nameINDEX_NAME
Sets the name of the new VLV index
--sortSORT
Sets a space-separated list of attributes to sort for this VLV index
--index-it
Creates the database index for this VLV index definition
COMMAND'dsconfbackendvlv-indexdel-index'
usage: dsconf [-v] [-j] instance backend vlv-index del-index
[-h] --parent-name PARENT_NAME [--index-name INDEX_NAME] [--sort SORT]
be_name
be_name
The backend name of the VLV index
OPTIONS'dsconfbackendvlv-indexdel-index'--parent-namePARENT_NAME
Sets the name or "cn" attribute value of the parent VLV search entry
--index-nameINDEX_NAME
Sets the name of the VLV index to delete
--sortSORT
Delete a VLV index that has this vlvsort value
COMMAND'dsconfbackendvlv-indexreindex'
usage: dsconf [-v] [-j] instance backend vlv-index reindex [-h]
[--index-name INDEX_NAME]
--parent-name PARENT_NAME
be_name
be_name
The backend name of the VLV index
OPTIONS'dsconfbackendvlv-indexreindex'--index-nameINDEX_NAME
Sets the name of the VLV index entry to re-index. If not set, all indexes are re-indexed
--parent-namePARENT_NAME
Sets the name or "cn" attribute value of the parent VLV search entry
COMMAND'dsconfbackendattr-encrypt'
usage: dsconf [-v] [-j] instance backend attr-encrypt [-h] [--list]
[--just-names]
[--add-attr ADD_ATTR]
[--del-attr DEL_ATTR]
be_name
be_name
The backend name or suffix
OPTIONS'dsconfbackendattr-encrypt'--list Lists all encrypted attributes in the backend
--just-names
List only the names of the encrypted attributes when used with --list
--add-attrADD_ATTR
Enables encryption for the specified attribute
--del-attrDEL_ATTR
Disables encryption for the specified attribute
COMMAND'dsconfbackendconfig'
usage: dsconf [-v] [-j] instance backend config [-h] {get,set} ...
POSITIONALARGUMENTS'dsconfbackendconfig'dsconfbackendconfigget
Display the global database configuration
dsconfbackendconfigset
Set the global database configuration
COMMAND'dsconfbackendconfigget'
usage: dsconf [-v] [-j] instance backend config get [-h]
COMMAND'dsconfbackendconfigset'
usage: dsconf [-v] [-j] instance backend config set [-h]
[--lookthroughlimit LOOKTHROUGHLIMIT]
[--mode MODE]
[--idlistscanlimit IDLISTSCANLIMIT]
[--directory DIRECTORY]
[--dbcachesize DBCACHESIZE]
[--logdirectory LOGDIRECTORY]
[--txn-wait TXN_WAIT]
[--checkpoint-interval CHECKPOINT_INTERVAL]
[--compactdb-interval COMPACTDB_INTERVAL]
[--compactdb-time COMPACTDB_TIME]
[--txn-batch-val TXN_BATCH_VAL]
[--txn-batch-min TXN_BATCH_MIN]
[--txn-batch-max TXN_BATCH_MAX]
[--logbufsize LOGBUFSIZE]
[--locks LOCKS]
[--locks-monitoring-enabled LOCKS_MONITORING_ENABLED]
[--locks-monitoring-threshold
LOCKS_MONITORING_THRESHOLD]
[--locks-monitoring-pause LOCKS_MONITORING_PAUSE]
[--import-cache-autosize IMPORT_CACHE_AUTOSIZE]
[--cache-autosize CACHE_AUTOSIZE]
[--cache-autosize-split CACHE_AUTOSIZE_SPLIT]
[--import-cachesize IMPORT_CACHESIZE]
[--exclude-from-export EXCLUDE_FROM_EXPORT]
[--pagedlookthroughlimit PAGEDLOOKTHROUGHLIMIT]
[--pagedidlistscanlimit PAGEDIDLISTSCANLIMIT]
[--rangelookthroughlimit RANGELOOKTHROUGHLIMIT]
[--backend-opt-level BACKEND_OPT_LEVEL]
[--deadlock-policy DEADLOCK_POLICY]
[--db-home-directory DB_HOME_DIRECTORY]
[--db-lib DB_LIB]
[--mdb-max-size MDB_MAX_SIZE]
[--mdb-max-readers MDB_MAX_READERS]
[--mdb-max-dbs MDB_MAX_DBS]
OPTIONS'dsconfbackendconfigset'--lookthroughlimitLOOKTHROUGHLIMIT
Specifies the maximum number of entries that the server will check when examining candidate
entries in response to a search request
--modeMODE
Specifies the permissions used for newly created index files
--idlistscanlimitIDLISTSCANLIMIT
Specifies the number of entry IDs that are searched during a search operation
--directoryDIRECTORY
Specifies absolute path to database instance
--dbcachesizeDBCACHESIZE
Specifies the database index cache size in bytes
--logdirectoryLOGDIRECTORY
Specifies the path to the directory that contains the database transaction logs
--txn-waitTXN_WAIT
Sets whether the server should should wait if there are no db locks available
--checkpoint-intervalCHECKPOINT_INTERVAL
Sets the amount of time in seconds after which the server sends a checkpoint entry to the database
transaction log
--compactdb-intervalCOMPACTDB_INTERVAL
Sets the interval in seconds when the database is compacted
--compactdb-timeCOMPACTDB_TIME
Sets the time (HH:MM format) of day when to compact the database after the "compactdb interval"
has been reached
--txn-batch-valTXN_BATCH_VAL
Specifies how many transactions will be batched before being committed
--txn-batch-minTXN_BATCH_MIN
Controls when transactions should be flushed earliest, independently of the batch count. Requires
that txn-batch-val is set
--txn-batch-maxTXN_BATCH_MAX
Controls when transactions should be flushed latest, independently of the batch count. Requires
that txn-batch-val is set)
--logbufsizeLOGBUFSIZE
Specifies the transaction log information buffer size
--locksLOCKS
Sets the maximum number of database locks
--locks-monitoring-enabledLOCKS_MONITORING_ENABLED
Enables or disables monitoring of DB locks when the value crosses the percentage set with
"--locks-monitoring-threshold"
--locks-monitoring-thresholdLOCKS_MONITORING_THRESHOLD
Sets the DB lock exhaustion threshold in percentage (valid range is 70-90). When the threshold is
reached, all searches are aborted until the number of active locks decreases below the configured
threshold and/or the administrator increases the number of database locks (nsslapd-db-locks). This
threshold is a safeguard against DB corruption which might be caused by locks exhaustion.
--locks-monitoring-pauseLOCKS_MONITORING_PAUSE
Sets the DB lock monitoring value in milliseconds for the amount of time that the monitoring
thread spends waiting between checks.
--import-cache-autosizeIMPORT_CACHE_AUTOSIZE
Enables or disables to automatically set the size of the import cache to be used during the import
process of LDIF files
--cache-autosizeCACHE_AUTOSIZE
Sets the percentage of free memory that is used in total for the database and entry cache. "0"
disables this feature.
--cache-autosize-splitCACHE_AUTOSIZE_SPLIT
Sets the percentage of RAM that is used for the database cache. The remaining percentage is used
for the entry cache
--import-cachesizeIMPORT_CACHESIZE
Sets the size in bytes of the database cache used in the import process.
--exclude-from-exportEXCLUDE_FROM_EXPORT
List of attributes to not include during database export operations
--pagedlookthroughlimitPAGEDLOOKTHROUGHLIMIT
Specifies the maximum number of entries that the server will check when examining candidate
entries for a search which uses the simple paged results control
--pagedidlistscanlimitPAGEDIDLISTSCANLIMIT
Specifies the number of entry IDs that are searched, specifically, for a search operation using
the simple paged results control.
--rangelookthroughlimitRANGELOOKTHROUGHLIMIT
Specifies the maximum number of entries that the server will check when examining candidate
entries in response to a range search request.
--backend-opt-levelBACKEND_OPT_LEVEL
Sets the backend optimization level for write performance (0, 1, 2, or 4). WARNING: This
parameter can trigger experimental code.
--deadlock-policyDEADLOCK_POLICY
Adjusts the backend database deadlock policy (Advanced setting)
--db-home-directoryDB_HOME_DIRECTORY
Sets the directory for the database mmapped files (Advanced setting)
--db-libDB_LIB
Sets which db lib is used. Valid values are: bdb or mdb
--mdb-max-sizeMDB_MAX_SIZE
Sets the lmdb database maximum size (in bytes).
--mdb-max-readersMDB_MAX_READERS
Sets the lmdb database maximum number of readers (Advanced setting)
--mdb-max-dbsMDB_MAX_DBS
Sets the lmdb database maximum number of sub databases (Advanced setting)
COMMAND'dsconfbackendmonitor'
usage: dsconf [-v] [-j] instance backend monitor [-h] [--suffix SUFFIX]
OPTIONS'dsconfbackendmonitor'--suffixSUFFIX
Displays monitoring information only for the specified suffix
COMMAND'dsconfbackendimport'
usage: dsconf [-v] [-j] instance backend import [-h] [-c CHUNKS_SIZE] [-E]
[-g GEN_UNIQ_ID] [-O]
[-s INCLUDE_SUFFIXES [INCLUDE_SUFFIXES ...]]
[-x EXCLUDE_SUFFIXES [EXCLUDE_SUFFIXES ...]]
[--timeout TIMEOUT]
[be_name] [ldifs ...]
be_name
The backend name or the root suffix
ldifs Specifies the filename of the input LDIF files. Multiple files are imported in the specified
order.
OPTIONS'dsconfbackendimport'-cCHUNKS_SIZE, --chunks-sizeCHUNKS_SIZE
The number of chunks to have during the import operation
-E, --encrypted
Encrypt attributes configured in the database for encryption
-gGEN_UNIQ_ID, --gen-uniq-idGEN_UNIQ_ID
Generate a unique id. Set "none" for no unique ID to be generated and "deterministic" for the
generated unique ID to be name-based. By default, a time-based unique ID is generated. When using
the deterministic generation to have a name-based unique ID, it is also possible to specify the
namespace for the server to use. namespaceId is a string of characters in the format
00-xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx.
-O, --only-core
Creates only the core database attribute indexes
-sINCLUDE_SUFFIXES[INCLUDE_SUFFIXES...], --include-suffixesINCLUDE_SUFFIXES[INCLUDE_SUFFIXES...]
Specifies the suffixes or the subtrees to be included
-xEXCLUDE_SUFFIXES[EXCLUDE_SUFFIXES...], --exclude-suffixesEXCLUDE_SUFFIXES[EXCLUDE_SUFFIXES...]
Specifies the suffixes to be excluded
--timeoutTIMEOUT
Set a timeout to wait for the export task. Default is 0 (no timeout)
COMMAND'dsconfbackendexport'
usage: dsconf [-v] [-j] instance backend export [-h] [-l LDIF] [-C] [-E] [-m]
[-N] [-r] [-u] [-U]
[-s INCLUDE_SUFFIXES [INCLUDE_SUFFIXES ...]]
[-x EXCLUDE_SUFFIXES [EXCLUDE_SUFFIXES ...]]
[--timeout TIMEOUT]
be_names [be_names ...]
be_names
The backend names or the root suffixes
OPTIONS'dsconfbackendexport'-lLDIF, --ldifLDIF
Sets the filename of the output LDIF file. Separate multiple file names with spaces.
-C, --use-id2entry
Uses only the main database file
-E, --encrypted
Decrypts encrypted data during export. This option is used only if database encryption is enabled.
-m, --min-base64
Sets minimal base-64 encoding
-N, --no-seq-num
Suppresses printing the sequence numbers
-r, --replication
Exports the data with information required to initialize a replica
-u, --no-dump-uniq-id
Omits exporting the unique ID
-U, --not-folded
Disables folding the output
-sINCLUDE_SUFFIXES[INCLUDE_SUFFIXES...], --include-suffixesINCLUDE_SUFFIXES[INCLUDE_SUFFIXES...]
Specifies the suffixes or the subtrees to be included
-xEXCLUDE_SUFFIXES[EXCLUDE_SUFFIXES...], --exclude-suffixesEXCLUDE_SUFFIXES[EXCLUDE_SUFFIXES...]
Specifies the suffixes to be excluded
--timeoutTIMEOUT
Set a timeout to wait for the export task. Default is 0 (no timeout)
COMMAND'dsconfbackendcreate'
usage: dsconf [-v] [-j] instance backend create [-h]
[--parent-suffix PARENT_SUFFIX]
--suffix SUFFIX
--be-name BE_NAME
[--create-entries]
[--create-suffix]
OPTIONS'dsconfbackendcreate'--parent-suffixPARENT_SUFFIX
Sets the parent suffix only if this backend is a sub-suffix
--suffixSUFFIX
Sets the database suffix DN
--be-nameBE_NAME
Sets the database backend name"
--create-entries
Adds sample entries to the database
--create-suffix
Creates the suffix object entry in the database. Only suffixes using the 'dc',
COMMAND'dsconfbackenddelete'
usage: dsconf [-v] [-j] instance backend delete [-h] [--do-it] be_name
be_name
The backend name or suffix
OPTIONS'dsconfbackenddelete'--do-it
Remove backend and its subsuffixes
COMMAND'dsconfbackendget-tree'
usage: dsconf [-v] [-j] instance backend get-tree [-h]
COMMAND'dsconfbackendcompact-db'
usage: dsconf [-v] [-j] instance backend compact-db [-h] [--only-changelog]
[--timeout TIMEOUT]
OPTIONS'dsconfbackendcompact-db'--only-changelog
Compacts only the replication change log
--timeoutTIMEOUT
Set a timeout to wait for the compaction task. Default is 0 (no timeout)
COMMAND'dsconfbackup'
usage: dsconf [-v] [-j] instance backup [-h] {create,restore} ...
POSITIONALARGUMENTS'dsconfbackup'dsconfbackupcreate
Creates a backup of the database
dsconfbackuprestore
Restores a database from a backup
COMMAND'dsconfbackupcreate'
usage: dsconf [-v] [-j] instance backup create [-h] [-t DB_TYPE]
[--timeout TIMEOUT]
[archive]
archive
Sets the directory where to store the backup files. Format: instance_name-
year_month_date_hour_minutes_seconds. Default: /var/lib/dirsrv/slapd- instance/bak/
OPTIONS'dsconfbackupcreate'-tDB_TYPE, --db-typeDB_TYPE
Sets the database type. Default: ldbm database
--timeoutTIMEOUT
Sets the task timeout. Default is 120 seconds,
COMMAND'dsconfbackuprestore'
usage: dsconf [-v] [-j] instance backup restore [-h] [-t DB_TYPE]
[--timeout TIMEOUT]
archive
archive
Set the directory that contains the backup files
OPTIONS'dsconfbackuprestore'-tDB_TYPE, --db-typeDB_TYPE
Sets the database type. Default: ldbm database
--timeoutTIMEOUT
Sets the task timeout. Default is 120 seconds.
COMMAND'dsconfchaining'
usage: dsconf [-v] [-j] instance chaining [-h]
{config-get,config-set,config-get-def,config-set-def,link-create,link-get,link-set,link-delete,monitor,link-list}
...
POSITIONALARGUMENTS'dsconfchaining'dsconfchainingconfig-get
Display the chaining controls and server component lists
dsconfchainingconfig-set
Set the chaining controls and server component lists
dsconfchainingconfig-get-def
Display the default creation parameters for new database links
dsconfchainingconfig-set-def
Set the default creation parameters for new database links
dsconfchaininglink-create
Create a database link to a remote server
dsconfchaininglink-get
Displays chaining database links
dsconfchaininglink-set
Edit a database link to a remote server
dsconfchaininglink-delete
Delete a database link
dsconfchainingmonitor
Display monitor information for a database chaining link
dsconfchaininglink-list
List database links
COMMAND'dsconfchainingconfig-get'
usage: dsconf [-v] [-j] instance chaining config-get [-h] [--avail-controls]
[--avail-comps]
OPTIONS'dsconfchainingconfig-get'--avail-controls
Lists available chaining controls
--avail-comps
Lists available chaining plugin components
COMMAND'dsconfchainingconfig-set'
usage: dsconf [-v] [-j] instance chaining config-set [-h]
[--add-control ADD_CONTROL]
[--del-control DEL_CONTROL]
[--add-comp ADD_COMP]
[--del-comp DEL_COMP]
OPTIONS'dsconfchainingconfig-set'--add-controlADD_CONTROL
Adds a transmitted control OID
--del-controlDEL_CONTROL
Deletes a transmitted control OID
--add-compADD_COMP
Adds a chaining component
--del-compDEL_COMP
Deletes a chaining component
COMMAND'dsconfchainingconfig-get-def'
usage: dsconf [-v] [-j] instance chaining config-get-def [-h]
COMMAND'dsconfchainingconfig-set-def'
usage: dsconf [-v] [-j] instance chaining config-set-def [-h]
[--conn-bind-limit CONN_BIND_LIMIT]
[--conn-op-limit CONN_OP_LIMIT]
[--abandon-check-interval
ABANDON_CHECK_INTERVAL]
[--bind-limit BIND_LIMIT]
[--op-limit OP_LIMIT]
[--proxied-auth PROXIED_AUTH]
[--conn-lifetime CONN_LIFETIME]
[--bind-timeout BIND_TIMEOUT]
[--return-ref RETURN_REF]
[--check-aci CHECK_ACI]
[--bind-attempts BIND_ATTEMPTS]
[--size-limit SIZE_LIMIT]
[--time-limit TIME_LIMIT]
[--hop-limit HOP_LIMIT]
[--response-delay RESPONSE_DELAY]
[--test-response-delay TEST_RESPONSE_DELAY]
[--use-starttls USE_STARTTLS]
OPTIONS'dsconfchainingconfig-set-def'--conn-bind-limitCONN_BIND_LIMIT
Sets the maximum number of BIND connections the database link establishes with the remote server
--conn-op-limitCONN_OP_LIMIT
Sets the maximum number of LDAP connections the database link establishes with the remote server
--abandon-check-intervalABANDON_CHECK_INTERVAL
Sets the number of seconds that pass before the server checks for abandoned operations
--bind-limitBIND_LIMIT
Sets the maximum number of concurrent bind operations per TCP connection
--op-limitOP_LIMIT
Sets the maximum number of concurrent operations allowed
--proxied-authPROXIED_AUTH
Enables or disables proxied authorization. If set to "off", the server executes bind for chained
operations as the user set in the nsMultiplexorBindDn attribute.
--conn-lifetimeCONN_LIFETIME
Specifies connection lifetime in seconds. "0" keeps the connection open forever.
--bind-timeoutBIND_TIMEOUT
Sets the amount of time in seconds before a bind attempt times out
--return-refRETURN_REF
Enables or disables whether referrals are returned by scoped searches
--check-aciCHECK_ACI
Enables or disables whether the server evaluates ACIs on the database link as well as the remote
data server
--bind-attemptsBIND_ATTEMPTS
Sets the number of times the server tries to bind to the remote server
--size-limitSIZE_LIMIT
Sets the maximum number of entries to return from a search operation
--time-limitTIME_LIMIT
Sets the maximum number of seconds allowed for an operation
--hop-limitHOP_LIMIT
Sets the maximum number of times a database is allowed to chain. That is the number of times a
request can be forwarded from one database link to another.
--response-delayRESPONSE_DELAY
Sets the maximum amount of time it can take a remote server to respond to an LDAP operation
request made by a database link before an error is suspected
--test-response-delayTEST_RESPONSE_DELAY
Sets the duration of the test issued by the database link to check whether the remote server is
responding
--use-starttlsUSE_STARTTLS
Configured that database links use StartTLS if set to "on"
COMMAND'dsconfchaininglink-create'
usage: dsconf instance [-v] [-j] chaining link-create [-h]
[--conn-bind-limit CONN_BIND_LIMIT]
[--conn-op-limit CONN_OP_LIMIT]
[--abandon-check-interval ABANDON_CHECK_INTERVAL]
[--bind-limit BIND_LIMIT]
[--op-limit OP_LIMIT]
[--proxied-auth PROXIED_AUTH]
[--conn-lifetime CONN_LIFETIME]
[--bind-timeout BIND_TIMEOUT]
[--return-ref RETURN_REF]
[--check-aci CHECK_ACI]
[--bind-attempts BIND_ATTEMPTS]
[--size-limit SIZE_LIMIT]
[--time-limit TIME_LIMIT]
[--hop-limit HOP_LIMIT]
[--response-delay RESPONSE_DELAY]
[--test-response-delay TEST_RESPONSE_DELAY]
[--use-starttls USE_STARTTLS]
--suffix SUFFIX
--server-url SERVER_URL
--bind-mech BIND_MECH
--bind-dn BIND_DN
[--bind-pw BIND_PW]
[--bind-pw-file BIND_PW_FILE]
[--bind-pw-prompt]
CHAIN_NAME
CHAIN_NAME
The name of the database link
OPTIONS'dsconfchaininglink-create'--conn-bind-limitCONN_BIND_LIMIT
Sets the maximum number of BIND connections the database link establishes with the remote server
--conn-op-limitCONN_OP_LIMIT
Sets the maximum number of LDAP connections the database link establishes with the remote server
--abandon-check-intervalABANDON_CHECK_INTERVAL
Sets the number of seconds that pass before the server checks for abandoned operations
--bind-limitBIND_LIMIT
Sets the maximum number of concurrent bind operations per TCP connection
--op-limitOP_LIMIT
Sets the maximum number of concurrent operations allowed
--proxied-authPROXIED_AUTH
Enables or disables proxied authorization. If set to "off", the server executes bind for chained
operations as the user set in the nsMultiplexorBindDn attribute.
--conn-lifetimeCONN_LIFETIME
Specifies connection lifetime in seconds. "0" keeps the connection open forever.
--bind-timeoutBIND_TIMEOUT
Sets the amount of time in seconds before a bind attempt times out
--return-refRETURN_REF
Enables or disables whether referrals are returned by scoped searches
--check-aciCHECK_ACI
Enables or disables whether the server evaluates ACIs on the database link as well as the remote
data server
--bind-attemptsBIND_ATTEMPTS
Sets the number of times the server tries to bind to the remote server
--size-limitSIZE_LIMIT
Sets the maximum number of entries to return from a search operation
--time-limitTIME_LIMIT
Sets the maximum number of seconds allowed for an operation
--hop-limitHOP_LIMIT
Sets the maximum number of times a database is allowed to chain. That is the number of times a
request can be forwarded from one database link to another.
--response-delayRESPONSE_DELAY
Sets the maximum amount of time it can take a remote server to respond to an LDAP operation
request made by a database link before an error is suspected
--test-response-delayTEST_RESPONSE_DELAY
Sets the duration of the test issued by the database link to check whether the remote server is
responding
--use-starttlsUSE_STARTTLS
Configured that database links use StartTLS if set to "on"
--suffixSUFFIX
Sets the suffix managed by the database link
--server-urlSERVER_URL
Sets the LDAP/LDAPS URL to the remote server
--bind-mechBIND_MECH
Sets the authentication method to use to authenticate to the remote server. Valid values:
"SIMPLE" (default), "EXTERNAL", "DIGEST-MD5", or "GSSAPI"
--bind-dnBIND_DN
Sets the DN of the administrative entry used to communicate with the remote server
--bind-pwBIND_PW
Sets the password of the administrative user
--bind-pw-fileBIND_PW_FILE
File containing the password
--bind-pw-prompt
Prompt for password
COMMAND'dsconfchaininglink-get'
usage: dsconf [-v] [-j] instance chaining link-get [-h] CHAIN_NAME
CHAIN_NAME
The chaining link name or suffix to retrieve
COMMAND'dsconfchaininglink-set'
usage: dsconf instance [-v] [-j] chaining link-set [-h]
[--conn-bind-limit CONN_BIND_LIMIT]
[--conn-op-limit CONN_OP_LIMIT]
[--abandon-check-interval ABANDON_CHECK_INTERVAL]
[--bind-limit BIND_LIMIT]
[--op-limit OP_LIMIT]
[--proxied-auth PROXIED_AUTH]
[--conn-lifetime CONN_LIFETIME]
[--bind-timeout BIND_TIMEOUT]
[--return-ref RETURN_REF]
[--check-aci CHECK_ACI]
[--bind-attempts BIND_ATTEMPTS]
[--size-limit SIZE_LIMIT]
[--time-limit TIME_LIMIT]
[--hop-limit HOP_LIMIT]
[--response-delay RESPONSE_DELAY]
[--test-response-delay TEST_RESPONSE_DELAY]
[--use-starttls USE_STARTTLS]
[--suffix SUFFIX]
[--server-url SERVER_URL]
[--bind-mech BIND_MECH]
[--bind-dn BIND_DN]
[--bind-pw BIND_PW]
[--bind-pw-file BIND_PW_FILE]
[--bind-pw-prompt]
CHAIN_NAME
CHAIN_NAME
The name of the database link
OPTIONS'dsconfchaininglink-set'--conn-bind-limitCONN_BIND_LIMIT
Sets the maximum number of BIND connections the database link establishes with the remote server
--conn-op-limitCONN_OP_LIMIT
Sets the maximum number of LDAP connections the database link establishes with the remote server
--abandon-check-intervalABANDON_CHECK_INTERVAL
Sets the number of seconds that pass before the server checks for abandoned operations
--bind-limitBIND_LIMIT
Sets the maximum number of concurrent bind operations per TCP connection
--op-limitOP_LIMIT
Sets the maximum number of concurrent operations allowed
--proxied-authPROXIED_AUTH
Enables or disables proxied authorization. If set to "off", the server executes bind for chained
operations as the user set in the nsMultiplexorBindDn attribute.
--conn-lifetimeCONN_LIFETIME
Specifies connection lifetime in seconds. "0" keeps the connection open forever.
--bind-timeoutBIND_TIMEOUT
Sets the amount of time in seconds before a bind attempt times out
--return-refRETURN_REF
Enables or disables whether referrals are returned by scoped searches
--check-aciCHECK_ACI
Enables or disables whether the server evaluates ACIs on the database link as well as the remote
data server
--bind-attemptsBIND_ATTEMPTS
Sets the number of times the server tries to bind to the remote server
--size-limitSIZE_LIMIT
Sets the maximum number of entries to return from a search operation
--time-limitTIME_LIMIT
Sets the maximum number of seconds allowed for an operation
--hop-limitHOP_LIMIT
Sets the maximum number of times a database is allowed to chain. That is the number of times a
request can be forwarded from one database link to another.
--response-delayRESPONSE_DELAY
Sets the maximum amount of time it can take a remote server to respond to an LDAP operation
request made by a database link before an error is suspected
--test-response-delayTEST_RESPONSE_DELAY
Sets the duration of the test issued by the database link to check whether the remote server is
responding
--use-starttlsUSE_STARTTLS
Configured that database links use StartTLS if set to "on"
--suffixSUFFIX
Sets the suffix managed by the database link
--server-urlSERVER_URL
Sets the LDAP/LDAPS URL to the remote server
--bind-mechBIND_MECH
Sets the authentication method to use to authenticate to the remote server: Valid values: "SIMPLE"
(default), "EXTERNAL", "DIGEST-MD5", or "GSSAPI"
--bind-dnBIND_DN
Sets the DN of the administrative entry used to communicate with the remote server
--bind-pwBIND_PW
Sets the password of the administrative user
--bind-pw-fileBIND_PW_FILE
File containing the password
--bind-pw-prompt
Prompt for password
COMMAND'dsconfchaininglink-delete'
usage: dsconf [-v] [-j] instance chaining link-delete [-h] CHAIN_NAME
CHAIN_NAME
The name of the database link
COMMAND'dsconfchainingmonitor'
usage: dsconf [-v] [-j] instance chaining monitor [-h] CHAIN_NAME
CHAIN_NAME
The name of the database link
COMMAND'dsconfchaininglink-list'
usage: dsconf [-v] [-j] instance chaining link-list [-h]
COMMAND'dsconfconfig'
usage: dsconf [-v] [-j] instance config [-h] {get,add,replace,delete} ...
POSITIONALARGUMENTS'dsconfconfig'dsconfconfigget
get
dsconfconfigadd
Add attribute value to configuration
dsconfconfigreplace
Replace attribute value in configuration
dsconfconfigdelete
Delete attribute value in configuration
COMMAND'dsconfconfigget'
usage: dsconf [-v] [-j] instance config get [-h] [attrs ...]
attrs Configuration attribute(s) to get
COMMAND'dsconfconfigadd'
usage: dsconf [-v] [-j] instance config add [-h] [attr ...]
attr Configuration attribute to add
COMMAND'dsconfconfigreplace'
usage: dsconf [-v] [-j] instance config replace [-h] [attr ...]
attr Configuration attribute to replace
COMMAND'dsconfconfigdelete'
usage: dsconf [-v] [-j] instance config delete [-h] [attr ...]
attr Configuration attribute to delete
COMMAND'dsconfdirectory_manager'
usage: dsconf [-v] [-j] instance directory_manager [-h] {password_change} ...
POSITIONALARGUMENTS'dsconfdirectory_manager'dsconfdirectory_managerpassword_change
Changes the password of the Directory Manager account
COMMAND'dsconfdirectory_managerpassword_change'
usage: dsconf [-v] [-j] instance directory_manager password_change [-h]
COMMAND'dsconflogging'
usage: dsconf [-v] [-j] instance logging [-h]
{access,audit,auditfail,error,security} ...
POSITIONALARGUMENTS'dsconflogging'dsconfloggingaccess
Manage access log settings
dsconfloggingaudit
Manage audit log settings
dsconfloggingauditfail
Manage auditfail log settings
dsconfloggingerror
Manage error log settings
dsconfloggingsecurity
Manage security log settings
COMMAND'dsconfloggingaccess'
usage: dsconf [-v] [-j] instance logging access [-h] {get,set,list-levels} ...
POSITIONALARGUMENTS'dsconfloggingaccess'dsconfloggingaccessget
Get access log configuration
dsconfloggingaccessset
Set access log configuration
dsconfloggingaccesslist-levels
List all the log levels
COMMAND'dsconfloggingaccessget'
usage: dsconf [-v] [-j] instance logging access get [-h]
COMMAND'dsconfloggingaccessset'
usage: dsconf [-v] [-j] instance logging access set [-h]
{level,logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,buffering-enabled,buffering-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space,log-format,time-format}
...
POSITIONALARGUMENTS'dsconfloggingaccessset'dsconfloggingaccesssetlevel
Set the log level
dsconfloggingaccesssetlogging-enabled
Enable access logging
dsconfloggingaccesssetlogging-disabled
Disable access logging
dsconfloggingaccesssetmode
Set the log file permissions. Default is 600
dsconfloggingaccesssetlocation
Set the log name and location
dsconfloggingaccesssetcompress-enabled
Enable log compression for rotated logs
dsconfloggingaccesssetcompress-disabled
Disable log compression for rotated logs
dsconfloggingaccesssetbuffering-enabled
Enable log buffering
dsconfloggingaccesssetbuffering-disabled
Disable log buffering
dsconfloggingaccesssetmax-logs
Set the maximum number of rotated logs the server will maintain
dsconfloggingaccesssetmax-logsize
Set the maximum size for a log in MB
dsconfloggingaccesssetrotation-interval
Set the interval for when a log is rotated.This works with the interval unit
dsconfloggingaccesssetrotation-interval-unit
Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute",
"hour", "day", "week", and "month"
dsconfloggingaccesssetrotation-tod-enabled
Enable "time of day" rotation for expired logs
dsconfloggingaccesssetrotation-tod-disabled
Disable "time of day" rotation for expired logs
dsconfloggingaccesssetrotation-tod-hour
Set the hour when an expired log should be rotated
dsconfloggingaccesssetrotation-tod-minute
Set the minute when an expired log should be rotated
dsconfloggingaccesssetdeletion-interval
Set the interval a rotated log should be deleted. This works with the deletion internal unit
setting
dsconfloggingaccesssetdeletion-interval-unit
Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month"
dsconfloggingaccesssetmax-disk-space
Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are
deleted.
dsconfloggingaccesssetfree-disk-space
The server deletes the oldest rotated log file when the available disk space in MB is less than
this amount.
dsconfloggingaccesssetlog-format
Choose between "default", "json", or "json-pretty"
dsconfloggingaccesssettime-format
Time format for JSON logging (strftime)
COMMAND'dsconfloggingaccesssetlevel'
usage: dsconf [-v] [-j] instance logging access set level [-h]
levels [levels ...]
levels log level
COMMAND'dsconfloggingaccesssetlogging-enabled'
usage: dsconf [-v] [-j] instance logging access set logging-enabled [-h]
COMMAND'dsconfloggingaccesssetlogging-disabled'
usage: dsconf [-v] [-j] instance logging access set logging-disabled [-h]
COMMAND'dsconfloggingaccesssetmode'
usage: dsconf [-v] [-j] instance logging access set mode [-h] values
values File permissions. Default is 600
COMMAND'dsconfloggingaccesssetlocation'
usage: dsconf [-v] [-j] instance logging access set location [-h] values
values Log name and location
COMMAND'dsconfloggingaccesssetcompress-enabled'
usage: dsconf [-v] [-j] instance logging access set compress-enabled [-h]
COMMAND'dsconfloggingaccesssetcompress-disabled'
usage: dsconf [-v] [-j] instance logging access set compress-disabled [-h]
COMMAND'dsconfloggingaccesssetbuffering-enabled'
usage: dsconf [-v] [-j] instance logging access set buffering-enabled [-h]
COMMAND'dsconfloggingaccesssetbuffering-disabled'
usage: dsconf [-v] [-j] instance logging access set buffering-disabled [-h]
COMMAND'dsconfloggingaccesssetmax-logs'
usage: dsconf [-v] [-j] instance logging access set max-logs [-h] values
values Set the maximum number of rotated logs the server will maintain
COMMAND'dsconfloggingaccesssetmax-logsize'
usage: dsconf [-v] [-j] instance logging access set max-logsize [-h] values
values Set the maximum size for a log in MB
COMMAND'dsconfloggingaccesssetrotation-interval'
usage: dsconf [-v] [-j] instance logging access set rotation-interval
[-h] values
values Set the interval for when a log is rotated.This works with the interval unit
COMMAND'dsconfloggingaccesssetrotation-interval-unit'
usage: dsconf [-v] [-j] instance logging access set rotation-interval-unit
[-h] values
values Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute",
"hour", "day", "week", and "month"
COMMAND'dsconfloggingaccesssetrotation-tod-enabled'
usage: dsconf [-v] [-j] instance logging access set rotation-tod-enabled [-h]
COMMAND'dsconfloggingaccesssetrotation-tod-disabled'
usage: dsconf [-v] [-j] instance logging access set rotation-tod-disabled [-h]
COMMAND'dsconfloggingaccesssetrotation-tod-hour'
usage: dsconf [-v] [-j] instance logging access set rotation-tod-hour
[-h] values
values Set the hour when an expired log should be rotated
COMMAND'dsconfloggingaccesssetrotation-tod-minute'
usage: dsconf [-v] [-j] instance logging access set rotation-tod-minute
[-h] values
values Set the minute when an expired log should be rotated
COMMAND'dsconfloggingaccesssetdeletion-interval'
usage: dsconf [-v] [-j] instance logging access set deletion-interval
[-h] values
values Set the interval a rotated log should be deleted. This works with the deletion internal unit
setting
COMMAND'dsconfloggingaccesssetdeletion-interval-unit'
usage: dsconf [-v] [-j] instance logging access set deletion-interval-unit
[-h] values
values Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month"
COMMAND'dsconfloggingaccesssetmax-disk-space'
usage: dsconf [-v] [-j] instance logging access set max-disk-space [-h] values
values Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are
deleted.
COMMAND'dsconfloggingaccesssetfree-disk-space'
usage: dsconf [-v] [-j] instance logging access set free-disk-space
[-h] values
values Set the minimum available disk space in MB that triggers the server to delete rotated log files.
COMMAND'dsconfloggingaccesssetlog-format'
usage: dsconf [-v] [-j] instance logging access set log-format [-h] values
values Choose between "default", "json", or "json-pretty"
COMMAND'dsconfloggingaccesssettime-format'
usage: dsconf [-v] [-j] instance logging access set time-format [-h] values
values Time format for JSON logging (strftime)
COMMAND'dsconfloggingaccesslist-levels'
usage: dsconf [-v] [-j] instance logging access list-levels [-h]
COMMAND'dsconfloggingaudit'
usage: dsconf [-v] [-j] instance logging audit [-h] {get,set} ...
POSITIONALARGUMENTS'dsconfloggingaudit'dsconfloggingauditget
Get audit log configuration
dsconfloggingauditset
Set audit log configuration
COMMAND'dsconfloggingauditget'
usage: dsconf [-v] [-j] instance logging audit get [-h]
COMMAND'dsconfloggingauditset'
usage: dsconf [-v] [-j] instance logging audit set [-h]
{logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,buffering-enabled,buffering-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space,log-format,time-format,display-attrs}
...
POSITIONALARGUMENTS'dsconfloggingauditset'dsconfloggingauditsetlogging-enabled
Enable access logging
dsconfloggingauditsetlogging-disabled
Disable audit logging
dsconfloggingauditsetmode
Set the log file permissions. Default is 600
dsconfloggingauditsetlocation
Set the log name and location
dsconfloggingauditsetcompress-enabled
Enable log compression for rotated logs
dsconfloggingauditsetcompress-disabled
Disable log compression for rotated logs
dsconfloggingauditsetbuffering-enabled
Enable log buffering
dsconfloggingauditsetbuffering-disabled
Disable log buffering
dsconfloggingauditsetmax-logs
Set the maximum number of rotated logs the server will maintain
dsconfloggingauditsetmax-logsize
Set the maximum size for a log in MB
dsconfloggingauditsetrotation-interval
Set the interval for when a log is rotated.This works with the interval unit
dsconfloggingauditsetrotation-interval-unit
Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute",
"hour", "day", "week", and "month"
dsconfloggingauditsetrotation-tod-enabled
Enable "time of day" rotation for expired logs
dsconfloggingauditsetrotation-tod-disabled
Disable "time of day" rotation for expired logs
dsconfloggingauditsetrotation-tod-hour
Set the hour when an expired log should be rotated
dsconfloggingauditsetrotation-tod-minute
Set the minute when an expired log should be rotated
dsconfloggingauditsetdeletion-interval
Set the interval a rotated log should be deleted. This works with the deletion internal unit
setting
dsconfloggingauditsetdeletion-interval-unit
Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month"
dsconfloggingauditsetmax-disk-space
Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are
deleted.
dsconfloggingauditsetfree-disk-space
The server deletes the oldest rotated log file when the available disk space in MB is less than
this amount.
dsconfloggingauditsetlog-format
Choose between "default", "json", or "json-pretty"
dsconfloggingauditsettime-format
Time format for JSON logging (strftime)
dsconfloggingauditsetdisplay-attrs
Sets additional identifying attrs to display
COMMAND'dsconfloggingauditsetlogging-enabled'
usage: dsconf [-v] [-j] instance logging audit set logging-enabled [-h]
COMMAND'dsconfloggingauditsetlogging-disabled'
usage: dsconf [-v] [-j] instance logging audit set logging-disabled [-h]
COMMAND'dsconfloggingauditsetmode'
usage: dsconf [-v] [-j] instance logging audit set mode [-h] values
values File permissions. Default is 600
COMMAND'dsconfloggingauditsetlocation'
usage: dsconf [-v] [-j] instance logging audit set location [-h] values
values Log name and location
COMMAND'dsconfloggingauditsetcompress-enabled'
usage: dsconf [-v] [-j] instance logging audit set compress-enabled [-h]
COMMAND'dsconfloggingauditsetcompress-disabled'
usage: dsconf [-v] [-j] instance logging audit set compress-disabled [-h]
COMMAND'dsconfloggingauditsetbuffering-enabled'
usage: dsconf [-v] [-j] instance logging audit set buffering-enabled [-h]
COMMAND'dsconfloggingauditsetbuffering-disabled'
usage: dsconf [-v] [-j] instance logging audit set buffering-disabled [-h]
COMMAND'dsconfloggingauditsetmax-logs'
usage: dsconf [-v] [-j] instance logging audit set max-logs [-h] values
values Set the maximum number of rotated logs the server will maintain
COMMAND'dsconfloggingauditsetmax-logsize'
usage: dsconf [-v] [-j] instance logging audit set max-logsize [-h] values
values Set the maximum size for a log in MB
COMMAND'dsconfloggingauditsetrotation-interval'
usage: dsconf [-v] [-j] instance logging audit set rotation-interval
[-h] values
values Set the interval for when a log is rotated.This works with the interval unit
COMMAND'dsconfloggingauditsetrotation-interval-unit'
usage: dsconf [-v] [-j] instance logging audit set rotation-interval-unit
[-h] values
values Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute",
"hour", "day", "week", and "month"
COMMAND'dsconfloggingauditsetrotation-tod-enabled'
usage: dsconf [-v] [-j] instance logging audit set rotation-tod-enabled [-h]
COMMAND'dsconfloggingauditsetrotation-tod-disabled'
usage: dsconf [-v] [-j] instance logging audit set rotation-tod-disabled [-h]
COMMAND'dsconfloggingauditsetrotation-tod-hour'
usage: dsconf [-v] [-j] instance logging audit set rotation-tod-hour
[-h] values
values Set the hour when an expired log should be rotated
COMMAND'dsconfloggingauditsetrotation-tod-minute'
usage: dsconf [-v] [-j] instance logging audit set rotation-tod-minute
[-h] values
values Set the minute when an expired log should be rotated
COMMAND'dsconfloggingauditsetdeletion-interval'
usage: dsconf [-v] [-j] instance logging audit set deletion-interval
[-h] values
values Set the interval a rotated log should be deleted. This works with the deletion internal unit
setting
COMMAND'dsconfloggingauditsetdeletion-interval-unit'
usage: dsconf [-v] [-j] instance logging audit set deletion-interval-unit
[-h] values
values Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month"
COMMAND'dsconfloggingauditsetmax-disk-space'
usage: dsconf [-v] [-j] instance logging audit set max-disk-space [-h] values
values Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are
deleted.
COMMAND'dsconfloggingauditsetfree-disk-space'
usage: dsconf [-v] [-j] instance logging audit set free-disk-space [-h] values
values Set the minimum available disk space in MB that triggers the server to delete rotated log files.
COMMAND'dsconfloggingauditsetlog-format'
usage: dsconf [-v] [-j] instance logging audit set log-format [-h] values
values Choose between "default", "json", or "json-pretty"
COMMAND'dsconfloggingauditsettime-format'
usage: dsconf [-v] [-j] instance logging audit set time-format [-h] values
values Time format for JSON logging (strftime)
COMMAND'dsconfloggingauditsetdisplay-attrs'
usage: dsconf [-v] [-j] instance logging audit set display-attrs
[-h] values [values ...]
values Sets additional identifying attrs to display
COMMAND'dsconfloggingauditfail'
usage: dsconf [-v] [-j] instance logging auditfail [-h] {get,set} ...
POSITIONALARGUMENTS'dsconfloggingauditfail'dsconfloggingauditfailget
Get auditfail log configuration
dsconfloggingauditfailset
Set auditfail log configuration
COMMAND'dsconfloggingauditfailget'
usage: dsconf [-v] [-j] instance logging auditfail get [-h]
COMMAND'dsconfloggingauditfailset'
usage: dsconf [-v] [-j] instance logging auditfail set [-h]
{logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space}
...
POSITIONALARGUMENTS'dsconfloggingauditfailset'dsconfloggingauditfailsetlogging-enabled
Enable access logging
dsconfloggingauditfailsetlogging-disabled
Disable auditfail logging
dsconfloggingauditfailsetmode
Set the log file permissions. Default is 600
dsconfloggingauditfailsetlocation
Set the log name and location
dsconfloggingauditfailsetcompress-enabled
Enable log compression for rotated logs
dsconfloggingauditfailsetcompress-disabled
Disable log compression for rotated logs
dsconfloggingauditfailsetmax-logs
Set the maximum number of rotated logs the server will maintain
dsconfloggingauditfailsetmax-logsize
Set the maximum size for a log in MB
dsconfloggingauditfailsetrotation-interval
Set the interval for when a log is rotated.This works with the interval unit
dsconfloggingauditfailsetrotation-interval-unit
Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute",
"hour", "day", "week", and "month"
dsconfloggingauditfailsetrotation-tod-enabled
Enable "time of day" rotation for expired logs
dsconfloggingauditfailsetrotation-tod-disabled
Disable "time of day" rotation for expired logs
dsconfloggingauditfailsetrotation-tod-hour
Set the hour when an expired log should be rotated
dsconfloggingauditfailsetrotation-tod-minute
Set the minute when an expired log should be rotated
dsconfloggingauditfailsetdeletion-interval
Set the interval a rotated log should be deleted. This works with the deletion internal unit
setting
dsconfloggingauditfailsetdeletion-interval-unit
Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month"
dsconfloggingauditfailsetmax-disk-space
Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are
deleted.
dsconfloggingauditfailsetfree-disk-space
The server deletes the oldest rotated log file when the available disk space in MB is less than
this amount.
COMMAND'dsconfloggingauditfailsetlogging-enabled'
usage: dsconf [-v] [-j] instance logging auditfail set logging-enabled [-h]
COMMAND'dsconfloggingauditfailsetlogging-disabled'
usage: dsconf [-v] [-j] instance logging auditfail set logging-disabled [-h]
COMMAND'dsconfloggingauditfailsetmode'
usage: dsconf [-v] [-j] instance logging auditfail set mode [-h] values
values File permissions. Default is 600
COMMAND'dsconfloggingauditfailsetlocation'
usage: dsconf [-v] [-j] instance logging auditfail set location [-h] values
values Log name and location
COMMAND'dsconfloggingauditfailsetcompress-enabled'
usage: dsconf [-v] [-j] instance logging auditfail set compress-enabled [-h]
COMMAND'dsconfloggingauditfailsetcompress-disabled'
usage: dsconf [-v] [-j] instance logging auditfail set compress-disabled [-h]
COMMAND'dsconfloggingauditfailsetmax-logs'
usage: dsconf [-v] [-j] instance logging auditfail set max-logs [-h] values
values Set the maximum number of rotated logs the server will maintain
COMMAND'dsconfloggingauditfailsetmax-logsize'
usage: dsconf [-v] [-j] instance logging auditfail set max-logsize [-h] values
values Set the maximum size for a log in MB
COMMAND'dsconfloggingauditfailsetrotation-interval'
usage: dsconf [-v] [-j] instance logging auditfail set rotation-interval
[-h] values
values Set the interval for when a log is rotated.This works with the interval unit
COMMAND'dsconfloggingauditfailsetrotation-interval-unit'
usage: dsconf [-v] [-j] instance logging auditfail set rotation-interval-unit
[-h] values
values Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute",
"hour", "day", "week", and "month"
COMMAND'dsconfloggingauditfailsetrotation-tod-enabled'
usage: dsconf [-v] [-j] instance logging auditfail set rotation-tod-enabled
[-h]
COMMAND'dsconfloggingauditfailsetrotation-tod-disabled'
usage: dsconf [-v] [-j] instance logging auditfail set rotation-tod-disabled
[-h]
COMMAND'dsconfloggingauditfailsetrotation-tod-hour'
usage: dsconf [-v] [-j] instance logging auditfail set rotation-tod-hour
[-h] values
values Set the hour when an expired log should be rotated
COMMAND'dsconfloggingauditfailsetrotation-tod-minute'
usage: dsconf [-v] [-j] instance logging auditfail set rotation-tod-minute
[-h] values
values Set the minute when an expired log should be rotated
COMMAND'dsconfloggingauditfailsetdeletion-interval'
usage: dsconf [-v] [-j] instance logging auditfail set deletion-interval
[-h] values
values Set the interval a rotated log should be deleted. This works with the deletion internal unit
setting
COMMAND'dsconfloggingauditfailsetdeletion-interval-unit'
usage: dsconf [-v] [-j] instance logging auditfail set deletion-interval-unit
[-h] values
values Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month"
COMMAND'dsconfloggingauditfailsetmax-disk-space'
usage: dsconf [-v] [-j] instance logging auditfail set max-disk-space
[-h] values
values Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are
deleted.
COMMAND'dsconfloggingauditfailsetfree-disk-space'
usage: dsconf [-v] [-j] instance logging auditfail set free-disk-space
[-h] values
values Set the minimum available disk space in MB that triggers the server to delete rotated log files.
COMMAND'dsconfloggingerror'
usage: dsconf [-v] [-j] instance logging error [-h] {get,set,list-levels} ...
POSITIONALARGUMENTS'dsconfloggingerror'dsconfloggingerrorget
Get error log configuration
dsconfloggingerrorset
Set error log configuration
dsconfloggingerrorlist-levels
List all the log levels
COMMAND'dsconfloggingerrorget'
usage: dsconf [-v] [-j] instance logging error get [-h]
COMMAND'dsconfloggingerrorset'
usage: dsconf [-v] [-j] instance logging error set [-h]
{level,logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,buffering-enabled,buffering-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space}
...
POSITIONALARGUMENTS'dsconfloggingerrorset'dsconfloggingerrorsetlevel
Set the log level
dsconfloggingerrorsetlogging-enabled
Enable access logging
dsconfloggingerrorsetlogging-disabled
Disable error logging
dsconfloggingerrorsetmode
Set the log file permissions. Default is 600
dsconfloggingerrorsetlocation
Set the log name and location
dsconfloggingerrorsetcompress-enabled
Enable log compression for rotated logs
dsconfloggingerrorsetcompress-disabled
Disable log compression for rotated logs
dsconfloggingerrorsetbuffering-enabled
Enable log buffering
dsconfloggingerrorsetbuffering-disabled
Disable log buffering
dsconfloggingerrorsetmax-logs
Set the maximum number of rotated logs the server will maintain
dsconfloggingerrorsetmax-logsize
Set the maximum size for a log in MB
dsconfloggingerrorsetrotation-interval
Set the interval for when a log is rotated.This works with the interval unit
dsconfloggingerrorsetrotation-interval-unit
Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute",
"hour", "day", "week", and "month"
dsconfloggingerrorsetrotation-tod-enabled
Enable "time of day" rotation for expired logs
dsconfloggingerrorsetrotation-tod-disabled
Disable "time of day" rotation for expired logs
dsconfloggingerrorsetrotation-tod-hour
Set the hour when an expired log should be rotated
dsconfloggingerrorsetrotation-tod-minute
Set the minute when an expired log should be rotated
dsconfloggingerrorsetdeletion-interval
Set the interval a rotated log should be deleted. This works with the deletion internal unit
setting
dsconfloggingerrorsetdeletion-interval-unit
Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month"
dsconfloggingerrorsetmax-disk-space
Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are
deleted.
dsconfloggingerrorsetfree-disk-space
The server deletes the oldest rotated log file when the available disk space in MB is less than
this amount.
COMMAND'dsconfloggingerrorsetlevel'
usage: dsconf [-v] [-j] instance logging error set level [-h]
levels [levels ...]
levels log level
COMMAND'dsconfloggingerrorsetlogging-enabled'
usage: dsconf [-v] [-j] instance logging error set logging-enabled [-h]
COMMAND'dsconfloggingerrorsetlogging-disabled'
usage: dsconf [-v] [-j] instance logging error set logging-disabled [-h]
COMMAND'dsconfloggingerrorsetmode'
usage: dsconf [-v] [-j] instance logging error set mode [-h] values
values File permissions. Default is 600
COMMAND'dsconfloggingerrorsetlocation'
usage: dsconf [-v] [-j] instance logging error set location [-h] values
values Log name and location
COMMAND'dsconfloggingerrorsetcompress-enabled'
usage: dsconf [-v] [-j] instance logging error set compress-enabled [-h]
COMMAND'dsconfloggingerrorsetcompress-disabled'
usage: dsconf [-v] [-j] instance logging error set compress-disabled [-h]
COMMAND'dsconfloggingerrorsetbuffering-enabled'
usage: dsconf [-v] [-j] instance logging error set buffering-enabled [-h]
COMMAND'dsconfloggingerrorsetbuffering-disabled'
usage: dsconf [-v] [-j] instance logging error set buffering-disabled [-h]
COMMAND'dsconfloggingerrorsetmax-logs'
usage: dsconf [-v] [-j] instance logging error set max-logs [-h] values
values Set the maximum number of rotated logs the server will maintain
COMMAND'dsconfloggingerrorsetmax-logsize'
usage: dsconf [-v] [-j] instance logging error set max-logsize [-h] values
values Set the maximum size for a log in MB
COMMAND'dsconfloggingerrorsetrotation-interval'
usage: dsconf [-v] [-j] instance logging error set rotation-interval
[-h] values
values Set the interval for when a log is rotated.This works with the interval unit
COMMAND'dsconfloggingerrorsetrotation-interval-unit'
usage: dsconf [-v] [-j] instance logging error set rotation-interval-unit
[-h] values
values Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute",
"hour", "day", "week", and "month"
COMMAND'dsconfloggingerrorsetrotation-tod-enabled'
usage: dsconf [-v] [-j] instance logging error set rotation-tod-enabled [-h]
COMMAND'dsconfloggingerrorsetrotation-tod-disabled'
usage: dsconf [-v] [-j] instance logging error set rotation-tod-disabled [-h]
COMMAND'dsconfloggingerrorsetrotation-tod-hour'
usage: dsconf [-v] [-j] instance logging error set rotation-tod-hour
[-h] values
values Set the hour when an expired log should be rotated
COMMAND'dsconfloggingerrorsetrotation-tod-minute'
usage: dsconf [-v] [-j] instance logging error set rotation-tod-minute
[-h] values
values Set the minute when an expired log should be rotated
COMMAND'dsconfloggingerrorsetdeletion-interval'
usage: dsconf [-v] [-j] instance logging error set deletion-interval
[-h] values
values Set the interval a rotated log should be deleted. This works with the deletion internal unit
setting
COMMAND'dsconfloggingerrorsetdeletion-interval-unit'
usage: dsconf [-v] [-j] instance logging error set deletion-interval-unit
[-h] values
values Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month"
COMMAND'dsconfloggingerrorsetmax-disk-space'
usage: dsconf [-v] [-j] instance logging error set max-disk-space [-h] values
values Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are
deleted.
COMMAND'dsconfloggingerrorsetfree-disk-space'
usage: dsconf [-v] [-j] instance logging error set free-disk-space [-h] values
values Set the minimum available disk space in MB that triggers the server to delete rotated log files.
COMMAND'dsconfloggingerrorlist-levels'
usage: dsconf [-v] [-j] instance logging error list-levels [-h]
COMMAND'dsconfloggingsecurity'
usage: dsconf [-v] [-j] instance logging security [-h] {get,set} ...
POSITIONALARGUMENTS'dsconfloggingsecurity'dsconfloggingsecurityget
Get security log configuration
dsconfloggingsecurityset
Set security log configuration
COMMAND'dsconfloggingsecurityget'
usage: dsconf [-v] [-j] instance logging security get [-h]
COMMAND'dsconfloggingsecurityset'
usage: dsconf [-v] [-j] instance logging security set [-h]
{logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,buffering-enabled,buffering-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space}
...
POSITIONALARGUMENTS'dsconfloggingsecurityset'dsconfloggingsecuritysetlogging-enabled
Enable access logging
dsconfloggingsecuritysetlogging-disabled
Disable security logging
dsconfloggingsecuritysetmode
Set the log file permissions. Default is 600
dsconfloggingsecuritysetlocation
Set the log name and location
dsconfloggingsecuritysetcompress-enabled
Enable log compression for rotated logs
dsconfloggingsecuritysetcompress-disabled
Disable log compression for rotated logs
dsconfloggingsecuritysetbuffering-enabled
Enable log buffering
dsconfloggingsecuritysetbuffering-disabled
Disable log buffering
dsconfloggingsecuritysetmax-logs
Set the maximum number of rotated logs the server will maintain
dsconfloggingsecuritysetmax-logsize
Set the maximum size for a log in MB
dsconfloggingsecuritysetrotation-interval
Set the interval for when a log is rotated.This works with the interval unit
dsconfloggingsecuritysetrotation-interval-unit
Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute",
"hour", "day", "week", and "month"
dsconfloggingsecuritysetrotation-tod-enabled
Enable "time of day" rotation for expired logs
dsconfloggingsecuritysetrotation-tod-disabled
Disable "time of day" rotation for expired logs
dsconfloggingsecuritysetrotation-tod-hour
Set the hour when an expired log should be rotated
dsconfloggingsecuritysetrotation-tod-minute
Set the minute when an expired log should be rotated
dsconfloggingsecuritysetdeletion-interval
Set the interval a rotated log should be deleted. This works with the deletion internal unit
setting
dsconfloggingsecuritysetdeletion-interval-unit
Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month"
dsconfloggingsecuritysetmax-disk-space
Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are
deleted.
dsconfloggingsecuritysetfree-disk-space
The server deletes the oldest rotated log file when the available disk space in MB is less than
this amount.
COMMAND'dsconfloggingsecuritysetlogging-enabled'
usage: dsconf [-v] [-j] instance logging security set logging-enabled [-h]
COMMAND'dsconfloggingsecuritysetlogging-disabled'
usage: dsconf [-v] [-j] instance logging security set logging-disabled [-h]
COMMAND'dsconfloggingsecuritysetmode'
usage: dsconf [-v] [-j] instance logging security set mode [-h] values
values File permissions. Default is 600
COMMAND'dsconfloggingsecuritysetlocation'
usage: dsconf [-v] [-j] instance logging security set location [-h] values
values Log name and location
COMMAND'dsconfloggingsecuritysetcompress-enabled'
usage: dsconf [-v] [-j] instance logging security set compress-enabled [-h]
COMMAND'dsconfloggingsecuritysetcompress-disabled'
usage: dsconf [-v] [-j] instance logging security set compress-disabled [-h]
COMMAND'dsconfloggingsecuritysetbuffering-enabled'
usage: dsconf [-v] [-j] instance logging security set buffering-enabled [-h]
COMMAND'dsconfloggingsecuritysetbuffering-disabled'
usage: dsconf [-v] [-j] instance logging security set buffering-disabled [-h]
COMMAND'dsconfloggingsecuritysetmax-logs'
usage: dsconf [-v] [-j] instance logging security set max-logs [-h] values
values Set the maximum number of rotated logs the server will maintain
COMMAND'dsconfloggingsecuritysetmax-logsize'
usage: dsconf [-v] [-j] instance logging security set max-logsize [-h] values
values Set the maximum size for a log in MB
COMMAND'dsconfloggingsecuritysetrotation-interval'
usage: dsconf [-v] [-j] instance logging security set rotation-interval
[-h] values
values Set the interval for when a log is rotated.This works with the interval unit
COMMAND'dsconfloggingsecuritysetrotation-interval-unit'
usage: dsconf [-v] [-j] instance logging security set rotation-interval-unit
[-h] values
values Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute",
"hour", "day", "week", and "month"
COMMAND'dsconfloggingsecuritysetrotation-tod-enabled'
usage: dsconf [-v] [-j] instance logging security set rotation-tod-enabled
[-h]
COMMAND'dsconfloggingsecuritysetrotation-tod-disabled'
usage: dsconf [-v] [-j] instance logging security set rotation-tod-disabled
[-h]
COMMAND'dsconfloggingsecuritysetrotation-tod-hour'
usage: dsconf [-v] [-j] instance logging security set rotation-tod-hour
[-h] values
values Set the hour when an expired log should be rotated
COMMAND'dsconfloggingsecuritysetrotation-tod-minute'
usage: dsconf [-v] [-j] instance logging security set rotation-tod-minute
[-h] values
values Set the minute when an expired log should be rotated
COMMAND'dsconfloggingsecuritysetdeletion-interval'
usage: dsconf [-v] [-j] instance logging security set deletion-interval
[-h] values
values Set the interval a rotated log should be deleted. This works with the deletion internal unit
setting
COMMAND'dsconfloggingsecuritysetdeletion-interval-unit'
usage: dsconf [-v] [-j] instance logging security set deletion-interval-unit
[-h] values
values Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month"
COMMAND'dsconfloggingsecuritysetmax-disk-space'
usage: dsconf [-v] [-j] instance logging security set max-disk-space
[-h] values
values Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are
deleted.
COMMAND'dsconfloggingsecuritysetfree-disk-space'
usage: dsconf [-v] [-j] instance logging security set free-disk-space
[-h] values
values Set the minimum available disk space in MB that triggers the server to delete rotated log files.
COMMAND'dsconfmonitor'
usage: dsconf [-v] [-j] instance monitor [-h]
{server,dbmon,ldbm,backend,snmp,chaining,disk} ...
POSITIONALARGUMENTS'dsconfmonitor'dsconfmonitorserver
Displays the server statistics, connections, and operations
dsconfmonitordbmon
Monitor all database statistics in a single report
dsconfmonitorldbm
Monitor the LDBM statistics, such as dbcache
dsconfmonitorbackend
Monitor the behavior of a backend database
dsconfmonitorsnmp
Displays the SNMP statistics
dsconfmonitorchaining
Monitor database chaining statistics
dsconfmonitordisk
Displays the disk space statistics. All values are in bytes.
COMMAND'dsconfmonitorserver'
usage: dsconf [-v] [-j] instance monitor server [-h]
COMMAND'dsconfmonitordbmon'
usage: dsconf [-v] [-j] instance monitor dbmon [-h] [-b BACKENDS] [-x]
OPTIONS'dsconfmonitordbmon'-bBACKENDS, --backendsBACKENDS
Specifies a list of space-separated backends to monitor. Default is all backends.
-x, --indexes
Shows index stats for each backend
COMMAND'dsconfmonitorldbm'
usage: dsconf [-v] [-j] instance monitor ldbm [-h]
COMMAND'dsconfmonitorbackend'
usage: dsconf [-v] [-j] instance monitor backend [-h] [backend]
backend
The optional name of the backend to monitor
COMMAND'dsconfmonitorsnmp'
usage: dsconf [-v] [-j] instance monitor snmp [-h]
COMMAND'dsconfmonitorchaining'
usage: dsconf [-v] [-j] instance monitor chaining [-h] [backend]
backend
The optional name of the chaining backend to monitor
COMMAND'dsconfmonitordisk'
usage: dsconf [-v] [-j] instance monitor disk [-h]
COMMAND'dsconfplugin'
usage: dsconf [-v] [-j] instance plugin [-h]
{memberof,automember,referential-integrity,root-dn,usn,account-policy,attr-uniq,dna,ldap-pass-through-auth,linked-attr,managed-entries,pam-pass-through-auth,retro-changelog,posix-winsync,contentsync,entryuuid,pwstorage-scheme,list,show,set}
...
