Red Hat DIRECTORY SERVER 7.1, Installation Manual

Page: 9 / 96

Chapter 1. Preparing for a Directory Server Installation 3
•
The directory must not already exist or must be empty.
•
When using tarballs, the server root directory must not be the same as the directory from which you
are running the setup program.
By default, the server root directory is /opt/redhat-ds/servers.
1.2.3. Deciding the User and Group for Your Servers
For security reasons, it is always best to run production servers with normal user privileges. That is,
you do not want to run Directory Server with root privileges. However, you will have to run Directory
Server with root privileges if you are using the default Directory Server ports. If Directory Server is
to be started by Administration Server, Administration Server must run either as root or as the same
user as Directory Server.
You must therefore decide which user accounts you will use for the following purposes:
•
The user and group under which you will run Directory Server.
Note
If you will not be running the Directory Server as root, it is strongly recommended that you create a
user account for all directory services. You should not use any existing operating system account
and must not use the nobody account. Also, you should create a common group for the directory
server files; again, you must not use the nobody group.
•
The user and group under which you will run Administration Server.
For installations that use the default port numbers, this must be root. However, if you use ports over
1024, then you should create a user account for all directory services and run Administration Server
as this account.
As a security precaution, when Administration Server is being run as root, it should be shut down
when it is not in use.
Note
On Linux, the group names must not contain spaces.
You should use a common group for all directory services, such as gid
DirectoryServer
, to ensure
that files can be shared between servers when necessary, and this GID should be the same across
all servers that will be running Directory Server since the Directory Server uses this GID to check
permissions. Also the UID of the users as whom the Directory Server will run should be the same on
all systems.
Before you can install Directory Server and Administration Server, you must make sure that the user
and group accounts you will use exist on your system.
1.2.4. Defining Authentication Entities
As you install Directory Server and Administration Server, you will be asked for various user names,
distinguished names (DN), and passwords. This list of login and bind entities will differ depending on
the type of installation that you are performing: