Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION 11-05-2007, Руководство по установке

Страница: 689 / 982

❺
rootdn
determines who owns administrator rights to this server. The user declared
here does not need to have an LDAP entry or exist as regular user.
❻
rootpw
sets the administrator password. Instead of using
secret
here, it is
possible to enter the hash of the administrator password created by
slappasswd
.
❼ The
directory
directive indicates the directory in the file system where the
database directories are stored on the server.
❽
The last directive,
index objectClass eq
, results in the maintenance of
an index of all object classes. Attributes for which users search most often can be
added here according to experience.
❾
overlay ppolicy
adds a layer of password control mechanisms.
ppolicy_default
specifies the DN of the pwdPolicy object to use when no
specific policy is set on a given user's entry. If there is no specific policy for an
entry and no default is given, no policies are enforced.
ppolicy_hash_cleartext
specifies that clear text passwords present in
add and modify requests are hashed before being stored in the database. When
this option is used, it is recommended to deny compare, search, and read access
to the
userPassword
attribute for all directory users, because
ppolicy_hash_cleartext
violates the X.500/LDAP information model.
ppolicy_use_lockout
sends a specific error code when a client tries to
connect to a locked account. When your site is sensitive to security issues, disable
this option as the error code provides useful information to attackers.
Custom
Access
rules defined here for the database are used instead of the global
Access
rules.
36.3.3 Starting and Stopping the Servers
Once the LDAP server is fully configured and all desired entries have been made ac-
cording to the pattern described in
Section 36.4, “Data Handling in the LDAP Directory”
(page 672), start the LDAP server as
root
by entering
rcldap start
. To stop the
server manually, enter the command
rcldap stop
. Request the status of the running
LDAP server with
rcldap status
.
LDAP—A Directory Service 671