DSCONF(8) Generated Python Manual DSCONF(8) # [NAME](#NAME) dsconf # [SYNOPSIS](#SYNOPSIS) **dsconf** \[-h] \[-v] \[-j] \[-D BINDDN] \[-w BINDPW] \[-W] \[-y PWDFILE] \[-b BASEDN] \[-Z] instance {backend,backup,chaining,config,directory\_manager,logging,monitor,plugin,pwpolicy,localpwp,replication,repl,repl-agmt,repl-winsync-agmt,repl-tasks,repl-conflict,sasl,security,schema} ... # [POSITIONAL ARGUMENTS](#POSITIONAL_ARGUMENTS) [**dsconf** *backend*](#dsconf) Manage database suffixes and backends [**dsconf** *backup*](#dsconf~2) Manage online backups [**dsconf** *chaining*](#dsconf~3) Manage database chaining and database links [**dsconf** *config*](#dsconf~4) Manage the server configuration [**dsconf** *directory\_manager*](#dsconf~5) Manage the Directory Manager account [**dsconf** *logging*](#dsconf~6) Manage the server logs [**dsconf** *monitor*](#dsconf~7) Monitor the state of the instance [**dsconf** *plugin*](#dsconf~8) Manage plug-ins available on the server [**dsconf** *pwpolicy*](#dsconf~9) Manage the global password policy settings [**dsconf** *localpwp*](#dsconf~10) Manage the local user and subtree password policies [**dsconf** *replication*](#dsconf~11) Manage replication for a suffix [**dsconf** *repl-agmt*](#dsconf~12) Manage replication agreements [**dsconf** *repl-winsync-agmt*](#dsconf~13) Manage Winsync agreements [**dsconf** *repl-tasks*](#dsconf~14) Manage replication tasks [**dsconf** *repl-conflict*](#dsconf~15) Manage replication conflicts [**dsconf** *sasl*](#dsconf~16) Manage SASL mappings [**dsconf** *security*](#dsconf~17) Manage security settings [**dsconf** *schema*](#dsconf~18) Manage the directory schema # COMMAND *'dsconf* *backend'* usage: dsconf \[-v] \[-j] instance backend \[-h] {suffix,index,vlv-index,attr-encrypt,config,monitor,import,export,create,delete,get-tree,compact-db} ... # POSITIONAL ARGUMENTS *'dsconf backend'* [**dsconf backend** *suffix*](#dsconf~19) Manage backend suffixes [**dsconf backend** *index*](#dsconf~20) Manage backend indexes [**dsconf backend** *vlv-index*](#dsconf~21) Manage VLV searches and indexes [**dsconf backend** *attr-encrypt*](#dsconf~22) Manage encrypted attribute settings [**dsconf backend** *config*](#dsconf~23) Manage the global database configuration settings [**dsconf backend** *monitor*](#dsconf~24) Displays global database or suffix monitoring information [**dsconf backend** *import*](#dsconf~25) Online import of a suffix [**dsconf backend** *export*](#dsconf~26) Online export of a suffix [**dsconf backend** *create*](#dsconf~27) Create a backend database [**dsconf backend** *delete*](#dsconf~28) Delete a backend database [**dsconf backend** *get-tree*](#dsconf~29) Display the suffix tree [**dsconf backend** *compact-db*](#dsconf~30) Compact the database and the replication changelog # COMMAND *'dsconf* *backend* *suffix'* usage: dsconf \[-v] \[-j] instance backend suffix \[-h] {list,get,get-dn,get-sub-suffixes,set} ... # POSITIONAL ARGUMENTS *'dsconf backend suffix'* [**dsconf backend suffix** *list*](#dsconf~31) List active backends and suffixes [**dsconf backend suffix** *get*](#dsconf~32) Display the suffix entry [**dsconf backend suffix** *get-dn*](#dsconf~33) Display the DN of a backend [**dsconf backend suffix** *get-sub-suffixes*](#dsconf~34) Display sub-suffixes [**dsconf backend suffix** *set*](#dsconf~35) Set configuration settings for a specific backend # COMMAND *'dsconf* *backend* *suffix* *list'* usage: dsconf \[-v] \[-j] instance backend suffix list \[-h] \[--suffix] \[--skip-subsuffixes] # OPTIONS *'dsconf* *backend* *suffix* *list'* [**--suffix**](#suffix) Displays the suffixes without backend name [**--skip-subsuffixes**](#skip) Displays the list of suffixes without sub-suffixes # COMMAND *'dsconf* *backend* *suffix* *get'* usage: dsconf \[-v] \[-j] instance backend suffix get \[-h] \[selector] [**selector**](#selector) The backend database name to search for # COMMAND *'dsconf* *backend* *suffix* *get-dn'* usage: dsconf \[-v] \[-j] instance backend suffix get-dn \[-h] \[dn] [**dn**](#dn) The DN to the database entry in cn=ldbm database,cn=plugins,cn=config # COMMAND *'dsconf* *backend* *suffix* *get-sub-suffixes'* usage: dsconf \[-v] \[-j] instance backend suffix get-sub-suffixes \[-h] \[--suffix] be\_name [**be\_name**](#be_name) The backend name or suffix # OPTIONS *'dsconf* *backend* *suffix* *get-sub-suffixes'* [**--suffix**](#suffix~2) Displays the list of suffixes without backend name # COMMAND *'dsconf* *backend* *suffix* *set'* usage: dsconf \[-v] \[-j] instance backend suffix set \[-h] \[--enable-readonly] \[--disable-readonly] \[--enable-orphan] \[--disable-orphan] \[--require-index] \[--ignore-index] \[--add-referral ADD\_REFERRAL] \[--del-referral DEL\_REFERRAL] \[--enable] \[--disable] \[--cache-size CACHE\_SIZE] \[--cache-memsize CACHE\_MEMSIZE] \[--cache-preserved-entries CACHE\_PRESERVED\_ENTRIES] \[--dncache-memsize DNCACHE\_MEMSIZE] \[--state STATE] be\_name [**be\_name**](#be_name~2) The backend name or suffix # OPTIONS *'dsconf* *backend* *suffix* *set'* [**--enable-readonly**](#enable) Enables read-only mode for the backend database [**--disable-readonly**](#disable) Disables read-only mode for the backend database [**--enable-orphan**](#enable~2) Disconnect a subsuffix from its parent suffix. [**--disable-orphan**](#disable~2) Let the subsuffix be connected to its parent suffix. [**--require-index**](#require) Allows only indexed searches [**--ignore-index**](#ignore) Allows all searches even if they are unindexed [**--add-referral** *ADD\_REFERRAL*](#add) Adds an LDAP referral to the backend [**--del-referral** *DEL\_REFERRAL*](#del) Removes an LDAP referral from the backend [**--enable**](#enable~3) Enables the backend database [**--disable**](#disable~3) Disables the backend database [**--cache-size** *CACHE\_SIZE*](#cache) Sets the maximum number of entries to keep in the entry cache [**--cache-memsize** *CACHE\_MEMSIZE*](#cache~2) Sets the maximum size in bytes that the entry cache can grow to [**--cache-preserved-entries** *CACHE\_PRESERVED\_ENTRIES*](#cache~3) Sets the maximum number of entries that are not evicted from the cache when trying to make space. This is typically used to keep very large groups in the cache [**--dncache-memsize** *DNCACHE\_MEMSIZE*](#dncache) Sets the maximum size in bytes that the DN cache can grow to [**--state** *STATE*](#state) Changes the backend state to: "backend", "disabled", "referral", or "referral on update" # COMMAND *'dsconf* *backend* *index'* usage: dsconf \[-v] \[-j] instance backend index \[-h] {add,set,get,list,delete,reindex} ... # POSITIONAL ARGUMENTS *'dsconf backend index'* [**dsconf backend index** *add*](#dsconf~36) Add an index [**dsconf backend index** *set*](#dsconf~37) Update an index [**dsconf backend index** *get*](#dsconf~38) Display an index entry [**dsconf backend index** *list*](#dsconf~39) Display the index [**dsconf backend index** *delete*](#dsconf~40) Delete an index [**dsconf backend index** *reindex*](#dsconf~41) Re-index the database for a single index or all indexes # COMMAND *'dsconf* *backend* *index* *add'* usage: dsconf \[-v] \[-j] instance backend index add \[-h] \--index-type INDEX\_TYPE \[--matching-rule MATCHING\_RULE] \[--reindex] --attr ATTR be\_name [**be\_name**](#be_name~3) The backend name or suffix # OPTIONS *'dsconf* *backend* *index* *add'* [**--index-type** *INDEX\_TYPE*](#index) Sets the indexing type (eq, sub, pres, or approx) [**--matching-rule** *MATCHING\_RULE*](#matching) Sets the matching rule for the index [**--reindex**](#reindex) Re-indexes the database after adding a new index [**--attr** *ATTR*](#attr) Sets the attribute name to index # COMMAND *'dsconf* *backend* *index* *set'* usage: dsconf \[-v] \[-j] instance backend index set \[-h] --attr ATTR \[--add-type ADD\_TYPE] \[--del-type DEL\_TYPE] \[--add-mr ADD\_MR] \[--del-mr DEL\_MR] \[--reindex] be\_name [**be\_name**](#be_name~4) The backend name or suffix # OPTIONS *'dsconf* *backend* *index* *set'* [**--attr** *ATTR*](#attr~2) Sets the indexed attribute to update [**--add-type** *ADD\_TYPE*](#add~2) Adds an index type to the index (eq, sub, pres, or approx) [**--del-type** *DEL\_TYPE*](#del~2) Removes an index type from the index: (eq, sub, pres, or approx) [**--add-mr** *ADD\_MR*](#add~3) Adds a matching-rule to the index [**--del-mr** *DEL\_MR*](#del~3) Removes a matching-rule from the index [**--reindex**](#reindex~2) Re-indexes the database after editing the index # COMMAND *'dsconf* *backend* *index* *get'* usage: dsconf \[-v] \[-j] instance backend index get \[-h] --attr ATTR be\_name [**be\_name**](#be_name~5) The backend name or suffix # OPTIONS *'dsconf* *backend* *index* *get'* [**--attr** *ATTR*](#attr~3) Sets the index name to display # COMMAND *'dsconf* *backend* *index* *list'* usage: dsconf \[-v] \[-j] instance backend index list \[-h] \[--just-names] be\_name [**be\_name**](#be_name~6) The backend name or suffix # OPTIONS *'dsconf* *backend* *index* *list'* [**--just-names**](#just) Displays only the names of indexed attributes # COMMAND *'dsconf* *backend* *index* *delete'* usage: dsconf \[-v] \[-j] instance backend index delete \[-h] \[--attr ATTR] be\_name [**be\_name**](#be_name~7) The backend name or suffix # OPTIONS *'dsconf* *backend* *index* *delete'* [**--attr** *ATTR*](#attr~4) Sets the name of the attribute to delete from the index # COMMAND *'dsconf* *backend* *index* *reindex'* usage: dsconf \[-v] \[-j] instance backend index reindex \[-h] \[--attr ATTR] \[--wait] \[--watch] be\_name [**be\_name**](#be_name~8) The backend name or suffix # OPTIONS *'dsconf* *backend* *index* *reindex'* [**--attr** *ATTR*](#attr~5) Sets the name of the attribute to re-index. Omit this argument to re-index all attributes [**--wait**](#wait) Waits for the index task to complete and reports the status [**--watch**](#watch) Watch the status of the reindexing task # COMMAND *'dsconf* *backend* *vlv-index'* usage: dsconf \[-v] \[-j] instance backend vlv-index \[-h] {list,get,add-search,edit-search,del-search,add-index,del-index,reindex} ... # POSITIONAL ARGUMENTS *'dsconf backend vlv-index'* [**dsconf backend vlv-index** *list*](#dsconf~42) List VLV search and index entries [**dsconf backend vlv-index** *get*](#dsconf~43) Display a VLV search and indexes [**dsconf backend vlv-index** *add-search*](#dsconf~44) Add a VLV search entry. The search entry is the parent entry of the VLV index entries, and it specifies the search parameters that are used to match entries for those indexes. [**dsconf backend vlv-index** *edit-search*](#dsconf~45) Update a VLV search and index [**dsconf backend vlv-index** *del-search*](#dsconf~46) Delete VLV search & index [**dsconf backend vlv-index** *add-index*](#dsconf~47) Create a VLV index under a VLV search entry (parent entry, formatter\_class=CustomHelpFormatter). The VLV index specifies the attributes to sort [**dsconf backend vlv-index** *del-index*](#dsconf~48) Delete a VLV index under a VLV search entry (parent entry) [**dsconf backend vlv-index** *reindex*](#dsconf~49) Index/re-index the VLV database index # COMMAND *'dsconf* *backend* *vlv-index* *list'* usage: dsconf \[-v] \[-j] instance backend vlv-index list \[-h] \[--just-names] be\_name [**be\_name**](#be_name~9) The backend name of the VLV index # OPTIONS *'dsconf* *backend* *vlv-index* *list'* [**--just-names**](#just~2) Displays only the names of VLV search entries # COMMAND *'dsconf* *backend* *vlv-index* *get'* usage: dsconf \[-v] \[-j] instance backend vlv-index get \[-h] \[--name NAME] be\_name [**be\_name**](#be_name~10) The backend name of the VLV index # OPTIONS *'dsconf* *backend* *vlv-index* *get'* [**--name** *NAME*](#name) Displays the VLV search entry and its index entries # COMMAND *'dsconf* *backend* *vlv-index* *add-search'* usage: dsconf instance \[-v] \[-j] backend vlv-index add-search \[-h] --name NAME --search-base SEARCH\_BASE --search-scope SEARCH\_SCOPE \--search-filter SEARCH\_FILTER be\_name [**be\_name**](#be_name~11) The backend name of the VLV index # OPTIONS *'dsconf* *backend* *vlv-index* *add-search'* [**--name** *NAME*](#name~2) Sets the name of the VLV search entry [**--search-base** *SEARCH\_BASE*](#search) Sets the VLV search base [**--search-scope** *SEARCH\_SCOPE*](#search~2) Sets the VLV search scope: 0 (base search), 1 (one-level search), or 2 (subtree search) [**--search-filter** *SEARCH\_FILTER*](#search~3) Sets the VLV search filter # COMMAND *'dsconf* *backend* *vlv-index* *edit-search'* usage: dsconf \[-v] \[-j] instance backend vlv-index edit-search \[-h] --name NAME \[--search-base SEARCH\_BASE] \[--search-scope SEARCH\_SCOPE] \[--search-filter SEARCH\_FILTER] \[--reindex] be\_name [**be\_name**](#be_name~12) The backend name of the VLV index to update # OPTIONS *'dsconf* *backend* *vlv-index* *edit-search'* [**--name** *NAME*](#name~3) Sets the name of the VLV index [**--search-base** *SEARCH\_BASE*](#search~4) Sets the VLV search base [**--search-scope** *SEARCH\_SCOPE*](#search~5) Sets the VLV search scope: 0 (base search), 1 (one-level search), or 2 (subtree search) [**--search-filter** *SEARCH\_FILTER*](#search~6) Sets the VLV search filter [**--reindex**](#reindex~3) Re-indexes all VLV database indexes # COMMAND *'dsconf* *backend* *vlv-index* *del-search'* usage: dsconf \[-v] \[-j] instance backend vlv-index del-search \[-h] --name NAME be\_name [**be\_name**](#be_name~13) The backend name of the VLV index # OPTIONS *'dsconf* *backend* *vlv-index* *del-search'* [**--name** *NAME*](#name~4) Sets the name of the VLV search index # COMMAND *'dsconf* *backend* *vlv-index* *add-index'* usage: dsconf instance \[-v] \[-j] backend vlv-index add-index \[-h] --parent-name PARENT\_NAME --index-name