Red Hat DIRECTORY SERVER 7.1, Administrator'S Manual, Page: 98 / 652

Creating and Maintaining Databases
98 Red Hat Directory Server Administrator’s Guide • May 2005
5.
Edit the
dse.ldif
file, and change the
nsslapd-db-logdirectory
attribute
for the new log file path:
nsslapd-db-logdirectory: /home/exampledb-txnlogs
This attribute goes on the same entry that has the
nsslapd-dbcachesize
attribute.
6.
Open the database directory.
cd
serverRoot
/slapd-
serverID
/db
7.
Remove all of the
__db.*
files.
8.
Move the
log.*
files to the new location.
9.
Start the Directory Server instance again.
serverRoott
/slapd-
serverID
/stop-slapd
Database Encryption
Directory Server offers a number of mechanisms to secure access to sensitive data,
such as access control rules to prevent unauthorized users from reading certain
entries or attributes within entries and SSL to protect data from eavesdropping
and tampering on untrusted networks. However, an unauthorized person could
potentially extract sensitive information from directory database files from copies
of files or old hard drives because information in a database is stored in plain text.
Thus, sensitive information such as government identification numbers may not
be protected enough by standard access control measures.
Since this potential information loss can present a significant security risk,
Directory Server can encrypt selected portions of its database. Once encrypted,
the data are safe even in the event that an attacker has a copy of the server’s
database files.
Database encryption encrypts attributes as they are stored within the database . When
configured, every instance of a particular attribute, even index data, is encrypted
for every entry stored in that database. Encryption and the encryption cipher are
configured per attribute per backend.
Indexed attributes may be encrypted, and database encryption is fully compatible
with indexing. The contents of the index files that are normally derived from
attribute values are also encrypted to prevent an attacker from recovering part or
all of the encrypted data from an analysis of the indexes.