POSITIONALARGUMENTS'dsconfplugin'dsconfpluginmemberof
Manage and configure MemberOf plugin
dsconfpluginautomember
Manage and configure Automembership plugin
dsconfpluginreferential-integrity
Manage and configure Referential Integrity Postoperation plugin
dsconfpluginroot-dn
Manage and configure RootDN Access Control plugin
dsconfpluginusn
Manage and configure USN plugin
dsconfpluginaccount-policy
Manage and configure Account Policy plugin
dsconfpluginattr-uniq
Manage and configure Attribute Uniqueness plugin
dsconfplugindna
Manage and configure DNA plugin
dsconfpluginldap-pass-through-auth
Manage and configure LDAP Pass-Through Authentication Plugin
dsconfpluginlinked-attr
Manage and configure Linked Attributes plugin
dsconfpluginmanaged-entries
Manage and configure Managed Entries Plugin
dsconfpluginpam-pass-through-auth
Manage and configure Pass-Through Authentication plugins (LDAP URLs and PAM)
dsconfpluginretro-changelog
Manage and configure Retro Changelog plugin
dsconfpluginposix-winsync
Manage and configure the Posix Winsync API plugin
dsconfplugincontentsync
Manage and configure Content Sync Plugin (aka syncrepl)
dsconfpluginentryuuid
Manage and configure EntryUUID plugin
dsconfpluginpwstorage-scheme
Manage password storage scheme plugins
dsconfpluginlist
List current configured (enabled and disabled) plugins
dsconfpluginshow
Show the plugin data
dsconfpluginset
Edit the plugin settings
COMMAND'dsconfpluginmemberof'
usage: dsconf [-v] [-j] instance plugin memberof [-h]
{show,enable,disable,status,set,config-entry,fixup,fixup-status}
...
POSITIONALARGUMENTS'dsconfpluginmemberof'dsconfpluginmemberofshow
Displays the plugin configuration
dsconfpluginmemberofenable
Enables the plugin
dsconfpluginmemberofdisable
Disables the plugin
dsconfpluginmemberofstatus
Displays the plugin status
dsconfpluginmemberofset
Edit the plugin settings
dsconfpluginmemberofconfig-entry
Manage the config entry
dsconfpluginmemberoffixup
Run the fix-up task for memberOf plugin
dsconfpluginmemberoffixup-status
Check the status of a fix-up task
COMMAND'dsconfpluginmemberofshow'
usage: dsconf [-v] [-j] instance plugin memberof show [-h]
COMMAND'dsconfpluginmemberofenable'
usage: dsconf [-v] [-j] instance plugin memberof enable [-h]
COMMAND'dsconfpluginmemberofdisable'
usage: dsconf [-v] [-j] instance plugin memberof disable [-h]
COMMAND'dsconfpluginmemberofstatus'
usage: dsconf [-v] [-j] instance plugin memberof status [-h]
COMMAND'dsconfpluginmemberofset'
usage: dsconf [-v] [-j] instance plugin memberof set [-h] [--attr ATTR]
[--groupattr GROUPATTR [GROUPATTR ...]]
[--allbackends {on,off}]
[--skipnested {on,off}]
[--scope SCOPE [SCOPE ...]]
[--exclude EXCLUDE [EXCLUDE ...]]
[--autoaddoc AUTOADDOC]
[--config-entry CONFIG_ENTRY]
OPTIONS'dsconfpluginmemberofset'--attrATTR
Specifies the attribute in the user entry for the Directory Server to manage to reflect group
membership (memberOfAttr)
--groupattrGROUPATTR[GROUPATTR...]
Specifies the attribute in the group entry to use to identify the DNs of group members
(memberOfGroupAttr)
--allbackends{on,off}
Specifies whether to search the local suffix for user entries on all available suffixes
(memberOfAllBackends)
--skipnested{on,off}
Specifies whether to skip nested groups or not (memberOfSkipNested)
--scopeSCOPE[SCOPE...]
Specifies backends or multiple-nested suffixes for the MemberOf plug-in to work on
(memberOfEntryScope)
--excludeEXCLUDE[EXCLUDE...]
Specifies backends or multiple-nested suffixes for the MemberOf plug-in to exclude
(memberOfEntryScopeExcludeSubtree)
--autoaddocAUTOADDOC
If an entry does not have an object class that allows the memberOf attribute then the memberOf
plugin will automatically add the object class listed in the memberOfAutoAddOC parameter
--config-entryCONFIG_ENTRY
The value to set as nsslapd-pluginConfigArea
COMMAND'dsconfpluginmemberofconfig-entry'
usage: dsconf [-v] [-j] instance plugin memberof config-entry
[-h] {add,set,show,delete} ...
POSITIONALARGUMENTS'dsconfpluginmemberofconfig-entry'dsconfpluginmemberofconfig-entryadd
Add the config entry
dsconfpluginmemberofconfig-entryset
Edit the config entry
dsconfpluginmemberofconfig-entryshow
Display the config entry
dsconfpluginmemberofconfig-entrydelete
Delete the config entry
COMMAND'dsconfpluginmemberofconfig-entryadd'
usage: dsconf [-v] [-j] instance plugin memberof config-entry add
[-h] [--attr ATTR] [--groupattr GROUPATTR [GROUPATTR ...]]
[--allbackends {on,off}] [--skipnested {on,off}]
[--scope SCOPE [SCOPE ...]] [--exclude EXCLUDE [EXCLUDE ...]]
[--autoaddoc AUTOADDOC]
DN
DN The config entry full DN
OPTIONS'dsconfpluginmemberofconfig-entryadd'--attrATTR
Specifies the attribute in the user entry for the Directory Server to manage to reflect group
membership (memberOfAttr)
--groupattrGROUPATTR[GROUPATTR...]
Specifies the attribute in the group entry to use to identify the DNs of group members
(memberOfGroupAttr)
--allbackends{on,off}
Specifies whether to search the local suffix for user entries on all available suffixes
(memberOfAllBackends)
--skipnested{on,off}
Specifies whether to skip nested groups or not (memberOfSkipNested)
--scopeSCOPE[SCOPE...]
Specifies backends or multiple-nested suffixes for the MemberOf plug-in to work on
(memberOfEntryScope)
--excludeEXCLUDE[EXCLUDE...]
Specifies backends or multiple-nested suffixes for the MemberOf plug-in to exclude
(memberOfEntryScopeExcludeSubtree)
--autoaddocAUTOADDOC
If an entry does not have an object class that allows the memberOf attribute then the memberOf
plugin will automatically add the object class listed in the memberOfAutoAddOC parameter
COMMAND'dsconfpluginmemberofconfig-entryset'
usage: dsconf [-v] [-j] instance plugin memberof config-entry set
[-h] [--attr ATTR] [--groupattr GROUPATTR [GROUPATTR ...]]
[--allbackends {on,off}] [--skipnested {on,off}]
[--scope SCOPE [SCOPE ...]] [--exclude EXCLUDE [EXCLUDE ...]]
[--autoaddoc AUTOADDOC]
DN
DN The config entry full DN
OPTIONS'dsconfpluginmemberofconfig-entryset'--attrATTR
Specifies the attribute in the user entry for the Directory Server to manage to reflect group
membership (memberOfAttr)
--groupattrGROUPATTR[GROUPATTR...]
Specifies the attribute in the group entry to use to identify the DNs of group members
(memberOfGroupAttr)
--allbackends{on,off}
Specifies whether to search the local suffix for user entries on all available suffixes
(memberOfAllBackends)
--skipnested{on,off}
Specifies whether to skip nested groups or not (memberOfSkipNested)
--scopeSCOPE[SCOPE...]
Specifies backends or multiple-nested suffixes for the MemberOf plug-in to work on
(memberOfEntryScope)
--excludeEXCLUDE[EXCLUDE...]
Specifies backends or multiple-nested suffixes for the MemberOf plug-in to exclude
(memberOfEntryScopeExcludeSubtree)
--autoaddocAUTOADDOC
If an entry does not have an object class that allows the memberOf attribute then the memberOf
plugin will automatically add the object class listed in the memberOfAutoAddOC parameter
COMMAND'dsconfpluginmemberofconfig-entryshow'
usage: dsconf [-v] [-j] instance plugin memberof config-entry show [-h] DN
DN The config entry full DN
COMMAND'dsconfpluginmemberofconfig-entrydelete'
usage: dsconf [-v] [-j] instance plugin memberof config-entry delete [-h] DN
DN The config entry full DN
COMMAND'dsconfpluginmemberoffixup'
usage: dsconf [-v] [-j] instance plugin memberof fixup [-h] [-f FILTER]
[--wait]
[--timeout TIMEOUT]
DN
DN Base DN that contains entries to fix up
OPTIONS'dsconfpluginmemberoffixup'-fFILTER, --filterFILTER
Filter for entries to fix up. If omitted, all entries with objectclass
inetuser/inetadmin/nsmemberof under the specified base will have their memberOf attribute
regenerated.
--wait Wait for the task to finish, this could take a long time
--timeoutTIMEOUT
Sets the task timeout. ,Default is 0 (no timeout)
COMMAND'dsconfpluginmemberoffixup-status'
usage: dsconf [-v] [-j] instance plugin memberof fixup-status
[-h] [--dn DN] [--show-log] [--watch]
OPTIONS'dsconfpluginmemberoffixup-status'--dnDN
The task entry's DN
--show-log
Display the task log
--watch
Watch the task's status and wait for it to finish
COMMAND'dsconfpluginautomember'
usage: dsconf [-v] [-j] instance plugin automember [-h]
{show,enable,disable,status,list,definition,fixup,fixup-status,abort-fixup}
...
POSITIONALARGUMENTS'dsconfpluginautomember'dsconfpluginautomembershow
Displays the plugin configuration
dsconfpluginautomemberenable
Enables the plugin
dsconfpluginautomemberdisable
Disables the plugin
dsconfpluginautomemberstatus
Displays the plugin status
dsconfpluginautomemberlist
List Automembership definitions or regex rules.
dsconfpluginautomemberdefinition
Manage Automembership definition.
dsconfpluginautomemberfixup
Run a rebuild membership task.
dsconfpluginautomemberfixup-status
Check the status of a fix-up task
dsconfpluginautomemberabort-fixup
Abort the rebuild membership task.
COMMAND'dsconfpluginautomembershow'
usage: dsconf [-v] [-j] instance plugin automember show [-h]
COMMAND'dsconfpluginautomemberenable'
usage: dsconf [-v] [-j] instance plugin automember enable [-h]
COMMAND'dsconfpluginautomemberdisable'
usage: dsconf [-v] [-j] instance plugin automember disable [-h]
COMMAND'dsconfpluginautomemberstatus'
usage: dsconf [-v] [-j] instance plugin automember status [-h]
COMMAND'dsconfpluginautomemberlist'
usage: dsconf [-v] [-j] instance plugin automember list [-h]
{definitions,regexes} ...
POSITIONALARGUMENTS'dsconfpluginautomemberlist'dsconfpluginautomemberlistdefinitions
Lists Automembership definitions.
dsconfpluginautomemberlistregexes
List Automembership regex rules.
COMMAND'dsconfpluginautomemberlistdefinitions'
usage: dsconf [-v] [-j] instance plugin automember list definitions [-h]
COMMAND'dsconfpluginautomemberlistregexes'
usage: dsconf [-v] [-j] instance plugin automember list regexes [-h] DEFNAME
DEFNAME
The definition entry CN
COMMAND'dsconfpluginautomemberdefinition'
usage: dsconf [-v] [-j] instance plugin automember definition
[-h] DEFNAME {add,set,delete,show,regex} ...
POSITIONALARGUMENTS'dsconfpluginautomemberdefinition'dsconfpluginautomemberdefinitionadd
Creates Automembership definition.
dsconfpluginautomemberdefinitionset
Edits Automembership definition.
dsconfpluginautomemberdefinitiondelete
Removes Automembership definition.
dsconfpluginautomemberdefinitionshow
Displays Automembership definition.
dsconfpluginautomemberdefinitionregex
Manage Automembership regex rules.
COMMAND'dsconfpluginautomemberdefinitionadd'
usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME add
[-h] --grouping-attr GROUPING_ATTR [--default-group DEFAULT_GROUP]
--scope SCOPE --filter FILTER
OPTIONS'dsconfpluginautomemberdefinitionadd'--grouping-attrGROUPING_ATTR
Specifies the name of the member attribute in the group entry and the attribute in the object
entry that supplies the member attribute value, in the format group_member_attr:entry_attr
(autoMemberGroupingAttr)
--default-groupDEFAULT_GROUP
Sets default or fallback group to add the entry to as a member attribute in group entry
(autoMemberDefaultGroup)
--scopeSCOPE
Sets the subtree DN to search for entries (autoMemberScope)
--filterFILTER
Sets a standard LDAP search filter to use to search for matching entries (autoMemberFilter)
COMMAND'dsconfpluginautomemberdefinitionset'
usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME set
[-h] --grouping-attr GROUPING_ATTR [--default-group DEFAULT_GROUP]
--scope SCOPE --filter FILTER
OPTIONS'dsconfpluginautomemberdefinitionset'--grouping-attrGROUPING_ATTR
Specifies the name of the member attribute in the group entry and the attribute in the object
entry that supplies the member attribute value, in the format group_member_attr:entry_attr
(autoMemberGroupingAttr)
--default-groupDEFAULT_GROUP
Sets default or fallback group to add the entry to as a member attribute in group entry
(autoMemberDefaultGroup)
--scopeSCOPE
Sets the subtree DN to search for entries (autoMemberScope)
--filterFILTER
Sets a standard LDAP search filter to use to search for matching entries (autoMemberFilter)
COMMAND'dsconfpluginautomemberdefinitiondelete'
usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME delete
[-h]
COMMAND'dsconfpluginautomemberdefinitionshow'
usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME show
[-h]
COMMAND'dsconfpluginautomemberdefinitionregex'
usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME regex
[-h] REGEXNAME {add,set,delete,show} ...
POSITIONALARGUMENTS'dsconfpluginautomemberdefinitionregex'dsconfpluginautomemberdefinitionregexadd
Creates Automembership regex.
dsconfpluginautomemberdefinitionregexset
Edits Automembership regex.
dsconfpluginautomemberdefinitionregexdelete
Removes Automembership regex.
dsconfpluginautomemberdefinitionregexshow
Displays Automembership regex.
COMMAND'dsconfpluginautomemberdefinitionregexadd'
usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME regex REGEXNAME add
[-h] [--exclusive EXCLUSIVE [EXCLUSIVE ...]]
[--inclusive INCLUSIVE [INCLUSIVE ...]] --target-group TARGET_GROUP
OPTIONS'dsconfpluginautomemberdefinitionregexadd'--exclusiveEXCLUSIVE[EXCLUSIVE...]
Sets a single regular expression to use to identify entries to exclude (autoMemberExclusiveRegex)
--inclusiveINCLUSIVE[INCLUSIVE...]
Sets a single regular expression to use to identify entries to include (autoMemberInclusiveRegex)
--target-groupTARGET_GROUP
Sets which group to add the entry to as a member, if it meets the regular expression conditions
(autoMemberTargetGroup)
COMMAND'dsconfpluginautomemberdefinitionregexset'
usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME regex REGEXNAME set
[-h] [--exclusive EXCLUSIVE [EXCLUSIVE ...]]
[--inclusive INCLUSIVE [INCLUSIVE ...]] --target-group TARGET_GROUP
OPTIONS'dsconfpluginautomemberdefinitionregexset'--exclusiveEXCLUSIVE[EXCLUSIVE...]
Sets a single regular expression to use to identify entries to exclude (autoMemberExclusiveRegex)
--inclusiveINCLUSIVE[INCLUSIVE...]
Sets a single regular expression to use to identify entries to include (autoMemberInclusiveRegex)
--target-groupTARGET_GROUP
Sets which group to add the entry to as a member, if it meets the regular expression conditions
(autoMemberTargetGroup)
COMMAND'dsconfpluginautomemberdefinitionregexdelete'
usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME regex REGEXNAME delete
[-h]
COMMAND'dsconfpluginautomemberdefinitionregexshow'
usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME regex REGEXNAME show
[-h]
COMMAND'dsconfpluginautomemberfixup'
usage: dsconf [-v] [-j] instance plugin automember fixup [-h] -f FILTER
-s {sub,base,one}
[--cleanup] [--wait]
[--timeout TIMEOUT]
DN
DN Base DN that contains entries to fix up
OPTIONS'dsconfpluginautomemberfixup'-fFILTER, --filterFILTER
Sets the LDAP filter for entries to fix up
-s{sub,base,one}, --scope{sub,base,one}
Sets the LDAP search scope for entries to fix up
--cleanup
Clean up previous group memberships before rebuilding
--wait Wait for the task to finish, this could take a long time
--timeoutTIMEOUT
Set a timeout to wait for the fixup task. Default is 0 (no timeout)
COMMAND'dsconfpluginautomemberfixup-status'
usage: dsconf [-v] [-j] instance plugin automember fixup-status
[-h] [--dn DN] [--show-log] [--watch]
OPTIONS'dsconfpluginautomemberfixup-status'--dnDN
The task entry's DN
--show-log
Display the task log
--watch
Watch the task's status and wait for it to finish
COMMAND'dsconfpluginautomemberabort-fixup'
usage: dsconf [-v] [-j] instance plugin automember abort-fixup
[-h] [--timeout TIMEOUT]
OPTIONS'dsconfpluginautomemberabort-fixup'--timeoutTIMEOUT
Set a timeout to wait for the abort task. Default is 0 (no timeout)
COMMAND'dsconfpluginreferential-integrity'
usage: dsconf instance [-v] [-j] plugin referential-integrity
[-h] {show,enable,disable,status,set,config-entry} ...
POSITIONALARGUMENTS'dsconfpluginreferential-integrity'dsconfpluginreferential-integrityshow
Displays the plugin configuration
dsconfpluginreferential-integrityenable
Enables the plugin
dsconfpluginreferential-integritydisable
Disables the plugin
dsconfpluginreferential-integritystatus
Displays the plugin status
dsconfpluginreferential-integrityset
Edit the plugin settings
dsconfpluginreferential-integrityconfig-entry
Manage the config entry
COMMAND'dsconfpluginreferential-integrityshow'
usage: dsconf [-v] [-j] instance plugin referential-integrity show [-h]
COMMAND'dsconfpluginreferential-integrityenable'
usage: dsconf [-v] [-j] instance plugin referential-integrity enable [-h]
COMMAND'dsconfpluginreferential-integritydisable'
usage: dsconf [-v] [-j] instance plugin referential-integrity disable [-h]
COMMAND'dsconfpluginreferential-integritystatus'
usage: dsconf [-v] [-j] instance plugin referential-integrity status [-h]
COMMAND'dsconfpluginreferential-integrityset'
usage: dsconf [-v] [-j] instance plugin referential-integrity set
[-h] [--update-delay UPDATE_DELAY]
[--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...]]
[--entry-scope ENTRY_SCOPE] [--exclude-entry-scope EXCLUDE_ENTRY_SCOPE]
[--container-scope CONTAINER_SCOPE] [--log-file LOG_FILE]
[--config-entry CONFIG_ENTRY]
OPTIONS'dsconfpluginreferential-integrityset'--update-delayUPDATE_DELAY
Sets the update interval. Special values: 0 - The check is performed immediately, -1 - No check is
performed (referint-update-delay)
--membership-attrMEMBERSHIP_ATTR[MEMBERSHIP_ATTR...]
Specifies attributes to check for and update (referint-membership-attr)
--entry-scopeENTRY_SCOPE
Defines the subtree in which the plug-in looks for the delete or rename operations of a user entry
(nsslapd-pluginEntryScope)
--exclude-entry-scopeEXCLUDE_ENTRY_SCOPE
Defines the subtree in which the plug-in ignores any operations for deleting or renaming a user
(nsslapd-pluginExcludeEntryScope)
--container-scopeCONTAINER_SCOPE
Specifies which branch the plug-in searches for the groups to which the user belongs. It only
updates groups that are under the specified container branch, and leaves all other groups not
updated (nsslapd-pluginContainerScope)
--log-fileLOG_FILE
Specifies a path to the Referential integrity logfile.For example:
/var/log/dirsrv/slapd-YOUR_INSTANCE/referint
--config-entryCONFIG_ENTRY
The value to set as nsslapd-pluginConfigArea
COMMAND'dsconfpluginreferential-integrityconfig-entry'
usage: dsconf [-v] [-j] instance plugin referential-integrity config-entry
[-h] {add,set,show,delete} ...
POSITIONALARGUMENTS'dsconfpluginreferential-integrityconfig-entry'dsconfpluginreferential-integrityconfig-entryadd
Add the config entry
dsconfpluginreferential-integrityconfig-entryset
Edit the config entry
dsconfpluginreferential-integrityconfig-entryshow
Display the config entry
dsconfpluginreferential-integrityconfig-entrydelete
Delete the config entry
COMMAND'dsconfpluginreferential-integrityconfig-entryadd'
usage: dsconf [-v] [-j] instance plugin referential-integrity config-entry add
[-h] [--update-delay UPDATE_DELAY]
[--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...]]
[--entry-scope ENTRY_SCOPE] [--exclude-entry-scope EXCLUDE_ENTRY_SCOPE]
[--container-scope CONTAINER_SCOPE] [--log-file LOG_FILE]
DN
DN The config entry full DN
OPTIONS'dsconfpluginreferential-integrityconfig-entryadd'--update-delayUPDATE_DELAY
Sets the update interval. Special values: 0 - The check is performed immediately, -1 - No check is
performed (referint-update-delay)
--membership-attrMEMBERSHIP_ATTR[MEMBERSHIP_ATTR...]
Specifies attributes to check for and update (referint-membership-attr)
--entry-scopeENTRY_SCOPE
Defines the subtree in which the plug-in looks for the delete or rename operations of a user entry
(nsslapd-pluginEntryScope)
--exclude-entry-scopeEXCLUDE_ENTRY_SCOPE
Defines the subtree in which the plug-in ignores any operations for deleting or renaming a user
(nsslapd-pluginExcludeEntryScope)
--container-scopeCONTAINER_SCOPE
Specifies which branch the plug-in searches for the groups to which the user belongs. It only
updates groups that are under the specified container branch, and leaves all other groups not
updated (nsslapd-pluginContainerScope)
--log-fileLOG_FILE
Specifies a path to the Referential integrity logfile.For example:
/var/log/dirsrv/slapd-YOUR_INSTANCE/referint
COMMAND'dsconfpluginreferential-integrityconfig-entryset'
usage: dsconf [-v] [-j] instance plugin referential-integrity config-entry set
[-h] [--update-delay UPDATE_DELAY]
[--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...]]
[--entry-scope ENTRY_SCOPE] [--exclude-entry-scope EXCLUDE_ENTRY_SCOPE]
[--container-scope CONTAINER_SCOPE] [--log-file LOG_FILE]
DN
DN The config entry full DN
OPTIONS'dsconfpluginreferential-integrityconfig-entryset'--update-delayUPDATE_DELAY
Sets the update interval. Special values: 0 - The check is performed immediately, -1 - No check is
performed (referint-update-delay)
--membership-attrMEMBERSHIP_ATTR[MEMBERSHIP_ATTR...]
Specifies attributes to check for and update (referint-membership-attr)
--entry-scopeENTRY_SCOPE
Defines the subtree in which the plug-in looks for the delete or rename operations of a user entry
(nsslapd-pluginEntryScope)
--exclude-entry-scopeEXCLUDE_ENTRY_SCOPE
Defines the subtree in which the plug-in ignores any operations for deleting or renaming a user
(nsslapd-pluginExcludeEntryScope)
--container-scopeCONTAINER_SCOPE
Specifies which branch the plug-in searches for the groups to which the user belongs. It only
updates groups that are under the specified container branch, and leaves all other groups not
updated (nsslapd-pluginContainerScope)
--log-fileLOG_FILE
Specifies a path to the Referential integrity logfile.For example:
/var/log/dirsrv/slapd-YOUR_INSTANCE/referint
COMMAND'dsconfpluginreferential-integrityconfig-entryshow'
usage: dsconf [-v] [-j] instance plugin referential-integrity config-entry show
[-h] DN
DN The config entry full DN
COMMAND'dsconfpluginreferential-integrityconfig-entrydelete'
usage: dsconf [-v] [-j] instance plugin referential-integrity config-entry delete
[-h] DN
DN The config entry full DN
COMMAND'dsconfpluginroot-dn'
usage: dsconf [-v] [-j] instance plugin root-dn [-h]
{show,enable,disable,status,set} ...
POSITIONALARGUMENTS'dsconfpluginroot-dn'dsconfpluginroot-dnshow
Displays the plugin configuration
dsconfpluginroot-dnenable
Enables the plugin
dsconfpluginroot-dndisable
Disables the plugin
dsconfpluginroot-dnstatus
Displays the plugin status
dsconfpluginroot-dnset
Edit the plugin settings
COMMAND'dsconfpluginroot-dnshow'
usage: dsconf [-v] [-j] instance plugin root-dn show [-h]
COMMAND'dsconfpluginroot-dnenable'
usage: dsconf [-v] [-j] instance plugin root-dn enable [-h]
COMMAND'dsconfpluginroot-dndisable'
usage: dsconf [-v] [-j] instance plugin root-dn disable [-h]
COMMAND'dsconfpluginroot-dnstatus'
usage: dsconf [-v] [-j] instance plugin root-dn status [-h]
COMMAND'dsconfpluginroot-dnset'
usage: dsconf [-v] [-j] instance plugin root-dn set [-h]
[--allow-host ALLOW_HOST [ALLOW_HOST ...]]
[--deny-host DENY_HOST [DENY_HOST ...]]
[--allow-ip ALLOW_IP [ALLOW_IP ...]]
[--deny-ip DENY_IP [DENY_IP ...]]
[--open-time OPEN_TIME]
[--close-time CLOSE_TIME]
[--days-allowed DAYS_ALLOWED]
OPTIONS'dsconfpluginroot-dnset'--allow-hostALLOW_HOST[ALLOW_HOST...]
Sets what hosts, by fully-qualified domain name, the root user is allowed to use to access
Directory Server. Any hosts not listed are implicitly denied (rootdn-allow-host)
--deny-hostDENY_HOST[DENY_HOST...]
Sets what hosts, by fully-qualified domain name, the root user is not allowed to use to access
Directory Server. Any hosts not listed are implicitly allowed (rootdn-deny-host). If a host
address is listed in both the rootdn-allow-host and rootdn-deny-host attributes, it is denied
access.
--allow-ipALLOW_IP[ALLOW_IP...]
Sets what IP addresses, either IPv4 or IPv6, for machines the root user is allowed to use to
access Directory Server. Any IP addresses not listed are implicitly denied (rootdn-allow-ip)
--deny-ipDENY_IP[DENY_IP...]
Sets what IP addresses, either IPv4 or IPv6, for machines the root user is not allowed to use to
access Directory Server. Any IP addresses not listed are implicitly allowed (rootdn-deny-ip). If
an IP address is listed in both the rootdn-allow-ip and rootdn-deny-ip attributes, it is denied
access.
--open-timeOPEN_TIME
Sets part of a time period or range when the root user is allowed to access Directory Server. This
sets when the time-based access begins (rootdn-open- time)
--close-timeCLOSE_TIME
Sets part of a time period or range when the root user is allowed to access Directory Server. This
sets when the time-based access ends (rootdn-close- time)
--days-allowedDAYS_ALLOWED
Sets a comma-separated list of what days the root user is allowed to use to access Directory
Server. Any days listed are implicitly denied (rootdn-days- allowed)
COMMAND'dsconfpluginusn'
usage: dsconf [-v] [-j] instance plugin usn [-h]
{show,enable,disable,status,global,cleanup} ...
POSITIONALARGUMENTS'dsconfpluginusn'dsconfpluginusnshow
Displays the plugin configuration
dsconfpluginusnenable
Enables the plugin
dsconfpluginusndisable
Disables the plugin
dsconfpluginusnstatus
Displays the plugin status
dsconfpluginusnglobal
Get or manage global USN mode (nsslapd-entryusn-global)
dsconfpluginusncleanup
Runs the USN tombstone cleanup task
COMMAND'dsconfpluginusnshow'
usage: dsconf [-v] [-j] instance plugin usn show [-h]
COMMAND'dsconfpluginusnenable'
usage: dsconf [-v] [-j] instance plugin usn enable [-h]
COMMAND'dsconfpluginusndisable'
usage: dsconf [-v] [-j] instance plugin usn disable [-h]
COMMAND'dsconfpluginusnstatus'
usage: dsconf [-v] [-j] instance plugin usn status [-h]
COMMAND'dsconfpluginusnglobal'
usage: dsconf [-v] [-j] instance plugin usn global [-h] {on,off} ...
POSITIONALARGUMENTS'dsconfpluginusnglobal'dsconfpluginusnglobalon
Enables USN global mode
dsconfpluginusnglobaloff
Disables USN global mode
COMMAND'dsconfpluginusnglobalon'
usage: dsconf [-v] [-j] instance plugin usn global on [-h]
COMMAND'dsconfpluginusnglobaloff'
usage: dsconf [-v] [-j] instance plugin usn global off [-h]
COMMAND'dsconfpluginusncleanup'
usage: dsconf [-v] [-j] instance plugin usn cleanup [-h] (-s SUFFIX |
-n BACKEND) [-m MAX_USN]
[--timeout TIMEOUT]
OPTIONS'dsconfpluginusncleanup'-sSUFFIX, --suffixSUFFIX
Sets the suffix or subtree in Directory Server to run the cleanup operation against. If the suffix
is not specified, then the back end must be specified (suffix).
-nBACKEND, --backendBACKEND
Sets the Directory Server instance back end, or database, to run the cleanup operation against. If
the back end is not specified, then the suffix must be specified. Backend instance in which USN
tombstone entries (backend)
-mMAX_USN, --max-usnMAX_USN
Sets the highest USN value to delete when removing tombstone entries (max_usn_to_delete)
--timeoutTIMEOUT
Sets the cleanup task timeout. Default is 120 seconds,
COMMAND'dsconfpluginaccount-policy'
usage: dsconf [-v] [-j] instance plugin account-policy [-h]
{show,enable,disable,status,set,config-entry} ...
POSITIONALARGUMENTS'dsconfpluginaccount-policy'dsconfpluginaccount-policyshow
Displays the plugin configuration
dsconfpluginaccount-policyenable
Enables the plugin
dsconfpluginaccount-policydisable
Disables the plugin
dsconfpluginaccount-policystatus
Displays the plugin status
dsconfpluginaccount-policyset
Edit the plugin settings
dsconfpluginaccount-policyconfig-entry
Manage the config entry
COMMAND'dsconfpluginaccount-policyshow'
usage: dsconf [-v] [-j] instance plugin account-policy show [-h]
COMMAND'dsconfpluginaccount-policyenable'
usage: dsconf [-v] [-j] instance plugin account-policy enable [-h]
COMMAND'dsconfpluginaccount-policydisable'
usage: dsconf [-v] [-j] instance plugin account-policy disable [-h]
COMMAND'dsconfpluginaccount-policystatus'
usage: dsconf [-v] [-j] instance plugin account-policy status [-h]
COMMAND'dsconfpluginaccount-policyset'
usage: dsconf [-v] [-j] instance plugin account-policy set [-h]
[--config-entry CONFIG_ENTRY]
OPTIONS'dsconfpluginaccount-policyset'--config-entryCONFIG_ENTRY
Sets the nsslapd-pluginarg0 attribute
COMMAND'dsconfpluginaccount-policyconfig-entry'
usage: dsconf [-v] [-j] instance plugin account-policy config-entry
[-h] {add,set,show,delete} ...