INDEX\_NAME --sort SORT \[--index-it] be\_name [**be\_name**](#be_name~14) The backend name of the VLV index # OPTIONS *'dsconf* *backend* *vlv-index* *add-index'* [**--parent-name** *PARENT\_NAME*](#parent) Sets the name or "cn" attribute of the parent VLV search entry [**--index-name** *INDEX\_NAME*](#index~2) Sets the name of the new VLV index [**--sort** *SORT*](#sort) Sets a space-separated list of attributes to sort for this VLV index [**--index-it**](#index~3) Creates the database index for this VLV index definition # COMMAND *'dsconf* *backend* *vlv-index* *del-index'* usage: dsconf \[-v] \[-j] instance backend vlv-index del-index \[-h] --parent-name PARENT\_NAME \[--index-name INDEX\_NAME] \[--sort SORT] be\_name [**be\_name**](#be_name~15) The backend name of the VLV index # OPTIONS *'dsconf* *backend* *vlv-index* *del-index'* [**--parent-name** *PARENT\_NAME*](#parent~2) Sets the name or "cn" attribute value of the parent VLV search entry [**--index-name** *INDEX\_NAME*](#index~4) Sets the name of the VLV index to delete [**--sort** *SORT*](#sort~2) Delete a VLV index that has this vlvsort value # COMMAND *'dsconf* *backend* *vlv-index* *reindex'* usage: dsconf \[-v] \[-j] instance backend vlv-index reindex \[-h] \[--index-name INDEX\_NAME] \--parent-name PARENT\_NAME be\_name [**be\_name**](#be_name~16) The backend name of the VLV index # OPTIONS *'dsconf* *backend* *vlv-index* *reindex'* [**--index-name** *INDEX\_NAME*](#index~5) Sets the name of the VLV index entry to re-index. If not set, all indexes are re-indexed [**--parent-name** *PARENT\_NAME*](#parent~3) Sets the name or "cn" attribute value of the parent VLV search entry # COMMAND *'dsconf* *backend* *attr-encrypt'* usage: dsconf \[-v] \[-j] instance backend attr-encrypt \[-h] \[--list] \[--just-names] \[--add-attr ADD\_ATTR] \[--del-attr DEL\_ATTR] be\_name [**be\_name**](#be_name~17) The backend name or suffix # OPTIONS *'dsconf* *backend* *attr-encrypt'* [**--list**](#list) Lists all encrypted attributes in the backend [**--just-names**](#just~3) List only the names of the encrypted attributes when used with --list [**--add-attr** *ADD\_ATTR*](#add~4) Enables encryption for the specified attribute [**--del-attr** *DEL\_ATTR*](#del~4) Disables encryption for the specified attribute # COMMAND *'dsconf* *backend* *config'* usage: dsconf \[-v] \[-j] instance backend config \[-h] {get,set} ... # POSITIONAL ARGUMENTS *'dsconf backend config'* [**dsconf backend config** *get*](#dsconf~50) Display the global database configuration [**dsconf backend config** *set*](#dsconf~51) Set the global database configuration # COMMAND *'dsconf* *backend* *config* *get'* usage: dsconf \[-v] \[-j] instance backend config get \[-h] # COMMAND *'dsconf* *backend* *config* *set'* usage: dsconf \[-v] \[-j] instance backend config set \[-h] \[--lookthroughlimit LOOKTHROUGHLIMIT] \[--mode MODE] \[--idlistscanlimit IDLISTSCANLIMIT] \[--directory DIRECTORY] \[--dbcachesize DBCACHESIZE] \[--logdirectory LOGDIRECTORY] \[--txn-wait TXN\_WAIT] \[--checkpoint-interval CHECKPOINT\_INTERVAL] \[--compactdb-interval COMPACTDB\_INTERVAL] \[--compactdb-time COMPACTDB\_TIME] \[--txn-batch-val TXN\_BATCH\_VAL] \[--txn-batch-min TXN\_BATCH\_MIN] \[--txn-batch-max TXN\_BATCH\_MAX] \[--logbufsize LOGBUFSIZE] \[--locks LOCKS] \[--locks-monitoring-enabled LOCKS\_MONITORING\_ENABLED] \[--locks-monitoring-threshold LOCKS\_MONITORING\_THRESHOLD] \[--locks-monitoring-pause LOCKS\_MONITORING\_PAUSE] \[--import-cache-autosize IMPORT\_CACHE\_AUTOSIZE] \[--cache-autosize CACHE\_AUTOSIZE] \[--cache-autosize-split CACHE\_AUTOSIZE\_SPLIT] \[--import-cachesize IMPORT\_CACHESIZE] \[--exclude-from-export EXCLUDE\_FROM\_EXPORT] \[--pagedlookthroughlimit PAGEDLOOKTHROUGHLIMIT] \[--pagedidlistscanlimit PAGEDIDLISTSCANLIMIT] \[--rangelookthroughlimit RANGELOOKTHROUGHLIMIT] \[--backend-opt-level BACKEND\_OPT\_LEVEL] \[--deadlock-policy DEADLOCK\_POLICY] \[--db-home-directory DB\_HOME\_DIRECTORY] \[--db-lib DB\_LIB] \[--mdb-max-size MDB\_MAX\_SIZE] \[--mdb-max-readers MDB\_MAX\_READERS] \[--mdb-max-dbs MDB\_MAX\_DBS] \[--enable-dynamic-lists] \[--disable-dynamic-lists] \[--dynamic-oc DYNAMIC\_OC] \[--dynamic-url-attr DYNAMIC\_URL\_ATTR] \[--dynamic-list-attr DYNAMIC\_LIST\_ATTR] # OPTIONS *'dsconf* *backend* *config* *set'* [**--lookthroughlimit** *LOOKTHROUGHLIMIT*](#lookthroughlimit) Specifies the maximum number of entries that the server will check when examining candidate entries in response to a search request [**--mode** *MODE*](#mode) Specifies the permissions used for newly created index files [**--idlistscanlimit** *IDLISTSCANLIMIT*](#idlistscanlimit) Specifies the number of entry IDs that are searched during a search operation [**--directory** *DIRECTORY*](#directory) Specifies absolute path to database instance [**--dbcachesize** *DBCACHESIZE*](#dbcachesize) Specifies the database index cache size in bytes [**--logdirectory** *LOGDIRECTORY*](#logdirectory) Specifies the path to the directory that contains the database transaction logs [**--txn-wait** *TXN\_WAIT*](#txn) Sets whether the server should should wait if there are no db locks available [**--checkpoint-interval** *CHECKPOINT\_INTERVAL*](#checkpoint) Sets the amount of time in seconds after which the server sends a checkpoint entry to the database transaction log [**--compactdb-interval** *COMPACTDB\_INTERVAL*](#compactdb) Sets the interval in seconds when the database is compacted [**--compactdb-time** *COMPACTDB\_TIME*](#compactdb~2) Sets the time (HH:MM format) of day when to compact the database after the "compactdb interval" has been reached [**--txn-batch-val** *TXN\_BATCH\_VAL*](#txn~2) Specifies how many transactions will be batched before being committed [**--txn-batch-min** *TXN\_BATCH\_MIN*](#txn~3) Controls when transactions should be flushed earliest, independently of the batch count. Requires that txn-batch-val is set [**--txn-batch-max** *TXN\_BATCH\_MAX*](#txn~4) Controls when transactions should be flushed latest, independently of the batch count. Requires that txn-batch-val is set) [**--logbufsize** *LOGBUFSIZE*](#logbufsize) Specifies the transaction log information buffer size [**--locks** *LOCKS*](#locks) Sets the maximum number of database locks [**--locks-monitoring-enabled** *LOCKS\_MONITORING\_ENABLED*](#locks~2) Enables or disables monitoring of DB locks when the value crosses the percentage set with "--locks-monitoring-threshold" [**--locks-monitoring-threshold** *LOCKS\_MONITORING\_THRESHOLD*](#locks~3) Sets the DB lock exhaustion threshold in percentage (valid range is 70-90). When the threshold is reached, all searches are aborted until the number of active locks decreases below the configured threshold and/or the administrator increases the number of database locks (nsslapd-db-locks). This threshold is a safeguard against DB corruption which might be caused by locks exhaustion. [**--locks-monitoring-pause** *LOCKS\_MONITORING\_PAUSE*](#locks~4) Sets the DB lock monitoring value in milliseconds for the amount of time that the monitoring thread spends waiting between checks. [**--import-cache-autosize** *IMPORT\_CACHE\_AUTOSIZE*](#import) Enables or disables to automatically set the size of the import cache to be used during the import process of LDIF files [**--cache-autosize** *CACHE\_AUTOSIZE*](#cache~4) Sets the percentage of free memory that is used in total for the database and entry cache. [**--cache-autosize-split** *CACHE\_AUTOSIZE\_SPLIT*](#cache~5) Sets the percentage of RAM that is used for the database cache. The remaining percentage is used for the entry cache [**--import-cachesize** *IMPORT\_CACHESIZE*](#import~2) Sets the size in bytes of the database cache used in the import process. [**--exclude-from-export** *EXCLUDE\_FROM\_EXPORT*](#exclude) List of attributes to not include during database export operations [**--pagedlookthroughlimit** *PAGEDLOOKTHROUGHLIMIT*](#pagedlookthroughlimit) Specifies the maximum number of entries that the server will check when examining candidate entries for a search which uses the simple paged results control [**--pagedidlistscanlimit** *PAGEDIDLISTSCANLIMIT*](#pagedidlistscanlimit) Specifies the number of entry IDs that are searched, specifically, for a search operation using the simple paged results control. [**--rangelookthroughlimit** *RANGELOOKTHROUGHLIMIT*](#rangelookthroughlimit) Specifies the maximum number of entries that the server will check when examining candidate entries in response to a range search request. [**--backend-opt-level** *BACKEND\_OPT\_LEVEL*](#backend) Sets the backend optimization level for write performance (0, 1, 2, or 4). WARNING: This parameter can trigger experimental code. [**--deadlock-policy** *DEADLOCK\_POLICY*](#deadlock) Adjusts the backend database deadlock policy (Advanced setting) [**--db-home-directory** *DB\_HOME\_DIRECTORY*](#db) Sets the directory for the database mmapped files (Advanced setting) [**--db-lib** *DB\_LIB*](#db~2) Sets which db lib is used. Valid values are: bdb or mdb [**--mdb-max-size** *MDB\_MAX\_SIZE*](#mdb) Sets the lmdb database maximum size (accepts bytes, or with unit suffix: k, m, g, t) [**--mdb-max-readers** *MDB\_MAX\_READERS*](#mdb~2) Sets the lmdb database maximum number of readers (Advanced setting) [**--mdb-max-dbs** *MDB\_MAX\_DBS*](#mdb~3) Sets the lmdb database maximum number of sub databases (Advanced setting) [**--enable-dynamic-lists**](#enable~4) Enables dynamic lists [**--disable-dynamic-lists**](#disable~4) Disables dynamic lists [**--dynamic-oc** *DYNAMIC\_OC*](#dynamic) Sets the objectclass for dynamic lists [**--dynamic-url-attr** *DYNAMIC\_URL\_ATTR*](#dynamic~2) Sets the url attribute for dynamic lists [**--dynamic-list-attr** *DYNAMIC\_LIST\_ATTR*](#dynamic~3) Sets the list attribute for dynamic lists # COMMAND *'dsconf* *backend* *monitor'* usage: dsconf \[-v] \[-j] instance backend monitor \[-h] \[--suffix SUFFIX] # OPTIONS *'dsconf* *backend* *monitor'* [**--suffix** *SUFFIX*](#suffix~3) Displays monitoring information only for the specified suffix # COMMAND *'dsconf* *backend* *import'* usage: dsconf \[-v] \[-j] instance backend import \[-h] \[-c CHUNKS\_SIZE] \[-E] \[-g GEN\_UNIQ\_ID] \[-O] \[-s INCLUDE\_SUFFIXES \[INCLUDE\_SUFFIXES ...]] \[-x EXCLUDE\_SUFFIXES \[EXCLUDE\_SUFFIXES ...]] \[--timeout TIMEOUT] \[-w] \[be\_name] \[ldifs ...] [**be\_name**](#be_name~18) The backend name or the root suffix [**ldifs**](#ldifs) Specifies the filename of the input LDIF files. Multiple files are imported in the specified order. # OPTIONS *'dsconf* *backend* *import'* [**-c** *CHUNKS\_SIZE*, **--chunks-size** *CHUNKS\_SIZE*](#c) The number of chunks to have during the import operation [**-E**, **--encrypted**](#E) Encrypt attributes configured in the database for encryption [**-g** *GEN\_UNIQ\_ID*, **--gen-uniq-id** *GEN\_UNIQ\_ID*](#g) Generate a unique id. Set "none" for no unique ID to be generated and "deterministic" for the generated unique ID to be name-based. By default, a time-based unique ID is generated. When using the deterministic generation to have a name-based unique ID, it is also possible to specify the namespace for the server to use. namespaceId is a string of characters in the format 00-xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx. [**-O**, **--only-core**](#O) Creates only the core database attribute indexes [**-s** *INCLUDE\_SUFFIXES \[INCLUDE\_SUFFIXES ...\]*, **--include-suffixes** *INCLUDE\_SUFFIXES \[INCLUDE\_SUFFIXES ...\]*](#s) Specifies the suffixes or the subtrees to be included [**-x** *EXCLUDE\_SUFFIXES \[EXCLUDE\_SUFFIXES ...\]*, **--exclude-suffixes** *EXCLUDE\_SUFFIXES \[EXCLUDE\_SUFFIXES ...\]*](#x) Specifies the suffixes to be excluded [**--timeout** *TIMEOUT*](#timeout) Set a timeout to wait for the export task. Default is 0 (no timeout) [**-w**, **--watch**](#w) Watch the status of the import # COMMAND *'dsconf* *backend* *export'* usage: dsconf \[-v] \[-j] instance backend export \[-h] \[-l LDIF] \[-C] \[-E] \[-m] \[-N] \[-r] \[-u] \[-U] \[-s INCLUDE\_SUFFIXES \[INCLUDE\_SUFFIXES ...]] \[-x EXCLUDE\_SUFFIXES \[EXCLUDE\_SUFFIXES ...]] \[--timeout TIMEOUT] \[-w] be\_names \[be\_names ...] [**be\_names**](#be_names) The backend names or the root suffixes # OPTIONS *'dsconf* *backend* *export'* [**-l** *LDIF*, **--ldif** *LDIF*](#l) Sets the filename of the output LDIF file. Separate multiple file names with spaces. [**-C**, **--use-id2entry**](#C) Uses only the main database file [**-E**, **--encrypted**](#E~2) Decrypts encrypted data during export. This option is used only if database encryption is enabled. [**-m**, **--min-base64**](#m) Sets minimal base-64 encoding [**-N**, **--no-seq-num**](#N) Suppresses printing the sequence numbers [**-r**, **--replication**](#r) Exports the data with information required to initialize a replica [**-u**, **--no-dump-uniq-id**](#u) Omits exporting the unique ID [**-U**, **--not-folded**](#U) Disables folding the output [**-s** *INCLUDE\_SUFFIXES \[INCLUDE\_SUFFIXES ...\]*, **--include-suffixes** *INCLUDE\_SUFFIXES \[INCLUDE\_SUFFIXES ...\]*](#s~2) Specifies the suffixes or the subtrees to be included [**-x** *EXCLUDE\_SUFFIXES \[EXCLUDE\_SUFFIXES ...\]*, **--exclude-suffixes** *EXCLUDE\_SUFFIXES \[EXCLUDE\_SUFFIXES ...