System Administration Guides and Best Practices

Migrate 389 Directory Server from Berkeley DB to LMDB with backend detection, dsctl dblib bdb2mdb, disk planning, validation, replicated rolling conversion, manual LDIF fallback, and recovery.

Update 389 Directory Server safely with dnf, pre-upgrade health checks, verified backups, standalone and rolling replica updates, post-upgrade validation, and recovery when a package update fails.

Migrate 389 Directory Server to a new host with replication or LDIF, including schema, TLS, validation, client cutover, and safe source removal.

Back up and restore 389 Directory Server with dsconf backup create, dsctl db2bak, checksum verification, off-host copies, systemd automation, and isolated restore testing.

Migrate OpenLDAP to 389 Directory Server with openldap_to_ds, LDIF preprocessing, schema and ACI mapping, validation, and cutover.

Learn 389 Directory Server administration from installation and instance creation to ACIs, TLS, plugins, password policies, LMDB tuning, backup, replication, monitoring, migration, and troubleshooting.

Create root suffixes and sub-suffixes with dsconf backend create, inspect backends, set read-only or disabled state, and delete a backend safely in 389 Directory Server.

Benchmark 389 Directory Server searches, binds, and writes with reproducible LDIF data, ldclt workloads, dsconf metrics, and logconv access-log analysis.

Configure Kerberos service principals, keytabs, SASL identity mapping, and GSSAPI authentication in 389 Directory Server with kinit and ldapwhoami.

Inspect and restrict TLS protocol versions and cipher suites in 389 Directory Server, test LDAPS and STARTTLS compatibility, and roll back safely.

Create custom 389 Directory Server attributes and auxiliary object classes with dsconf, schema LDIF files, reload tasks, validation, and replication-safe deployment.

Configure 389 Directory Server database links with dsconf chaining, proxy bind accounts, remote ACIs, LDAPS and StartTLS, failover settings, controls, monitoring, and troubleshooting.

Tune 389 Directory Server worker threads, listener threads, per-connection limits, idle timeouts, and file descriptors with dsconf and monitor output.

Configure 389 Directory Server size, time, look-through, paged, range, and ID-list limits with global and per-user overrides.

Configure 389 Directory Server self-service ACIs with userdn ldap:///self for profile read and write, TLS-protected userPassword changes, selfwrite for opt-in group membership, and verification as the real bind user.

Tune 389 Directory Server LMDB map size, entry cache, DN cache, and normalized DN cache using dsconf backend config, monitor dbmon, and memory budgeting on MDB backends.

Enable password-based account lockout in 389 Directory Server, set failure thresholds and unlock behaviour, inspect lockout attributes, test automatic unlock, recover locked accounts, and replicate lockout state.

Configure global, subtree, and user password policies in 389 Directory Server with dsconf pwpolicy and localpwp, enforce complexity and expiration, test precedence, and manage temporary passwords.

Use Get Effective Rights in 389 Directory Server to test ACI permissions with ldapsearch, interpret entryLevelRights and attributeLevelRights, and verify results with real LDAP operations.

Restrict 389 Directory Server anonymous LDAP access with nsslapd-allow-anonymous-access, narrow ldap:///anyone ACIs, disable unauthenticated empty-password binds, and verify root DSE, suffix, and public-attribute …

Configure 389 Directory Server macro ACIs with ($dn), [$dn], and ($attr.attributeName) to reduce duplicate rules and enforce tenant isolation.

Configure 389 Directory Server Virtual List View indexes with dsconf backend vlv-index, test server-side sorting and VLV controls with ldapsearch, and verify vlvUses and access-log usage.

Enable LDAPS and STARTTLS in 389 Directory Server, import server and CA certificates, configure client trust, and verify TLS with ldapsearch and openssl.

Create virtual directory tree views in 389 Directory Server with nsView and nsViewFilter, nested filters, LDAP search verification, indexing, limitations, and troubleshooting.

Generate synthetic LDAP test data with dsctl ldifgen in 389 Directory Server—users, groups, CoS, roles, modification workloads, and nested trees—then review and load LDIF safely.

Prepare ou=People and ou=Groups, create POSIX users and static groups with dsidm, set passwords, lock accounts, manage membership, verify LDAP attributes, and delete entries safely in 389 Directory Server.

Generate a dscreate INF template, configure instance and backend settings, protect credentials, run dscreate from-file, and verify the new 389 Directory Server suffix.

Install 389 Directory Server, create an LDAP instance with dscreate, configure a directory suffix, verify the service, and test LDAP access.

Recover a failed 389 Directory Server supplier, hub, or consumer with safe restore, replica reinitialization, RUV checks, and replication validation.

Export and import 389 Directory Server backend data with dsconf and dsctl LDIF tools, validate migration files, prepare the destination suffix, and verify users and groups after import.