POSITIONALARGUMENTS'dsconfpluginaccount-policyconfig-entry'dsconfpluginaccount-policyconfig-entryadd
Add the config entry
dsconfpluginaccount-policyconfig-entryset
Edit the config entry
dsconfpluginaccount-policyconfig-entryshow
Display the config entry
dsconfpluginaccount-policyconfig-entrydelete
Delete the config entry
COMMAND'dsconfpluginaccount-policyconfig-entryadd'
usage: dsconf [-v] [-j] instance plugin account-policy config-entry add
[-h] [--always-record-login {yes,no}] [--alt-state-attr ALT_STATE_ATTR]
[--always-record-login-attr ALWAYS_RECORD_LOGIN_ATTR]
[--limit-attr LIMIT_ATTR] [--spec-attr SPEC_ATTR]
[--state-attr STATE_ATTR] [--login-history-size LOGIN_HISTORY_SIZE]
[--check-all-state-attrs {yes,no}]
DN
DN The full DN of the config entry
OPTIONS'dsconfpluginaccount-policyconfig-entryadd'--always-record-login{yes,no}
Sets that every entry records its last login time (alwaysRecordLogin)
--alt-state-attrALT_STATE_ATTR
Provides a backup attribute for the server to reference to evaluate the expiration time
(altStateAttrName)
--always-record-login-attrALWAYS_RECORD_LOGIN_ATTR
Specifies the attribute to store the time of the last successful login in this attribute in the
users directory entry (alwaysRecordLoginAttr)
--limit-attrLIMIT_ATTR
Specifies the attribute within the policy to use for the account inactivation limit
(limitAttrName)
--spec-attrSPEC_ATTR
Specifies the attribute to identify which entries are account policy configuration entries
(specAttrName)
--state-attrSTATE_ATTR
Specifies the primary time attribute used to evaluate an account policy (stateAttrName)
--login-history-sizeLOGIN_HISTORY_SIZE
Specifies the number of login timestamps to store (lastLoginHistSize) )
--check-all-state-attrs{yes,no}
Check both state and alternate state attributes for account state
COMMAND'dsconfpluginaccount-policyconfig-entryset'
usage: dsconf [-v] [-j] instance plugin account-policy config-entry set
[-h] [--always-record-login {yes,no}] [--alt-state-attr ALT_STATE_ATTR]
[--always-record-login-attr ALWAYS_RECORD_LOGIN_ATTR]
[--limit-attr LIMIT_ATTR] [--spec-attr SPEC_ATTR]
[--state-attr STATE_ATTR] [--login-history-size LOGIN_HISTORY_SIZE]
[--check-all-state-attrs {yes,no}]
DN
DN The full DN of the config entry
OPTIONS'dsconfpluginaccount-policyconfig-entryset'--always-record-login{yes,no}
Sets that every entry records its last login time (alwaysRecordLogin)
--alt-state-attrALT_STATE_ATTR
Provides a backup attribute for the server to reference to evaluate the expiration time
(altStateAttrName)
--always-record-login-attrALWAYS_RECORD_LOGIN_ATTR
Specifies the attribute to store the time of the last successful login in this attribute in the
users directory entry (alwaysRecordLoginAttr)
--limit-attrLIMIT_ATTR
Specifies the attribute within the policy to use for the account inactivation limit
(limitAttrName)
--spec-attrSPEC_ATTR
Specifies the attribute to identify which entries are account policy configuration entries
(specAttrName)
--state-attrSTATE_ATTR
Specifies the primary time attribute used to evaluate an account policy (stateAttrName)
--login-history-sizeLOGIN_HISTORY_SIZE
Specifies the number of login timestamps to store (lastLoginHistSize) )
--check-all-state-attrs{yes,no}
Check both state and alternate state attributes for account state
COMMAND'dsconfpluginaccount-policyconfig-entryshow'
usage: dsconf [-v] [-j] instance plugin account-policy config-entry show
[-h] DN
DN The full DN of the config entry
COMMAND'dsconfpluginaccount-policyconfig-entrydelete'
usage: dsconf [-v] [-j] instance plugin account-policy config-entry delete
[-h] DN
DN The full DN of the config entry
COMMAND'dsconfpluginattr-uniq'
usage: dsconf [-v] [-j] instance plugin attr-uniq [-h]
{list,add,set,show,delete,enable,disable,status} ...
POSITIONALARGUMENTS'dsconfpluginattr-uniq'dsconfpluginattr-uniqlist
Lists available plugin configs
dsconfpluginattr-uniqadd
Add the config entry
dsconfpluginattr-uniqset
Edit the config entry
dsconfpluginattr-uniqshow
Display the config entry
dsconfpluginattr-uniqdelete
Delete the config entry
dsconfpluginattr-uniqenable
enable plugin
dsconfpluginattr-uniqdisable
disable plugin
dsconfpluginattr-uniqstatus
display plugin status
COMMAND'dsconfpluginattr-uniqlist'
usage: dsconf [-v] [-j] instance plugin attr-uniq list [-h]
COMMAND'dsconfpluginattr-uniqadd'
usage: dsconf [-v] [-j] instance plugin attr-uniq add [-h]
[--enabled {on,off}]
[--attr-name ATTR_NAME [ATTR_NAME ...]]
[--subtree SUBTREE [SUBTREE ...]]
[--across-all-subtrees {on,off}]
[--top-entry-oc TOP_ENTRY_OC]
[--subtree-entries-oc SUBTREE_ENTRIES_OC]
NAME
NAME The name of the plug-in configuration record. (cn) You can use any string, but "attribute_name
Attribute Uniqueness" is recommended.
OPTIONS'dsconfpluginattr-uniqadd'--enabled{on,off}
Identifies whether or not the config is enabled.
--attr-nameATTR_NAME[ATTR_NAME...]
Sets the name of the attribute whose values must be unique. This attribute is multi-valued.
(uniqueness-attribute-name)
--subtreeSUBTREE[SUBTREE...]
Sets the DN under which the plug-in checks for uniqueness of the attributes value. This attribute
is multi-valued (uniqueness-subtrees)
--across-all-subtrees{on,off}
If enabled (on), the plug-in checks that the attribute is unique across all subtrees set. If you
set the attribute to off, uniqueness is only enforced within the subtree of the updated entry
(uniqueness-across-all-subtrees)
--top-entry-ocTOP_ENTRY_OC
Verifies that the value of the attribute set in uniqueness-attribute-name is unique in this
subtree (uniqueness-top-entry-oc)
--subtree-entries-ocSUBTREE_ENTRIES_OC
Verifies if an attribute is unique, if the entry contains the object class set in this parameter
(uniqueness-subtree-entries-oc)
COMMAND'dsconfpluginattr-uniqset'
usage: dsconf [-v] [-j] instance plugin attr-uniq set [-h]
[--enabled {on,off}]
[--attr-name ATTR_NAME [ATTR_NAME ...]]
[--subtree SUBTREE [SUBTREE ...]]
[--across-all-subtrees {on,off}]
[--top-entry-oc TOP_ENTRY_OC]
[--subtree-entries-oc SUBTREE_ENTRIES_OC]
NAME
NAME The name of the plug-in configuration record. (cn) You can use any string, but "attribute_name
Attribute Uniqueness" is recommended.
OPTIONS'dsconfpluginattr-uniqset'--enabled{on,off}
Identifies whether or not the config is enabled.
--attr-nameATTR_NAME[ATTR_NAME...]
Sets the name of the attribute whose values must be unique. This attribute is multi-valued.
(uniqueness-attribute-name)
--subtreeSUBTREE[SUBTREE...]
Sets the DN under which the plug-in checks for uniqueness of the attributes value. This attribute
is multi-valued (uniqueness-subtrees)
--across-all-subtrees{on,off}
If enabled (on), the plug-in checks that the attribute is unique across all subtrees set. If you
set the attribute to off, uniqueness is only enforced within the subtree of the updated entry
(uniqueness-across-all-subtrees)
--top-entry-ocTOP_ENTRY_OC
Verifies that the value of the attribute set in uniqueness-attribute-name is unique in this
subtree (uniqueness-top-entry-oc)
--subtree-entries-ocSUBTREE_ENTRIES_OC
Verifies if an attribute is unique, if the entry contains the object class set in this parameter
(uniqueness-subtree-entries-oc)
COMMAND'dsconfpluginattr-uniqshow'
usage: dsconf [-v] [-j] instance plugin attr-uniq show [-h] NAME
NAME The name of the plug-in configuration record
COMMAND'dsconfpluginattr-uniqdelete'
usage: dsconf [-v] [-j] instance plugin attr-uniq delete [-h] NAME
NAME The name of the plug-in configuration record
COMMAND'dsconfpluginattr-uniqenable'
usage: dsconf [-v] [-j] instance plugin attr-uniq enable [-h] NAME
NAME The name of the plug-in configuration record
COMMAND'dsconfpluginattr-uniqdisable'
usage: dsconf [-v] [-j] instance plugin attr-uniq disable [-h] NAME
NAME The name of the plug-in configuration record
COMMAND'dsconfpluginattr-uniqstatus'
usage: dsconf [-v] [-j] instance plugin attr-uniq status [-h] NAME
NAME The name of the plug-in configuration record
COMMAND'dsconfplugindna'
usage: dsconf [-v] [-j] instance plugin dna [-h]
{show,enable,disable,status,list,config} ...
POSITIONALARGUMENTS'dsconfplugindna'dsconfplugindnashow
Displays the plugin configuration
dsconfplugindnaenable
Enables the plugin
dsconfplugindnadisable
Disables the plugin
dsconfplugindnastatus
Displays the plugin status
dsconfplugindnalist
List available plugin configs
dsconfplugindnaconfig
Manage plugin configs
COMMAND'dsconfplugindnashow'
usage: dsconf [-v] [-j] instance plugin dna show [-h]
COMMAND'dsconfplugindnaenable'
usage: dsconf [-v] [-j] instance plugin dna enable [-h]
COMMAND'dsconfplugindnadisable'
usage: dsconf [-v] [-j] instance plugin dna disable [-h]
COMMAND'dsconfplugindnastatus'
usage: dsconf [-v] [-j] instance plugin dna status [-h]
COMMAND'dsconfplugindnalist'
usage: dsconf [-v] [-j] instance plugin dna list [-h]
{configs,shared-configs} ...
POSITIONALARGUMENTS'dsconfplugindnalist'dsconfplugindnalistconfigs
List main DNA plugin config entries
dsconfplugindnalistshared-configs
List DNA plugin shared config entries
COMMAND'dsconfplugindnalistconfigs'
usage: dsconf [-v] [-j] instance plugin dna list configs [-h]
COMMAND'dsconfplugindnalistshared-configs'
usage: dsconf [-v] [-j] instance plugin dna list shared-configs [-h] BASEDN
BASEDN The search DN
COMMAND'dsconfplugindnaconfig'
usage: dsconf [-v] [-j] instance plugin dna config [-h]
NAME
{add,set,show,delete,shared-config-entry} ...
POSITIONALARGUMENTS'dsconfplugindnaconfig'dsconfplugindnaconfigadd
Add the config entry
dsconfplugindnaconfigset
Edit the config entry
dsconfplugindnaconfigshow
Display the config entry
dsconfplugindnaconfigdelete
Delete the config entry
dsconfplugindnaconfigshared-config-entry
Manage the shared config entry
COMMAND'dsconfplugindnaconfigadd'
usage: dsconf [-v] [-j] instance plugin dna config NAME add
[-h] [--type TYPE [TYPE ...]] [--prefix PREFIX]
[--next-value NEXT_VALUE] [--max-value MAX_VALUE] [--interval INTERVAL]
[--magic-regen MAGIC_REGEN] [--filter FILTER] [--scope SCOPE]
[--remote-bind-dn REMOTE_BIND_DN] [--remote-bind-cred REMOTE_BIND_CRED]
[--shared-config-entry SHARED_CONFIG_ENTRY] [--threshold THRESHOLD]
[--next-range NEXT_RANGE]
[--range-request-timeout RANGE_REQUEST_TIMEOUT]
OPTIONS'dsconfplugindnaconfigadd'--typeTYPE[TYPE...]
Sets which attributes have unique numbers being generated for them (dnaType)
--prefixPREFIX
Defines a prefix that can be prepended to the generated number values for the attribute
(dnaPrefix)
--next-valueNEXT_VALUE
Sets the next available number which can be assigned (dnaNextValue)
--max-valueMAX_VALUE
Sets the maximum value that can be assigned for the range (dnaMaxValue)
--intervalINTERVAL
Sets an interval to use to increment through numbers in a range (dnaInterval)
--magic-regenMAGIC_REGEN
Sets a user-defined value that instructs the plug-in to assign a new value for the entry
(dnaMagicRegen)
--filterFILTER
Sets an LDAP filter to use to search for and identify the entries to which to apply the
distributed numeric assignment range (dnaFilter)
--scopeSCOPE
Sets the base DN to search for entries to which to apply the distributed numeric assignment
(dnaScope)
--remote-bind-dnREMOTE_BIND_DN
Specifies the Replication Manager DN (dnaRemoteBindDN)
--remote-bind-credREMOTE_BIND_CRED
Specifies the Replication Manager's password (dnaRemoteBindCred)
--shared-config-entrySHARED_CONFIG_ENTRY
Defines a shared identity that the servers can use to transfer ranges to one another
(dnaSharedCfgDN)
--thresholdTHRESHOLD
Sets a threshold of remaining available numbers in the range. When the server hits the threshold,
it sends a request for a new range (dnaThreshold)
--next-rangeNEXT_RANGE
Defines the next range to use when the current range is exhausted (dnaNextRange)
--range-request-timeoutRANGE_REQUEST_TIMEOUT
Sets a timeout period, in seconds, for range requests so that the server does not stall waiting on
a new range from one server and can request a range from a new server (dnaRangeRequestTimeout)
COMMAND'dsconfplugindnaconfigset'
usage: dsconf [-v] [-j] instance plugin dna config NAME set
[-h] [--type TYPE [TYPE ...]] [--prefix PREFIX]
[--next-value NEXT_VALUE] [--max-value MAX_VALUE] [--interval INTERVAL]
[--magic-regen MAGIC_REGEN] [--filter FILTER] [--scope SCOPE]
[--remote-bind-dn REMOTE_BIND_DN] [--remote-bind-cred REMOTE_BIND_CRED]
[--shared-config-entry SHARED_CONFIG_ENTRY] [--threshold THRESHOLD]
[--next-range NEXT_RANGE]
[--range-request-timeout RANGE_REQUEST_TIMEOUT]
OPTIONS'dsconfplugindnaconfigset'--typeTYPE[TYPE...]
Sets which attributes have unique numbers being generated for them (dnaType)
--prefixPREFIX
Defines a prefix that can be prepended to the generated number values for the attribute
(dnaPrefix)
--next-valueNEXT_VALUE
Sets the next available number which can be assigned (dnaNextValue)
--max-valueMAX_VALUE
Sets the maximum value that can be assigned for the range (dnaMaxValue)
--intervalINTERVAL
Sets an interval to use to increment through numbers in a range (dnaInterval)
--magic-regenMAGIC_REGEN
Sets a user-defined value that instructs the plug-in to assign a new value for the entry
(dnaMagicRegen)
--filterFILTER
Sets an LDAP filter to use to search for and identify the entries to which to apply the
distributed numeric assignment range (dnaFilter)
--scopeSCOPE
Sets the base DN to search for entries to which to apply the distributed numeric assignment
(dnaScope)
--remote-bind-dnREMOTE_BIND_DN
Specifies the Replication Manager DN (dnaRemoteBindDN)
--remote-bind-credREMOTE_BIND_CRED
Specifies the Replication Manager's password (dnaRemoteBindCred)
--shared-config-entrySHARED_CONFIG_ENTRY
Defines a shared identity that the servers can use to transfer ranges to one another
(dnaSharedCfgDN)
--thresholdTHRESHOLD
Sets a threshold of remaining available numbers in the range. When the server hits the threshold,
it sends a request for a new range (dnaThreshold)
--next-rangeNEXT_RANGE
Defines the next range to use when the current range is exhausted (dnaNextRange)
--range-request-timeoutRANGE_REQUEST_TIMEOUT
Sets a timeout period, in seconds, for range requests so that the server does not stall waiting on
a new range from one server and can request a range from a new server (dnaRangeRequestTimeout)
COMMAND'dsconfplugindnaconfigshow'
usage: dsconf [-v] [-j] instance plugin dna config NAME show [-h]
COMMAND'dsconfplugindnaconfigdelete'
usage: dsconf [-v] [-j] instance plugin dna config NAME delete [-h]
COMMAND'dsconfplugindnaconfigshared-config-entry'
usage: dsconf [-v] [-j] instance plugin dna config NAME shared-config-entry
[-h] SHARED_CFG {set,show,delete} ...
POSITIONALARGUMENTS'dsconfplugindnaconfigshared-config-entry'dsconfplugindnaconfigshared-config-entryset
Edit the shared config entry
dsconfplugindnaconfigshared-config-entryshow
Display the shared config entry
dsconfplugindnaconfigshared-config-entrydelete
Delete the shared config entry
COMMAND'dsconfplugindnaconfigshared-config-entryset'
usage: dsconf [-v] [-j] instance plugin dna config NAME shared-config-entry SHARED_CFG set
[-h] [--remote-bind-method REMOTE_BIND_METHOD]
[--remote-conn-protocol REMOTE_CONN_PROTOCOL]
OPTIONS'dsconfplugindnaconfigshared-config-entryset'--remote-bind-methodREMOTE_BIND_METHOD
Specifies the remote bind method "SIMPLE", "SSL" (for SSL client auth), "SASL/GSSAPI", or
"SASL/DIGEST-MD5" (dnaRemoteBindMethod)
--remote-conn-protocolREMOTE_CONN_PROTOCOL
Specifies the remote connection protocol "LDAP", or "TLS" (dnaRemoteConnProtocol)
COMMAND'dsconfplugindnaconfigshared-config-entryshow'
usage: dsconf [-v] [-j] instance plugin dna config NAME shared-config-entry SHARED_CFG show
[-h]
COMMAND'dsconfplugindnaconfigshared-config-entrydelete'
usage: dsconf [-v] [-j] instance plugin dna config NAME shared-config-entry SHARED_CFG delete
[-h]
COMMAND'dsconfpluginldap-pass-through-auth'
usage: dsconf instance [-v] [-j] plugin ldap-pass-through-auth
[-h] {show,enable,disable,status,list,add,modify,delete} ...
POSITIONALARGUMENTS'dsconfpluginldap-pass-through-auth'dsconfpluginldap-pass-through-authshow
Displays the plugin configuration
dsconfpluginldap-pass-through-authenable
Enables the plugin
dsconfpluginldap-pass-through-authdisable
Disables the plugin
dsconfpluginldap-pass-through-authstatus
Displays the plugin status
dsconfpluginldap-pass-through-authlist
Lists LDAP URLs
dsconfpluginldap-pass-through-authadd
Add an LDAP url to the config entry
dsconfpluginldap-pass-through-authmodify
Edit the LDAP pass through config entry
dsconfpluginldap-pass-through-authdelete
Delete a URL from the config entry
COMMAND'dsconfpluginldap-pass-through-authshow'
usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth show [-h]
COMMAND'dsconfpluginldap-pass-through-authenable'
usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth enable [-h]
COMMAND'dsconfpluginldap-pass-through-authdisable'
usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth disable [-h]
COMMAND'dsconfpluginldap-pass-through-authstatus'
usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth status [-h]
COMMAND'dsconfpluginldap-pass-through-authlist'
usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth list [-h]
COMMAND'dsconfpluginldap-pass-through-authadd'
usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth add [-h] URL
URL The full LDAP URL in format "ldap|ldaps://authDS/subtree
maxconns,maxops,timeout,ldver,connlifetime,startTLS". If one optional parameter is specified the
rest should be specified too
COMMAND'dsconfpluginldap-pass-through-authmodify'
usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth modify
[-h] OLD_URL NEW_URL
OLD_URL
The full LDAP URL you get from the "list" command
NEW_URL
Sets the full LDAP URL in format "ldap|ldaps://authDS/subtree
maxconns,maxops,timeout,ldver,connlifetime,startTLS". If one optional parameter is specified the
rest should be specified too.
COMMAND'dsconfpluginldap-pass-through-authdelete'
usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth delete [-h] URL
URL The full LDAP URL you get from the "list" command
COMMAND'dsconfpluginlinked-attr'
usage: dsconf [-v] [-j] instance plugin linked-attr [-h]
{show,enable,disable,status,fixup,fixup-status,list,config}
...
POSITIONALARGUMENTS'dsconfpluginlinked-attr'dsconfpluginlinked-attrshow
Displays the plugin configuration
dsconfpluginlinked-attrenable
Enables the plugin
dsconfpluginlinked-attrdisable
Disables the plugin
dsconfpluginlinked-attrstatus
Displays the plugin status
dsconfpluginlinked-attrfixup
Run the fix-up task for linked attributes plugin
dsconfpluginlinked-attrfixup-status
Check the status of a fix-up task
dsconfpluginlinked-attrlist
List available plugin configs
dsconfpluginlinked-attrconfig
Manage plugin configs
COMMAND'dsconfpluginlinked-attrshow'
usage: dsconf [-v] [-j] instance plugin linked-attr show [-h]
COMMAND'dsconfpluginlinked-attrenable'
usage: dsconf [-v] [-j] instance plugin linked-attr enable [-h]
COMMAND'dsconfpluginlinked-attrdisable'
usage: dsconf [-v] [-j] instance plugin linked-attr disable [-h]
COMMAND'dsconfpluginlinked-attrstatus'
usage: dsconf [-v] [-j] instance plugin linked-attr status [-h]
COMMAND'dsconfpluginlinked-attrfixup'
usage: dsconf [-v] [-j] instance plugin linked-attr fixup [-h] [-l LINKDN]
[--wait]
OPTIONS'dsconfpluginlinked-attrfixup'-lLINKDN, --linkdnLINKDN
Sets the base DN that contains entries to fix up
--wait Wait for the task to finish, this could take a long time
COMMAND'dsconfpluginlinked-attrfixup-status'
usage: dsconf [-v] [-j] instance plugin linked-attr fixup-status
[-h] [--dn DN] [--show-log] [--watch]
OPTIONS'dsconfpluginlinked-attrfixup-status'--dnDN
The task entry's DN
--show-log
Display the task log
--watch
Watch the task's status and wait for it to finish
COMMAND'dsconfpluginlinked-attrlist'
usage: dsconf [-v] [-j] instance plugin linked-attr list [-h]
COMMAND'dsconfpluginlinked-attrconfig'
usage: dsconf [-v] [-j] instance plugin linked-attr config [-h]
NAME
{add,set,show,delete} ...
POSITIONALARGUMENTS'dsconfpluginlinked-attrconfig'dsconfpluginlinked-attrconfigadd
Add the config entry
dsconfpluginlinked-attrconfigset
Edit the config entry
dsconfpluginlinked-attrconfigshow
Display the config entry
dsconfpluginlinked-attrconfigdelete
Delete the config entry
COMMAND'dsconfpluginlinked-attrconfigadd'
usage: dsconf [-v] [-j] instance plugin linked-attr config NAME add
[-h] [--link-type LINK_TYPE] [--managed-type MANAGED_TYPE]
[--link-scope LINK_SCOPE]
OPTIONS'dsconfpluginlinked-attrconfigadd'--link-typeLINK_TYPE
Sets the attribute that is managed manually by administrators (linkType)
--managed-typeMANAGED_TYPE
Sets the attribute that is created dynamically by the plugin (managedType)
--link-scopeLINK_SCOPE
Sets the scope that restricts the plugin to a specific part of the directory tree (linkScope)
COMMAND'dsconfpluginlinked-attrconfigset'
usage: dsconf [-v] [-j] instance plugin linked-attr config NAME set
[-h] [--link-type LINK_TYPE] [--managed-type MANAGED_TYPE]
[--link-scope LINK_SCOPE]
OPTIONS'dsconfpluginlinked-attrconfigset'--link-typeLINK_TYPE
Sets the attribute that is managed manually by administrators (linkType)
--managed-typeMANAGED_TYPE
Sets the attribute that is created dynamically by the plugin (managedType)
--link-scopeLINK_SCOPE
Sets the scope that restricts the plugin to a specific part of the directory tree (linkScope)
COMMAND'dsconfpluginlinked-attrconfigshow'
usage: dsconf [-v] [-j] instance plugin linked-attr config NAME show [-h]
COMMAND'dsconfpluginlinked-attrconfigdelete'
usage: dsconf [-v] [-j] instance plugin linked-attr config NAME delete [-h]
COMMAND'dsconfpluginmanaged-entries'
usage: dsconf [-v] [-j] instance plugin managed-entries [-h]
{show,enable,disable,status,set,list,config,template}
...
POSITIONALARGUMENTS'dsconfpluginmanaged-entries'dsconfpluginmanaged-entriesshow
Displays the plugin configuration
dsconfpluginmanaged-entriesenable
Enables the plugin
dsconfpluginmanaged-entriesdisable
Disables the plugin
dsconfpluginmanaged-entriesstatus
Displays the plugin status
dsconfpluginmanaged-entriesset
Edit the plugin settings
dsconfpluginmanaged-entrieslist
List Managed Entries Plugin configs and templates
dsconfpluginmanaged-entriesconfig
Handle Managed Entries Plugin configs
dsconfpluginmanaged-entriestemplate
Handle Managed Entries Plugin templates
COMMAND'dsconfpluginmanaged-entriesshow'
usage: dsconf [-v] [-j] instance plugin managed-entries show [-h]
COMMAND'dsconfpluginmanaged-entriesenable'
usage: dsconf [-v] [-j] instance plugin managed-entries enable [-h]
COMMAND'dsconfpluginmanaged-entriesdisable'
usage: dsconf [-v] [-j] instance plugin managed-entries disable [-h]
COMMAND'dsconfpluginmanaged-entriesstatus'
usage: dsconf [-v] [-j] instance plugin managed-entries status [-h]
COMMAND'dsconfpluginmanaged-entriesset'
usage: dsconf [-v] [-j] instance plugin managed-entries set
[-h] [--config-area CONFIG_AREA]
OPTIONS'dsconfpluginmanaged-entriesset'--config-areaCONFIG_AREA
Sets the value of the nsslapd-pluginConfigArea attribute
COMMAND'dsconfpluginmanaged-entrieslist'
usage: dsconf [-v] [-j] instance plugin managed-entries list
[-h] {configs,templates} ...
POSITIONALARGUMENTS'dsconfpluginmanaged-entrieslist'dsconfpluginmanaged-entrieslistconfigs
List Managed Entries Plugin configs (list config-area if specified in the main plugin entry)
dsconfpluginmanaged-entrieslisttemplates
List Managed Entries Plugin templates in the directory
COMMAND'dsconfpluginmanaged-entrieslistconfigs'
usage: dsconf instance [-v] [-j] plugin managed-entries list configs [-h]
COMMAND'dsconfpluginmanaged-entrieslisttemplates'
usage: dsconf instance [-v] [-j] plugin managed-entries list templates
[-h] [BASEDN]
BASEDN The base DN where to search the templates
COMMAND'dsconfpluginmanaged-entriesconfig'
usage: dsconf [-v] [-j] instance plugin managed-entries config
[-h] NAME {add,set,show,delete} ...
POSITIONALARGUMENTS'dsconfpluginmanaged-entriesconfig'dsconfpluginmanaged-entriesconfigadd
Add the config entry
dsconfpluginmanaged-entriesconfigset
Edit the config entry
dsconfpluginmanaged-entriesconfigshow
Display the config entry
dsconfpluginmanaged-entriesconfigdelete
Delete the config entry
COMMAND'dsconfpluginmanaged-entriesconfigadd'
usage: dsconf [-v] [-j] instance plugin managed-entries config NAME add
[-h] [--scope SCOPE] [--filter FILTER] [--managed-base MANAGED_BASE]
[--managed-template MANAGED_TEMPLATE]
OPTIONS'dsconfpluginmanaged-entriesconfigadd'--scopeSCOPE
Sets the scope of the search to use to see which entries the plug-in monitors (originScope)
--filterFILTER
Sets the search filter to use to search for and identify the entries within the subtree which
require a managed entry (originFilter)
--managed-baseMANAGED_BASE
Sets the subtree under which to create the managed entries (managedBase)
--managed-templateMANAGED_TEMPLATE
Identifies the template entry to use to create the managed entry (managedTemplate)
COMMAND'dsconfpluginmanaged-entriesconfigset'
usage: dsconf [-v] [-j] instance plugin managed-entries config NAME set
[-h] [--scope SCOPE] [--filter FILTER] [--managed-base MANAGED_BASE]
[--managed-template MANAGED_TEMPLATE]
OPTIONS'dsconfpluginmanaged-entriesconfigset'--scopeSCOPE
Sets the scope of the search to use to see which entries the plug-in monitors (originScope)
--filterFILTER
Sets the search filter to use to search for and identify the entries within the subtree which
require a managed entry (originFilter)
--managed-baseMANAGED_BASE
Sets the subtree under which to create the managed entries (managedBase)
--managed-templateMANAGED_TEMPLATE
Identifies the template entry to use to create the managed entry (managedTemplate)
COMMAND'dsconfpluginmanaged-entriesconfigshow'
usage: dsconf [-v] [-j] instance plugin managed-entries config NAME show [-h]
COMMAND'dsconfpluginmanaged-entriesconfigdelete'
usage: dsconf [-v] [-j] instance plugin managed-entries config NAME delete
[-h]
COMMAND'dsconfpluginmanaged-entriestemplate'
usage: dsconf [-v] [-j] instance plugin managed-entries template
[-h] DN {add,set,show,delete} ...
POSITIONALARGUMENTS'dsconfpluginmanaged-entriestemplate'dsconfpluginmanaged-entriestemplateadd
Add the template entry
dsconfpluginmanaged-entriestemplateset
Edit the template entry
dsconfpluginmanaged-entriestemplateshow
Display the template entry
dsconfpluginmanaged-entriestemplatedelete
Delete the template entry
COMMAND'dsconfpluginmanaged-entriestemplateadd'
usage: dsconf [-v] [-j] instance plugin managed-entries template DN add
[-h] [--rdn-attr RDN_ATTR]
[--static-attr STATIC_ATTR [STATIC_ATTR ...]]
[--mapped-attr MAPPED_ATTR [MAPPED_ATTR ...]]
OPTIONS'dsconfpluginmanaged-entriestemplateadd'--rdn-attrRDN_ATTR
Sets which attribute to use as the naming attribute in the automatically- generated entry
(mepRDNAttr)
--static-attrSTATIC_ATTR[STATIC_ATTR...]
Sets an attribute with a defined value that must be added to the automatically-generated entry
(mepStaticAttr)
--mapped-attrMAPPED_ATTR[MAPPED_ATTR...]
Sets attributes in the Managed Entries template entry which must exist in the generated entry
(mepMappedAttr)
COMMAND'dsconfpluginmanaged-entriestemplateset'
usage: dsconf [-v] [-j] instance plugin managed-entries template DN set
[-h] [--rdn-attr RDN_ATTR]
[--static-attr STATIC_ATTR [STATIC_ATTR ...]]
[--mapped-attr MAPPED_ATTR [MAPPED_ATTR ...]]
OPTIONS'dsconfpluginmanaged-entriestemplateset'--rdn-attrRDN_ATTR
Sets which attribute to use as the naming attribute in the automatically- generated entry
(mepRDNAttr)
--static-attrSTATIC_ATTR[STATIC_ATTR...]