\]*](#x~2) Specifies the suffixes to be excluded [**--timeout** *TIMEOUT*](#timeout~2) Set a timeout to wait for the export task. Default is 0 (no timeout) [**-w**, **--watch**](#w~2) Watch the status of the export # COMMAND *'dsconf* *backend* *create'* usage: dsconf \[-v] \[-j] instance backend create \[-h] \[--parent-suffix PARENT\_SUFFIX] \--suffix SUFFIX \--be-name BE\_NAME \[--create-entries] \[--create-suffix] # OPTIONS *'dsconf* *backend* *create'* [**--parent-suffix** *PARENT\_SUFFIX*](#parent~4) Sets the parent suffix only if this backend is a sub-suffix [**--suffix** *SUFFIX*](#suffix~4) Sets the database suffix DN [**--be-name** *BE\_NAME*](#be) Sets the database backend name" [**--create-entries**](#create) Adds sample entries to the database [**--create-suffix**](#create~2) Creates the suffix object entry in the database. Only suffixes using the 'dc', # COMMAND *'dsconf* *backend* *delete'* usage: dsconf \[-v] \[-j] instance backend delete \[-h] \[--do-it] be\_name [**be\_name**](#be_name~19) The backend name or suffix # OPTIONS *'dsconf* *backend* *delete'* [**--do-it**](#do) Remove backend and its subsuffixes # COMMAND *'dsconf* *backend* *get-tree'* usage: dsconf \[-v] \[-j] instance backend get-tree \[-h] # COMMAND *'dsconf* *backend* *compact-db'* usage: dsconf \[-v] \[-j] instance backend compact-db \[-h] \[--only-changelog] \[--timeout TIMEOUT] # OPTIONS *'dsconf* *backend* *compact-db'* [**--only-changelog**](#only) Compacts only the replication change log [**--timeout** *TIMEOUT*](#timeout~3) Set a timeout to wait for the compaction task. Default is 0 (no timeout) # COMMAND *'dsconf* *backup'* usage: dsconf \[-v] \[-j] instance backup \[-h] {create,restore} ... # POSITIONAL ARGUMENTS *'dsconf backup'* [**dsconf backup** *create*](#dsconf~52) Creates a backup of the database [**dsconf backup** *restore*](#dsconf~53) Restores a database from a backup # COMMAND *'dsconf* *backup* *create'* usage: dsconf \[-v] \[-j] instance backup create \[-h] \[-t DB\_TYPE] \[--timeout TIMEOUT] \[--watch] \[archive] [**archive**](#archive) Sets the directory where to store the backup files. Format: instance\_name- year\_month\_date\_hour\_minutes\_seconds. Default: /var/lib/dirsrv/slapd- instance/bak/ # OPTIONS *'dsconf* *backup* *create'* [**-t** *DB\_TYPE*, **--db-type** *DB\_TYPE*](#t) Sets the database type. Default: ldbm database [**--timeout** *TIMEOUT*](#timeout~4) Sets the task timeout. Default is 120 seconds, [**--watch**](#watch~2) Watch the status of the backup task # COMMAND *'dsconf* *backup* *restore'* usage: dsconf \[-v] \[-j] instance backup restore \[-h] \[-t DB\_TYPE] \[--timeout TIMEOUT] \[--watch] archive [**archive**](#archive~2) Set the directory that contains the backup files # OPTIONS *'dsconf* *backup* *restore'* [**-t** *DB\_TYPE*, **--db-type** *DB\_TYPE*](#t~2) Sets the database type. Default: ldbm database [**--timeout** *TIMEOUT*](#timeout~5) Sets the task timeout. Default is 120 seconds. [**--watch**](#watch~3) Watch the status of the restore task # COMMAND *'dsconf* *chaining'* usage: dsconf \[-v] \[-j] instance chaining \[-h] {config-get,config-set,config-get-def,config-set-def,link-create,link-get,link-set,link-delete,monitor,link-list} ... # POSITIONAL ARGUMENTS *'dsconf chaining'* [**dsconf chaining** *config-get*](#dsconf~54) Display the chaining controls and server component lists [**dsconf chaining** *config-set*](#dsconf~55) Set the chaining controls and server component lists [**dsconf chaining** *config-get-def*](#dsconf~56) Display the default creation parameters for new database links [**dsconf chaining** *config-set-def*](#dsconf~57) Set the default creation parameters for new database links [**dsconf chaining** *link-create*](#dsconf~58) Create a database link to a remote server [**dsconf chaining** *link-get*](#dsconf~59) Displays chaining database links [**dsconf chaining** *link-set*](#dsconf~60) Edit a database link to a remote server [**dsconf chaining** *link-delete*](#dsconf~61) Delete a database link [**dsconf chaining** *monitor*](#dsconf~62) Display monitor information for a database chaining link [**dsconf chaining** *link-list*](#dsconf~63) List database links # COMMAND *'dsconf* *chaining* *config-get'* usage: dsconf \[-v] \[-j] instance chaining config-get \[-h] \[--avail-controls] \[--avail-comps] # OPTIONS *'dsconf* *chaining* *config-get'* [**--avail-controls**](#avail) Lists available chaining controls [**--avail-comps**](#avail~2) Lists available chaining plugin components # COMMAND *'dsconf* *chaining* *config-set'* usage: dsconf \[-v] \[-j] instance chaining config-set \[-h] \[--add-control ADD\_CONTROL] \[--del-control DEL\_CONTROL] \[--add-comp ADD\_COMP] \[--del-comp DEL\_COMP] # OPTIONS *'dsconf* *chaining* *config-set'* [**--add-control** *ADD\_CONTROL*](#add~5) Adds a transmitted control OID [**--del-control** *DEL\_CONTROL*](#del~5) Deletes a transmitted control OID [**--add-comp** *ADD\_COMP*](#add~6) Adds a chaining component [**--del-comp** *DEL\_COMP*](#del~6) Deletes a chaining component # COMMAND *'dsconf* *chaining* *config-get-def'* usage: dsconf \[-v] \[-j] instance chaining config-get-def \[-h] # COMMAND *'dsconf* *chaining* *config-set-def'* usage: dsconf \[-v] \[-j] instance chaining config-set-def \[-h] \[--conn-bind-limit CONN\_BIND\_LIMIT] \[--conn-op-limit CONN\_OP\_LIMIT] \[--abandon-check-interval ABANDON\_CHECK\_INTERVAL] \[--bind-limit BIND\_LIMIT] \[--op-limit OP\_LIMIT] \[--proxied-auth PROXIED\_AUTH] \[--conn-lifetime CONN\_LIFETIME] \[--bind-timeout BIND\_TIMEOUT] \[--return-ref RETURN\_REF] \[--check-aci CHECK\_ACI] \[--bind-attempts BIND\_ATTEMPTS] \[--size-limit SIZE\_LIMIT] \[--time-limit TIME\_LIMIT] \[--hop-limit HOP\_LIMIT] \[--response-delay RESPONSE\_DELAY] \[--test-response-delay TEST\_RESPONSE\_DELAY] \[--use-starttls USE\_STARTTLS] # OPTIONS *'dsconf* *chaining* *config-set-def'* [**--conn-bind-limit** *CONN\_BIND\_LIMIT*](#conn) Sets the maximum number of BIND connections the database link establishes with the remote server [**--conn-op-limit** *CONN\_OP\_LIMIT*](#conn~2) Sets the maximum number of LDAP connections the database link establishes with the remote server [**--abandon-check-interval** *ABANDON\_CHECK\_INTERVAL*](#abandon) Sets the number of seconds that pass before the server checks for abandoned operations [**--bind-limit** *BIND\_LIMIT*](#bind) Sets the maximum number of concurrent bind operations per TCP connection [**--op-limit** *OP\_LIMIT*](#op) Sets the maximum number of concurrent operations allowed [**--proxied-auth** *PROXIED\_AUTH*](#proxied) Enables or disables proxied authorization. If set to "off", the server executes bind for chained operations as the user set in the nsMultiplexorBindDn attribute. [**--conn-lifetime** *CONN\_LIFETIME*](#conn~3) Specifies connection lifetime in seconds. "0" keeps the connection open forever. [**--bind-timeout** *BIND\_TIMEOUT*](#bind~2) Sets the amount of time in seconds before a bind attempt times out [**--return-ref** *RETURN\_REF*](#return) Enables or disables whether referrals are returned by scoped searches [**--check-aci** *CHECK\_ACI*](#check) Enables or disables whether the server evaluates ACIs on the database link as well as the remote data server [**--bind-attempts** *BIND\_ATTEMPTS*](#bind~3) Sets the number of times the server tries to bind to the remote server [**--size-limit** *SIZE\_LIMIT*](#size) Sets the maximum number of entries to return from a search operation [**--time-limit** *TIME\_LIMIT*](#time) Sets the maximum number of seconds allowed for an operation [**--hop-limit** *HOP\_LIMIT*](#hop) Sets the maximum number of times a database is allowed to chain. That is the number of times a request can be forwarded from one database link to another. [**--response-delay** *RESPONSE\_DELAY*](#response) Sets the maximum amount of time it can take a remote server to respond to an LDAP operation request made by a database link before an error is suspected [**--test-response-delay** *TEST\_RESPONSE\_DELAY*](#test) Sets the duration of the test issued by the database link to check whether the remote server is responding [**--use-starttls** *USE\_STARTTLS*](#use) Configured that database links use StartTLS if set to "on" # COMMAND *'dsconf* *chaining* *link-create'* usage: dsconf instance \[-v] \[-j] chaining link-create \[-h] \[--conn-bind-limit CONN\_BIND\_LIMIT] \[--conn-op-limit CONN\_OP\_LIMIT] \[--abandon-check-interval ABANDON\_CHECK\_INTERVAL] \[--bind-limit BIND\_LIMIT] \[--op-limit OP\_LIMIT] \[--proxied-auth PROXIED\_AUTH] \[--conn-lifetime CONN\_LIFETIME] \[--bind-timeout BIND\_TIMEOUT] \[--return-ref RETURN\_REF] \[--check-aci CHECK\_ACI] \[--bind-attempts BIND\_ATTEMPTS] \[--size-limit SIZE\_LIMIT] \[--time-limit TIME\_LIMIT] \[--hop-limit HOP\_LIMIT] \[--response-delay RESPONSE\_DELAY] \[--test-response-delay TEST\_RESPONSE\_DELAY] \[--use-starttls USE\_STARTTLS] \--suffix SUFFIX \--server-url SERVER\_URL \--bind-mech BIND\_MECH \--bind-dn BIND\_DN \[--bind-pw BIND\_PW] \[--bind-pw-file BIND\_PW\_FILE] \[--bind-pw-prompt] CHAIN\_NAME [**CHAIN\_NAME**](#CHAIN_NAME) The name of the database link # OPTIONS *'dsconf* *chaining* *link-create'* [**--conn-bind-limit** *CONN\_BIND\_LIMIT*](#conn~4) Sets the maximum number of BIND connections the database link establishes with the remote server [**--conn-op-limit** *CONN\_OP\_LIMIT*](#conn~5) Sets the maximum number of LDAP connections the database link establishes with the remote server [**--abandon-check-interval** *ABANDON\_CHECK\_INTERVAL*](#abandon~2) Sets the number of seconds that pass before the server checks for abandoned operations [**--bind-limit** *BIND\_LIMIT*](#bind~4) Sets the maximum number of concurrent bind operations per TCP connection [**--op-limit** *OP\_LIMIT*](#op~2) Sets the maximum number of concurrent operations allowed [**--proxied-auth** *PROXIED\_AUTH*](#proxied~2) Enables or disables proxied authorization. If set to "off", the server executes bind for chained operations as the user set in the nsMultiplexorBindDn attribute. [**--conn-lifetime** *CONN\_LIFETIME*](#conn~6) Specifies connection lifetime in seconds. "0" keeps the connection open forever. [**--bind-timeout** *BIND\_TIMEOUT*](#bind~5) Sets the amount of time in seconds before a bind attempt times out [**--return-ref** *RETURN\_REF*](#return~2) Enables or disables whether referrals are returned by scoped searches [**--check-aci** *CHECK\_ACI*](#check~2) Enables or disables whether the server evaluates ACIs on the database link as well as the remote data server [**--bind-attempts** *BIND\_ATTEMPTS*](#bind~6) Sets the number of times the server tries to bind to the remote server [**--size-limit** *SIZE\_LIMIT*](#size~2) Sets the maximum number of entries to return from a search operation [**--time-limit** *TIME\_LIMIT*](#time~2) Sets the maximum number of seconds allowed for an operation [**--hop-limit** *HOP\_LIMIT*](#hop~2) Sets the maximum number of times a database is allowed to chain. That is the number of times a request can be forwarded from one database link to another. [**--response-delay** *RESPONSE\_DELAY*](#response~2) Sets the maximum amount of time it can take a remote server to respond to an LDAP operation request made by a database link before an error is suspected [**--test-response-delay** *TEST\_RESPONSE\_DELAY*](#test~2) Sets the duration of the test issued by the database link to check whether the remote server is responding [**--use-starttls** *USE\_STARTTLS*](#use~2) Configured that database links use StartTLS if set to "on" [**--suffix** *SUFFIX*](#suffix~5) Sets the suffix managed by the database link [**--server-url** *SERVER\_URL*](#server) Sets the LDAP/LDAPS URL to the remote server [**--bind-mech** *BIND\_MECH*](#bind~7) Sets the authentication method to use to authenticate to the remote server. Valid values: "SIMPLE" (default), "EXTERNAL", "DIGEST-MD5", or "GSSAPI" [**--bind-dn** *BIND\_DN*](#bind~8) Sets the DN of the administrative entry used to communicate with the remote server [**--bind-pw** *BIND\_PW*](#bind~9) Sets the password of the administrative user [**--bind-pw-file** *BIND\_PW\_FILE*](#bind~10) File containing the password [**--bind-pw-prompt**](#bind~11) Prompt for password # COMMAND *'dsconf* *chaining* *link-get'* usage: dsconf \[-v] \[-j] instance chaining link-get \[-h] CHAIN\_NAME [**CHAIN\_NAME**](#CHAIN_NAME~2) The chaining link name or suffix to retrieve # COMMAND *'dsconf* *chaining* *link-set'* usage: dsconf instance \[-v] \[-j] chaining link-set \[-h] \[--conn-bind-limit CONN\_BIND\_LIMIT] \[--conn-op-limit CONN\_OP\_LIMIT] \[--abandon-check-interval ABANDON\_CHECK\_INTERVAL] \[--bind-limit BIND\_LIMIT] \[--op-limit OP\_LIMIT] \[--proxied-auth PROXIED\_AUTH] \[--conn-lifetime CONN\_LIFETIME] \[--bind-timeout BIND\_TIMEOUT] \[--return-ref RETURN\_REF] \[--check-aci CHECK\_ACI] \[--bind-attempts BIND\_ATTEMPTS] \[--size-limit SIZE\_LIMIT] \[--time-limit TIME\_LIMIT] \[--hop-limit HOP\_LIMIT] \[--response-delay RESPONSE\_DELAY] \[--test-response-delay TEST\_RESPONSE\_DELAY] \[--use-starttls USE\_STARTTLS] \[--suffix SUFFIX] \[--server-url SERVER\_URL] \[--bind-mech BIND\_MECH] \[--bind-dn BIND\_DN] \[--bind-pw BIND\_PW] \[--bind-pw-file BIND\_PW\_FILE] \[--bind-pw-prompt] CHAIN\_NAME [**CHAIN\_NAME**](#CHAIN_NAME~3) The name of the database link # OPTIONS *'dsconf* *chaining* *link-set'* [**--conn-bind-limit** *CONN\_BIND\_LIMIT*](#conn~7) Sets the maximum number of BIND connections the database link establishes with the remote server [**--conn-op-limit** *CONN\_OP\_LIMIT*](#conn~8) Sets the maximum number of LDAP connections the database link establishes with the remote server [**--abandon-check-interval** *ABANDON\_CHECK\_INTERVAL*](#abandon~3) Sets the number of seconds that pass before the server checks for abandoned operations [**--bind-limit** *BIND\_LIMIT*](#bind~12) Sets the maximum number of concurrent bind operations per TCP connection [**--op-limit** *OP\_LIMIT*](#op~3) Sets the maximum number of concurrent operations allowed [**--proxied-auth** *PROXIED\_AUTH*](#proxied~3) Enables or disables proxied authorization. If set to "off", the server executes bind for chained operations as the