Chapter 1. Preparing for a Directory Server Installation
2
NOTE
While the legal range of port numbers is
1
to
65535
, the Internet Assigned Numbers
Authority (IANA) has already assigned ports
1
to
1024
to common processes. Never
assign a Directory Server port number below
1024
(except for
389
/
636
for the LDAP
server) because this may conflict with other services.
For LDAPS (LDAP with TLS/SSL), the default port number is
636
. The server can listen to both the
LDAP and LDAPS port at the same time. However, the setup program will not allow you to configure
TLS/SSL. To use LDAPS, assign the LDAP port number in the setup process, then reconfigure the
Directory Server to use LDAPS port and the other TLS/SSL parameters afterward. For information on
how to configure LDAPS, see the
Directory Server Administrator's Guide
.
The Administration Server runs on a web server, so it uses HTTP or HTTPS. However, unlike the
Directory Server which can run on secure (LDAPS) and insecure (LDAP) ports at the same time, the
Administration Server cannot run over both HTTP and HTTPS simultaneously. The setup program,
setup-ds-admin.pl
, does not allow you to configure the Administration Server to use TLS/SSL. To
use TLS/SSL (meaning HTTPS) with the Administration Server, first set up the Administration Server
to use HTTP, then reconfigure it to use HTTPS.
NOTE
When determining the port numbers you will use, verify that the specified port numbers
are not already in use by running a command like
netstat
.
If you are using ports below
1024
, such as the default LDAP port (
389
), you must run the setup
program and start the servers as
root
. You do
not
, however, have to set the server user ID to
root
.
When it starts, the server binds and listens to its port as
root
, then immediately drops its privileges
and runs as the non-
root
server user ID. When the system restarts, the server is started as
root
by
the initscript. The
setuid(2) man page
1
has detailed technical information.
Section 1.2.2, “Directory Server User and Group”
has more information about the server user ID.
1.2.2. Directory Server User and Group
The setup process sets a user ID (UID) and group ID (GID) as which the servers will run. The default
UID is a non-privileged (non-root) user,
nobody
on Red Hat Enterprise Linux and Solaris and
daemon
on HP-UX. Red Hat strongly recommends using this default value.
IMPORTANT
By default, the same UID is used for both the Directory Server and the Administration
Server, which simplifies administration. If you choose a different UID for each server,
those UIDs
must
both belong to the group assigned to Directory Server.
For security reasons, Red Hat strongly discourages you from setting the Directory Server or
Administration Server user to
root
. If an attacker gains access to the server, he might be able to
1
http://grove.ufl.edu/cgi-bin/webman?man2+setuid.2.gz