Sets an attribute with a defined value that must be added to the automatically-generated entry
(mepStaticAttr)
--mapped-attrMAPPED_ATTR[MAPPED_ATTR...]
Sets attributes in the Managed Entries template entry which must exist in the generated entry
(mepMappedAttr)
COMMAND'dsconfpluginmanaged-entriestemplateshow'
usage: dsconf [-v] [-j] instance plugin managed-entries template DN show [-h]
COMMAND'dsconfpluginmanaged-entriestemplatedelete'
usage: dsconf [-v] [-j] instance plugin managed-entries template DN delete
[-h]
COMMAND'dsconfpluginpam-pass-through-auth'
usage: dsconf instance [-v] [-j] plugin pam-pass-through-auth
[-h] {show,enable,disable,status,list,config} ...
POSITIONALARGUMENTS'dsconfpluginpam-pass-through-auth'dsconfpluginpam-pass-through-authshow
Displays the plugin configuration
dsconfpluginpam-pass-through-authenable
Enables the plugin
dsconfpluginpam-pass-through-authdisable
Disables the plugin
dsconfpluginpam-pass-through-authstatus
Displays the plugin status
dsconfpluginpam-pass-through-authlist
Lists PAM configurations
dsconfpluginpam-pass-through-authconfig
Manage PAM PTA configurations.
COMMAND'dsconfpluginpam-pass-through-authshow'
usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth show [-h]
COMMAND'dsconfpluginpam-pass-through-authenable'
usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth enable [-h]
COMMAND'dsconfpluginpam-pass-through-authdisable'
usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth disable [-h]
COMMAND'dsconfpluginpam-pass-through-authstatus'
usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth status [-h]
COMMAND'dsconfpluginpam-pass-through-authlist'
usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth list [-h]
COMMAND'dsconfpluginpam-pass-through-authconfig'
usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth config
[-h] NAME {add,set,show,delete} ...
POSITIONALARGUMENTS'dsconfpluginpam-pass-through-authconfig'dsconfpluginpam-pass-through-authconfigadd
Add the config entry
dsconfpluginpam-pass-through-authconfigset
Edit the config entry
dsconfpluginpam-pass-through-authconfigshow
Display the config entry
dsconfpluginpam-pass-through-authconfigdelete
Delete the config entry
COMMAND'dsconfpluginpam-pass-through-authconfigadd'
usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth config NAME add
[-h] [--exclude-suffix EXCLUDE_SUFFIX [EXCLUDE_SUFFIX ...]]
[--include-suffix INCLUDE_SUFFIX [INCLUDE_SUFFIX ...]]
[--missing-suffix {ERROR,ALLOW,IGNORE,delete,}] [--filter FILTER]
[--id-attr ID_ATTR] [--id_map_method ID_MAP_METHOD]
[--fallback {TRUE,FALSE}] [--secure {TRUE,FALSE}] [--service SERVICE]
OPTIONS'dsconfpluginpam-pass-through-authconfigadd'--exclude-suffixEXCLUDE_SUFFIX[EXCLUDE_SUFFIX...]
Specifies a suffix to exclude from PAM authentication (pamExcludeSuffix)
--include-suffixINCLUDE_SUFFIX[INCLUDE_SUFFIX...]
Sets a suffix to include for PAM authentication (pamIncludeSuffix)
--missing-suffix{ERROR,ALLOW,IGNORE,delete,}
Identifies how to handle missing include or exclude suffixes (pamMissingSuffix)
--filterFILTER
Sets an LDAP filter to use to identify specific entries within the included suffixes for which to
use PAM pass-through authentication (pamFilter)
--id-attrID_ATTR
Contains the attribute name which is used to hold the PAM user ID (pamIDAttr)
--id_map_methodID_MAP_METHOD
Sets the method to use to map the LDAP bind DN to a PAM identity (pamIDMapMethod)
--fallback{TRUE,FALSE}
Sets whether to fallback to regular LDAP authentication if PAM authentication fails (pamFallback)
--secure{TRUE,FALSE}
Requires secure TLS connection for PAM authentication (pamSecure)
--serviceSERVICE
Contains the service name to pass to PAM (pamService)
COMMAND'dsconfpluginpam-pass-through-authconfigset'
usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth config NAME set
[-h] [--exclude-suffix EXCLUDE_SUFFIX [EXCLUDE_SUFFIX ...]]
[--include-suffix INCLUDE_SUFFIX [INCLUDE_SUFFIX ...]]
[--missing-suffix {ERROR,ALLOW,IGNORE,delete,}] [--filter FILTER]
[--id-attr ID_ATTR] [--id_map_method ID_MAP_METHOD]
[--fallback {TRUE,FALSE}] [--secure {TRUE,FALSE}] [--service SERVICE]
OPTIONS'dsconfpluginpam-pass-through-authconfigset'--exclude-suffixEXCLUDE_SUFFIX[EXCLUDE_SUFFIX...]
Specifies a suffix to exclude from PAM authentication (pamExcludeSuffix)
--include-suffixINCLUDE_SUFFIX[INCLUDE_SUFFIX...]
Sets a suffix to include for PAM authentication (pamIncludeSuffix)
--missing-suffix{ERROR,ALLOW,IGNORE,delete,}
Identifies how to handle missing include or exclude suffixes (pamMissingSuffix)
--filterFILTER
Sets an LDAP filter to use to identify specific entries within the included suffixes for which to
use PAM pass-through authentication (pamFilter)
--id-attrID_ATTR
Contains the attribute name which is used to hold the PAM user ID (pamIDAttr)
--id_map_methodID_MAP_METHOD
Sets the method to use to map the LDAP bind DN to a PAM identity (pamIDMapMethod)
--fallback{TRUE,FALSE}
Sets whether to fallback to regular LDAP authentication if PAM authentication fails (pamFallback)
--secure{TRUE,FALSE}
Requires secure TLS connection for PAM authentication (pamSecure)
--serviceSERVICE
Contains the service name to pass to PAM (pamService)
COMMAND'dsconfpluginpam-pass-through-authconfigshow'
usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth config NAME show
[-h]
COMMAND'dsconfpluginpam-pass-through-authconfigdelete'
usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth config NAME delete
[-h]
COMMAND'dsconfpluginretro-changelog'
usage: dsconf [-v] [-j] instance plugin retro-changelog [-h]
{show,enable,disable,status,set,add,del} ...
POSITIONALARGUMENTS'dsconfpluginretro-changelog'dsconfpluginretro-changelogshow
Displays the plugin configuration
dsconfpluginretro-changelogenable
Enables the plugin
dsconfpluginretro-changelogdisable
Disables the plugin
dsconfpluginretro-changelogstatus
Displays the plugin status
dsconfpluginretro-changelogset
Edit the plugin
dsconfpluginretro-changelogadd
Add attributes to the plugin
dsconfpluginretro-changelogdel
Delete an attribute from plugin scope
COMMAND'dsconfpluginretro-changelogshow'
usage: dsconf [-v] [-j] instance plugin retro-changelog show [-h]
COMMAND'dsconfpluginretro-changelogenable'
usage: dsconf [-v] [-j] instance plugin retro-changelog enable [-h]
COMMAND'dsconfpluginretro-changelogdisable'
usage: dsconf [-v] [-j] instance plugin retro-changelog disable [-h]
COMMAND'dsconfpluginretro-changelogstatus'
usage: dsconf [-v] [-j] instance plugin retro-changelog status [-h]
COMMAND'dsconfpluginretro-changelogset'
usage: dsconf [-v] [-j] instance plugin retro-changelog set
[-h] [--is-replicated {TRUE,FALSE}] [--attribute ATTRIBUTE]
[--directory DIRECTORY] [--max-age MAX_AGE]
[--trim-interval TRIM_INTERVAL] [--exclude-suffix [EXCLUDE_SUFFIX ...]]
[--exclude-attrs [EXCLUDE_ATTRS ...]]
OPTIONS'dsconfpluginretro-changelogset'--is-replicated{TRUE,FALSE}
Sets a flag to indicate on a change in the changelog whether the change is newly made on that
server or whether it was replicated over from another server (isReplicated)
--attributeATTRIBUTE
Specifies another Directory Server attribute which must be included in the retro changelog entries
(nsslapd-attribute)
--directoryDIRECTORY
Specifies the name of the directory in which the changelog database is created the first time the
plug-in is run
--max-ageMAX_AGE
Specifies the maximum age of any entry in the changelog. Used to trim the changelog
(nsslapd-changelogmaxage)
--trim-intervalTRIM_INTERVAL--exclude-suffix[EXCLUDE_SUFFIX...]
Specifies the suffix which will be excluded from the scope of the plugin (nsslapd-exclude-suffix)
--exclude-attrs[EXCLUDE_ATTRS...]
Specifies the attributes which will be excluded from the scope of the plugin
(nsslapd-exclude-attrs)
COMMAND'dsconfpluginretro-changelogadd'
usage: dsconf [-v] [-j] instance plugin retro-changelog add
[-h] [--is-replicated {TRUE,FALSE}] [--attribute ATTRIBUTE]
[--directory DIRECTORY] [--max-age MAX_AGE]
[--trim-interval TRIM_INTERVAL] [--exclude-suffix [EXCLUDE_SUFFIX ...]]
[--exclude-attrs [EXCLUDE_ATTRS ...]]
OPTIONS'dsconfpluginretro-changelogadd'--is-replicated{TRUE,FALSE}
Sets a flag to indicate on a change in the changelog whether the change is newly made on that
server or whether it was replicated over from another server (isReplicated)
--attributeATTRIBUTE
Specifies another Directory Server attribute which must be included in the retro changelog entries
(nsslapd-attribute)
--directoryDIRECTORY
Specifies the name of the directory in which the changelog database is created the first time the
plug-in is run
--max-ageMAX_AGE
Specifies the maximum age of any entry in the changelog. Used to trim the changelog
(nsslapd-changelogmaxage)
--trim-intervalTRIM_INTERVAL--exclude-suffix[EXCLUDE_SUFFIX...]
Specifies the suffix which will be excluded from the scope of the plugin (nsslapd-exclude-suffix)
--exclude-attrs[EXCLUDE_ATTRS...]
Specifies the attributes which will be excluded from the scope of the plugin
(nsslapd-exclude-attrs)
COMMAND'dsconfpluginretro-changelogdel'
usage: dsconf [-v] [-j] instance plugin retro-changelog del
[-h] [--is-replicated {TRUE,FALSE}] [--attribute ATTRIBUTE]
[--directory DIRECTORY] [--max-age MAX_AGE]
[--trim-interval TRIM_INTERVAL] [--exclude-suffix [EXCLUDE_SUFFIX ...]]
[--exclude-attrs [EXCLUDE_ATTRS ...]]
OPTIONS'dsconfpluginretro-changelogdel'--is-replicated{TRUE,FALSE}
Sets a flag to indicate on a change in the changelog whether the change is newly made on that
server or whether it was replicated over from another server (isReplicated)
--attributeATTRIBUTE
Specifies another Directory Server attribute which must be included in the retro changelog entries
(nsslapd-attribute)
--directoryDIRECTORY
Specifies the name of the directory in which the changelog database is created the first time the
plug-in is run
--max-ageMAX_AGE
Specifies the maximum age of any entry in the changelog. Used to trim the changelog
(nsslapd-changelogmaxage)
--trim-intervalTRIM_INTERVAL--exclude-suffix[EXCLUDE_SUFFIX...]
Specifies the suffix which will be excluded from the scope of the plugin (nsslapd-exclude-suffix)
--exclude-attrs[EXCLUDE_ATTRS...]
Specifies the attributes which will be excluded from the scope of the plugin
(nsslapd-exclude-attrs)
COMMAND'dsconfpluginposix-winsync'
usage: dsconf [-v] [-j] instance plugin posix-winsync [-h]
{show,enable,disable,status,set,fixup} ...
POSITIONALARGUMENTS'dsconfpluginposix-winsync'dsconfpluginposix-winsyncshow
Displays the plugin configuration
dsconfpluginposix-winsyncenable
Enables the plugin
dsconfpluginposix-winsyncdisable
Disables the plugin
dsconfpluginposix-winsyncstatus
Displays the plugin status
dsconfpluginposix-winsyncset
Edit the plugin settings
dsconfpluginposix-winsyncfixup
Run the memberOf fix-up task to correct mismatched member and uniquemember values for synced users
COMMAND'dsconfpluginposix-winsyncshow'
usage: dsconf [-v] [-j] instance plugin posix-winsync show [-h]
COMMAND'dsconfpluginposix-winsyncenable'
usage: dsconf [-v] [-j] instance plugin posix-winsync enable [-h]
COMMAND'dsconfpluginposix-winsyncdisable'
usage: dsconf [-v] [-j] instance plugin posix-winsync disable [-h]
COMMAND'dsconfpluginposix-winsyncstatus'
usage: dsconf [-v] [-j] instance plugin posix-winsync status [-h]
COMMAND'dsconfpluginposix-winsyncset'
usage: dsconf [-v] [-j] instance plugin posix-winsync set [-h]
[--create-memberof-task {true,false}]
[--lower-case-uid {true,false}]
[--map-member-uid {true,false}]
[--map-nested-grouping {true,false}]
[--ms-sfu-schema {true,false}]
OPTIONS'dsconfpluginposix-winsyncset'--create-memberof-task{true,false}
Sets whether to run the memberUID fix-up task immediately after a sync run in order to update
group memberships for synced users (posixWinsyncCreateMemberOfTask)
--lower-case-uid{true,false}
Sets whether to store (and, if necessary, convert) the UID value in the memberUID attribute in
lower case.(posixWinsyncLowerCaseUID)
--map-member-uid{true,false}
Sets whether to map the memberUID attribute in an Active Directory group to the uniqueMember
attribute in a Directory Server group (posixWinsyncMapMemberUID)
--map-nested-grouping{true,false}
Manages if nested groups are updated when memberUID attributes in an Active Directory POSIX group
change (posixWinsyncMapNestedGrouping)
--ms-sfu-schema{true,false}
Sets whether to the older Microsoft System Services for Unix 3.0 (msSFU30) schema when syncing
Posix attributes from Active Directory (posixWinsyncMsSFUSchema)
COMMAND'dsconfpluginposix-winsyncfixup'
usage: dsconf [-v] [-j] instance plugin posix-winsync fixup
[-h] [-f FILTER] [--timeout TIMEOUT] DN
DN Set the base DN that contains entries to fix up
OPTIONS'dsconfpluginposix-winsyncfixup'-fFILTER, --filterFILTER
Filter for entries to fix up. If omitted, all entries with objectclass
inetuser/inetadmin/nsmemberof under the specified base will have their memberOf attribute
regenerated.
--timeoutTIMEOUT
Set a timeout to wait for the fixup task. Default is 120 seconds
COMMAND'dsconfplugincontentsync'
usage: dsconf [-v] [-j] instance plugin contentsync [-h]
{show,enable,disable,status,set,add} ...
POSITIONALARGUMENTS'dsconfplugincontentsync'dsconfplugincontentsyncshow
Displays the plugin configuration
dsconfplugincontentsyncenable
Enables the plugin
dsconfplugincontentsyncdisable
Disables the plugin
dsconfplugincontentsyncstatus
Displays the plugin status
dsconfplugincontentsyncset
Edit the plugin settings
dsconfplugincontentsyncadd
Add attributes to the plugin
COMMAND'dsconfplugincontentsyncshow'
usage: dsconf [-v] [-j] instance plugin contentsync show [-h]
COMMAND'dsconfplugincontentsyncenable'
usage: dsconf [-v] [-j] instance plugin contentsync enable [-h]
COMMAND'dsconfplugincontentsyncdisable'
usage: dsconf [-v] [-j] instance plugin contentsync disable [-h]
COMMAND'dsconfplugincontentsyncstatus'
usage: dsconf [-v] [-j] instance plugin contentsync status [-h]
COMMAND'dsconfplugincontentsyncset'
usage: dsconf [-v] [-j] instance plugin contentsync set [-h]
[--allow-openldap {on,off}]
OPTIONS'dsconfplugincontentsyncset'--allow-openldap{on,off}
Allows openldap servers to act as read only consumers of this server via syncrepl
COMMAND'dsconfplugincontentsyncadd'
usage: dsconf [-v] [-j] instance plugin contentsync add [-h]
[--allow-openldap {on,off}]
OPTIONS'dsconfplugincontentsyncadd'--allow-openldap{on,off}
Allows openldap servers to act as read only consumers of this server via syncrepl
COMMAND'dsconfpluginentryuuid'
usage: dsconf [-v] [-j] instance plugin entryuuid [-h]
{show,enable,disable,status,fixup,fixup-status} ...
POSITIONALARGUMENTS'dsconfpluginentryuuid'dsconfpluginentryuuidshow
Displays the plugin configuration
dsconfpluginentryuuidenable
Enables the plugin
dsconfpluginentryuuiddisable
Disables the plugin
dsconfpluginentryuuidstatus
Displays the plugin status
dsconfpluginentryuuidfixup
Run the fix-up task for EntryUUID plugin
dsconfpluginentryuuidfixup-status
Check the status of a fix-up task
COMMAND'dsconfpluginentryuuidshow'
usage: dsconf [-v] [-j] instance plugin entryuuid show [-h]
COMMAND'dsconfpluginentryuuidenable'
usage: dsconf [-v] [-j] instance plugin entryuuid enable [-h]
COMMAND'dsconfpluginentryuuiddisable'
usage: dsconf [-v] [-j] instance plugin entryuuid disable [-h]
COMMAND'dsconfpluginentryuuidstatus'
usage: dsconf [-v] [-j] instance plugin entryuuid status [-h]
COMMAND'dsconfpluginentryuuidfixup'
usage: dsconf [-v] [-j] instance plugin entryuuid fixup [-h] [-f FILTER]
[--wait]
[--timeout TIMEOUT]
DN
DN Base DN that contains entries to fix up
OPTIONS'dsconfpluginentryuuidfixup'-fFILTER, --filterFILTER
Filter for entries to fix up. If omitted, all entries under base DNwill have their EntryUUID
attribute regenerated if not present.
--wait Wait for the task to finish, this could take a long time
--timeoutTIMEOUT
Sets the task timeout. Default is 0 (no timeout)
COMMAND'dsconfpluginentryuuidfixup-status'
usage: dsconf [-v] [-j] instance plugin entryuuid fixup-status
[-h] [--dn DN] [--show-log] [--watch]
OPTIONS'dsconfpluginentryuuidfixup-status'--dnDN
The task entry's DN
--show-log
Display the task log
--watch
Watch the task's status and wait for it to finish
COMMAND'dsconfpluginpwstorage-scheme'
usage: dsconf [-v] [-j] instance plugin pwstorage-scheme [-h]
{pbkdf2,pbkdf2-sha1,pbkdf2-sha256,pbkdf2-sha512}
...
POSITIONALARGUMENTS'dsconfpluginpwstorage-scheme'dsconfpluginpwstorage-schemepbkdf2
Manage PBKDF2 scheme
dsconfpluginpwstorage-schemepbkdf2-sha1
Manage PBKDF2-SHA1 scheme
dsconfpluginpwstorage-schemepbkdf2-sha256
Manage PBKDF2-SHA256 scheme
dsconfpluginpwstorage-schemepbkdf2-sha512
Manage PBKDF2-SHA512 scheme
COMMAND'dsconfpluginpwstorage-schemepbkdf2'
usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2
[-h] {get-num-iterations,set-num-iterations} ...
POSITIONALARGUMENTS'dsconfpluginpwstorage-schemepbkdf2'dsconfpluginpwstorage-schemepbkdf2get-num-iterations
Get number of iterations
dsconfpluginpwstorage-schemepbkdf2set-num-iterations
Set number of iterations
COMMAND'dsconfpluginpwstorage-schemepbkdf2get-num-iterations'
usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2 get-num-iterations
[-h]
COMMAND'dsconfpluginpwstorage-schemepbkdf2set-num-iterations'
usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2 set-num-iterations
[-h] iterations
iterations
Number of iterations (10,000-10,000,000)
COMMAND'dsconfpluginpwstorage-schemepbkdf2-sha1'
usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha1
[-h] {get-num-iterations,set-num-iterations} ...
POSITIONALARGUMENTS'dsconfpluginpwstorage-schemepbkdf2-sha1'dsconfpluginpwstorage-schemepbkdf2-sha1get-num-iterations
Get number of iterations
dsconfpluginpwstorage-schemepbkdf2-sha1set-num-iterations
Set number of iterations
COMMAND'dsconfpluginpwstorage-schemepbkdf2-sha1get-num-iterations'
usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha1 get-num-iterations
[-h]
COMMAND'dsconfpluginpwstorage-schemepbkdf2-sha1set-num-iterations'
usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha1 set-num-iterations
[-h] iterations
iterations
Number of iterations (10,000-10,000,000)
COMMAND'dsconfpluginpwstorage-schemepbkdf2-sha256'
usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha256
[-h] {get-num-iterations,set-num-iterations} ...
POSITIONALARGUMENTS'dsconfpluginpwstorage-schemepbkdf2-sha256'dsconfpluginpwstorage-schemepbkdf2-sha256get-num-iterations
Get number of iterations
dsconfpluginpwstorage-schemepbkdf2-sha256set-num-iterations
Set number of iterations
COMMAND'dsconfpluginpwstorage-schemepbkdf2-sha256get-num-iterations'
usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha256 get-num-iterations
[-h]
COMMAND'dsconfpluginpwstorage-schemepbkdf2-sha256set-num-iterations'
usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha256 set-num-iterations
[-h] iterations
iterations
Number of iterations (10,000-10,000,000)
COMMAND'dsconfpluginpwstorage-schemepbkdf2-sha512'
usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha512
[-h] {get-num-iterations,set-num-iterations} ...
POSITIONALARGUMENTS'dsconfpluginpwstorage-schemepbkdf2-sha512'dsconfpluginpwstorage-schemepbkdf2-sha512get-num-iterations
Get number of iterations
dsconfpluginpwstorage-schemepbkdf2-sha512set-num-iterations
Set number of iterations
COMMAND'dsconfpluginpwstorage-schemepbkdf2-sha512get-num-iterations'
usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha512 get-num-iterations
[-h]
COMMAND'dsconfpluginpwstorage-schemepbkdf2-sha512set-num-iterations'
usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha512 set-num-iterations
[-h] iterations
iterations
Number of iterations (10,000-10,000,000)
COMMAND'dsconfpluginlist'
usage: dsconf [-v] [-j] instance plugin list [-h]
COMMAND'dsconfpluginshow'
usage: dsconf [-v] [-j] instance plugin show [-h] [selector]
selector
The plugin to search for
COMMAND'dsconfpluginset'
usage: dsconf [-v] [-j] instance plugin set [-h] [--type TYPE]
[--enabled {on,off}] [--path PATH]
[--initfunc INITFUNC] [--id ID]
[--vendor VENDOR]
[--version VERSION]
[--description DESCRIPTION]
[--depends-on-type DEPENDS_ON_TYPE]
[--depends-on-named DEPENDS_ON_NAMED]
[--precedence PRECEDENCE]
[selector]
selector
The plugin to edit
OPTIONS'dsconfpluginset'--typeTYPE
The type of plugin.
--enabled{on,off}
Identifies whether or not the plugin is enabled.
--pathPATH
The plugin library name (without the library suffix).
--initfuncINITFUNC
An initialization function of the plugin.
--idID
The plugin ID.
--vendorVENDOR
The vendor of plugin.
--versionVERSION
The version of plugin.
--descriptionDESCRIPTION
The description of the plugin.
--depends-on-typeDEPENDS_ON_TYPE
All plug-ins with a type value which matches one of the values in the following valid range will
be started by the server prior to this plug-in.
--depends-on-namedDEPENDS_ON_NAMED
The plug-in name matching one of the following values will be started by the server prior to this
plug-in
--precedencePRECEDENCE
The priority it has in the execution order of plug-ins
COMMAND'dsconfpwpolicy'
usage: dsconf [-v] [-j] instance pwpolicy [-h] {get,set,list-schemes} ...
POSITIONALARGUMENTS'dsconfpwpolicy'dsconfpwpolicyget
Get the global password policy entry
dsconfpwpolicyset
Set an attribute in a global password policy
dsconfpwpolicylist-schemes
Get a list of the current password storage schemes
COMMAND'dsconfpwpolicyget'
usage: dsconf [-v] [-j] instance pwpolicy get [-h]
COMMAND'dsconfpwpolicyset'
usage: dsconf instance [-v] [-j] pwpolicy set [-h] [--pwdscheme PWDSCHEME]
[--pwdchange PWDCHANGE]
[--pwdmustchange PWDMUSTCHANGE]
[--pwdhistory PWDHISTORY]
[--pwdhistorycount PWDHISTORYCOUNT]
[--pwdadmin PWDADMIN]
[--pwdadminskipupdates PWDADMINSKIPUPDATES]
[--pwdtrack PWDTRACK]
[--pwdwarning PWDWARNING]
[--pwdexpire PWDEXPIRE]
[--pwdmaxage PWDMAXAGE]
[--pwdminage PWDMINAGE]
[--pwdgracelimit PWDGRACELIMIT]
[--pwdsendexpiring PWDSENDEXPIRING]
[--pwdlockout PWDLOCKOUT]
[--pwdunlock PWDUNLOCK]
[--pwdlockoutduration PWDLOCKOUTDURATION]
[--pwdmaxfailures PWDMAXFAILURES]
[--pwdresetfailcount PWDRESETFAILCOUNT]
[--pwdchecksyntax PWDCHECKSYNTAX]
[--pwdminlen PWDMINLEN]
[--pwdmindigits PWDMINDIGITS]
[--pwdminalphas PWDMINALPHAS]
[--pwdminuppers PWDMINUPPERS]
[--pwdminlowers PWDMINLOWERS]
[--pwdminspecials PWDMINSPECIALS]
[--pwdmin8bits PWDMIN8BITS]
[--pwdmaxrepeats PWDMAXREPEATS]
[--pwdpalindrome PWDPALINDROME]
[--pwdmaxseq PWDMAXSEQ]
[--pwdmaxseqsets PWDMAXSEQSETS]
[--pwdmaxclasschars PWDMAXCLASSCHARS]
[--pwdmincatagories PWDMINCATAGORIES]
[--pwdmintokenlen PWDMINTOKENLEN]
[--pwdbadwords PWDBADWORDS]
[--pwduserattrs PWDUSERATTRS]
[--pwddictcheck PWDDICTCHECK]
[--pwddictpath PWDDICTPATH]
[--pwptprmaxuse PWPTPRMAXUSE]
[--pwptprdelayexpireat PWPTPRDELAYEXPIREAT]
[--pwptprdelayvalidfrom PWPTPRDELAYVALIDFROM]
[--pwdlocal PWDLOCAL]
[--pwdisglobal PWDISGLOBAL]
[--pwdallowhash PWDALLOWHASH]
[--pwpinheritglobal PWPINHERITGLOBAL]
OPTIONS'dsconfpwpolicyset'--pwdschemePWDSCHEME
The password storage scheme
--pwdchangePWDCHANGE
Allow users to change their passwords
--pwdmustchangePWDMUSTCHANGE
Users must change their password after it was reset by an administrator
--pwdhistoryPWDHISTORY
To enable password history set this to "on", otherwise "off"
--pwdhistorycountPWDHISTORYCOUNT
The number of passwords to keep in history
--pwdadminPWDADMIN
The DN of an entry or a group of account that can bypass password policy constraints
--pwdadminskipupdatesPWDADMINSKIPUPDATES
Set to "on" if the Password Admin's password update should not trigger updates to the password
state attributes (passwordExpirationtime, passwordHistory, etc).
--pwdtrackPWDTRACK
Set to "on" to track the time the password was last changed
--pwdwarningPWDWARNING
Send an expiring warning if password expires within this time (in seconds)
--pwdexpirePWDEXPIRE
Set to "on" to enable password expiration
--pwdmaxagePWDMAXAGE
The password expiration time in seconds
--pwdminagePWDMINAGE
The number of seconds that must pass before a user can change their password
--pwdgracelimitPWDGRACELIMIT
The number of allowed logins after the password has expired
--pwdsendexpiringPWDSENDEXPIRING
Set to "on" to always send the expiring control regardless of the warning period
--pwdlockoutPWDLOCKOUT
Set to "on" to enable account lockout
--pwdunlockPWDUNLOCK
Set to "on" to allow an account to become unlocked after the lockout duration
--pwdlockoutdurationPWDLOCKOUTDURATION
The number of seconds an account stays locked out
--pwdmaxfailuresPWDMAXFAILURES
The maximum number of allowed failed password attempts before the account gets locked
--pwdresetfailcountPWDRESETFAILCOUNT
The number of seconds to wait before reducing the failed login count on an account
--pwdchecksyntaxPWDCHECKSYNTAX
Set to "on" to enable password syntax checking
--pwdminlenPWDMINLEN
The minimum number of characters required in a password
--pwdmindigitsPWDMINDIGITS
The minimum number of digit/number characters in a password
--pwdminalphasPWDMINALPHAS
The minimum number of alpha characters required in a password
--pwdminuppersPWDMINUPPERS
The minimum number of uppercase characters required in a password
--pwdminlowersPWDMINLOWERS
The minimum number of lowercase characters required in a password
--pwdminspecialsPWDMINSPECIALS
The minimum number of special characters required in a password
--pwdmin8bitsPWDMIN8BITS
The minimum number of 8-bit characters required in a password
--pwdmaxrepeatsPWDMAXREPEATS
The maximum number of times the same character can appear sequentially in the password
--pwdpalindromePWDPALINDROME
Set to "on" to reject passwords that are palindromes
--pwdmaxseqPWDMAXSEQ
The maximum number of allowed monotonic character sequences in a password
--pwdmaxseqsetsPWDMAXSEQSETS
The maximum number of allowed monotonic character sequences that can be duplicated in a password
--pwdmaxclasscharsPWDMAXCLASSCHARS
The maximum number of sequential characters from the same character class that is allowed in a
password
--pwdmincatagoriesPWDMINCATAGORIES
The minimum number of syntax category checks
--pwdmintokenlenPWDMINTOKENLEN
Sets the smallest attribute value length that is used for trivial/user words checking. This also
impacts "--pwduserattrs"
--pwdbadwordsPWDBADWORDS
A space-separated list of words that can not be in a password
--pwduserattrsPWDUSERATTRS
A space-separated list of attributes whose values can not appear in the password (See
"--pwdmintokenlen")
--pwddictcheckPWDDICTCHECK
Set to "on" to enforce CrackLib dictionary checking
--pwddictpathPWDDICTPATH
Filesystem path to specific/custom CrackLib dictionary files
--pwptprmaxusePWPTPRMAXUSE
Number of times a reset password can be used for authentication
--pwptprdelayexpireatPWPTPRDELAYEXPIREAT
Number of seconds after which a reset password expires
--pwptprdelayvalidfromPWPTPRDELAYVALIDFROM
Number of seconds to wait before using a reset password to authenticated
--pwdlocalPWDLOCAL
Set to "on" to enable fine-grained (subtree/user-level) password policies
--pwdisglobalPWDISGLOBAL
Set to "on" to enable password policy state attributes to be replicated
--pwdallowhashPWDALLOWHASH
Set to "on" to allow adding prehashed passwords
--pwpinheritglobalPWPINHERITGLOBAL
Set to "on" to allow local policies to inherit the global policy
COMMAND'dsconfpwpolicylist-schemes'
usage: dsconf [-v] [-j] instance pwpolicy list-schemes [-h]
COMMAND'dsconflocalpwp'
usage: dsconf [-v] [-j] instance localpwp [-h]
{list,get,set,remove,adduser,addsubtree} ...