user set in the nsMultiplexorBindDn attribute. [**--conn-lifetime** *CONN\_LIFETIME*](#conn~9) Specifies connection lifetime in seconds. "0" keeps the connection open forever. [**--bind-timeout** *BIND\_TIMEOUT*](#bind~13) Sets the amount of time in seconds before a bind attempt times out [**--return-ref** *RETURN\_REF*](#return~3) Enables or disables whether referrals are returned by scoped searches [**--check-aci** *CHECK\_ACI*](#check~3) Enables or disables whether the server evaluates ACIs on the database link as well as the remote data server [**--bind-attempts** *BIND\_ATTEMPTS*](#bind~14) Sets the number of times the server tries to bind to the remote server [**--size-limit** *SIZE\_LIMIT*](#size~3) Sets the maximum number of entries to return from a search operation [**--time-limit** *TIME\_LIMIT*](#time~3) Sets the maximum number of seconds allowed for an operation [**--hop-limit** *HOP\_LIMIT*](#hop~3) Sets the maximum number of times a database is allowed to chain. That is the number of times a request can be forwarded from one database link to another. [**--response-delay** *RESPONSE\_DELAY*](#response~3) Sets the maximum amount of time it can take a remote server to respond to an LDAP operation request made by a database link before an error is suspected [**--test-response-delay** *TEST\_RESPONSE\_DELAY*](#test~3) Sets the duration of the test issued by the database link to check whether the remote server is responding [**--use-starttls** *USE\_STARTTLS*](#use~3) Configured that database links use StartTLS if set to "on" [**--suffix** *SUFFIX*](#suffix~6) Sets the suffix managed by the database link [**--server-url** *SERVER\_URL*](#server~2) Sets the LDAP/LDAPS URL to the remote server [**--bind-mech** *BIND\_MECH*](#bind~15) Sets the authentication method to use to authenticate to the remote server: Valid values: "SIMPLE" (default), "EXTERNAL", "DIGEST-MD5", or "GSSAPI" [**--bind-dn** *BIND\_DN*](#bind~16) Sets the DN of the administrative entry used to communicate with the remote server [**--bind-pw** *BIND\_PW*](#bind~17) Sets the password of the administrative user [**--bind-pw-file** *BIND\_PW\_FILE*](#bind~18) File containing the password [**--bind-pw-prompt**](#bind~19) Prompt for password # COMMAND *'dsconf* *chaining* *link-delete'* usage: dsconf \[-v] \[-j] instance chaining link-delete \[-h] CHAIN\_NAME [**CHAIN\_NAME**](#CHAIN_NAME~4) The name of the database link # COMMAND *'dsconf* *chaining* *monitor'* usage: dsconf \[-v] \[-j] instance chaining monitor \[-h] CHAIN\_NAME [**CHAIN\_NAME**](#CHAIN_NAME~5) The name of the database link # COMMAND *'dsconf* *chaining* *link-list'* usage: dsconf \[-v] \[-j] instance chaining link-list \[-h] # COMMAND *'dsconf* *config'* usage: dsconf \[-v] \[-j] instance config \[-h] {get,add,replace,delete} ... # POSITIONAL ARGUMENTS *'dsconf config'* [**dsconf config** *get*](#dsconf~64) get [**dsconf config** *add*](#dsconf~65) Add attribute value to configuration [**dsconf config** *replace*](#dsconf~66) Replace attribute value in configuration [**dsconf config** *delete*](#dsconf~67) Delete attribute value in configuration # COMMAND *'dsconf* *config* *get'* usage: dsconf \[-v] \[-j] instance config get \[-h] \[attrs ...] [**attrs**](#attrs) Configuration attribute(s) to get # COMMAND *'dsconf* *config* *add'* usage: dsconf \[-v] \[-j] instance config add \[-h] \[attr ...] [**attr**](#attr~6) Configuration attribute to add # COMMAND *'dsconf* *config* *replace'* usage: dsconf \[-v] \[-j] instance config replace \[-h] \[attr ...] [**attr**](#attr~7) Configuration attribute to replace # COMMAND *'dsconf* *config* *delete'* usage: dsconf \[-v] \[-j] instance config delete \[-h] \[attr ...] [**attr**](#attr~8) Configuration attribute to delete # COMMAND *'dsconf* *directory\_manager'* usage: dsconf \[-v] \[-j] instance directory\_manager \[-h] {password\_change} ... # POSITIONAL ARGUMENTS *'dsconf directory\_manager'* [**dsconf directory\_manager** *password\_change*](#dsconf~68) Changes the password of the Directory Manager account # COMMAND *'dsconf* *directory\_manager* *password\_change'* usage: dsconf \[-v] \[-j] instance directory\_manager password\_change \[-h] # COMMAND *'dsconf* *logging'* usage: dsconf \[-v] \[-j] instance logging \[-h] {access,audit,auditfail,error,security} ... # POSITIONAL ARGUMENTS *'dsconf logging'* [**dsconf logging** *access*](#dsconf~69) Manage access log settings [**dsconf logging** *audit*](#dsconf~70) Manage audit log settings [**dsconf logging** *auditfail*](#dsconf~71) Manage auditfail log settings [**dsconf logging** *error*](#dsconf~72) Manage error log settings [**dsconf logging** *security*](#dsconf~73) Manage security log settings # COMMAND *'dsconf* *logging* *access'* usage: dsconf \[-v] \[-j] instance logging access \[-h] {get,set,list-levels} ... # POSITIONAL ARGUMENTS *'dsconf logging access'* [**dsconf logging access** *get*](#dsconf~74) Get access log configuration [**dsconf logging access** *set*](#dsconf~75) Set access log configuration [**dsconf logging access** *list-levels*](#dsconf~76) List all the log levels # COMMAND *'dsconf* *logging* *access* *get'* usage: dsconf \[-v] \[-j] instance logging access get \[-h] # COMMAND *'dsconf* *logging* *access* *set'* usage: dsconf \[-v] \[-j] instance logging access set \[-h] {level,logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,buffering-enabled,buffering-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space,log-format,time-format} ... # POSITIONAL ARGUMENTS *'dsconf logging access set'* [**dsconf logging access set** *level*](#dsconf~77) Set the log level [**dsconf logging access set** *logging-enabled*](#dsconf~78) Enable access logging [**dsconf logging access set** *logging-disabled*](#dsconf~79) Disable access logging [**dsconf logging access set** *mode*](#dsconf~80) Set the log file permissions. Default is 600 [**dsconf logging access set** *location*](#dsconf~81) Set the log name and location [**dsconf logging access set** *compress-enabled*](#dsconf~82) Enable log compression for rotated logs [**dsconf logging access set** *compress-disabled*](#dsconf~83) Disable log compression for rotated logs [**dsconf logging access set** *buffering-enabled*](#dsconf~84) Enable log buffering [**dsconf logging access set** *buffering-disabled*](#dsconf~85) Disable log buffering [**dsconf logging access set** *max-logs*](#dsconf~86) Set the maximum number of rotated logs the server will maintain [**dsconf logging access set** *max-logsize*](#dsconf~87) Set the maximum size for a log in MB [**dsconf logging access set** *rotation-interval*](#dsconf~88) Set the interval for when a log is rotated.This works with the interval unit [**dsconf logging access set** *rotation-interval-unit*](#dsconf~89) Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute", "hour", "day", "week", and "month" [**dsconf logging access set** *rotation-tod-enabled*](#dsconf~90) Enable "time of day" rotation for expired logs [**dsconf logging access set** *rotation-tod-disabled*](#dsconf~91) Disable "time of day" rotation for expired logs [**dsconf logging access set** *rotation-tod-hour*](#dsconf~92) Set the hour when an expired log should be rotated [**dsconf logging access set** *rotation-tod-minute*](#dsconf~93) Set the minute when an expired log should be rotated [**dsconf logging access set** *deletion-interval*](#dsconf~94) Set the interval a rotated log should be deleted. This works with the deletion internal unit setting [**dsconf logging access set** *deletion-interval-unit*](#dsconf~95) Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month" [**dsconf logging access set** *max-disk-space*](#dsconf~96) Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. [**dsconf logging access set** *free-disk-space*](#dsconf~97) The server deletes the oldest rotated log file when the available disk space in MB is less than this amount. [**dsconf logging access set** *log-format*](#dsconf~98) Choose between "default", "json", or "json-pretty" [**dsconf logging access set** *time-format*](#dsconf~99) Time format for JSON logging (strftime) # COMMAND *'dsconf* *logging* *access* *set* *level'* usage: dsconf \[-v] \[-j] instance logging access set level \[-h] levels \[levels ...] [**levels**](#levels) log level # COMMAND *'dsconf* *logging* *access* *set* *logging-enabled'* usage: dsconf \[-v] \[-j] instance logging access set logging-enabled \[-h] # COMMAND *'dsconf* *logging* *access* *set* *logging-disabled'* usage: dsconf \[-v] \[-j] instance logging access set logging-disabled \[-h] # COMMAND *'dsconf* *logging* *access* *set* *mode'* usage: dsconf \[-v] \[-j] instance logging access set mode \[-h] values [**values**](#values) File permissions. Default is 600 # COMMAND *'dsconf* *logging* *access* *set* *location'* usage: dsconf \[-v] \[-j] instance logging access set location \[-h] values [**values**](#values~2) Log name and location # COMMAND *'dsconf* *logging* *access* *set* *compress-enabled'* usage: dsconf \[-v] \[-j] instance logging access set compress-enabled \[-h] # COMMAND *'dsconf* *logging* *access* *set* *compress-disabled'* usage: dsconf \[-v] \[-j] instance logging access set compress-disabled \[-h] # COMMAND *'dsconf* *logging* *access* *set* *buffering-enabled'* usage: dsconf \[-v] \[-j] instance logging access set buffering-enabled \[-h] # COMMAND *'dsconf* *logging* *access* *set* *buffering-disabled'* usage: dsconf \[-v] \[-j] instance logging access set buffering-disabled \[-h] # COMMAND *'dsconf* *logging* *access* *set* *max-logs'* usage: dsconf \[-v] \[-j] instance logging access set max-logs \[-h] values [**values**](#values~3) Set the maximum number of rotated logs the server will maintain # COMMAND *'dsconf* *logging* *access* *set* *max-logsize'* usage: dsconf \[-v] \[-j] instance logging access set max-logsize \[-h] values [**values**](#values~4) Set the maximum size for a log in MB # COMMAND *'dsconf* *logging* *access* *set* *rotation-interval'* usage: dsconf \[-v] \[-j] instance logging access set rotation-interval \[-h] values [**values**](#values~5) Set the interval for when a log is rotated.This works with the interval unit # COMMAND *'dsconf* *logging* *access* *set* *rotation-interval-unit'* usage: dsconf \[-v] \[-j] instance logging access set rotation-interval-unit \[-h] values [**values**](#values~6) Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute", "hour", "day", "week", and "month" # COMMAND *'dsconf* *logging* *access* *set* *rotation-tod-enabled'* usage: dsconf \[-v] \[-j] instance logging access set rotation-tod-enabled \[-h] # COMMAND *'dsconf* *logging* *access* *set* *rotation-tod-disabled'* usage: dsconf \[-v] \[-j] instance logging access set rotation-tod-disabled \[-h] # COMMAND *'dsconf* *logging* *access* *set* *rotation-tod-hour'* usage: dsconf \[-v] \[-j] instance logging access set rotation-tod-hour \[-h] values [**values**](#values~7) Set the hour when an expired log should be rotated # COMMAND *'dsconf* *logging* *access* *set* *rotation-tod-minute'* usage: dsconf \[-v] \[-j] instance logging access set rotation-tod-minute \[-h] values [**values**](#values~8) Set the minute when an expired log should be rotated # COMMAND *'dsconf* *logging* *access* *set* *deletion-interval'* usage: dsconf \[-v] \[-j] instance logging access set deletion-interval \[-h] values [**values**](#values~9) Set the interval a rotated log should be deleted. This works with the deletion internal unit setting # COMMAND *'dsconf* *logging* *access* *set* *deletion-interval-unit'* usage: dsconf \[-v] \[-j] instance logging access set deletion-interval-unit \[-h] values [**values**](#values~10) Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month" # COMMAND *'dsconf* *logging* *access* *set* *max-disk-space'* usage: dsconf \[-v] \[-j] instance logging access set max-disk-space \[-h] values [**values**](#values~11) Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. # COMMAND *'dsconf* *logging* *access* *set* *free-disk-space'* usage: dsconf \[-v] \[-j] instance logging access set free-disk-space \[-h] values [**values**](#values~12) Set the minimum available disk space in MB that triggers the server to delete rotated log files. # COMMAND *'dsconf* *logging* *access* *set* *log-format'* usage: dsconf \[-v] \[-j] instance logging access set log-format \[-h] values [**values**](#values~13) Choose between "default", "json", or "json-pretty" # COMMAND *'dsconf* *logging* *access* *set* *time-format'* usage: dsconf \[-v] \[-j] instance logging access set time-format \[-h] values [**values**](#values~14) Time format for JSON logging (strftime) # COMMAND *'dsconf* *logging* *access* *list-levels'* usage: dsconf \[-v] \[-j] instance logging access list-levels \[-h] # COMMAND *'dsconf* *logging* *audit'* usage: dsconf \[-v] \[-j] instance logging audit \[-h] {get,set} ... # POSITIONAL ARGUMENTS *'dsconf logging audit'* [**dsconf logging audit** *get*](#dsconf~100) Get audit log configuration [**dsconf logging audit** *set*](#dsconf~101) Set audit log configuration # COMMAND *'dsconf* *logging* *audit* *get'* usage: dsconf \[-v] \[-j] instance logging audit get \[-h] # COMMAND *'dsconf* *logging* *audit* *set'* usage: dsconf \[-v] \[-j] instance logging audit set \[-h] {logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,buffering-enabled,buffering-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space,log-format,time-format,display-attrs} ... # POSITIONAL ARGUMENTS *'dsconf logging audit set'* [**dsconf logging audit set** *logging-enabled*](#dsconf~102) Enable access logging [**dsconf logging audit set** *logging-disabled*](#dsconf~103) Disable audit logging [**dsconf logging audit set** *mode*](#dsconf~104) Set the log file permissions. Default is 600 [**dsconf logging audit set** *location*](#dsconf~105) Set the log name and location [**dsconf logging audit set** *compress-enabled*](#dsconf~106) Enable log compression for rotated logs [**dsconf logging audit set** *compress-disabled*](#dsconf~107) Disable log compression for rotated logs [**dsconf logging audit set** *buffering-enabled*](#dsconf~108) Enable log buffering [**dsconf logging audit set** *buffering-disabled*](#dsconf~109) Disable log buffering [**dsconf logging audit set** *max-logs*](#dsconf~110) Set the maximum number of rotated logs the server will maintain [**dsconf logging audit set** *max-logsize*](#dsconf~111) Set the maximum size for a log in MB [**dsconf logging audit set** *rotation-interval*](#dsconf~112) Set the interval for when a log is rotated.This works with the interval unit [**dsconf logging audit set** *rotation-interval-unit*](#dsconf~113) Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute", "hour", "day", "week", and "month" [**dsconf logging audit set** *rotation-tod-enabled*](#dsconf~114) Enable "time of day" rotation for expired logs [**dsconf logging audit set** *rotation-tod-disabled*](#dsconf~115) Disable "time of day" rotation for expired logs [**dsconf logging audit set** *rotation-tod-hour*](#dsconf~116) Set the hour when an expired log should be rotated [**dsconf logging audit set** *rotation-tod-minute*](#dsconf~117) Set the minute when an expired log should be rotated [**dsconf logging audit set** *deletion-interval*](#dsconf~118) Set the interval a rotated log should be deleted. This works with the deletion internal unit setting [**dsconf logging audit set** *deletion-interval-unit*](#dsconf~119) Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month" [**dsconf logging audit set** *max-disk-space*](#dsconf~120) Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. [**dsconf logging audit set** *free-disk-space*](#dsconf~121) The server deletes the oldest rotated log file when the available disk space in MB is less than this amount. [**dsconf logging audit set** *log-format*](#dsconf~122) Choose between "default", "json", or "json-pretty" [**dsconf logging audit set** *time-format*](#dsconf~123) Time format for JSON logging (strftime) [**dsconf logging audit set** *display-attrs*](#dsconf~124) Sets additional identifying attrs to display # COMMAND *'dsconf* *logging* *audit* *set* *logging-enabled'* usage: dsconf \[-v] \[-j] instance logging audit set logging-enabled \[-h] # COMMAND *'dsconf* *logging* *audit* *set* *logging-disabled'* usage: dsconf \[-v] \[-j] instance logging audit set logging-disabled \[-h] # COMMAND *'dsconf* *logging* *audit* *set* *mode'* usage: dsconf \[-v] \[-j] instance logging audit set mode \[-h] values [**values**](#values~15) File permissions. Default is 600 # COMMAND *'dsconf* *logging* *audit* *set* *location'* usage: dsconf \[-v] \[-j] instance logging audit set location \[-h] values [**values**](#values~16) Log name and location # COMMAND *'dsconf* *logging* *audit* *set* *compress-enabled'* usage: dsconf \[-v] \[-j] instance logging audit set compress-enabled \[-h] # COMMAND *'dsconf* *logging* *audit* *set* *compress-disabled'* usage: dsconf \[-v] \[-j] instance logging audit set compress-disabled \[-h] # COMMAND *'dsconf* *logging* *audit* *set* *buffering-enabled'* usage: dsconf \[-v] \[-j] instance logging audit set buffering-enabled \[-h] # COMMAND *'dsconf* *logging* *audit* *set* *buffering-disabled'* usage: dsconf \[-v] \[-j] instance logging audit set buffering-disabled \[-h] # COMMAND *'dsconf* *logging* *audit* *set* *max-logs'* usage: dsconf \[-v] \[-j] instance logging audit set max-logs \[-h] values [**values**](#values~17) Set the maximum number of rotated logs the server will maintain # COMMAND *'dsconf* *logging* *audit* *set* *max-logsize'* usage: dsconf \[-v] \[-j] instance logging audit set max-logsize \[-h] values [**values**](#values~18) Set the maximum size for a log in MB # COMMAND *'dsconf* *logging* *audit* *set* *rotation-interval'* usage: dsconf \[-v] \[-j] instance logging audit set rotation-interval \[-h] values [**values**](#values~19) Set the interval for when a log is rotated.This works with the interval unit # COMMAND *'dsconf* *logging* *audit* *set* *rotation-interval-unit'* usage: dsconf \[-v] \[-j] instance logging audit set rotation-interval-unit \[-h] values [**values**](#values~20) Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute", "hour", "day", "week", and "month" # COMMAND *'dsconf* *logging* *audit* *set* *rotation-tod-enabled'* usage: dsconf \[-v] \[-j] instance logging audit set rotation-tod-enabled \[-h] # COMMAND *'dsconf* *logging* *audit* *set* *rotation-tod-disabled'* usage: dsconf \[-v] \[-j] instance logging audit set rotation-tod-disabled \[-h] # COMMAND *'dsconf* *logging* *audit* *set* *rotation-tod-hour'* usage: dsconf \[-v] \[-j] instance logging audit set rotation-tod-hour \[-h] values [**values**](#values~21) Set the hour when an expired log should be rotated # COMMAND *'dsconf* *logging* *audit* *set* *rotation-tod-minute'* usage: dsconf \[-v] \[-j] instance logging audit set rotation-tod-minute \[-h] values [**values**](#values~22) Set the minute when an expired log should be rotated # COMMAND *'dsconf* *logging* *audit* *set* *deletion-interval'* usage: dsconf \[-v] \[-j] instance logging audit set deletion-interval \[-h] values [**values**](#values~23) Set the interval a rotated log should be deleted. This works with the deletion internal unit setting # COMMAND *'dsconf* *logging* *audit* *set* *deletion-interval-unit'* usage: dsconf \[-v] \[-j] instance logging audit set deletion-interval-unit \[-h] values [**values**](#values~24) Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month" # COMMAND *'dsconf* *logging* *audit* *set* *max-disk-space'* usage: dsconf \[-v] \[-j] instance logging audit set max-disk-space \[-h] values [**values**](#values~25) Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. # COMMAND *'dsconf* *logging* *audit* *set* *free-disk-space'* usage: dsconf \[-v] \[-j] instance logging audit set free-disk-space \[-h] values [**values**](#values~26) Set the minimum available disk space in MB that triggers the server to delete rotated log files. # COMMAND *'dsconf* *logging* *audit* *set* *log-format'* usage: dsconf \[-v] \[-j] instance logging audit set log-format \[-h] values [**values**](#values~27) Choose between "default", "json", or "json-pretty" # COMMAND *'dsconf* *logging* *audit* *set* *time-format'* usage: dsconf \[-v] \[-j] instance logging audit set time-format \[-h] values [**values**](#values~28) Time format for JSON logging (strftime) # COMMAND *'dsconf* *logging* *audit* *set* *display-attrs'* usage: dsconf \[-v] \[-j] instance logging audit set display-attrs \[-h] values \[values ...] [**values**](#values~29) Sets additional identifying attrs to display # COMMAND *'dsconf* *logging* *auditfail'* usage: dsconf \[-v] \[-j] instance logging auditfail \[-h] {get,set} ... # POSITIONAL ARGUMENTS *'dsconf logging auditfail'* [**dsconf logging auditfail** *get*](#dsconf~125) Get auditfail log configuration [**dsconf logging auditfail** *set*](#dsconf~126) Set auditfail log configuration # COMMAND *'dsconf* *logging* *auditfail* *get'* usage: dsconf \[-v] \[-j] instance logging auditfail get \[-h] # COMMAND *'dsconf* *logging* *auditfail* *set'* usage: dsconf \[-v] \[-j] instance logging auditfail set \[-h] {logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space} ... # POSITIONAL ARGUMENTS *'dsconf logging auditfail set'* [**dsconf logging auditfail set** *logging-enabled*](#dsconf~127) Enable access logging [**dsconf logging auditfail set** *logging-disabled*](#dsconf~128) Disable auditfail logging [**dsconf logging auditfail set** *mode*](#dsconf~129) Set the log file permissions. Default is 600 [**dsconf logging auditfail set** *location*](#dsconf~130) Set the log name and location [**dsconf logging auditfail set** *compress-enabled*](#dsconf~131) Enable log compression for rotated logs [**dsconf logging auditfail set** *compress-disabled*](#dsconf~132) Disable log compression for rotated logs [**dsconf logging auditfail set** *max-logs*](#dsconf~133) Set the maximum number of rotated logs the server will maintain [**dsconf logging auditfail set** *max-logsize*](#dsconf~134) Set the maximum size for a log in MB [**dsconf logging auditfail set** *rotation-interval*](#dsconf~135) Set the interval for when a log is rotated.This works with the interval unit [**dsconf logging auditfail set** *rotation-interval-unit*](#dsconf~136) Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute", "hour", "day", "week", and "month" [**dsconf logging auditfail set** *rotation-tod-enabled*](#dsconf~137) Enable "time of day" rotation for expired logs [**dsconf logging auditfail set** *rotation-tod-disabled*](#dsconf~138) Disable "time of day" rotation for expired logs [**dsconf logging auditfail set** *rotation-tod-hour*](#dsconf~139) Set the hour when an expired log should be rotated [**dsconf logging auditfail set** *rotation-tod-minute*](#dsconf~140) Set the minute when an expired log should be rotated [**dsconf logging auditfail set** *deletion-interval*](#dsconf~141) Set the interval a rotated log should be deleted. This works with the deletion internal unit setting [**dsconf logging auditfail set** *deletion-interval-unit*](#dsconf~142) Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month" [**dsconf logging auditfail set** *max-disk-space*](#dsconf~143) Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. [**dsconf logging auditfail set** *free-disk-space*](#dsconf~144) The server deletes the oldest rotated log file when the available disk space in MB is less than this amount. # COMMAND *'dsconf* *logging* *auditfail* *set* *logging-enabled'* usage: dsconf \[-v] \[-j] instance logging auditfail set logging-enabled \[-h] # COMMAND *'dsconf* *logging* *auditfail* *set* *logging-disabled'* usage: dsconf \[-v] \[-j] instance logging auditfail set logging-disabled \[-h] # COMMAND *'dsconf* *logging* *auditfail* *set* *mode'* usage: dsconf \[-v] \[-j] instance logging auditfail set mode \[-h] values [**values**](#values~30) File permissions. Default is 600 # COMMAND *'dsconf* *logging* *auditfail* *set* *location'* usage: dsconf \[-v] \[-j] instance logging auditfail set location \[-h] values [**values**](#values~31) Log name and location # COMMAND *'dsconf* *logging* *auditfail* *set* *compress-enabled'* usage: dsconf \[-v] \[-j] instance logging auditfail set compress-enabled \[-h] # COMMAND *'dsconf* *logging* *auditfail* *set* *compress-disabled'* usage: dsconf \[-v] \[-j] instance logging auditfail set compress-disabled \[-h] # COMMAND *'dsconf* *logging* *auditfail* *set* *max-logs'* usage: dsconf \[-v] \[-j] instance logging auditfail set max-logs \[-h] values [**values**](#values~32) Set the maximum number of rotated logs the server will maintain # COMMAND *'dsconf* *logging* *auditfail* *set* *max-logsize'* usage: dsconf \[-v] \[-j] instance logging auditfail set max-logsize \[-h] values [**values**](#values~33) Set the maximum size for a log in MB # COMMAND *'dsconf* *logging* *auditfail* *set* *rotation-interval'* usage: dsconf \[-v] \[-j] instance logging auditfail set rotation-interval \[-h] values [**values**](#values~34) Set the interval for when a log is rotated.This works with the interval unit # COMMAND *'dsconf* *logging* *auditfail* *set* *rotation-interval-unit'* usage: dsconf \[-v] \[-j] instance logging auditfail set rotation-interval-unit \[-h] values [**values**](#values~35) Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute", "hour", "day", "week", and "month" # COMMAND *'dsconf* *logging* *auditfail* *set* *rotation-tod-enabled'* usage: dsconf \[-v] \[-j] instance logging auditfail set rotation-tod-enabled \[-h] # COMMAND *'dsconf* *logging* *auditfail* *set* *rotation-tod-disabled'* usage: dsconf \[-v] \[-j] instance logging auditfail set rotation-tod-disabled \[-h] # COMMAND *'dsconf* *logging* *auditfail* *set* *rotation-tod-hour'* usage: dsconf \[-v] \[-j] instance logging auditfail set rotation-tod-hour \[-h] values [**values**](#values~36) Set the hour when an expired log should be rotated # COMMAND *'dsconf* *logging* *auditfail* *set* *rotation-tod-minute'* usage: dsconf \[-v] \[-j] instance logging auditfail set rotation-tod-minute \[-h] values [**values**](#values~37) Set the minute when an expired log should be rotated # COMMAND *'dsconf* *logging* *auditfail* *set* *deletion-interval'* usage: dsconf \[-v] \[-j] instance logging auditfail set deletion-interval \[-h] values [**values**](#values~38) Set the interval a rotated log should be deleted. This works with the deletion internal unit setting # COMMAND *'dsconf* *logging* *auditfail* *set* *deletion-interval-unit'* usage: dsconf \[-v] \[-j] instance logging auditfail set deletion-interval-unit \[-h] values [**values**](#values~39) Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month" # COMMAND *'dsconf* *logging* *auditfail* *set* *max-disk-space'* usage: dsconf \[-v] \[-j] instance logging auditfail set max-disk-space \[-h] values [**values**](#values~40) Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. # COMMAND *'dsconf* *logging* *auditfail* *set* *free-disk-space'* usage: dsconf \[-v] \[-j] instance logging auditfail set free-disk-space \[-h] values [**values**](#values~41) Set the minimum available disk space in MB that triggers the server to delete rotated log files. # COMMAND *'dsconf* *logging* *error'* usage: dsconf \[-v] \[-j] instance logging error \[-h] {get,set,list-levels} ... # POSITIONAL ARGUMENTS *'dsconf logging error'* [**dsconf logging error** *get*](#dsconf~145) Get error