POSITIONALARGUMENTS'dsconflocalpwp'dsconflocalpwplist
List all the local password policies
dsconflocalpwpget
Get local password policy entry
dsconflocalpwpset
Set an attribute in a local password policy
dsconflocalpwpremove
Remove a local password policy
dsconflocalpwpadduser
Add new user password policy
dsconflocalpwpaddsubtree
Add new subtree password policy
COMMAND'dsconflocalpwplist'
usage: dsconf [-v] [-j] instance localpwp list [-h] [DN]
DN Suffix to search for local password policies
COMMAND'dsconflocalpwpget'
usage: dsconf [-v] [-j] instance localpwp get [-h] DN
DN Get the local policy for this entry DN
COMMAND'dsconflocalpwpset'
usage: dsconf [-v] [-j] instance localpwp set [-h] [--pwdscheme PWDSCHEME]
[--pwdchange PWDCHANGE]
[--pwdmustchange PWDMUSTCHANGE]
[--pwdhistory PWDHISTORY]
[--pwdhistorycount PWDHISTORYCOUNT]
[--pwdadmin PWDADMIN]
[--pwdadminskipupdates PWDADMINSKIPUPDATES]
[--pwdtrack PWDTRACK]
[--pwdwarning PWDWARNING]
[--pwdexpire PWDEXPIRE]
[--pwdmaxage PWDMAXAGE]
[--pwdminage PWDMINAGE]
[--pwdgracelimit PWDGRACELIMIT]
[--pwdsendexpiring PWDSENDEXPIRING]
[--pwdlockout PWDLOCKOUT]
[--pwdunlock PWDUNLOCK]
[--pwdlockoutduration PWDLOCKOUTDURATION]
[--pwdmaxfailures PWDMAXFAILURES]
[--pwdresetfailcount PWDRESETFAILCOUNT]
[--pwdchecksyntax PWDCHECKSYNTAX]
[--pwdminlen PWDMINLEN]
[--pwdmindigits PWDMINDIGITS]
[--pwdminalphas PWDMINALPHAS]
[--pwdminuppers PWDMINUPPERS]
[--pwdminlowers PWDMINLOWERS]
[--pwdminspecials PWDMINSPECIALS]
[--pwdmin8bits PWDMIN8BITS]
[--pwdmaxrepeats PWDMAXREPEATS]
[--pwdpalindrome PWDPALINDROME]
[--pwdmaxseq PWDMAXSEQ]
[--pwdmaxseqsets PWDMAXSEQSETS]
[--pwdmaxclasschars PWDMAXCLASSCHARS]
[--pwdmincatagories PWDMINCATAGORIES]
[--pwdmintokenlen PWDMINTOKENLEN]
[--pwdbadwords PWDBADWORDS]
[--pwduserattrs PWDUSERATTRS]
[--pwddictcheck PWDDICTCHECK]
[--pwddictpath PWDDICTPATH]
[--pwptprmaxuse PWPTPRMAXUSE]
[--pwptprdelayexpireat PWPTPRDELAYEXPIREAT]
[--pwptprdelayvalidfrom PWPTPRDELAYVALIDFROM]
DN
DN Set the local policy for this entry DN
OPTIONS'dsconflocalpwpset'--pwdschemePWDSCHEME
The password storage scheme
--pwdchangePWDCHANGE
Allow users to change their passwords
--pwdmustchangePWDMUSTCHANGE
Users must change their password after it was reset by an administrator
--pwdhistoryPWDHISTORY
To enable password history set this to "on", otherwise "off"
--pwdhistorycountPWDHISTORYCOUNT
The number of passwords to keep in history
--pwdadminPWDADMIN
The DN of an entry or a group of account that can bypass password policy constraints
--pwdadminskipupdatesPWDADMINSKIPUPDATES
Set to "on" if the Password Admin's password update should not trigger updates to the password
state attributes (passwordExpirationtime, passwordHistory, etc).
--pwdtrackPWDTRACK
Set to "on" to track the time the password was last changed
--pwdwarningPWDWARNING
Send an expiring warning if password expires within this time (in seconds)
--pwdexpirePWDEXPIRE
Set to "on" to enable password expiration
--pwdmaxagePWDMAXAGE
The password expiration time in seconds
--pwdminagePWDMINAGE
The number of seconds that must pass before a user can change their password
--pwdgracelimitPWDGRACELIMIT
The number of allowed logins after the password has expired
--pwdsendexpiringPWDSENDEXPIRING
Set to "on" to always send the expiring control regardless of the warning period
--pwdlockoutPWDLOCKOUT
Set to "on" to enable account lockout
--pwdunlockPWDUNLOCK
Set to "on" to allow an account to become unlocked after the lockout duration
--pwdlockoutdurationPWDLOCKOUTDURATION
The number of seconds an account stays locked out
--pwdmaxfailuresPWDMAXFAILURES
The maximum number of allowed failed password attempts before the account gets locked
--pwdresetfailcountPWDRESETFAILCOUNT
The number of seconds to wait before reducing the failed login count on an account
--pwdchecksyntaxPWDCHECKSYNTAX
Set to "on" to enable password syntax checking
--pwdminlenPWDMINLEN
The minimum number of characters required in a password
--pwdmindigitsPWDMINDIGITS
The minimum number of digit/number characters in a password
--pwdminalphasPWDMINALPHAS
The minimum number of alpha characters required in a password
--pwdminuppersPWDMINUPPERS
The minimum number of uppercase characters required in a password
--pwdminlowersPWDMINLOWERS
The minimum number of lowercase characters required in a password
--pwdminspecialsPWDMINSPECIALS
The minimum number of special characters required in a password
--pwdmin8bitsPWDMIN8BITS
The minimum number of 8-bit characters required in a password
--pwdmaxrepeatsPWDMAXREPEATS
The maximum number of times the same character can appear sequentially in the password
--pwdpalindromePWDPALINDROME
Set to "on" to reject passwords that are palindromes
--pwdmaxseqPWDMAXSEQ
The maximum number of allowed monotonic character sequences in a password
--pwdmaxseqsetsPWDMAXSEQSETS
The maximum number of allowed monotonic character sequences that can be duplicated in a password
--pwdmaxclasscharsPWDMAXCLASSCHARS
The maximum number of sequential characters from the same character class that is allowed in a
password
--pwdmincatagoriesPWDMINCATAGORIES
The minimum number of syntax category checks
--pwdmintokenlenPWDMINTOKENLEN
Sets the smallest attribute value length that is used for trivial/user words checking. This also
impacts "--pwduserattrs"
--pwdbadwordsPWDBADWORDS
A space-separated list of words that can not be in a password
--pwduserattrsPWDUSERATTRS
A space-separated list of attributes whose values can not appear in the password (See
"--pwdmintokenlen")
--pwddictcheckPWDDICTCHECK
Set to "on" to enforce CrackLib dictionary checking
--pwddictpathPWDDICTPATH
Filesystem path to specific/custom CrackLib dictionary files
--pwptprmaxusePWPTPRMAXUSE
Number of times a reset password can be used for authentication
--pwptprdelayexpireatPWPTPRDELAYEXPIREAT
Number of seconds after which a reset password expires
--pwptprdelayvalidfromPWPTPRDELAYVALIDFROM
Number of seconds to wait before using a reset password to authenticated
COMMAND'dsconflocalpwpremove'
usage: dsconf [-v] [-j] instance localpwp remove [-h] DN
DN Remove local policy for this entry DN
COMMAND'dsconflocalpwpadduser'
usage: dsconf [-v] [-j] instance localpwp adduser [-h] [--pwdscheme PWDSCHEME]
[--pwdchange PWDCHANGE]
[--pwdmustchange PWDMUSTCHANGE]
[--pwdhistory PWDHISTORY]
[--pwdhistorycount PWDHISTORYCOUNT]
[--pwdadmin PWDADMIN]
[--pwdadminskipupdates PWDADMINSKIPUPDATES]
[--pwdtrack PWDTRACK]
[--pwdwarning PWDWARNING]
[--pwdexpire PWDEXPIRE]
[--pwdmaxage PWDMAXAGE]
[--pwdminage PWDMINAGE]
[--pwdgracelimit PWDGRACELIMIT]
[--pwdsendexpiring PWDSENDEXPIRING]
[--pwdlockout PWDLOCKOUT]
[--pwdunlock PWDUNLOCK]
[--pwdlockoutduration PWDLOCKOUTDURATION]
[--pwdmaxfailures PWDMAXFAILURES]
[--pwdresetfailcount PWDRESETFAILCOUNT]
[--pwdchecksyntax PWDCHECKSYNTAX]
[--pwdminlen PWDMINLEN]
[--pwdmindigits PWDMINDIGITS]
[--pwdminalphas PWDMINALPHAS]
[--pwdminuppers PWDMINUPPERS]
[--pwdminlowers PWDMINLOWERS]
[--pwdminspecials PWDMINSPECIALS]
[--pwdmin8bits PWDMIN8BITS]
[--pwdmaxrepeats PWDMAXREPEATS]
[--pwdpalindrome PWDPALINDROME]
[--pwdmaxseq PWDMAXSEQ]
[--pwdmaxseqsets PWDMAXSEQSETS]
[--pwdmaxclasschars PWDMAXCLASSCHARS]
[--pwdmincatagories PWDMINCATAGORIES]
[--pwdmintokenlen PWDMINTOKENLEN]
[--pwdbadwords PWDBADWORDS]
[--pwduserattrs PWDUSERATTRS]
[--pwddictcheck PWDDICTCHECK]
[--pwddictpath PWDDICTPATH]
[--pwptprmaxuse PWPTPRMAXUSE]
[--pwptprdelayexpireat PWPTPRDELAYEXPIREAT]
[--pwptprdelayvalidfrom PWPTPRDELAYVALIDFROM]
DN
DN Add/replace the local password policy for this entry DN
OPTIONS'dsconflocalpwpadduser'--pwdschemePWDSCHEME
The password storage scheme
--pwdchangePWDCHANGE
Allow users to change their passwords
--pwdmustchangePWDMUSTCHANGE
Users must change their password after it was reset by an administrator
--pwdhistoryPWDHISTORY
To enable password history set this to "on", otherwise "off"
--pwdhistorycountPWDHISTORYCOUNT
The number of passwords to keep in history
--pwdadminPWDADMIN
The DN of an entry or a group of account that can bypass password policy constraints
--pwdadminskipupdatesPWDADMINSKIPUPDATES
Set to "on" if the Password Admin's password update should not trigger updates to the password
state attributes (passwordExpirationtime, passwordHistory, etc).
--pwdtrackPWDTRACK
Set to "on" to track the time the password was last changed
--pwdwarningPWDWARNING
Send an expiring warning if password expires within this time (in seconds)
--pwdexpirePWDEXPIRE
Set to "on" to enable password expiration
--pwdmaxagePWDMAXAGE
The password expiration time in seconds
--pwdminagePWDMINAGE
The number of seconds that must pass before a user can change their password
--pwdgracelimitPWDGRACELIMIT
The number of allowed logins after the password has expired
--pwdsendexpiringPWDSENDEXPIRING
Set to "on" to always send the expiring control regardless of the warning period
--pwdlockoutPWDLOCKOUT
Set to "on" to enable account lockout
--pwdunlockPWDUNLOCK
Set to "on" to allow an account to become unlocked after the lockout duration
--pwdlockoutdurationPWDLOCKOUTDURATION
The number of seconds an account stays locked out
--pwdmaxfailuresPWDMAXFAILURES
The maximum number of allowed failed password attempts before the account gets locked
--pwdresetfailcountPWDRESETFAILCOUNT
The number of seconds to wait before reducing the failed login count on an account
--pwdchecksyntaxPWDCHECKSYNTAX
Set to "on" to enable password syntax checking
--pwdminlenPWDMINLEN
The minimum number of characters required in a password
--pwdmindigitsPWDMINDIGITS
The minimum number of digit/number characters in a password
--pwdminalphasPWDMINALPHAS
The minimum number of alpha characters required in a password
--pwdminuppersPWDMINUPPERS
The minimum number of uppercase characters required in a password
--pwdminlowersPWDMINLOWERS
The minimum number of lowercase characters required in a password
--pwdminspecialsPWDMINSPECIALS
The minimum number of special characters required in a password
--pwdmin8bitsPWDMIN8BITS
The minimum number of 8-bit characters required in a password
--pwdmaxrepeatsPWDMAXREPEATS
The maximum number of times the same character can appear sequentially in the password
--pwdpalindromePWDPALINDROME
Set to "on" to reject passwords that are palindromes
--pwdmaxseqPWDMAXSEQ
The maximum number of allowed monotonic character sequences in a password
--pwdmaxseqsetsPWDMAXSEQSETS
The maximum number of allowed monotonic character sequences that can be duplicated in a password
--pwdmaxclasscharsPWDMAXCLASSCHARS
The maximum number of sequential characters from the same character class that is allowed in a
password
--pwdmincatagoriesPWDMINCATAGORIES
The minimum number of syntax category checks
--pwdmintokenlenPWDMINTOKENLEN
Sets the smallest attribute value length that is used for trivial/user words checking. This also
impacts "--pwduserattrs"
--pwdbadwordsPWDBADWORDS
A space-separated list of words that can not be in a password
--pwduserattrsPWDUSERATTRS
A space-separated list of attributes whose values can not appear in the password (See
"--pwdmintokenlen")
--pwddictcheckPWDDICTCHECK
Set to "on" to enforce CrackLib dictionary checking
--pwddictpathPWDDICTPATH
Filesystem path to specific/custom CrackLib dictionary files
--pwptprmaxusePWPTPRMAXUSE
Number of times a reset password can be used for authentication
--pwptprdelayexpireatPWPTPRDELAYEXPIREAT
Number of seconds after which a reset password expires
--pwptprdelayvalidfromPWPTPRDELAYVALIDFROM
Number of seconds to wait before using a reset password to authenticated
COMMAND'dsconflocalpwpaddsubtree'
usage: dsconf [-v] [-j] instance localpwp addsubtree [-h]
[--pwdscheme PWDSCHEME]
[--pwdchange PWDCHANGE]
[--pwdmustchange PWDMUSTCHANGE]
[--pwdhistory PWDHISTORY]
[--pwdhistorycount PWDHISTORYCOUNT]
[--pwdadmin PWDADMIN]
[--pwdadminskipupdates PWDADMINSKIPUPDATES]
[--pwdtrack PWDTRACK]
[--pwdwarning PWDWARNING]
[--pwdexpire PWDEXPIRE]
[--pwdmaxage PWDMAXAGE]
[--pwdminage PWDMINAGE]
[--pwdgracelimit PWDGRACELIMIT]
[--pwdsendexpiring PWDSENDEXPIRING]
[--pwdlockout PWDLOCKOUT]
[--pwdunlock PWDUNLOCK]
[--pwdlockoutduration PWDLOCKOUTDURATION]
[--pwdmaxfailures PWDMAXFAILURES]
[--pwdresetfailcount PWDRESETFAILCOUNT]
[--pwdchecksyntax PWDCHECKSYNTAX]
[--pwdminlen PWDMINLEN]
[--pwdmindigits PWDMINDIGITS]
[--pwdminalphas PWDMINALPHAS]
[--pwdminuppers PWDMINUPPERS]
[--pwdminlowers PWDMINLOWERS]
[--pwdminspecials PWDMINSPECIALS]
[--pwdmin8bits PWDMIN8BITS]
[--pwdmaxrepeats PWDMAXREPEATS]
[--pwdpalindrome PWDPALINDROME]
[--pwdmaxseq PWDMAXSEQ]
[--pwdmaxseqsets PWDMAXSEQSETS]
[--pwdmaxclasschars PWDMAXCLASSCHARS]
[--pwdmincatagories PWDMINCATAGORIES]
[--pwdmintokenlen PWDMINTOKENLEN]
[--pwdbadwords PWDBADWORDS]
[--pwduserattrs PWDUSERATTRS]
[--pwddictcheck PWDDICTCHECK]
[--pwddictpath PWDDICTPATH]
[--pwptprmaxuse PWPTPRMAXUSE]
[--pwptprdelayexpireat PWPTPRDELAYEXPIREAT]
[--pwptprdelayvalidfrom PWPTPRDELAYVALIDFROM]
DN
DN Add/replace the subtree policy for this entry DN
OPTIONS'dsconflocalpwpaddsubtree'--pwdschemePWDSCHEME
The password storage scheme
--pwdchangePWDCHANGE
Allow users to change their passwords
--pwdmustchangePWDMUSTCHANGE
Users must change their password after it was reset by an administrator
--pwdhistoryPWDHISTORY
To enable password history set this to "on", otherwise "off"
--pwdhistorycountPWDHISTORYCOUNT
The number of passwords to keep in history
--pwdadminPWDADMIN
The DN of an entry or a group of account that can bypass password policy constraints
--pwdadminskipupdatesPWDADMINSKIPUPDATES
Set to "on" if the Password Admin's password update should not trigger updates to the password
state attributes (passwordExpirationtime, passwordHistory, etc).
--pwdtrackPWDTRACK
Set to "on" to track the time the password was last changed
--pwdwarningPWDWARNING
Send an expiring warning if password expires within this time (in seconds)
--pwdexpirePWDEXPIRE
Set to "on" to enable password expiration
--pwdmaxagePWDMAXAGE
The password expiration time in seconds
--pwdminagePWDMINAGE
The number of seconds that must pass before a user can change their password
--pwdgracelimitPWDGRACELIMIT
The number of allowed logins after the password has expired
--pwdsendexpiringPWDSENDEXPIRING
Set to "on" to always send the expiring control regardless of the warning period
--pwdlockoutPWDLOCKOUT
Set to "on" to enable account lockout
--pwdunlockPWDUNLOCK
Set to "on" to allow an account to become unlocked after the lockout duration
--pwdlockoutdurationPWDLOCKOUTDURATION
The number of seconds an account stays locked out
--pwdmaxfailuresPWDMAXFAILURES
The maximum number of allowed failed password attempts before the account gets locked
--pwdresetfailcountPWDRESETFAILCOUNT
The number of seconds to wait before reducing the failed login count on an account
--pwdchecksyntaxPWDCHECKSYNTAX
Set to "on" to enable password syntax checking
--pwdminlenPWDMINLEN
The minimum number of characters required in a password
--pwdmindigitsPWDMINDIGITS
The minimum number of digit/number characters in a password
--pwdminalphasPWDMINALPHAS
The minimum number of alpha characters required in a password
--pwdminuppersPWDMINUPPERS
The minimum number of uppercase characters required in a password
--pwdminlowersPWDMINLOWERS
The minimum number of lowercase characters required in a password
--pwdminspecialsPWDMINSPECIALS
The minimum number of special characters required in a password
--pwdmin8bitsPWDMIN8BITS
The minimum number of 8-bit characters required in a password
--pwdmaxrepeatsPWDMAXREPEATS
The maximum number of times the same character can appear sequentially in the password
--pwdpalindromePWDPALINDROME
Set to "on" to reject passwords that are palindromes
--pwdmaxseqPWDMAXSEQ
The maximum number of allowed monotonic character sequences in a password
--pwdmaxseqsetsPWDMAXSEQSETS
The maximum number of allowed monotonic character sequences that can be duplicated in a password
--pwdmaxclasscharsPWDMAXCLASSCHARS
The maximum number of sequential characters from the same character class that is allowed in a
password
--pwdmincatagoriesPWDMINCATAGORIES
The minimum number of syntax category checks
--pwdmintokenlenPWDMINTOKENLEN
Sets the smallest attribute value length that is used for trivial/user words checking. This also
impacts "--pwduserattrs"
--pwdbadwordsPWDBADWORDS
A space-separated list of words that can not be in a password
--pwduserattrsPWDUSERATTRS
A space-separated list of attributes whose values can not appear in the password (See
"--pwdmintokenlen")
--pwddictcheckPWDDICTCHECK
Set to "on" to enforce CrackLib dictionary checking
--pwddictpathPWDDICTPATH
Filesystem path to specific/custom CrackLib dictionary files
--pwptprmaxusePWPTPRMAXUSE
Number of times a reset password can be used for authentication
--pwptprdelayexpireatPWPTPRDELAYEXPIREAT
Number of seconds after which a reset password expires
--pwptprdelayvalidfromPWPTPRDELAYVALIDFROM
Number of seconds to wait before using a reset password to authenticated
COMMAND'dsconfreplication'
usage: dsconf [-v] [-j] instance replication [-h]
{enable,disable,get-ruv,list,status,winsync-status,promote,create-manager,delete-manager,demote,get,set-changelog,get-changelog,export-changelog,import-changelog,set,monitor}
...
POSITIONALARGUMENTS'dsconfreplication'dsconfreplicationenable
Enable replication for a suffix
dsconfreplicationdisable
Disable replication for a suffix
dsconfreplicationget-ruv
Display the database RUV entry for a suffix
dsconfreplicationlist
Lists all the replicated suffixes
dsconfreplicationstatus
Display the current status of all the replication agreements
dsconfreplicationwinsync-status
Display the current status of all the replication agreements
dsconfreplicationpromote
Promote a replica to a hub or supplier
dsconfreplicationcreate-manager
Create a replication manager entry
dsconfreplicationdelete-manager
Delete a replication manager entry
dsconfreplicationdemote
Demote replica to a hub or consumer
dsconfreplicationget
Display the replication configuration
dsconfreplicationset-changelog
Set replication changelog attributes
dsconfreplicationget-changelog
Display replication changelog attributes
dsconfreplicationexport-changelog
Export the Directory Server replication changelog to an LDIF file
dsconfreplicationimport-changelog
Restore/import Directory Server replication change log from an LDIF file. This is typically used
when managing changelog encryption
dsconfreplicationset
Set an attribute in the replication configuration
dsconfreplicationmonitor
Display the full replication topology report
COMMAND'dsconfreplicationenable'
usage: dsconf [-v] [-j] instance replication enable [-h] --suffix SUFFIX
--role ROLE
[--replica-id REPLICA_ID]
[--bind-group-dn BIND_GROUP_DN]
[--bind-dn BIND_DN]
[--bind-passwd BIND_PASSWD]
[--bind-passwd-file BIND_PASSWD_FILE]
[--bind-passwd-prompt]
OPTIONS'dsconfreplicationenable'--suffixSUFFIX
Sets the DN of the suffix to be enabled for replication
--roleROLE
Sets the replication role: "supplier", "hub", or "consumer"
--replica-idREPLICA_ID
Sets the replication identifier for a "supplier". Values range from 1 - 65534
--bind-group-dnBIND_GROUP_DN
Sets a group entry DN containing members that are "bind/supplier" DNs
--bind-dnBIND_DN
Sets the bind or supplier DN that can make replication updates
--bind-passwdBIND_PASSWD
Sets the password for replication manager (--bind-dn). This will create the manager entry if a
value is set
--bind-passwd-fileBIND_PASSWD_FILE
File containing the password
--bind-passwd-prompt
Prompt for password
COMMAND'dsconfreplicationdisable'
usage: dsconf [-v] [-j] instance replication disable [-h] --suffix SUFFIX
OPTIONS'dsconfreplicationdisable'--suffixSUFFIX
Sets the DN of the suffix to have replication disabled
COMMAND'dsconfreplicationget-ruv'
usage: dsconf [-v] [-j] instance replication get-ruv [-h] --suffix SUFFIX
OPTIONS'dsconfreplicationget-ruv'--suffixSUFFIX
Sets the DN of the replicated suffix
COMMAND'dsconfreplicationlist'
usage: dsconf [-v] [-j] instance replication list [-h]
COMMAND'dsconfreplicationstatus'
usage: dsconf [-v] [-j] instance replication status [-h] --suffix SUFFIX
[--bind-dn BIND_DN]
[--bind-passwd BIND_PASSWD]
[--bind-passwd-file BIND_PASSWD_FILE]
[--bind-passwd-prompt]
OPTIONS'dsconfreplicationstatus'--suffixSUFFIX
Sets the DN of the replication suffix
--bind-dnBIND_DN
Sets the DN to use to authenticate to the consumer. If not set, current instance's root DN will be
used. It will be used for all agreements
--bind-passwdBIND_PASSWD
Sets the password for the bind DN. It will be used for all agreements
--bind-passwd-fileBIND_PASSWD_FILE
File containing the password. It will be used for all agreements
--bind-passwd-prompt
Prompt for passwords for each agreement's instance separately
COMMAND'dsconfreplicationwinsync-status'
usage: dsconf instance [-v] [-j] replication winsync-status
[-h] --suffix SUFFIX [--bind-dn BIND_DN] [--bind-passwd BIND_PASSWD]
[--bind-passwd-file BIND_PASSWD_FILE] [--bind-passwd-prompt]
OPTIONS'dsconfreplicationwinsync-status'--suffixSUFFIX
Sets the DN of the replication suffix
--bind-dnBIND_DN
Sets the DN to use to authenticate to the consumer. Currectly not used
--bind-passwdBIND_PASSWD
Sets the password of the bind DN. Currectly not used
--bind-passwd-fileBIND_PASSWD_FILE
File containing the password. Currectly not used
--bind-passwd-prompt
Prompt for password. Currectly not used
COMMAND'dsconfreplicationpromote'
usage: dsconf [-v] [-j] instance replication promote [-h] --suffix SUFFIX
--newrole NEWROLE
[--replica-id REPLICA_ID]
[--bind-group-dn BIND_GROUP_DN]
[--bind-dn BIND_DN]
OPTIONS'dsconfreplicationpromote'--suffixSUFFIX
Sets the DN of the replication suffix to promote
--newroleNEWROLE
Sets the new replica role to "hub" or "supplier"
--replica-idREPLICA_ID
Sets the replication identifier for a "supplier". Values range from 1 - 65534
--bind-group-dnBIND_GROUP_DN
Sets a group entry DN containing members that are "bind/supplier" DNs
--bind-dnBIND_DN
Sets the bind or supplier DN that can make replication updates
COMMAND'dsconfreplicationcreate-manager'
usage: dsconf [-v] [-j] instance replication create-manager
[-h] [--name NAME] [--passwd PASSWD] [--passwd-file PASSWD_FILE]
[--bind-passwd-file BIND_PASSWD_FILE] [--suffix SUFFIX]
OPTIONS'dsconfreplicationcreate-manager'--nameNAME
Sets the name of the new replication manager entry.For example, if the name is "replication
manager" then the new manager entry's DN would be "cn=replication manager,cn=config".
--passwdPASSWD
Sets the password for replication manager. If not provided, you will be prompted for the password
--passwd-filePASSWD_FILE
File containing the password for back compatibility
--bind-passwd-fileBIND_PASSWD_FILE
File containing the password
--suffixSUFFIX
The DN of the replication suffix whose replication configuration you want to add this new manager
to (OPTIONAL)
COMMAND'dsconfreplicationdelete-manager'
usage: dsconf [-v] [-j] instance replication delete-manager
[-h] [--name NAME] [--suffix SUFFIX]
OPTIONS'dsconfreplicationdelete-manager'--nameNAME
Sets the name of the replication manager entry under cn=config: "cn=NAME,cn=config"
--suffixSUFFIX
Sets the DN of the replication suffix whose replication configuration you want to remove this
manager from (OPTIONAL)
COMMAND'dsconfreplicationdemote'
usage: dsconf [-v] [-j] instance replication demote [-h] --suffix SUFFIX
--newrole NEWROLE
OPTIONS'dsconfreplicationdemote'--suffixSUFFIX
Sets the DN of the replication suffix
--newroleNEWROLE
Sets the new replication role to "hub", or "consumer"
COMMAND'dsconfreplicationget'
usage: dsconf [-v] [-j] instance replication get [-h] --suffix SUFFIX
OPTIONS'dsconfreplicationget'--suffixSUFFIX
Sets the suffix DN for the replication configuration to display
COMMAND'dsconfreplicationset-changelog'
usage: dsconf [-v] [-j] instance replication set-changelog [-h]
--suffix SUFFIX
[--max-entries MAX_ENTRIES]
[--max-age MAX_AGE]
[--trim-interval TRIM_INTERVAL]
[--encrypt]
[--disable-encrypt]
OPTIONS'dsconfreplicationset-changelog'--suffixSUFFIX
Sets the suffix that uses the changelog
--max-entriesMAX_ENTRIES
Sets the maximum number of entries to get in the replication changelog
--max-ageMAX_AGE
Set the maximum age of a replication changelog entry
--trim-intervalTRIM_INTERVAL
Sets the interval to check if the replication changelog can be trimmed
--encrypt
Sets the replication changelog to use encryption. You must export and import the changelog after
setting this.
--disable-encrypt
Sets the replication changelog to not use encryption. You must export and import the changelog
after setting this.
COMMAND'dsconfreplicationget-changelog'
usage: dsconf [-v] [-j] instance replication get-changelog [-h]
--suffix SUFFIX
OPTIONS'dsconfreplicationget-changelog'--suffixSUFFIX
Sets the suffix that uses the changelog
COMMAND'dsconfreplicationexport-changelog'
usage: dsconf [-v] [-j] instance replication export-changelog
[-h] {to-ldif,default} ...
POSITIONALARGUMENTS'dsconfreplicationexport-changelog'dsconfreplicationexport-changelogto-ldif
Sets the LDIF file name. This is typically used for setting up changelog encryption
dsconfreplicationexport-changelogdefault
Export the replication changelog to the server's default LDIF directory
COMMAND'dsconfreplicationexport-changelogto-ldif'
usage: dsconf instance [-v] [-j] replication export-changelog to-ldif
[-h] [-c] [-d] [-l] [-i CHANGELOG_LDIF] -o OUTPUT_FILE -r REPLICA_ROOT
OPTIONS'dsconfreplicationexport-changelogto-ldif'-c, --csn-only
Enables to export and interpret CSN only. This option can be used with or without -i option. The
LDIF file that is generated can not be imported and is only used for debugging purposes.
-d, --decode
Decodes the base64 values in each changelog entry. The LDIF file that is generated can not be
imported and is only used for debugging purposes.
-l, --preserve-ldif-done
Preserves generated LDIF "files.done" files in changelog directory.
-iCHANGELOG_LDIF, --changelog-ldifCHANGELOG_LDIF
Decodes changes in an LDIF file. Use this option if you already have a changelog LDIF file, but
the changes in that file are encoded.
-oOUTPUT_FILE, --output-fileOUTPUT_FILE
Sets the path name for the final result
-rREPLICA_ROOT, --replica-rootREPLICA_ROOT
Specifies the replica root whose changelog you want to export
COMMAND'dsconfreplicationexport-changelogdefault'
usage: dsconf [-v] [-j] instance replication export-changelog default
[-h] -r REPLICA_ROOT
OPTIONS'dsconfreplicationexport-changelogdefault'-rREPLICA_ROOT, --replica-rootREPLICA_ROOT
Specifies the replica root whose changelog you want to export
COMMAND'dsconfreplicationimport-changelog'
usage: dsconf instance [-v] [-j] replication import-changelog
[-h] {from-ldif,default} ...