log configuration [**dsconf logging error** *set*](#dsconf~146) Set error log configuration [**dsconf logging error** *list-levels*](#dsconf~147) List all the log levels # COMMAND *'dsconf* *logging* *error* *get'* usage: dsconf \[-v] \[-j] instance logging error get \[-h] # COMMAND *'dsconf* *logging* *error* *set'* usage: dsconf \[-v] \[-j] instance logging error set \[-h] {level,logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,buffering-enabled,buffering-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space,log-format,time-format} ... # POSITIONAL ARGUMENTS *'dsconf logging error set'* [**dsconf logging error set** *level*](#dsconf~148) Set the log level [**dsconf logging error set** *logging-enabled*](#dsconf~149) Enable access logging [**dsconf logging error set** *logging-disabled*](#dsconf~150) Disable error logging [**dsconf logging error set** *mode*](#dsconf~151) Set the log file permissions. Default is 600 [**dsconf logging error set** *location*](#dsconf~152) Set the log name and location [**dsconf logging error set** *compress-enabled*](#dsconf~153) Enable log compression for rotated logs [**dsconf logging error set** *compress-disabled*](#dsconf~154) Disable log compression for rotated logs [**dsconf logging error set** *buffering-enabled*](#dsconf~155) Enable log buffering [**dsconf logging error set** *buffering-disabled*](#dsconf~156) Disable log buffering [**dsconf logging error set** *max-logs*](#dsconf~157) Set the maximum number of rotated logs the server will maintain [**dsconf logging error set** *max-logsize*](#dsconf~158) Set the maximum size for a log in MB [**dsconf logging error set** *rotation-interval*](#dsconf~159) Set the interval for when a log is rotated.This works with the interval unit [**dsconf logging error set** *rotation-interval-unit*](#dsconf~160) Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute", "hour", "day", "week", and "month" [**dsconf logging error set** *rotation-tod-enabled*](#dsconf~161) Enable "time of day" rotation for expired logs [**dsconf logging error set** *rotation-tod-disabled*](#dsconf~162) Disable "time of day" rotation for expired logs [**dsconf logging error set** *rotation-tod-hour*](#dsconf~163) Set the hour when an expired log should be rotated [**dsconf logging error set** *rotation-tod-minute*](#dsconf~164) Set the minute when an expired log should be rotated [**dsconf logging error set** *deletion-interval*](#dsconf~165) Set the interval a rotated log should be deleted. This works with the deletion internal unit setting [**dsconf logging error set** *deletion-interval-unit*](#dsconf~166) Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month" [**dsconf logging error set** *max-disk-space*](#dsconf~167) Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. [**dsconf logging error set** *free-disk-space*](#dsconf~168) The server deletes the oldest rotated log file when the available disk space in MB is less than this amount. [**dsconf logging error set** *log-format*](#dsconf~169) Choose between "default", "json", or "json-pretty" [**dsconf logging error set** *time-format*](#dsconf~170) Time format for JSON logging (strftime) # COMMAND *'dsconf* *logging* *error* *set* *level'* usage: dsconf \[-v] \[-j] instance logging error set level \[-h] levels \[levels ...] [**levels**](#levels~2) log level # COMMAND *'dsconf* *logging* *error* *set* *logging-enabled'* usage: dsconf \[-v] \[-j] instance logging error set logging-enabled \[-h] # COMMAND *'dsconf* *logging* *error* *set* *logging-disabled'* usage: dsconf \[-v] \[-j] instance logging error set logging-disabled \[-h] # COMMAND *'dsconf* *logging* *error* *set* *mode'* usage: dsconf \[-v] \[-j] instance logging error set mode \[-h] values [**values**](#values~42) File permissions. Default is 600 # COMMAND *'dsconf* *logging* *error* *set* *location'* usage: dsconf \[-v] \[-j] instance logging error set location \[-h] values [**values**](#values~43) Log name and location # COMMAND *'dsconf* *logging* *error* *set* *compress-enabled'* usage: dsconf \[-v] \[-j] instance logging error set compress-enabled \[-h] # COMMAND *'dsconf* *logging* *error* *set* *compress-disabled'* usage: dsconf \[-v] \[-j] instance logging error set compress-disabled \[-h] # COMMAND *'dsconf* *logging* *error* *set* *buffering-enabled'* usage: dsconf \[-v] \[-j] instance logging error set buffering-enabled \[-h] # COMMAND *'dsconf* *logging* *error* *set* *buffering-disabled'* usage: dsconf \[-v] \[-j] instance logging error set buffering-disabled \[-h] # COMMAND *'dsconf* *logging* *error* *set* *max-logs'* usage: dsconf \[-v] \[-j] instance logging error set max-logs \[-h] values [**values**](#values~44) Set the maximum number of rotated logs the server will maintain # COMMAND *'dsconf* *logging* *error* *set* *max-logsize'* usage: dsconf \[-v] \[-j] instance logging error set max-logsize \[-h] values [**values**](#values~45) Set the maximum size for a log in MB # COMMAND *'dsconf* *logging* *error* *set* *rotation-interval'* usage: dsconf \[-v] \[-j] instance logging error set rotation-interval \[-h] values [**values**](#values~46) Set the interval for when a log is rotated.This works with the interval unit # COMMAND *'dsconf* *logging* *error* *set* *rotation-interval-unit'* usage: dsconf \[-v] \[-j] instance logging error set rotation-interval-unit \[-h] values [**values**](#values~47) Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute", "hour", "day", "week", and "month" # COMMAND *'dsconf* *logging* *error* *set* *rotation-tod-enabled'* usage: dsconf \[-v] \[-j] instance logging error set rotation-tod-enabled \[-h] # COMMAND *'dsconf* *logging* *error* *set* *rotation-tod-disabled'* usage: dsconf \[-v] \[-j] instance logging error set rotation-tod-disabled \[-h] # COMMAND *'dsconf* *logging* *error* *set* *rotation-tod-hour'* usage: dsconf \[-v] \[-j] instance logging error set rotation-tod-hour \[-h] values [**values**](#values~48) Set the hour when an expired log should be rotated # COMMAND *'dsconf* *logging* *error* *set* *rotation-tod-minute'* usage: dsconf \[-v] \[-j] instance logging error set rotation-tod-minute \[-h] values [**values**](#values~49) Set the minute when an expired log should be rotated # COMMAND *'dsconf* *logging* *error* *set* *deletion-interval'* usage: dsconf \[-v] \[-j] instance logging error set deletion-interval \[-h] values [**values**](#values~50) Set the interval a rotated log should be deleted. This works with the deletion internal unit setting # COMMAND *'dsconf* *logging* *error* *set* *deletion-interval-unit'* usage: dsconf \[-v] \[-j] instance logging error set deletion-interval-unit \[-h] values [**values**](#values~51) Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month" # COMMAND *'dsconf* *logging* *error* *set* *max-disk-space'* usage: dsconf \[-v] \[-j] instance logging error set max-disk-space \[-h] values [**values**](#values~52) Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. # COMMAND *'dsconf* *logging* *error* *set* *free-disk-space'* usage: dsconf \[-v] \[-j] instance logging error set free-disk-space \[-h] values [**values**](#values~53) Set the minimum available disk space in MB that triggers the server to delete rotated log files. # COMMAND *'dsconf* *logging* *error* *set* *log-format'* usage: dsconf \[-v] \[-j] instance logging error set log-format \[-h] values [**values**](#values~54) Choose between "default", "json", or "json-pretty" # COMMAND *'dsconf* *logging* *error* *set* *time-format'* usage: dsconf \[-v] \[-j] instance logging error set time-format \[-h] values [**values**](#values~55) Time format for JSON logging (strftime) # COMMAND *'dsconf* *logging* *error* *list-levels'* usage: dsconf \[-v] \[-j] instance logging error list-levels \[-h] # COMMAND *'dsconf* *logging* *security'* usage: dsconf \[-v] \[-j] instance logging security \[-h] {get,set} ... # POSITIONAL ARGUMENTS *'dsconf logging security'* [**dsconf logging security** *get*](#dsconf~171) Get security log configuration [**dsconf logging security** *set*](#dsconf~172) Set security log configuration # COMMAND *'dsconf* *logging* *security* *get'* usage: dsconf \[-v] \[-j] instance logging security get \[-h] # COMMAND *'dsconf* *logging* *security* *set'* usage: dsconf \[-v] \[-j] instance logging security set \[-h] {logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,buffering-enabled,buffering-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space} ... # POSITIONAL ARGUMENTS *'dsconf logging security set'* [**dsconf logging security set** *logging-enabled*](#dsconf~173) Enable access logging [**dsconf logging security set** *logging-disabled*](#dsconf~174) Disable security logging [**dsconf logging security set** *mode*](#dsconf~175) Set the log file permissions. Default is 600 [**dsconf logging security set** *location*](#dsconf~176) Set the log name and location [**dsconf logging security set** *compress-enabled*](#dsconf~177) Enable log compression for rotated logs [**dsconf logging security set** *compress-disabled*](#dsconf~178) Disable log compression for rotated logs [**dsconf logging security set** *buffering-enabled*](#dsconf~179) Enable log buffering [**dsconf logging security set** *buffering-disabled*](#dsconf~180) Disable log buffering [**dsconf logging security set** *max-logs*](#dsconf~181) Set the maximum number of rotated logs the server will maintain [**dsconf logging security set** *max-logsize*](#dsconf~182) Set the maximum size for a log in MB [**dsconf logging security set** *rotation-interval*](#dsconf~183) Set the interval for when a log is rotated.This works with the interval unit [**dsconf logging security set** *rotation-interval-unit*](#dsconf~184) Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute", "hour", "day", "week", and "month" [**dsconf logging security set** *rotation-tod-enabled*](#dsconf~185) Enable "time of day" rotation for expired logs [**dsconf logging security set** *rotation-tod-disabled*](#dsconf~186) Disable "time of day" rotation for expired logs [**dsconf logging security set** *rotation-tod-hour*](#dsconf~187) Set the hour when an expired log should be rotated [**dsconf logging security set** *rotation-tod-minute*](#dsconf~188) Set the minute when an expired log should be rotated [**dsconf logging security set** *deletion-interval*](#dsconf~189) Set the interval a rotated log should be deleted. This works with the deletion internal unit setting [**dsconf logging security set** *deletion-interval-unit*](#dsconf~190) Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month" [**dsconf logging security set** *max-disk-space*](#dsconf~191) Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. [**dsconf logging security set** *free-disk-space*](#dsconf~192) The server deletes the oldest rotated log file when the available disk space in MB is less than this amount. # COMMAND *'dsconf* *logging* *security* *set* *logging-enabled'* usage: dsconf \[-v] \[-j] instance logging security set logging-enabled \[-h] # COMMAND *'dsconf* *logging* *security* *set* *logging-disabled'* usage: dsconf \[-v] \[-j] instance logging security set logging-disabled \[-h] # COMMAND *'dsconf* *logging* *security* *set* *mode'* usage: dsconf \[-v] \[-j] instance logging security set mode \[-h] values [**values**](#values~56) File permissions. Default is 600 # COMMAND *'dsconf* *logging* *security* *set* *location'* usage: dsconf \[-v] \[-j] instance logging security set location \[-h] values [**values**](#values~57) Log name and location # COMMAND *'dsconf* *logging* *security* *set* *compress-enabled'* usage: dsconf \[-v] \[-j] instance logging security set compress-enabled \[-h] # COMMAND *'dsconf* *logging* *security* *set* *compress-disabled'* usage: dsconf \[-v] \[-j] instance logging security set compress-disabled \[-h] # COMMAND *'dsconf* *logging* *security* *set* *buffering-enabled'* usage: dsconf \[-v] \[-j] instance logging security set buffering-enabled \[-h] # COMMAND *'dsconf* *logging* *security* *set* *buffering-disabled'* usage: dsconf \[-v] \[-j] instance logging security set buffering-disabled \[-h] # COMMAND *'dsconf* *logging* *security* *set* *max-logs'* usage: dsconf \[-v] \[-j] instance logging security set max-logs \[-h] values [**values**](#values~58) Set the maximum number of rotated logs the server will maintain # COMMAND *'dsconf* *logging* *security* *set* *max-logsize'* usage: dsconf \[-v] \[-j] instance logging security set max-logsize \[-h] values [**values**](#values~59) Set the maximum size for a log in MB # COMMAND *'dsconf* *logging* *security* *set* *rotation-interval'* usage: dsconf \[-v] \[-j] instance logging security set rotation-interval \[-h] values [**values**](#values~60) Set the interval for when a log is rotated.This works with the interval unit # COMMAND *'dsconf* *logging* *security* *set* *rotation-interval-unit'* usage: dsconf \[-v] \[-j] instance logging security set rotation-interval-unit \[-h] values [**values**](#values~61) Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute", "hour", "day", "week", and "month" # COMMAND *'dsconf* *logging* *security* *set* *rotation-tod-enabled'* usage: dsconf \[-v] \[-j] instance logging security set rotation-tod-enabled \[-h] # COMMAND *'dsconf* *logging* *security* *set* *rotation-tod-disabled'* usage: dsconf \[-v] \[-j] instance logging security set rotation-tod-disabled \[-h] # COMMAND *'dsconf* *logging* *security* *set* *rotation-tod-hour'* usage: dsconf \[-v] \[-j] instance logging security set rotation-tod-hour \[-h] values [**values**](#values~62) Set the hour when an expired log should be rotated # COMMAND *'dsconf* *logging* *security* *set* *rotation-tod-minute'* usage: dsconf \[-v] \[-j] instance logging