POSITIONALARGUMENTS'dsconfreplicationimport-changelog'dsconfreplicationimport-changelogfrom-ldif
Restore/import a specific single LDIF file
dsconfreplicationimport-changelogdefault
Import the default changelog LDIF file created by the server
COMMAND'dsconfreplicationimport-changelogfrom-ldif'
usage: dsconf [-v] [-j] instance replication import-changelog from-ldif
[-h] -r REPLICA_ROOT LDIF_PATH
LDIF_PATH
The path of the changelog LDIF file
OPTIONS'dsconfreplicationimport-changelogfrom-ldif'-rREPLICA_ROOT, --replica-rootREPLICA_ROOT
Specifies the replica root whose changelog you want to import
COMMAND'dsconfreplicationimport-changelogdefault'
usage: dsconf instance [-v] [-j] replication import-changelog default
[-h] -r REPLICA_ROOT
OPTIONS'dsconfreplicationimport-changelogdefault'-rREPLICA_ROOT, --replica-rootREPLICA_ROOT
Specifies the replica root whose changelog you want to import
COMMAND'dsconfreplicationset'
usage: dsconf [-v] [-j] instance replication set [-h] --suffix SUFFIX
[--repl-add-bind-dn REPL_ADD_BIND_DN]
[--repl-del-bind-dn REPL_DEL_BIND_DN]
[--repl-add-ref REPL_ADD_REF]
[--repl-del-ref REPL_DEL_REF]
[--repl-purge-delay REPL_PURGE_DELAY]
[--repl-tombstone-purge-interval
REPL_TOMBSTONE_PURGE_INTERVAL]
[--repl-fast-tombstone-purging
REPL_FAST_TOMBSTONE_PURGING]
[--repl-bind-group REPL_BIND_GROUP]
[--repl-bind-group-interval REPL_BIND_GROUP_INTERVAL]
[--repl-protocol-timeout REPL_PROTOCOL_TIMEOUT]
[--repl-backoff-max REPL_BACKOFF_MAX]
[--repl-backoff-min REPL_BACKOFF_MIN]
[--repl-release-timeout REPL_RELEASE_TIMEOUT]
[--repl-keepalive-update-interval
REPL_KEEPALIVE_UPDATE_INTERVAL]
OPTIONS'dsconfreplicationset'--suffixSUFFIX
Sets the DN of the replication suffix
--repl-add-bind-dnREPL_ADD_BIND_DN
Adds a bind (supplier) DN
--repl-del-bind-dnREPL_DEL_BIND_DN
Removes a bind (supplier) DN
--repl-add-refREPL_ADD_REF
Adds a replication referral (for consumers only)
--repl-del-refREPL_DEL_REF
Removes a replication referral (for conusmers only)
--repl-purge-delayREPL_PURGE_DELAY
Sets the replication purge delay
--repl-tombstone-purge-intervalREPL_TOMBSTONE_PURGE_INTERVAL
Sets the interval in seconds to check for tombstones that can be purged
--repl-fast-tombstone-purgingREPL_FAST_TOMBSTONE_PURGING
Enables or disables improving the tombstone purging performance
--repl-bind-groupREPL_BIND_GROUP
Sets a group entry DN containing members that are "bind/supplier" DNs
--repl-bind-group-intervalREPL_BIND_GROUP_INTERVAL
Sets an interval in seconds to check if the bind group has been updated
--repl-protocol-timeoutREPL_PROTOCOL_TIMEOUT
Sets a timeout in seconds on how long to wait before stopping replication when the server is under
load
--repl-backoff-maxREPL_BACKOFF_MAX
The maximum time in seconds a replication agreement should stay in a backoff state while waiting
to acquire the consumer. Default is 300 seconds
--repl-backoff-minREPL_BACKOFF_MIN
The starting time in seconds a replication agreement should stay in a backoff state while waiting
to acquire the consumer. Default is 3 seconds
--repl-release-timeoutREPL_RELEASE_TIMEOUT
A timeout in seconds a replication supplier should send updates before it yields its replication
session
--repl-keepalive-update-intervalREPL_KEEPALIVE_UPDATE_INTERVAL
Interval in seconds for how often the server will apply an internal update to keep the RUV from
getting stale. The default is 1 hour (3600 seconds)
COMMAND'dsconfreplicationmonitor'
usage: dsconf [-v] [-j] instance replication monitor [-h]
[-c [CONNECTIONS ...]]
[-a [ALIASES ...]]
OPTIONS'dsconfreplicationmonitor'-c[CONNECTIONS...], --connections[CONNECTIONS...]
Sets the connection values for monitoring other not connected topologies. The format:
'host:port:binddn:bindpwd'. You can use regex for host and port. You can set bindpwd to * and it
will be requested at the runtime or you can include the path to the password file in square
brackets - [~/pwd.txt]
-a[ALIASES...], --aliases[ALIASES...]
Enables displaying an alias instead of host:port, if an alias is assigned to a host:port
combination. The format: alias=host:port
COMMAND'dsconfrepl-agmt'
usage: dsconf [-v] [-j] instance repl-agmt [-h]
{list,enable,disable,init,init-status,poke,status,delete,create,set,get}
...
POSITIONALARGUMENTS'dsconfrepl-agmt'dsconfrepl-agmtlist
List all replication agreements
dsconfrepl-agmtenable
Enable replication agreement
dsconfrepl-agmtdisable
Disable replication agreement
dsconfrepl-agmtinit
Initialize replication agreement
dsconfrepl-agmtinit-status
Check the agreement initialization status
dsconfrepl-agmtpoke
Trigger replication to send updates now
dsconfrepl-agmtstatus
Displays the current status of the replication agreement
dsconfrepl-agmtdelete
Delete replication agreement
dsconfrepl-agmtcreate
Initialize replication agreement
dsconfrepl-agmtset
Set an attribute in the replication agreement
dsconfrepl-agmtget
Get replication configuration
COMMAND'dsconfrepl-agmtlist'
usage: dsconf [-v] [-j] instance repl-agmt list [-h] --suffix SUFFIX
[--entry ENTRY]
OPTIONS'dsconfrepl-agmtlist'--suffixSUFFIX
Sets the DN of the suffix to look up replication agreements for
--entryENTRY
Returns the entire entry for each agreement
COMMAND'dsconfrepl-agmtenable'
usage: dsconf [-v] [-j] instance repl-agmt enable [-h] --suffix SUFFIX
AGMT_NAME
AGMT_NAME
The name of the replication agreement
OPTIONS'dsconfrepl-agmtenable'--suffixSUFFIX
Sets the DN of the replication suffix
COMMAND'dsconfrepl-agmtdisable'
usage: dsconf [-v] [-j] instance repl-agmt disable [-h] --suffix SUFFIX
AGMT_NAME
AGMT_NAME
The name of the replication agreement
OPTIONS'dsconfrepl-agmtdisable'--suffixSUFFIX
Sets the DN of the replication suffix
COMMAND'dsconfrepl-agmtinit'
usage: dsconf [-v] [-j] instance repl-agmt init [-h] --suffix SUFFIX AGMT_NAME
AGMT_NAME
The name of the replication agreement
OPTIONS'dsconfrepl-agmtinit'--suffixSUFFIX
Sets the DN of the replication suffix
COMMAND'dsconfrepl-agmtinit-status'
usage: dsconf [-v] [-j] instance repl-agmt init-status [-h] --suffix SUFFIX
AGMT_NAME
AGMT_NAME
The name of the replication agreement
OPTIONS'dsconfrepl-agmtinit-status'--suffixSUFFIX
Sets the DN of the replication suffix
COMMAND'dsconfrepl-agmtpoke'
usage: dsconf [-v] [-j] instance repl-agmt poke [-h] --suffix SUFFIX AGMT_NAME
AGMT_NAME
The name of the replication agreement
OPTIONS'dsconfrepl-agmtpoke'--suffixSUFFIX
Sets the DN of the replication suffix
COMMAND'dsconfrepl-agmtstatus'
usage: dsconf [-v] [-j] instance repl-agmt status [-h] --suffix SUFFIX
[--bind-dn BIND_DN]
[--bind-passwd BIND_PASSWD]
[--bind-passwd-file BIND_PASSWD_FILE]
[--bind-passwd-prompt]
AGMT_NAME
AGMT_NAME
The name of the replication agreement
OPTIONS'dsconfrepl-agmtstatus'--suffixSUFFIX
Sets the DN of the replication suffix
--bind-dnBIND_DN
Sets the DN to use to authenticate to the consumer. If not set, current instance's root DN will be
used. It will be used for all agreements
--bind-passwdBIND_PASSWD
Sets the password for the bind DN. It will be used for all agreements
--bind-passwd-fileBIND_PASSWD_FILE
File containing the password. It will be used for all agreements
--bind-passwd-prompt
Prompt for passwords for each agreement's instance separately
COMMAND'dsconfrepl-agmtdelete'
usage: dsconf [-v] [-j] instance repl-agmt delete [-h] --suffix SUFFIX
AGMT_NAME
AGMT_NAME
The name of the replication agreement
OPTIONS'dsconfrepl-agmtdelete'--suffixSUFFIX
Sets the DN of the replication suffix
COMMAND'dsconfrepl-agmtcreate'
usage: dsconf [-v] [-j] instance repl-agmt create [-h] --suffix SUFFIX
--host HOST --port PORT
--conn-protocol CONN_PROTOCOL
[--bind-dn BIND_DN]
[--bind-passwd BIND_PASSWD]
[--bind-passwd-file BIND_PASSWD_FILE]
[--bind-passwd-prompt]
--bind-method BIND_METHOD
[--frac-list FRAC_LIST]
[--frac-list-total FRAC_LIST_TOTAL]
[--strip-list STRIP_LIST]
[--schedule SCHEDULE]
[--conn-timeout CONN_TIMEOUT]
[--protocol-timeout PROTOCOL_TIMEOUT]
[--wait-async-results WAIT_ASYNC_RESULTS]
[--busy-wait-time BUSY_WAIT_TIME]
[--session-pause-time SESSION_PAUSE_TIME]
[--flow-control-window FLOW_CONTROL_WINDOW]
[--flow-control-pause FLOW_CONTROL_PAUSE]
[--bootstrap-bind-dn BOOTSTRAP_BIND_DN]
[--bootstrap-bind-passwd BOOTSTRAP_BIND_PASSWD]
[--bootstrap-bind-passwd-file
BOOTSTRAP_BIND_PASSWD_FILE]
[--bootstrap-bind-passwd-prompt]
[--bootstrap-conn-protocol BOOTSTRAP_CONN_PROTOCOL]
[--bootstrap-bind-method BOOTSTRAP_BIND_METHOD]
[--init]
AGMT_NAME
AGMT_NAME
The name of the replication agreement
OPTIONS'dsconfrepl-agmtcreate'--suffixSUFFIX
Sets the DN of the replication suffix
--hostHOST
Sets the hostname of the remote replica
--portPORT
Sets the port number of the remote replica
--conn-protocolCONN_PROTOCOL
Sets the replication connection protocol: LDAP, LDAPS, or StartTLS
--bind-dnBIND_DN
Sets the bind DN the agreement uses to authenticate to the replica
--bind-passwdBIND_PASSWD
Sets the credentials for the bind DN
--bind-passwd-fileBIND_PASSWD_FILE
File containing the password
--bind-passwd-prompt
Prompt for password
--bind-methodBIND_METHOD
Sets the bind method: "SIMPLE", "SSLCLIENTAUTH", "SASL/DIGEST", or "SASL/GSSAPI"
--frac-listFRAC_LIST
Sets the list of attributes to NOT replicate to the consumer during incremental updates
--frac-list-totalFRAC_LIST_TOTAL
Sets the list of attributes to NOT replicate during a total initialization
--strip-listSTRIP_LIST
Sets a list of attributes that are removed from updates only if the event would otherwise be
empty. Typically this is set to "modifiersname" and "modifytimestmap"
--scheduleSCHEDULE
Sets the replication update schedule: 'HHMM-HHMM DDDDDDD' D = 0-6 (Sunday - Saturday).
--conn-timeoutCONN_TIMEOUT
Sets the timeout used for replication connections
--protocol-timeoutPROTOCOL_TIMEOUT
Sets a timeout in seconds on how long to wait before stopping replication when the server is under
load
--wait-async-resultsWAIT_ASYNC_RESULTS
Sets the amount of time in milliseconds the server waits if the consumer is not ready before
resending data
--busy-wait-timeBUSY_WAIT_TIME
Sets the amount of time in seconds a supplier should wait after a consumer sends back a busy
response before making another attempt to acquire access.
--session-pause-timeSESSION_PAUSE_TIME
Sets the amount of time in seconds a supplier should wait between update sessions.
--flow-control-windowFLOW_CONTROL_WINDOW
Sets the maximum number of entries and updates sent by a supplier, which are not acknowledged by
the consumer.
--flow-control-pauseFLOW_CONTROL_PAUSE
Sets the time in milliseconds to pause after reaching the number of entries and updates set in
"--flow-control-window"
--bootstrap-bind-dnBOOTSTRAP_BIND_DN
Sets an optional bind DN the agreement can use to bootstrap initialization when bind groups are
being used
--bootstrap-bind-passwdBOOTSTRAP_BIND_PASSWD
Sets the bootstrap credentials for the bind DN
--bootstrap-bind-passwd-fileBOOTSTRAP_BIND_PASSWD_FILE
File containing the password
--bootstrap-bind-passwd-prompt
File containing the password
--bootstrap-conn-protocolBOOTSTRAP_CONN_PROTOCOL
Sets the replication bootstrap connection protocol: LDAP, LDAPS, or StartTLS
--bootstrap-bind-methodBOOTSTRAP_BIND_METHOD
Sets the bind method: "SIMPLE", or "SSLCLIENTAUTH"
--init Initializes the agreement after creating it
COMMAND'dsconfrepl-agmtset'
usage: dsconf [-v] [-j] instance repl-agmt set [-h] --suffix SUFFIX
[--host HOST] [--port PORT]
[--conn-protocol CONN_PROTOCOL]
[--bind-dn BIND_DN]
[--bind-passwd BIND_PASSWD]
[--bind-passwd-file BIND_PASSWD_FILE]
[--bind-passwd-prompt]
[--bind-method BIND_METHOD]
[--frac-list FRAC_LIST]
[--frac-list-total FRAC_LIST_TOTAL]
[--strip-list STRIP_LIST]
[--schedule SCHEDULE]
[--conn-timeout CONN_TIMEOUT]
[--protocol-timeout PROTOCOL_TIMEOUT]
[--wait-async-results WAIT_ASYNC_RESULTS]
[--busy-wait-time BUSY_WAIT_TIME]
[--session-pause-time SESSION_PAUSE_TIME]
[--flow-control-window FLOW_CONTROL_WINDOW]
[--flow-control-pause FLOW_CONTROL_PAUSE]
[--bootstrap-bind-dn BOOTSTRAP_BIND_DN]
[--bootstrap-bind-passwd BOOTSTRAP_BIND_PASSWD]
[--bootstrap-bind-passwd-file BOOTSTRAP_BIND_PASSWD_FILE]
[--bootstrap-bind-passwd-prompt]
[--bootstrap-conn-protocol BOOTSTRAP_CONN_PROTOCOL]
[--bootstrap-bind-method BOOTSTRAP_BIND_METHOD]
AGMT_NAME
AGMT_NAME
The name of the replication agreement
OPTIONS'dsconfrepl-agmtset'--suffixSUFFIX
Sets the DN of the replication suffix
--hostHOST
Sets the hostname of the remote replica
--portPORT
Sets the port number of the remote replica
--conn-protocolCONN_PROTOCOL
Sets the replication connection protocol: LDAP, LDAPS, or StartTLS
--bind-dnBIND_DN
Sets the Bind DN the agreement uses to authenticate to the replica
--bind-passwdBIND_PASSWD
Sets the credentials for the bind DN
--bind-passwd-fileBIND_PASSWD_FILE
File containing the password
--bind-passwd-prompt
Prompt for password
--bind-methodBIND_METHOD
Sets the bind method: "SIMPLE", "SSLCLIENTAUTH", "SASL/DIGEST", or "SASL/GSSAPI"
--frac-listFRAC_LIST
Sets a list of attributes to NOT replicate to the consumer during incremental updates
--frac-list-totalFRAC_LIST_TOTAL
Sets a list of attributes to NOT replicate during a total initialization
--strip-listSTRIP_LIST
Sets a list of attributes that are removed from updates only if the event would otherwise be
empty. Typically this is set to "modifiersname" and "modifytimestmap"
--scheduleSCHEDULE
Sets the replication update schedule: 'HHMM-HHMM DDDDDDD' D = 0-6 (Sunday - Saturday).
--conn-timeoutCONN_TIMEOUT
Sets the timeout used for replication connections
--protocol-timeoutPROTOCOL_TIMEOUT
Sets a timeout in seconds on how long to wait before stopping replication when the server is under
load
--wait-async-resultsWAIT_ASYNC_RESULTS
Sets the amount of time in milliseconds the server waits if the consumer is not ready before
resending data
--busy-wait-timeBUSY_WAIT_TIME
Sets the amount of time in seconds a supplier should wait after a consumer sends back a busy
response before making another attempt to acquire access.
--session-pause-timeSESSION_PAUSE_TIME
Sets the amount of time in seconds a supplier should wait between update sessions.
--flow-control-windowFLOW_CONTROL_WINDOW
Sets the maximum number of entries and updates sent by a supplier, which are not acknowledged by
the consumer.
--flow-control-pauseFLOW_CONTROL_PAUSE
Sets the time in milliseconds to pause after reaching the number of entries and updates set in
"--flow-control-window"
--bootstrap-bind-dnBOOTSTRAP_BIND_DN
Sets an optional bind DN the agreement can use to bootstrap initialization when bind groups are
being used
--bootstrap-bind-passwdBOOTSTRAP_BIND_PASSWD
sets the bootstrap credentials for the bind DN
--bootstrap-bind-passwd-fileBOOTSTRAP_BIND_PASSWD_FILE
File containing the password
--bootstrap-bind-passwd-prompt
Prompt for password
--bootstrap-conn-protocolBOOTSTRAP_CONN_PROTOCOL
Sets the replication bootstrap connection protocol: LDAP, LDAPS, or StartTLS
--bootstrap-bind-methodBOOTSTRAP_BIND_METHOD
Sets the bind method: "SIMPLE", or "SSLCLIENTAUTH"
COMMAND'dsconfrepl-agmtget'
usage: dsconf [-v] [-j] instance repl-agmt get [-h] --suffix SUFFIX AGMT_NAME
AGMT_NAME
The suffix DN for which to display the replication configuration
OPTIONS'dsconfrepl-agmtget'--suffixSUFFIX
Sets the DN of the replication suffix
COMMAND'dsconfrepl-winsync-agmt'
usage: dsconf [-v] [-j] instance repl-winsync-agmt [-h]
{list,enable,disable,init,init-status,poke,status,delete,create,set,get}
...
POSITIONALARGUMENTS'dsconfrepl-winsync-agmt'dsconfrepl-winsync-agmtlist
List all the replication winsync agreements
dsconfrepl-winsync-agmtenable
Enable replication winsync agreement
dsconfrepl-winsync-agmtdisable
Disable replication winsync agreement
dsconfrepl-winsync-agmtinit
Initialize replication winsync agreement
dsconfrepl-winsync-agmtinit-status
Check the agreement initialization status
dsconfrepl-winsync-agmtpoke
Trigger replication to send updates now
dsconfrepl-winsync-agmtstatus
Display the current status of the replication agreement
dsconfrepl-winsync-agmtdelete
Delete replication winsync agreement
dsconfrepl-winsync-agmtcreate
Initialize replication winsync agreement
dsconfrepl-winsync-agmtset
Set an attribute in the replication winsync agreement
dsconfrepl-winsync-agmtget
Display replication configuration
COMMAND'dsconfrepl-winsync-agmtlist'
usage: dsconf [-v] [-j] instance repl-winsync-agmt list [-h] --suffix SUFFIX
OPTIONS'dsconfrepl-winsync-agmtlist'--suffixSUFFIX
Sets the DN of the suffix to look up replication winsync agreements
COMMAND'dsconfrepl-winsync-agmtenable'
usage: dsconf [-v] [-j] instance repl-winsync-agmt enable [-h] --suffix SUFFIX
AGMT_NAME
AGMT_NAME
The name of the replication winsync agreement
OPTIONS'dsconfrepl-winsync-agmtenable'--suffixSUFFIX
Sets the DN of the replication winsync suffix
COMMAND'dsconfrepl-winsync-agmtdisable'
usage: dsconf [-v] [-j] instance repl-winsync-agmt disable [-h]
--suffix SUFFIX
AGMT_NAME
AGMT_NAME
The name of the replication winsync agreement
OPTIONS'dsconfrepl-winsync-agmtdisable'--suffixSUFFIX
Sets the DN of the replication winsync suffix
COMMAND'dsconfrepl-winsync-agmtinit'
usage: dsconf [-v] [-j] instance repl-winsync-agmt init [-h] --suffix SUFFIX
AGMT_NAME
AGMT_NAME
The name of the replication winsync agreement
OPTIONS'dsconfrepl-winsync-agmtinit'--suffixSUFFIX
Sets the DN of the replication winsync suffix
COMMAND'dsconfrepl-winsync-agmtinit-status'
usage: dsconf [-v] [-j] instance repl-winsync-agmt init-status
[-h] --suffix SUFFIX AGMT_NAME
AGMT_NAME
The name of the replication agreement
OPTIONS'dsconfrepl-winsync-agmtinit-status'--suffixSUFFIX
Sets the DN of the replication suffix
COMMAND'dsconfrepl-winsync-agmtpoke'
usage: dsconf [-v] [-j] instance repl-winsync-agmt poke [-h] --suffix SUFFIX
AGMT_NAME
AGMT_NAME
The name of the replication winsync agreement
OPTIONS'dsconfrepl-winsync-agmtpoke'--suffixSUFFIX
Sets the DN of the replication winsync suffix
COMMAND'dsconfrepl-winsync-agmtstatus'
usage: dsconf [-v] [-j] instance repl-winsync-agmt status [-h] --suffix SUFFIX
AGMT_NAME
AGMT_NAME
The name of the replication agreement
OPTIONS'dsconfrepl-winsync-agmtstatus'--suffixSUFFIX
Sets the DN of the replication suffix
COMMAND'dsconfrepl-winsync-agmtdelete'
usage: dsconf [-v] [-j] instance repl-winsync-agmt delete [-h] --suffix SUFFIX
AGMT_NAME
AGMT_NAME
The name of the replication winsync agreement
OPTIONS'dsconfrepl-winsync-agmtdelete'--suffixSUFFIX
Sets the DN of the replication winsync suffix
COMMAND'dsconfrepl-winsync-agmtcreate'
usage: dsconf [-v] [-j] instance repl-winsync-agmt create [-h] --suffix SUFFIX
--host HOST
--port PORT
--conn-protocol CONN_PROTOCOL
--bind-dn BIND_DN
[--bind-passwd BIND_PASSWD]
[--bind-passwd-file BIND_PASSWD_FILE]
[--bind-passwd-prompt]
[--frac-list FRAC_LIST]
[--schedule SCHEDULE]
--win-subtree WIN_SUBTREE
--ds-subtree DS_SUBTREE
--win-domain WIN_DOMAIN
[--sync-users SYNC_USERS]
[--sync-groups SYNC_GROUPS]
[--sync-interval SYNC_INTERVAL]
[--one-way-sync ONE_WAY_SYNC]
[--move-action MOVE_ACTION]
[--win-filter WIN_FILTER]
[--ds-filter DS_FILTER]
[--subtree-pair SUBTREE_PAIR]
[--conn-timeout CONN_TIMEOUT]
[--busy-wait-time BUSY_WAIT_TIME]
[--session-pause-time SESSION_PAUSE_TIME]
[--flatten-tree]
[--init]
AGMT_NAME
AGMT_NAME
The name of the replication winsync agreement
OPTIONS'dsconfrepl-winsync-agmtcreate'--suffixSUFFIX
Sets the DN of the replication winsync suffix
--hostHOST
Sets the hostname of the AD server
--portPORT
Sets the port number of the AD server
--conn-protocolCONN_PROTOCOL
Sets the replication winsync connection protocol: LDAP, LDAPS, or StartTLS
--bind-dnBIND_DN
Sets the bind DN the agreement uses to authenticate to the AD Server
--bind-passwdBIND_PASSWD
Sets the credentials for the Bind DN
--bind-passwd-fileBIND_PASSWD_FILE
File containing the password
--bind-passwd-prompt
Prompt for password
--frac-listFRAC_LIST
Sets a list of attributes to NOT replicate to the consumer during incremental updates
--scheduleSCHEDULE
Sets the replication update schedule
--win-subtreeWIN_SUBTREE
Sets the suffix of the AD Server
--ds-subtreeDS_SUBTREE
Sets the Directory Server suffix
--win-domainWIN_DOMAIN
Sets the AD Domain
--sync-usersSYNC_USERS
Synchronizes users between AD and DS
--sync-groupsSYNC_GROUPS
Synchronizes groups between AD and DS
--sync-intervalSYNC_INTERVAL
Sets the interval that DS checks AD for changes in entries
--one-way-syncONE_WAY_SYNC
Sets which direction to perform synchronization: "toWindows", or "fromWindows". By default sync
occurs in both directions.
--move-actionMOVE_ACTION
Sets instructions on how to handle moved or deleted entries: "none", "unsync", or "delete"
--win-filterWIN_FILTER
Sets a custom filter for finding users in AD Server
--ds-filterDS_FILTER
Sets a custom filter for finding AD users in DS
--subtree-pairSUBTREE_PAIR
Sets the subtree pair: <DS_SUBTREE>:<WINDOWS_SUBTREE>
--conn-timeoutCONN_TIMEOUT
Sets the timeout used for replicaton connections
--busy-wait-timeBUSY_WAIT_TIME
Sets the amount of time in seconds a supplier should wait after a consumer sends back a busy
response before making another attempt to acquire access
--session-pause-timeSESSION_PAUSE_TIME
Sets the amount of time in seconds a supplier should wait between update sessions
--flatten-tree
By default, the tree structure of AD is preserved into 389. This MAY cause replication to fail in
some cases, as you may need to create missing OU's to recreate the same treestructure. This
setting when enabled, removes the tree structure of AD and flattens all entries into the
ds-subtree. This does NOT affect or change the tree structure of the AD directory.
--init Initializes the agreement after creating it
COMMAND'dsconfrepl-winsync-agmtset'
usage: dsconf [-v] [-j] instance repl-winsync-agmt set [-h] [--suffix SUFFIX]
[--host HOST]
[--port PORT]
[--conn-protocol CONN_PROTOCOL]
[--bind-dn BIND_DN]
[--bind-passwd BIND_PASSWD]
[--bind-passwd-file BIND_PASSWD_FILE]
[--bind-passwd-prompt]
[--frac-list FRAC_LIST]
[--schedule SCHEDULE]
[--win-subtree WIN_SUBTREE]
[--ds-subtree DS_SUBTREE]
[--win-domain WIN_DOMAIN]
[--sync-users SYNC_USERS]
[--sync-groups SYNC_GROUPS]
[--sync-interval SYNC_INTERVAL]
[--one-way-sync ONE_WAY_SYNC]
[--move-action MOVE_ACTION]
[--win-filter WIN_FILTER]
[--ds-filter DS_FILTER]
[--subtree-pair SUBTREE_PAIR]
[--conn-timeout CONN_TIMEOUT]
[--busy-wait-time BUSY_WAIT_TIME]
[--session-pause-time SESSION_PAUSE_TIME]
AGMT_NAME
AGMT_NAME
The name of the replication winsync agreement
OPTIONS'dsconfrepl-winsync-agmtset'--suffixSUFFIX
Sets the DN of the replication winsync suffix
--hostHOST
Sets the hostname of the AD server
--portPORT
Sets the port number of the AD server
--conn-protocolCONN_PROTOCOL
Sets the replication winsync connection protocol: LDAP, LDAPS, or StartTLS
--bind-dnBIND_DN
Sets the bind DN the agreement uses to authenticate to the AD Server
--bind-passwdBIND_PASSWD
Sets the credentials for the Bind DN
--bind-passwd-fileBIND_PASSWD_FILE
File containing the password
--bind-passwd-prompt
Prompt for password
--frac-listFRAC_LIST
Sets a list of attributes to NOT replicate to the consumer during incremental updates
--scheduleSCHEDULE
Sets the replication update schedule
--win-subtreeWIN_SUBTREE
Sets the suffix of the AD Server
--ds-subtreeDS_SUBTREE
Sets the Directory Server suffix
--win-domainWIN_DOMAIN
Sets the AD Domain
--sync-usersSYNC_USERS
Synchronizes users between AD and DS
--sync-groupsSYNC_GROUPS
Synchronizes groups between AD and DS
--sync-intervalSYNC_INTERVAL
Sets the interval that DS checks AD for changes in entries
--one-way-syncONE_WAY_SYNC
Sets which direction to perform synchronization: "toWindows", or "fromWindows". By default sync
occurs in both directions.
--move-actionMOVE_ACTION
Sets instructions on how to handle moved or deleted entries: "none", "unsync", or "delete"
--win-filterWIN_FILTER
Sets a custom filter for finding users in AD Server
--ds-filterDS_FILTER
Sets a custom filter for finding AD users in DS
--subtree-pairSUBTREE_PAIR
Sets the subtree pair: <DS_SUBTREE>:<WINDOWS_SUBTREE>
--conn-timeoutCONN_TIMEOUT
Sets the timeout used for replicaton connections
--busy-wait-timeBUSY_WAIT_TIME
Sets the amount of time in seconds a supplier should wait after a consumer sends back a busy
response before making another attempt to acquire access
--session-pause-timeSESSION_PAUSE_TIME
Sets the amount of time in seconds a supplier should wait between update sessions
COMMAND'dsconfrepl-winsync-agmtget'
usage: dsconf [-v] [-j] instance repl-winsync-agmt get [-h] --suffix SUFFIX
AGMT_NAME
AGMT_NAME
The suffix DN for the replication configuration to display
OPTIONS'dsconfrepl-winsync-agmtget'--suffixSUFFIX
Sets the DN of the replication suffix
COMMAND'dsconfrepl-tasks'
usage: dsconf [-v] [-j] instance repl-tasks [-h]
{cleanallruv,list-cleanruv-tasks,abort-cleanallruv,list-abortruv-tasks}
...
POSITIONALARGUMENTS'dsconfrepl-tasks'dsconfrepl-taskscleanallruv
Cleanup old/removed replica IDs
dsconfrepl-taskslist-cleanruv-tasks
List all the running CleanAllRUV tasks
dsconfrepl-tasksabort-cleanallruv
Abort cleanallruv tasks
dsconfrepl-taskslist-abortruv-tasks
List all the running CleanAllRUV abort tasks
COMMAND'dsconfrepl-taskscleanallruv'
usage: dsconf [-v] [-j] instance repl-tasks cleanallruv [-h] --suffix SUFFIX
--replica-id REPLICA_ID
[--force-cleaning]
OPTIONS'dsconfrepl-taskscleanallruv'--suffixSUFFIX
Sets the Directory Server suffix
--replica-idREPLICA_ID
Sets the replica ID to remove/clean
--force-cleaning
Ignores errors and make a best attempt to clean all replicas
COMMAND'dsconfrepl-taskslist-cleanruv-tasks'
usage: dsconf [-v] [-j] instance repl-tasks list-cleanruv-tasks
[-h] [--suffix SUFFIX]
OPTIONS'dsconfrepl-taskslist-cleanruv-tasks'--suffixSUFFIX
Lists only tasks for the specified suffix
COMMAND'dsconfrepl-tasksabort-cleanallruv'
usage: dsconf [-v] [-j] instance repl-tasks abort-cleanallruv
[-h] --suffix SUFFIX --replica-id REPLICA_ID [--certify]
OPTIONS'dsconfrepl-tasksabort-cleanallruv'--suffixSUFFIX
Sets the Directory Server suffix
--replica-idREPLICA_ID
Sets the replica ID of the cleaning task to abort
--certify
Enforces that the abort task completed on all replicas
COMMAND'dsconfrepl-taskslist-abortruv-tasks'
usage: dsconf [-v] [-j] instance repl-tasks list-abortruv-tasks
[-h] [--suffix SUFFIX]
OPTIONS'dsconfrepl-taskslist-abortruv-tasks'--suffixSUFFIX
Lists only tasks for the specified suffix
COMMAND'dsconfrepl-conflict'
usage: dsconf [-v] [-j] instance repl-conflict [-h]
{list,compare,delete,swap,convert,list-glue,delete-glue,convert-glue}
...