security set rotation-tod-minute \[-h] values [**values**](#values~63) Set the minute when an expired log should be rotated # COMMAND *'dsconf* *logging* *security* *set* *deletion-interval'* usage: dsconf \[-v] \[-j] instance logging security set deletion-interval \[-h] values [**values**](#values~64) Set the interval a rotated log should be deleted. This works with the deletion internal unit setting # COMMAND *'dsconf* *logging* *security* *set* *deletion-interval-unit'* usage: dsconf \[-v] \[-j] instance logging security set deletion-interval-unit \[-h] values [**values**](#values~65) Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month" # COMMAND *'dsconf* *logging* *security* *set* *max-disk-space'* usage: dsconf \[-v] \[-j] instance logging security set max-disk-space \[-h] values [**values**](#values~66) Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. # COMMAND *'dsconf* *logging* *security* *set* *free-disk-space'* usage: dsconf \[-v] \[-j] instance logging security set free-disk-space \[-h] values [**values**](#values~67) Set the minimum available disk space in MB that triggers the server to delete rotated log files. # COMMAND *'dsconf* *monitor'* usage: dsconf \[-v] \[-j] instance monitor \[-h] {server,dbmon,ldbm,backend,snmp,chaining,disk,memberof} ... # POSITIONAL ARGUMENTS *'dsconf monitor'* [**dsconf monitor** *server*](#dsconf~193) Displays the server statistics, connections, and operations [**dsconf monitor** *dbmon*](#dsconf~194) Monitor all database statistics in a single report [**dsconf monitor** *ldbm*](#dsconf~195) Monitor the LDBM statistics, such as dbcache [**dsconf monitor** *backend*](#dsconf~196) Monitor the behavior of a backend database [**dsconf monitor** *snmp*](#dsconf~197) Displays the SNMP statistics [**dsconf monitor** *chaining*](#dsconf~198) Monitor database chaining statistics [**dsconf monitor** *disk*](#dsconf~199) Displays the disk space statistics. All values are in bytes. [**dsconf monitor** *memberof*](#dsconf~200) Displays deferred memberof plugin stats. # COMMAND *'dsconf* *monitor* *server'* usage: dsconf \[-v] \[-j] instance monitor server \[-h] \[-r] # OPTIONS *'dsconf* *monitor* *server'* [**-r**, **--just-resources**](#r~2) Just display the server resources being consumed # COMMAND *'dsconf* *monitor* *dbmon'* usage: dsconf \[-v] \[-j] instance monitor dbmon \[-h] \[-b BACKENDS] \[-x] # OPTIONS *'dsconf* *monitor* *dbmon'* [**-b** *BACKENDS*, **--backends** *BACKENDS*](#b) Specifies a list of space-separated backends to monitor. Default is all backends. [**-x**, **--indexes**](#x~3) Shows index stats for each backend # COMMAND *'dsconf* *monitor* *ldbm'* usage: dsconf \[-v] \[-j] instance monitor ldbm \[-h] # COMMAND *'dsconf* *monitor* *backend'* usage: dsconf \[-v] \[-j] instance monitor backend \[-h] \[backend] [**backend**](#backend~2) The optional name of the backend to monitor # COMMAND *'dsconf* *monitor* *snmp'* usage: dsconf \[-v] \[-j] instance monitor snmp \[-h] # COMMAND *'dsconf* *monitor* *chaining'* usage: dsconf \[-v] \[-j] instance monitor chaining \[-h] \[backend] [**backend**](#backend~3) The optional name of the chaining backend to monitor # COMMAND *'dsconf* *monitor* *disk'* usage: dsconf \[-v] \[-j] instance monitor disk \[-h] # COMMAND *'dsconf* *monitor* *memberof'* usage: dsconf \[-v] \[-j] instance monitor memberof \[-h] # COMMAND *'dsconf* *plugin'* usage: dsconf \[-v] \[-j] instance plugin \[-h] {memberof,automember,referential-integrity,root-dn,usn,account-policy,attr-uniq,dna,ldap-pass-through-auth,linked-attr,managed-entries,pam-pass-through-auth,retro-changelog,posix-winsync,contentsync,entryuuid,pwstorage-scheme,list,show,set} ... # POSITIONAL ARGUMENTS *'dsconf plugin'* [**dsconf plugin** *memberof*](#dsconf~201) Manage and configure MemberOf plugin [**dsconf plugin** *automember*](#dsconf~202) Manage and configure Automembership plugin [**dsconf plugin** *referential-integrity*](#dsconf~203) Manage and configure Referential Integrity Postoperation plugin [**dsconf plugin** *root-dn*](#dsconf~204) Manage and configure RootDN Access Control plugin [**dsconf plugin** *usn*](#dsconf~205) Manage and configure USN plugin [**dsconf plugin** *account-policy*](#dsconf~206) Manage and configure Account Policy plugin [**dsconf plugin** *attr-uniq*](#dsconf~207) Manage and configure Attribute Uniqueness plugin [**dsconf plugin** *dna*](#dsconf~208) Manage and configure DNA plugin [**dsconf plugin** *ldap-pass-through-auth*](#dsconf~209) Manage and configure LDAP Pass-Through Authentication Plugin [**dsconf plugin** *linked-attr*](#dsconf~210) Manage and configure Linked Attributes plugin [**dsconf plugin** *managed-entries*](#dsconf~211) Manage and configure Managed Entries Plugin [**dsconf plugin** *pam-pass-through-auth*](#dsconf~212) Manage and configure Pass-Through Authentication plugins (LDAP URLs and PAM) [**dsconf plugin** *retro-changelog*](#dsconf~213) Manage and configure Retro Changelog plugin [**dsconf plugin** *posix-winsync*](#dsconf~214) Manage and configure the Posix Winsync API plugin [**dsconf plugin** *contentsync*](#dsconf~215) Manage and configure Content Sync Plugin (aka syncrepl) [**dsconf plugin** *entryuuid*](#dsconf~216) Manage and configure EntryUUID plugin [**dsconf plugin** *pwstorage-scheme*](#dsconf~217) Manage password storage scheme plugins [**dsconf plugin** *list*](#dsconf~218) List current configured (enabled and disabled) plugins [**dsconf plugin** *show*](#dsconf~219) Show the plugin data [**dsconf plugin** *set*](#dsconf~220) Edit the plugin settings # COMMAND *'dsconf* *plugin* *memberof'* usage: dsconf \[-v] \[-j] instance plugin memberof \[-h] {show,enable,disable,status,set,add-attr,del-attr,config-entry,fixup,fixup-status} ... # POSITIONAL ARGUMENTS *'dsconf plugin memberof'* [**dsconf plugin memberof** *show*](#dsconf~221) Displays the plugin configuration [**dsconf plugin memberof** *enable*](#dsconf~222) Enables the plugin [**dsconf plugin memberof** *disable*](#dsconf~223) Disables the plugin [**dsconf plugin memberof** *status*](#dsconf~224) Displays the plugin status [**dsconf plugin memberof** *set*](#dsconf~225) Edit the plugin settings [**dsconf plugin memberof** *add-attr*](#dsconf~226) Add attributes to the plugin [**dsconf plugin memberof** *del-attr*](#dsconf~227) Delete attributes from the plugin [**dsconf plugin memberof** *config-entry*](#dsconf~228) Manage the config entry [**dsconf plugin memberof** *fixup*](#dsconf~229) Run the fix-up task for memberOf plugin [**dsconf plugin memberof** *fixup-status*](#dsconf~230) Check the status of a fix-up task # COMMAND *'dsconf* *plugin* *memberof* *show'* usage: dsconf \[-v] \[-j] instance plugin memberof show \[-h] # COMMAND *'dsconf* *plugin* *memberof* *enable'* usage: dsconf \[-v] \[-j] instance plugin memberof enable \[-h] # COMMAND *'dsconf* *plugin* *memberof* *disable'* usage: dsconf \[-v] \[-j] instance plugin memberof disable \[-h] # COMMAND *'dsconf* *plugin* *memberof* *status'* usage: dsconf \[-v] \[-j] instance plugin memberof status \[-h] # COMMAND *'dsconf* *plugin* *memberof* *set'* usage: dsconf \[-v] \[-j] instance plugin memberof set \[-h] \[--attr ATTR] \[--groupattr GROUPATTR \[GROUPATTR ...]] \[--allbackends {on,off}] \[--skipnested {on,off}] \[--scope SCOPE \[SCOPE ...]] \[--exclude EXCLUDE \[EXCLUDE ...]] \[--autoaddoc AUTOADDOC] \[--deferredupdate {on,off}] \[--launchfixup {on,off}] \[--specific-group-oc SPECIFIC\_GROUP\_OC \[SPECIFIC\_GROUP\_OC ...]] \[--specific-group-filter SPECIFIC\_GROUP\_FILTER \[SPECIFIC\_GROUP\_FILTER ...]] \[--exclude-specific-group-filter EXCLUDE\_SPECIFIC\_GROUP\_FILTER \[EXCLUDE\_SPECIFIC\_GROUP\_FILTER ...]] \[--config-entry CONFIG\_ENTRY] # OPTIONS *'dsconf* *plugin* *memberof* *set'* [**--attr** *ATTR*](#attr~9) Specifies the attribute in the user entry for the Directory Server to manage to reflect group membership (memberOfAttr) [**--groupattr** *GROUPATTR \[GROUPATTR ...\]*](#groupattr) Specifies the attribute in the group entry to use to identify the DNs of group members (memberOfGroupAttr) [**--allbackends** *{on,off}*](#allbackends) Specifies whether to search the local suffix for user entries on all available suffixes (memberOfAllBackends) [**--skipnested** *{on,off}*](#skipnested) Specifies whether to skip nested groups or not (memberOfSkipNested) [**--scope** *SCOPE \[SCOPE ...\]*](#scope) Specifies backends or multiple-nested suffixes for the MemberOf plug-in to work on (memberOfEntryScope) [**--exclude** *EXCLUDE \[EXCLUDE ...\]*](#exclude~2) Specifies backends or multiple-nested suffixes for the MemberOf plug-in to exclude (memberOfEntryScopeExcludeSubtree) [**--autoaddoc** *AUTOADDOC*](#autoaddoc) If an entry does not have an object class that allows the memberOf attribute then the memberOf plugin will automatically add the object class listed in the memberOfAutoAddOC parameter [**--deferredupdate** *{on,off}*](#deferredupdate) Specifies that the updates of the members are done after the completion of the update of the target group. In addition each update (group/members) uses its own transaction [**--launchfixup** *{on,off}*](#launchfixup) Specify that if the server disorderly shutdown (crash, kill,..) then at restart the memberof fixup task is launched automatically [**--specific-group-oc** *SPECIFIC\_GROUP\_OC \[SPECIFIC\_GROUP\_OC ...\]*](#specific) Set objectclasses for the specific groups to include/exclude. Otherwise all other groups will be excluded. Note, this replaces all existing values. To add a new value, use the "add-attr" command. (memberOfSpecificGroupOC) [**--specific-group-filter** *SPECIFIC\_GROUP\_FILTER \[SPECIFIC\_GROUP\_FILTER ...\]*](#specific~2) Specifies a filter for groups to include. Otherwise all other groups will be excluded (memberOfSpecificGroupFilter) [**--exclude-specific-group-filter** *EXCLUDE\_SPECIFIC\_GROUP\_FILTER \[EXCLUDE\_SPECIFIC\_GROUP\_FILTER ...\]*](#exclude~3) Specifies a filter for groups to exclude. Otherwise all other groups will be included. (memberOfExcludeSpecificGroupFilter) [**--config-entry** *CONFIG\_ENTRY*](#config) The value to set as nsslapd-pluginConfigArea # COMMAND *'dsconf* *plugin* *memberof* *add-attr'* usage: dsconf \[-v] \[-j] instance plugin memberof add-attr \[-h] \[--specific-group-filter SPECIFIC\_GROUP\_FILTER \[SPECIFIC\_GROUP\_FILTER ...]] \[--exclude-specific-group-filter EXCLUDE\_SPECIFIC\_GROUP\_FILTER \[EXCLUDE\_SPECIFIC\_GROUP\_FILTER ...]] # OPTIONS *'dsconf* *plugin* *memberof* *add-attr'* [**--specific-group-filter** *SPECIFIC\_GROUP\_FILTER \[SPECIFIC\_GROUP\_FILTER ...\]*](#specific~3) Specifies a filter for groups to include. This adds to the existing values. Otherwise all other groups will be excluded (memberOfSpecificGroupFilter) [**--exclude-specific-group-filter** *EXCLUDE\_SPECIFIC\_GROUP\_FILTER \[EXCLUDE\_SPECIFIC\_GROUP\_FILTER ...\]*](#exclude~4) Specifies a filter for groups to exclude. This adds to the existing values. Otherwise all other groups will be included (memberOfExcludeSpecificGroupFilter) # COMMAND *'dsconf* *plugin* *memberof* *del-attr'* usage: dsconf \[-v] \[-j] instance plugin memberof del-attr \[-h] \[--specific-group-filter SPECIFIC\_GROUP\_FILTER \[SPECIFIC\_GROUP\_FILTER ...]] \[--exclude-specific-group-filter EXCLUDE\_SPECIFIC\_GROUP\_FILTER \[EXCLUDE\_SPECIFIC\_GROUP\_FILTER ...]] # OPTIONS *'dsconf* *plugin* *memberof* *del-attr'* [**--specific-group-filter** *SPECIFIC\_GROUP\_FILTER \[SPECIFIC\_GROUP\_FILTER ...\]*](#specific~4) Removes a filter for groups to include. This removes the value from the existing values. (memberOfSpecificGroupFilter) [**--exclude-specific-group-filter** *EXCLUDE\_SPECIFIC\_GROUP\_FILTER \[EXCLUDE\_SPECIFIC\_GROUP\_FILTER ...\]*](#exclude~5) Removes a filter for groups to exclude. This removes the value from the existing values. (memberOfExcludeSpecificGroupFilter) # COMMAND *'dsconf* *plugin* *memberof* *config-entry'* usage: dsconf \[-v] \[-j] instance plugin memberof config-entry \[-h] {add,set,add-attr,del-attr,show,delete} ... # POSITIONAL ARGUMENTS *'dsconf plugin memberof config-entry'* [**dsconf plugin memberof config-entry** *add*](#dsconf~231) Add the config entry [**dsconf plugin memberof config-entry** *set*](#dsconf~232) Edit the config entry [**dsconf plugin memberof config-entry** *add-attr*](#dsconf~233) Add attributes to the config entry [**dsconf plugin memberof config-entry** *del-attr*](#dsconf~234) Delete attributes from the config entry [**dsconf plugin memberof config-entry** *show*](#dsconf~235) Display the config entry [**dsconf plugin memberof config-entry** *delete*](#dsconf~236) Delete the config entry and remove the reference in the plugin # COMMAND *'dsconf* *plugin* *memberof* *config-entry* *add'* usage: dsconf \[-v] \[-j] instance plugin memberof config-entry add \[-h] \[--attr ATTR] \[--groupattr GROUPATTR \[GROUPATTR ...]] \[--allbackends {on,off}] \[--skipnested {on,off}] \[--scope SCOPE \[SCOPE ...]] \[--exclude EXCLUDE \[EXCLUDE ...]] \[--autoaddoc AUTOADDOC] \[--deferredupdate {on,off}] \[--launchfixup {on,off}] \[--specific-group-oc SPECIFIC\_GROUP\_OC \[SPECIFIC\_GROUP\_OC ...]] \[--specific-group-filter SPECIFIC\_GROUP\_FILTER \[SPECIFIC\_GROUP\_FILTER ...]] \[--exclude-specific-group-filter EXCLUDE\_SPECIFIC\_GROUP\_FILTER \[EXCLUDE\_SPECIFIC\_GROUP\_FILTER ...]] DN [**DN**](#DN) The config entry full DN # OPTIONS *'dsconf* *plugin* *memberof* *config-entry* *add'* [**--attr** *ATTR*](#attr~10) Specifies the attribute in the user entry for the Directory Server to manage to reflect group membership (memberOfAttr) [**--groupattr** *GROUPATTR \[GROUPATTR ...