POSITIONALARGUMENTS'dsconfrepl-conflict'dsconfrepl-conflictlist
List conflict entries
dsconfrepl-conflictcompare
Compare the conflict entry with its valid counterpart
dsconfrepl-conflictdelete
Delete a conflict entry
dsconfrepl-conflictswap
Replace the valid entry with the conflict entry
dsconfrepl-conflictconvert
Convert the conflict entry to a valid entry, while keeping the original valid entry counterpart.
This requires that the converted conflict entry have a new RDN value. For example:
"cn=my_new_rdn_value".
dsconfrepl-conflictlist-glue
List replication glue entries
dsconfrepl-conflictdelete-glue
Delete the glue entry and its child entries
dsconfrepl-conflictconvert-glue
Convert the glue entry into a regular entry
COMMAND'dsconfrepl-conflictlist'
usage: dsconf [-v] [-j] instance repl-conflict list [-h] suffix
suffix Sets the backend name, or suffix, to look for conflict entries
COMMAND'dsconfrepl-conflictcompare'
usage: dsconf [-v] [-j] instance repl-conflict compare [-h] DN
DN The DN of the conflict entry
COMMAND'dsconfrepl-conflictdelete'
usage: dsconf [-v] [-j] instance repl-conflict delete [-h] DN
DN The DN of the conflict entry
COMMAND'dsconfrepl-conflictswap'
usage: dsconf [-v] [-j] instance repl-conflict swap [-h] DN
DN The DN of the conflict entry
COMMAND'dsconfrepl-conflictconvert'
usage: dsconf instance [-v] [-j] repl-conflict convert [-h] --new-rdn NEW_RDN
DN
DN The DN of the conflict entry
OPTIONS'dsconfrepl-conflictconvert'--new-rdnNEW_RDN
Sets the new RDN for the converted conflict entry. For example: "cn=my_new_rdn_value"
COMMAND'dsconfrepl-conflictlist-glue'
usage: dsconf [-v] [-j] instance repl-conflict list-glue [-h] suffix
suffix The backend name, or suffix, to look for glue entries
COMMAND'dsconfrepl-conflictdelete-glue'
usage: dsconf [-v] [-j] instance repl-conflict delete-glue [-h] DN
DN The DN of the glue entry
COMMAND'dsconfrepl-conflictconvert-glue'
usage: dsconf [-v] [-j] instance repl-conflict convert-glue [-h] DN
DN The DN of the glue entry
COMMAND'dsconfsasl'
usage: dsconf [-v] [-j] instance sasl [-h]
{list,get-mechs,get-available-mechs,get,create,delete} ...
POSITIONALARGUMENTS'dsconfsasl'dsconfsasllist
Display available SASL mappings
dsconfsaslget-mechs
Display the SASL mechanisms that the server will accept
dsconfsaslget-available-mechs
Display the SASL mechanisms that are available to the server
dsconfsaslget
Displays SASL mappings
dsconfsaslcreate
Create a SASL mapping
dsconfsasldelete
Deletes the SASL object
COMMAND'dsconfsasllist'
usage: dsconf [-v] [-j] instance sasl list [-h] [--details]
OPTIONS'dsconfsasllist'--details
Displays each SASL mapping in detail
COMMAND'dsconfsaslget-mechs'
usage: dsconf [-v] [-j] instance sasl get-mechs [-h]
COMMAND'dsconfsaslget-available-mechs'
usage: dsconf [-v] [-j] instance sasl get-available-mechs [-h]
COMMAND'dsconfsaslget'
usage: dsconf [-v] [-j] instance sasl get [-h] [selector]
selector
The SASL mapping name to display
COMMAND'dsconfsaslcreate'
usage: dsconf [-v] [-j] instance sasl create [-h] [--cn [CN]]
[--nsSaslMapRegexString [NSSASLMAPREGEXSTRING]]
[--nsSaslMapBaseDNTemplate [NSSASLMAPBASEDNTEMPLATE]]
[--nsSaslMapFilterTemplate [NSSASLMAPFILTERTEMPLATE]]
[--nsSaslMapPriority [NSSASLMAPPRIORITY]]
OPTIONS'dsconfsaslcreate'--cn[CN]
Value of cn
--nsSaslMapRegexString[NSSASLMAPREGEXSTRING]
Value of nsSaslMapRegexString
--nsSaslMapBaseDNTemplate[NSSASLMAPBASEDNTEMPLATE]
Value of nsSaslMapBaseDNTemplate
--nsSaslMapFilterTemplate[NSSASLMAPFILTERTEMPLATE]
Value of nsSaslMapFilterTemplate
--nsSaslMapPriority[NSSASLMAPPRIORITY]
Value of nsSaslMapPriority
COMMAND'dsconfsasldelete'
usage: dsconf [-v] [-j] instance sasl delete [-h] map_name
map_name
The SASL mapping name ("cn" value)
COMMAND'dsconfsecurity'
usage: dsconf [-v] [-j] instance security [-h]
{set,get,enable,disable,disable_plain_port,certificate,ca-certificate,rsa,ciphers,csr,key,export-cert}
...
POSITIONALARGUMENTS'dsconfsecurity'dsconfsecurityset
Set general security options
dsconfsecurityget
Display general security options
dsconfsecurityenable
Enable security
dsconfsecuritydisable
Disable security
dsconfsecuritydisable_plain_port
Disables the plain text LDAP port, allowing only LDAPS to function
dsconfsecuritycertificate
Manage TLS certificates
dsconfsecurityca-certificate
Manage TLS certificate authorities
dsconfsecurityrsa
Query and update RSA security options
dsconfsecurityciphers
Manage secure ciphers
dsconfsecuritycsr
Manage certificate signing requests
dsconfsecuritykey
Manage keys in NSS DB
dsconfsecurityexport-cert
Export a certificate to PEM or DER/Binary format. PEM format is the default
COMMAND'dsconfsecurityset'
usage: dsconf [-v] [-j] instance security set [-h] [--security SECURITY]
[--listen-host LISTEN_HOST]
[--secure-port SECURE_PORT]
[--tls-client-auth TLS_CLIENT_AUTH]
[--tls-client-renegotiation TLS_CLIENT_RENEGOTIATION]
[--require-secure-authentication
REQUIRE_SECURE_AUTHENTICATION]
[--check-hostname CHECK_HOSTNAME]
[--verify-cert-chain-on-startup
VERIFY_CERT_CHAIN_ON_STARTUP]
[--session-timeout SESSION_TIMEOUT]
[--tls-protocol-min TLS_PROTOCOL_MIN]
[--tls-protocol-max TLS_PROTOCOL_MAX]
[--allow-insecure-ciphers ALLOW_INSECURE_CIPHERS]
[--allow-weak-dh-param ALLOW_WEAK_DH_PARAM]
[--cipher-pref CIPHER_PREF]
Use this command for setting security related options located in cn=config and cn=encryption,cn=config.
To enable/disable security you can use enable and disable commands instead.
OPTIONS'dsconfsecurityset'--securitySECURITY
Enables or disables security (nsslapd-security)
--listen-hostLISTEN_HOST
Sets the host or IP address to listen on for LDAPS (nsslapd-securelistenhost)
--secure-portSECURE_PORT
Sets the port for LDAPS to listen on (nsslapd-securePort)
--tls-client-authTLS_CLIENT_AUTH
Configures client authentication requirement (nsSSLClientAuth)
--tls-client-renegotiationTLS_CLIENT_RENEGOTIATION
Allows client TLS renegotiation (nsTLSAllowClientRenegotiation)
--require-secure-authenticationREQUIRE_SECURE_AUTHENTICATION
Configures whether binds over LDAPS, StartTLS, or SASL are required (nsslapd-
require-secure-binds)
--check-hostnameCHECK_HOSTNAME
Checks the subject of remote certificate against the hostname (nsslapd-ssl- check-hostname)
--verify-cert-chain-on-startupVERIFY_CERT_CHAIN_ON_STARTUP
Validates the server certificate during startup (nsslapd-validate-cert)
--session-timeoutSESSION_TIMEOUT
Sets the secure session timeout (nsSSLSessionTimeout)
--tls-protocol-minTLS_PROTOCOL_MIN
Sets the minimal allowed secure protocol version (sslVersionMin)
--tls-protocol-maxTLS_PROTOCOL_MAX
Sets the maximal allowed secure protocol version (sslVersionMax)
--allow-insecure-ciphersALLOW_INSECURE_CIPHERS
Allows weak ciphers for legacy use (allowWeakCipher)
--allow-weak-dh-paramALLOW_WEAK_DH_PARAM
Allows short DH params for legacy use (allowWeakDHParam)
--cipher-prefCIPHER_PREF
Directly sets the nsSSL3Ciphers attribute. It is a comma-separated list of cipher names (prefixed
with + or -), optionally including +all or -all. The attribute may optionally be prefixed by
keyword "default". Please refer to documentation of the attribute for a more detailed description.
(nsSSL3Ciphers)
COMMAND'dsconfsecurityget'
usage: dsconf [-v] [-j] instance security get [-h]
COMMAND'dsconfsecurityenable'
usage: dsconf instance [-v] [-j] security enable [-h] [--cert-name CERT_NAME]
If missing, create security database, then turn on security functionality. Please note this is usually
not enough for TLS connections to work - proper setup of CA and server certificate is necessary.
OPTIONS'dsconfsecurityenable'--cert-nameCERT_NAME
Sets the name of the certificate the server should use
COMMAND'dsconfsecuritydisable'
usage: dsconf instance [-v] [-j] security disable [-h]
Turn off security functionality. The rest of the configuration will be left untouched.
COMMAND'dsconfsecuritydisable_plain_port'
usage: dsconf instance [-v] [-j] security disable_plain_port [-h]
COMMAND'dsconfsecuritycertificate'
usage: dsconf [-v] [-j] instance security certificate [-h]
{add,set-trust-flags,del,get,list} ...
POSITIONALARGUMENTS'dsconfsecuritycertificate'dsconfsecuritycertificateadd
Add a server certificate
dsconfsecuritycertificateset-trust-flags
Set the Trust flags
dsconfsecuritycertificatedel
Delete a certificate
dsconfsecuritycertificateget
Display a server certificate's information
dsconfsecuritycertificatelist
List the server certificates
COMMAND'dsconfsecuritycertificateadd'
usage: dsconf instance [-v] [-j] security certificate add [-h] --file FILE
--name NAME
[--primary-cert]
Add a server certificate to the NSS database
OPTIONS'dsconfsecuritycertificateadd'--fileFILE
Sets the file name of the certificate
--nameNAME
Sets the name/nickname of the certificate
--primary-cert
Sets this certificate as the server's certificate
COMMAND'dsconfsecuritycertificateset-trust-flags'
usage: dsconf instance [-v] [-j] security certificate set-trust-flags
[-h] --flags FLAGS name
Change the trust flags of a server certificate
name The name/nickname of the certificate
OPTIONS'dsconfsecuritycertificateset-trust-flags'--flagsFLAGS
Sets the trust flags for the server certificate
COMMAND'dsconfsecuritycertificatedel'
usage: dsconf instance [-v] [-j] security certificate del [-h] name
Delete a certificate from the NSS database
name The name/nickname of the certificate
COMMAND'dsconfsecuritycertificateget'
usage: dsconf instance [-v] [-j] security certificate get [-h] name
Displays detailed information about a certificate, such as trust attributes, expiration dates, Subject
and Issuer DNs
name Set the name/nickname of the certificate
COMMAND'dsconfsecuritycertificatelist'
usage: dsconf instance [-v] [-j] security certificate list [-h]
Lists the server certificates in the NSS database
COMMAND'dsconfsecurityca-certificate'
usage: dsconf [-v] [-j] instance security ca-certificate [-h]
{add,set-trust-flags,del,get,list} ...
POSITIONALARGUMENTS'dsconfsecurityca-certificate'dsconfsecurityca-certificateadd
Add a Certificate Authority
dsconfsecurityca-certificateset-trust-flags
Set the Trust flags
dsconfsecurityca-certificatedel
Delete a certificate
dsconfsecurityca-certificateget
Displays a Certificate Authority's information
dsconfsecurityca-certificatelist
List the Certificate Authorities
COMMAND'dsconfsecurityca-certificateadd'
usage: dsconf instance [-v] [-j] security ca-certificate add
[-h] --file FILE --name NAME [NAME ...]
Add a Certificate Authority to the NSS database
OPTIONS'dsconfsecurityca-certificateadd'--fileFILE
Sets the file name of the CA certificate
--nameNAME[NAME...]
Sets the name/nickname of the CA certificate, if adding a PEM bundle then specify multiple names
one for each certificate, otherwise a number increment will be added to the previous name.
COMMAND'dsconfsecurityca-certificateset-trust-flags'
usage: dsconf instance [-v] [-j] security ca-certificate set-trust-flags
[-h] --flags FLAGS name
Change the trust attributes of a CA certificate. Certificate Authorities typically use "CT,,"
name The name/nickname of the CA certificate
OPTIONS'dsconfsecurityca-certificateset-trust-flags'--flagsFLAGS
Sets the trust flags for the CA certificate
COMMAND'dsconfsecurityca-certificatedel'
usage: dsconf instance [-v] [-j] security ca-certificate del [-h] name
Delete a CA certificate from the NSS database
name The name/nickname of the CA certificate
COMMAND'dsconfsecurityca-certificateget'
usage: dsconf instance [-v] [-j] security ca-certificate get [-h] name
Get detailed information about a CA certificate, like trust attributes, expiration dates, Subject and
Issuer DN
name The name/nickname of the CA certificate
COMMAND'dsconfsecurityca-certificatelist'
usage: dsconf instance [-v] [-j] security ca-certificate list [-h]
List the CA certificates in the NSS database
COMMAND'dsconfsecurityrsa'
usage: dsconf [-v] [-j] instance security rsa [-h]
{set,get,enable,disable} ...
POSITIONALARGUMENTS'dsconfsecurityrsa'dsconfsecurityrsaset
Set RSA security options
dsconfsecurityrsaget
Get RSA security options
dsconfsecurityrsaenable
Enable RSA
dsconfsecurityrsadisable
Disable RSA
COMMAND'dsconfsecurityrsaset'
usage: dsconf [-v] [-j] instance security rsa set [-h]
[--tls-allow-rsa-certificates
TLS_ALLOW_RSA_CERTIFICATES]
[--nss-cert-name NSS_CERT_NAME]
[--nss-token NSS_TOKEN]
Use this command for setting RSA (private key) related options located in cn=RSA,cn=encryption,cn=config.
To enable/disable RSA you can use enable and disable commands instead.
OPTIONS'dsconfsecurityrsaset'--tls-allow-rsa-certificatesTLS_ALLOW_RSA_CERTIFICATES
Activates the use of RSA certificates (nsSSLActivation)
--nss-cert-nameNSS_CERT_NAME
Sets the server certificate name in NSS DB (nsSSLPersonalitySSL)
--nss-tokenNSS_TOKEN
Sets the security token name (module of NSS DB) (nsSSLToken)
COMMAND'dsconfsecurityrsaget'
usage: dsconf [-v] [-j] instance security rsa get [-h]
COMMAND'dsconfsecurityrsaenable'
usage: dsconf [-v] [-j] instance security rsa enable [-h]
COMMAND'dsconfsecurityrsadisable'
usage: dsconf [-v] [-j] instance security rsa disable [-h]
COMMAND'dsconfsecurityciphers'
usage: dsconf [-v] [-j] instance security ciphers [-h]
{enable,disable,get,set,list} ...
POSITIONALARGUMENTS'dsconfsecurityciphers'dsconfsecurityciphersenable
Enable ciphers
dsconfsecurityciphersdisable
Disable ciphers
dsconfsecurityciphersget
Get ciphers attribute
dsconfsecurityciphersset
Set ciphers attribute
dsconfsecuritycipherslist
List ciphers
COMMAND'dsconfsecurityciphersenable'
usage: dsconf instance [-v] [-j] security ciphers enable [-h]
cipher [cipher ...]
Use this command to enable specific ciphers.
cipherCOMMAND'dsconfsecurityciphersdisable'
usage: dsconf instance [-v] [-j] security ciphers disable [-h]
cipher [cipher ...]
Use this command to disable specific ciphers.
cipherCOMMAND'dsconfsecurityciphersget'
usage: dsconf instance [-v] [-j] security ciphers get [-h]
Use this command to get contents of nsSSL3Ciphers attribute.
COMMAND'dsconfsecurityciphersset'
usage: dsconf instance [-v] [-j] security ciphers set [-h] cipher-string
Use this command to directly set nsSSL3Ciphers attribute. It is a comma separated list of cipher names
(prefixed with + or -), optionally including +all or -all. The attribute may optionally be set to keyword
default. Please refer to documentation of the attribute for a more detailed description.
cipher-stringCOMMAND'dsconfsecuritycipherslist'
usage: dsconf instance [-v] [-j] security ciphers list [-h] [--enabled |
--supported |
--disabled]
List secure ciphers. Without arguments, list ciphers as configured in nsSSL3Ciphers attribute.
OPTIONS'dsconfsecuritycipherslist'--enabled
Lists only enabled ciphers
--supported
Lists only supported ciphers
--disabled
Lists only supported ciphers but without enabled ciphers
COMMAND'dsconfsecuritycsr'
usage: dsconf [-v] [-j] instance security csr [-h] {list,get,req,del} ...
POSITIONALARGUMENTS'dsconfsecuritycsr'dsconfsecuritycsrlist
List CSRs
dsconfsecuritycsrget
Display CSR content
dsconfsecuritycsrreq
Generate a Certificate Signing Request
dsconfsecuritycsrdel
Delete a CSR file
COMMAND'dsconfsecuritycsrlist'
usage: dsconf instance [-v] [-j] security csr list [-h] [--path PATH]
List all CSR files in instance configuration directiory
OPTIONS'dsconfsecuritycsrlist'--pathPATH, -pPATH
Directory contanining CSR file
COMMAND'dsconfsecuritycsrget'
usage: dsconf instance [-v] [-j] security csr get [-h] name
Displays the contents of a CSR, which can be used for submittal to CA
name Name of the CSR file to display
COMMAND'dsconfsecuritycsrreq'
usage: dsconf instance [-v] [-j] security csr req [-h] --subject SUBJECT
--name NAME
[alt_names ...]
Generate a CSR that can be submitted to a CA for verification
alt_names
CSR alternative names. These are auto-detected if not provided
OPTIONS'dsconfsecuritycsrreq'--subjectSUBJECT, -sSUBJECT
Subject field
--nameNAME, -nNAME
Name
COMMAND'dsconfsecuritycsrdel'
usage: dsconf [-v] [-j] instance security csr del [-h] name
Delete a CSR file
name Name of the CSR file to delete
COMMAND'dsconfsecuritykey'
usage: dsconf [-v] [-j] instance security key [-h] {list,del} ...
POSITIONALARGUMENTS'dsconfsecuritykey'dsconfsecuritykeylist
List all keys in NSS DB
dsconfsecuritykeydel
Delete a key from NSS DB
COMMAND'dsconfsecuritykeylist'
usage: dsconf [-v] [-j] instance security key list [-h] [--orphan]
OPTIONS'dsconfsecuritykeylist'--orphan
List orphan keys (An orphan key is a private key in the NSS DB for which there is NO cert with the
corresponding public key). An orphan key is created during CSR generation, when the associated
certificate is imported into the NSS DB, its orphan state will be removed.
COMMAND'dsconfsecuritykeydel'
usage: dsconf instance [-v] [-j] security key del [-h] key_id
Remove a key from the NSS DB. Make sure the key is not in use before you delete
key_id This is the key ID displayed when listing keys
COMMAND'dsconfsecurityexport-cert'
usage: dsconf instance [-v] [-j] security export-cert [-h] [--binary-format]
[--output-file OUTPUT_FILE]
nickname
nickname
The name of the certificate to export
OPTIONS'dsconfsecurityexport-cert'--binary-format
Export certificate in DER/binary format
--output-fileOUTPUT_FILE
The name for the exported certificate. Default name is the certificate nickname with an extension
of ".pem" or ".crt"
COMMAND'dsconfschema'
usage: dsconf [-v] [-j] instance schema [-h]
{list,attributetypes,objectclasses,matchingrules,reload,validate-syntax,import-openldap-file}
...
POSITIONALARGUMENTS'dsconfschema'dsconfschemalist
List all schema objects on this system
dsconfschemaattributetypes
Work with attribute types on this system
dsconfschemaobjectclasses
Work with objectClasses on this system
dsconfschemamatchingrules
Work with matching rules on this system
dsconfschemareload
Dynamically reload schema while server is running
dsconfschemavalidate-syntax
Run a task to check that all attributes in an entry have the correct syntax
dsconfschemaimport-openldap-file
Import an openldap formatted dynamic schema ldifs. These will contain values like
olcAttributeTypes and olcObjectClasses.
COMMAND'dsconfschemalist'
usage: dsconf [-v] [-j] instance schema list [-h]
COMMAND'dsconfschemaattributetypes'
usage: dsconf [-v] [-j] instance schema attributetypes [-h]
{get_syntaxes,list,query,add,replace,remove} ...
POSITIONALARGUMENTS'dsconfschemaattributetypes'dsconfschemaattributetypesget_syntaxes
List all available attribute type syntaxes
dsconfschemaattributetypeslist
List available attribute types on this system
dsconfschemaattributetypesquery
Query an attribute to determine object classes that may or must take it
dsconfschemaattributetypesadd
Add an attribute type to this system
dsconfschemaattributetypesreplace
Replace an attribute type on this system
dsconfschemaattributetypesremove
Remove an attribute type on this system
COMMAND'dsconfschemaattributetypesget_syntaxes'
usage: dsconf [-v] [-j] instance schema attributetypes get_syntaxes [-h]
COMMAND'dsconfschemaattributetypeslist'
usage: dsconf [-v] [-j] instance schema attributetypes list [-h]
COMMAND'dsconfschemaattributetypesquery'
usage: dsconf [-v] [-j] instance schema attributetypes query [-h] [name]
name Attribute type to query
COMMAND'dsconfschemaattributetypesadd'
usage: dsconf [-v] [-j] instance schema attributetypes add [-h] [--oid OID]
[--desc DESC]
[--x-origin X_ORIGIN]
[--aliases ALIASES [ALIASES ...]]
[--single-value]
[--multi-value]
[--no-user-mod]
[--user-mod]
[--equality EQUALITY]
[--substr SUBSTR]
[--ordering ORDERING]
[--usage USAGE]
[--sup SUP]
--syntax SYNTAX
name
name NAME of the object
OPTIONS'dsconfschemaattributetypesadd'--oidOID
OID assigned to the object
--descDESC
Description text(DESC) of the object
--x-originX_ORIGIN
Provides information about where the attribute type is defined
--aliasesALIASES[ALIASES...]
Additional NAMEs of the object.
--single-value
True if the matching rule must have only one valueOnly one of the flags this or --multi-value
should be specified
--multi-value
True if the matching rule may have multiple values (default)Only one of the flags this or
--single-value should be specified
--no-user-mod
True if the attribute is not modifiable by a client applicationOnly one of the flags this or
--user-mod should be specified
--user-mod
True if the attribute is modifiable by a client application (default)Only one of the flags this or
--no-user-mode should be specified
--equalityEQUALITY
NAME or OID of the matching rule used for checkingwhether attribute values are equal
--substrSUBSTR
NAME or OID of the matching rule used for checkingwhether an attribute value contains another
value
--orderingORDERING
NAME or OID of the matching rule used for checkingwhether attribute values are lesser - equal than
--usageUSAGE
The flag indicates how the attribute type is to be used. Choose from the list: userApplications
(default), directoryOperation, distributedOperation, dSAOperation
--supSUP
The NAME or OID of attribute type this attribute type is derived from
--syntaxSYNTAX
OID of the LDAP syntax assigned to the attribute
COMMAND'dsconfschemaattributetypesreplace'
usage: dsconf [-v] [-j] instance schema attributetypes replace
[-h] [--oid OID] [--desc DESC] [--x-origin X_ORIGIN]
[--aliases ALIASES [ALIASES ...]] [--single-value] [--multi-value]
[--no-user-mod] [--user-mod] [--equality EQUALITY] [--substr SUBSTR]
[--ordering ORDERING] [--usage USAGE] [--sup SUP] [--syntax SYNTAX]
name
name NAME of the object
OPTIONS'dsconfschemaattributetypesreplace'--oidOID
OID assigned to the object
--descDESC
Description text(DESC) of the object
--x-originX_ORIGIN
Provides information about where the attribute type is defined
--aliasesALIASES[ALIASES...]
Additional NAMEs of the object.
--single-value
True if the matching rule must have only one valueOnly one of the flags this or --multi-value
should be specified
--multi-value
True if the matching rule may have multiple values (default)Only one of the flags this or
--single-value should be specified
--no-user-mod
True if the attribute is not modifiable by a client applicationOnly one of the flags this or
--user-mod should be specified
--user-mod
True if the attribute is modifiable by a client application (default)Only one of the flags this or
--no-user-mode should be specified
--equalityEQUALITY
NAME or OID of the matching rule used for checkingwhether attribute values are equal
--substrSUBSTR
NAME or OID of the matching rule used for checkingwhether an attribute value contains another
value
--orderingORDERING
NAME or OID of the matching rule used for checkingwhether attribute values are lesser - equal than
--usageUSAGE
The flag indicates how the attribute type is to be used. Choose from the list: userApplications
(default), directoryOperation, distributedOperation, dSAOperation
--supSUP
The NAME or OID of attribute type this attribute type is derived from
--syntaxSYNTAX
OID of the LDAP syntax assigned to the attribute
COMMAND'dsconfschemaattributetypesremove'
usage: dsconf [-v] [-j] instance schema attributetypes remove [-h] name
name NAME of the object
COMMAND'dsconfschemaobjectclasses'
usage: dsconf [-v] [-j] instance schema objectclasses [-h]
{list,query,add,replace,remove} ...
POSITIONALARGUMENTS'dsconfschemaobjectclasses'dsconfschemaobjectclasseslist
List available objectClasses on this system
dsconfschemaobjectclassesquery
Query an objectClass
dsconfschemaobjectclassesadd
Add an objectClass to this system
dsconfschemaobjectclassesreplace
Replace an objectClass on this system
dsconfschemaobjectclassesremove
Remove an objectClass on this system
COMMAND'dsconfschemaobjectclasseslist'
usage: dsconf [-v] [-j] instance schema objectclasses list [-h]
COMMAND'dsconfschemaobjectclassesquery'
usage: dsconf [-v] [-j] instance schema objectclasses query [-h] [name]
name ObjectClass to query
COMMAND'dsconfschemaobjectclassesadd'
usage: dsconf [-v] [-j] instance schema objectclasses add [-h] [--oid OID]
[--desc DESC]
[--x-origin X_ORIGIN]
[--must MUST [MUST ...]]
[--may MAY [MAY ...]]
[--kind KIND]
[--sup SUP [SUP ...]]
name
name NAME of the object
OPTIONS'dsconfschemaobjectclassesadd'--oidOID
OID assigned to the object
--descDESC
Description text(DESC) of the object
--x-originX_ORIGIN
Provides information about where the attribute type is defined
--mustMUST[MUST...]
NAMEs or OIDs of all attributes an entry of the object must have
--mayMAY[MAY...]
NAMEs or OIDs of additional attributes an entry of the object may have
--kindKIND
Kind of an object. STRUCTURAL (default), ABSTRACT, AUXILIARY
--supSUP[SUP...]
NAME or OIDs of object classes this object is derived from
COMMAND'dsconfschemaobjectclassesreplace'
usage: dsconf [-v] [-j] instance schema objectclasses replace
[-h] [--oid OID] [--desc DESC] [--x-origin X_ORIGIN]
[--must MUST [MUST ...]] [--may MAY [MAY ...]] [--kind KIND]
[--sup SUP [SUP ...]]
name
name NAME of the object
OPTIONS'dsconfschemaobjectclassesreplace'--oidOID
OID assigned to the object
--descDESC
Description text(DESC) of the object
--x-originX_ORIGIN
Provides information about where the attribute type is defined
--mustMUST[MUST...]
NAMEs or OIDs of all attributes an entry of the object must have
--mayMAY[MAY...]
NAMEs or OIDs of additional attributes an entry of the object may have
--kindKIND
Kind of an object. STRUCTURAL (default), ABSTRACT, AUXILIARY
--supSUP[SUP...]
NAME or OIDs of object classes this object is derived from
COMMAND'dsconfschemaobjectclassesremove'
usage: dsconf [-v] [-j] instance schema objectclasses remove [-h] name
name NAME of the object
COMMAND'dsconfschemamatchingrules'
usage: dsconf [-v] [-j] instance schema matchingrules [-h] {list,query} ...
POSITIONALARGUMENTS'dsconfschemamatchingrules'dsconfschemamatchingruleslist
List available matching rules on this system
dsconfschemamatchingrulesquery
Query a matching rule
COMMAND'dsconfschemamatchingruleslist'
usage: dsconf [-v] [-j] instance schema matchingrules list [-h]
COMMAND'dsconfschemamatchingrulesquery'
usage: dsconf [-v] [-j] instance schema matchingrules query [-h] [name]
name Matching rule to query
COMMAND'dsconfschemareload'
usage: dsconf [-v] [-j] instance schema reload [-h] [-d SCHEMADIR] [--wait]
[--timeout TIMEOUT]
OPTIONS'dsconfschemareload'-dSCHEMADIR, --schemadirSCHEMADIR
directory where schema files are located
--wait Wait for the reload task to complete
--timeoutTIMEOUT
Set a timeout to wait for the reload task. Default is 120 seconds
COMMAND'dsconfschemavalidate-syntax'
usage: dsconf instance [-v] [-j] schema validate-syntax [-h] [-f FILTER]
[--timeout TIMEOUT]
DN
DN Base DN that contains entries to validate
OPTIONS'dsconfschemavalidate-syntax'-fFILTER, --filterFILTER
Filter for entries to validate. If omitted, all entries with filter "(objectclass=*)" are
validated
--timeoutTIMEOUT
Set a timeout to wait for the validation task. Default is 120 seconds
COMMAND'dsconfschemaimport-openldap-file'
usage: dsconf instance [-v] [-j] schema import-openldap-file
[-h] [--confirm] schema_file
schema_file
Path to the openldap dynamic schema ldif to import
OPTIONS'dsconfschemaimport-openldap-file'--confirm
Confirm that you want to apply these schema migration actions to the 389-ds instance. By default
no actions are taken.
Install Now
PNG Icons