\]*](#groupattr~2) Specifies the attribute in the group entry to use to identify the DNs of group members (memberOfGroupAttr) [**--allbackends** *{on,off}*](#allbackends~2) Specifies whether to search the local suffix for user entries on all available suffixes (memberOfAllBackends) [**--skipnested** *{on,off}*](#skipnested~2) Specifies whether to skip nested groups or not (memberOfSkipNested) [**--scope** *SCOPE \[SCOPE ...\]*](#scope~2) Specifies backends or multiple-nested suffixes for the MemberOf plug-in to work on (memberOfEntryScope) [**--exclude** *EXCLUDE \[EXCLUDE ...\]*](#exclude~6) Specifies backends or multiple-nested suffixes for the MemberOf plug-in to exclude (memberOfEntryScopeExcludeSubtree) [**--autoaddoc** *AUTOADDOC*](#autoaddoc~2) If an entry does not have an object class that allows the memberOf attribute then the memberOf plugin will automatically add the object class listed in the memberOfAutoAddOC parameter [**--deferredupdate** *{on,off}*](#deferredupdate~2) Specifies that the updates of the members are done after the completion of the update of the target group. In addition each update (group/members) uses its own transaction [**--launchfixup** *{on,off}*](#launchfixup~2) Specify that if the server disorderly shutdown (crash, kill,..) then at restart the memberof fixup task is launched automatically [**--specific-group-oc** *SPECIFIC\_GROUP\_OC \[SPECIFIC\_GROUP\_OC ...\]*](#specific~5) Set objectclasses for the specific groups to include/exclude. Otherwise all other groups will be excluded. Note, this replaces all existing values. To add a new value, use the "add-attr" command. (memberOfSpecificGroupOC) [**--specific-group-filter** *SPECIFIC\_GROUP\_FILTER \[SPECIFIC\_GROUP\_FILTER ...\]*](#specific~6) Specifies a filter for groups to include. Otherwise all other groups will be excluded (memberOfSpecificGroupFilter) [**--exclude-specific-group-filter** *EXCLUDE\_SPECIFIC\_GROUP\_FILTER \[EXCLUDE\_SPECIFIC\_GROUP\_FILTER ...\]*](#exclude~7) Specifies a filter for groups to exclude. Otherwise all other groups will be included. (memberOfExcludeSpecificGroupFilter) # COMMAND *'dsconf* *plugin* *memberof* *config-entry* *set'* usage: dsconf \[-v] \[-j] instance plugin memberof config-entry set \[-h] \[--attr ATTR] \[--groupattr GROUPATTR \[GROUPATTR ...]] \[--allbackends {on,off}] \[--skipnested {on,off}] \[--scope SCOPE \[SCOPE ...]] \[--exclude EXCLUDE \[EXCLUDE ...]] \[--autoaddoc AUTOADDOC] \[--deferredupdate {on,off}] \[--launchfixup {on,off}] \[--specific-group-oc SPECIFIC\_GROUP\_OC \[SPECIFIC\_GROUP\_OC ...]] \[--specific-group-filter SPECIFIC\_GROUP\_FILTER \[SPECIFIC\_GROUP\_FILTER ...]] \[--exclude-specific-group-filter EXCLUDE\_SPECIFIC\_GROUP\_FILTER \[EXCLUDE\_SPECIFIC\_GROUP\_FILTER ...]] DN [**DN**](#DN~2) The config entry full DN # OPTIONS *'dsconf* *plugin* *memberof* *config-entry* *set'* [**--attr** *ATTR*](#attr~11) Specifies the attribute in the user entry for the Directory Server to manage to reflect group membership (memberOfAttr) [**--groupattr** *GROUPATTR \[GROUPATTR ...\]*](#groupattr~3) Specifies the attribute in the group entry to use to identify the DNs of group members (memberOfGroupAttr) [**--allbackends** *{on,off}*](#allbackends~3) Specifies whether to search the local suffix for user entries on all available suffixes (memberOfAllBackends) [**--skipnested** *{on,off}*](#skipnested~3) Specifies whether to skip nested groups or not (memberOfSkipNested) [**--scope** *SCOPE \[SCOPE ...\]*](#scope~3) Specifies backends or multiple-nested suffixes for the MemberOf plug-in to work on (memberOfEntryScope) [**--exclude** *EXCLUDE \[EXCLUDE ...\]*](#exclude~8) Specifies backends or multiple-nested suffixes for the MemberOf plug-in to exclude (memberOfEntryScopeExcludeSubtree) [**--autoaddoc** *AUTOADDOC*](#autoaddoc~3) If an entry does not have an object class that allows the memberOf attribute then the memberOf plugin will automatically add the object class listed in the memberOfAutoAddOC parameter [**--deferredupdate** *{on,off}*](#deferredupdate~3) Specifies that the updates of the members are done after the completion of the update of the target group. In addition each update (group/members) uses its own transaction [**--launchfixup** *{on,off}*](#launchfixup~3) Specify that if the server disorderly shutdown (crash, kill,..) then at restart the memberof fixup task is launched automatically [**--specific-group-oc** *SPECIFIC\_GROUP\_OC \[SPECIFIC\_GROUP\_OC ...\]*](#specific~7) Set objectclasses for the specific groups to include/exclude. Otherwise all other groups will be excluded. Note, this replaces all existing values. To add a new value, use the "add-attr" command. (memberOfSpecificGroupOC) [**--specific-group-filter** *SPECIFIC\_GROUP\_FILTER \[SPECIFIC\_GROUP\_FILTER ...\]*](#specific~8) Specifies a filter for groups to include. Otherwise all other groups will be excluded (memberOfSpecificGroupFilter) [**--exclude-specific-group-filter** *EXCLUDE\_SPECIFIC\_GROUP\_FILTER \[EXCLUDE\_SPECIFIC\_GROUP\_FILTER ...\]*](#exclude~9) Specifies a filter for groups to exclude. Otherwise all other groups will be included. (memberOfExcludeSpecificGroupFilter) # COMMAND *'dsconf* *plugin* *memberof* *config-entry* *add-attr'* usage: dsconf \[-v] \[-j] instance plugin memberof config-entry add-attr \[-h] \[--specific-group-filter SPECIFIC\_GROUP\_FILTER \[SPECIFIC\_GROUP\_FILTER ...]] \[--exclude-specific-group-filter EXCLUDE\_SPECIFIC\_GROUP\_FILTER \[EXCLUDE\_SPECIFIC\_GROUP\_FILTER ...]] DN [**DN**](#DN~3) The config entry full DN # OPTIONS *'dsconf* *plugin* *memberof* *config-entry* *add-attr'* [**--specific-group-filter** *SPECIFIC\_GROUP\_FILTER \[SPECIFIC\_GROUP\_FILTER ...\]*](#specific~9) Specifies a filter for groups to include. This adds to the existing values. Otherwise all other groups will be excluded (memberOfSpecificGroupFilter) [**--exclude-specific-group-filter** *EXCLUDE\_SPECIFIC\_GROUP\_FILTER \[EXCLUDE\_SPECIFIC\_GROUP\_FILTER ...\]*](#exclude~10) Specifies a filter for groups to exclude. This adds to the existing values. Otherwise all other groups will be included (memberOfExcludeSpecificGroupFilter) # COMMAND *'dsconf* *plugin* *memberof* *config-entry* *del-attr'* usage: dsconf \[-v] \[-j] instance plugin memberof config-entry del-attr \[-h] \[--specific-group-filter SPECIFIC\_GROUP\_FILTER \[SPECIFIC\_GROUP\_FILTER ...]] \[--exclude-specific-group-filter EXCLUDE\_SPECIFIC\_GROUP\_FILTER \[EXCLUDE\_SPECIFIC\_GROUP\_FILTER ...]] DN [**DN**](#DN~4) The config entry full DN # OPTIONS *'dsconf* *plugin* *memberof* *config-entry* *del-attr'* [**--specific-group-filter** *SPECIFIC\_GROUP\_FILTER \[SPECIFIC\_GROUP\_FILTER ...\]*](#specific~10) Removes a filter for groups to include. This removes the value from the existing values. (memberOfSpecificGroupFilter) [**--exclude-specific-group-filter** *EXCLUDE\_SPECIFIC\_GROUP\_FILTER \[EXCLUDE\_SPECIFIC\_GROUP\_FILTER ...\]*](#exclude~11) Removes a filter for groups to exclude. This removes the value from the existing values. (memberOfExcludeSpecificGroupFilter) # COMMAND *'dsconf* *plugin* *memberof* *config-entry* *show'* usage: dsconf \[-v] \[-j] instance plugin memberof config-entry show \[-h] DN [**DN**](#DN~5) The config entry full DN # COMMAND *'dsconf* *plugin* *memberof* *config-entry* *delete'* usage: dsconf \[-v] \[-j] instance plugin memberof config-entry delete \[-h] DN [**DN**](#DN~6) The config entry full DN # COMMAND *'dsconf* *plugin* *memberof* *fixup'* usage: dsconf \[-v] \[-j] instance plugin memberof fixup \[-h] \[-f FILTER] \[--wait] \[--timeout TIMEOUT] DN [**DN**](#DN~7) Base DN that contains entries to fix up # OPTIONS *'dsconf* *plugin* *memberof* *fixup'* [**-f** *FILTER*, **--filter** *FILTER*](#f) Filter for entries to fix up. If omitted, all entries with objectclass inetuser/inetadmin/nsmemberof under the specified base will have their memberOf attribute regenerated. [**--wait**](#wait~2) Wait for the task to finish, this could take a long time [**--timeout** *TIMEOUT*](#timeout~6) Sets the task timeout. Default is 0 (no timeout) # COMMAND *'dsconf* *plugin* *memberof* *fixup-status'* usage: dsconf \[-v] \[-j] instance plugin memberof fixup-status \[-h] \[--dn DN] \[--show-log] \[--watch] # OPTIONS *'dsconf* *plugin* *memberof* *fixup-status'* [**--dn** *DN*](#dn~2) The task entry's DN [**--show-log**](#show) Display the task log [**--watch**](#watch~4) Watch the task's status and wait for it to finish # COMMAND *'dsconf* *plugin* *automember'* usage: dsconf \[-v] \[-j] instance plugin automember \[-h] {show,enable,disable,status,list,definition,fixup,fixup-status,abort-fixup} ... # POSITIONAL ARGUMENTS *'dsconf plugin automember'* [**dsconf plugin automember** *show*](#dsconf~237) Displays the plugin configuration [**dsconf plugin automember** *enable*](#dsconf~238) Enables the plugin [**dsconf plugin automember** *disable*](#dsconf~239) Disables the plugin [**dsconf plugin automember** *status*](#dsconf~240) Displays the plugin status [**dsconf plugin automember** *list*](#dsconf~241) List Automembership definitions or regex rules. [**dsconf plugin automember** *definition*](#dsconf~242) Manage Automembership definition. [**dsconf plugin automember** *fixup*](#dsconf~243) Run a rebuild membership task. [**dsconf plugin automember** *fixup-status*](#dsconf~244) Check the status of a fix-up task [**dsconf plugin automember** *abort-fixup*](#dsconf~245) Abort the rebuild membership task. # COMMAND *'dsconf* *plugin* *automember* *show'* usage: dsconf \[-v] \[-j] instance plugin automember show \[-h] # COMMAND *'dsconf* *plugin* *automember* *enable'* usage: dsconf \[-v] \[-j] instance plugin automember enable \[-h] # COMMAND *'dsconf* *plugin* *automember* *disable'* usage: dsconf \[-v] \[-j] instance plugin automember disable \[-h] # COMMAND *'dsconf* *plugin* *automember* *status'* usage: dsconf \[-v] \[-j] instance plugin automember status \[-h] # COMMAND *'dsconf* *plugin* *automember* *list'* usage: dsconf \[-v] \[-j] instance plugin automember list \[-h] {definitions,regexes} ... # POSITIONAL ARGUMENTS *'dsconf plugin automember list'* [**dsconf plugin automember list** *definitions*](#dsconf~246) Lists Automembership definitions. [**dsconf plugin automember list** *regexes*](#dsconf~247) List Automembership regex rules. # COMMAND *'dsconf* *plugin* *automember* *list* *definitions'* usage: dsconf \[-v] \[-j] instance plugin automember list definitions \[-h] # COMMAND *'dsconf* *plugin* *automember* *list* *regexes'* usage: dsconf \[-v] \[-j] instance plugin automember list regexes \[-h] DEFNAME [**DEFNAME**](#DEFNAME) The definition entry CN # COMMAND *'dsconf* *plugin* *automember* *definition'* usage: dsconf \[-v] \[-j] instance plugin automember definition \[-h] DEFNAME {add,set,delete,show,regex} ... # POSITIONAL ARGUMENTS *'dsconf plugin automember definition'* [**dsconf plugin automember definition** *add*](#dsconf~248) Creates Automembership definition. [**dsconf plugin automember definition** *set*](#dsconf~249) Edits Automembership definition. [**dsconf plugin automember definition** *delete*](#dsconf~250) Removes Automembership definition. [**dsconf plugin automember definition** *show*](#dsconf~251) Displays Automembership definition. [**dsconf plugin automember definition** *regex*](#dsconf~252) Manage Automembership regex rules. # COMMAND *'dsconf* *plugin* *automember* *definition* *add'* usage: dsconf \[-v] \[-j] instance plugin automember definition DEFNAME add \[-h] --grouping-attr GROUPING\_ATTR \[--default-group DEFAULT\_GROUP] \--scope SCOPE --filter FILTER # OPTIONS *'dsconf* *plugin* *automember* *definition* *add'* [**--grouping-attr** *GROUPING\_ATTR*](#grouping) Specifies the name of the member attribute in the group entry and the attribute in the object entry that supplies the member attribute value, in the format group\_member\_attr:entry\_attr (autoMemberGroupingAttr) [**--default-group** *DEFAULT\_GROUP*](#default) Sets default or fallback group to add the entry to as a member attribute in group entry (autoMemberDefaultGroup) [**--scope** *SCOPE*](#scope~4) Sets the subtree DN to search for entries (autoMemberScope) [**--filter** *FILTER*](#filter) Sets a standard LDAP search filter to use to search for matching entries (autoMemberFilter) # COMMAND *'dsconf* *plugin* *automember* *definition* *set'* usage: dsconf \[-v] \[-j] instance plugin automember definition DEFNAME set \[-h] --grouping-attr GROUPING\_ATTR \[--default-group DEFAULT\_GROUP] \--scope SCOPE --filter FILTER # OPTIONS *'dsconf* *plugin* *automember* *definition* *set'* [**--grouping-attr** *GROUPING\_ATTR*](#grouping~2) Specifies the name of the member attribute in the group entry and the attribute in the object entry that supplies the member attribute value, in the format group\_member\_attr:entry\_attr (autoMemberGroupingAttr) [**--default-group** *DEFAULT\_GROUP*](#default~2) Sets default or fallback group to add the entry to as a member attribute in group entry (autoMemberDefaultGroup) [**--scope** *SCOPE*](#scope~5) Sets the subtree DN to search for entries (autoMemberScope) [**--filter** *FILTER*](#filter~2) Sets a standard LDAP search filter to use to search for matching entries (autoMemberFilter) # COMMAND *'dsconf* *plugin* *automember* *definition* *delete'* usage: dsconf \[-v] \[-j] instance plugin automember definition DEFNAME delete \[-h] # COMMAND *'dsconf* *plugin* *automember* *definition* *show'* usage: dsconf \[-v] \[-j] instance plugin automember definition DEFNAME show \[-h] # COMMAND *'dsconf* *plugin* *automember* *definition* *regex'* usage: dsconf \[-v] \[-j] instance plugin automember definition DEFNAME regex \[-h] REGEXNAME {add,set,delete,show} ... # POSITIONAL ARGUMENTS *'dsconf plugin automember definition regex'* [**dsconf plugin automember definition regex** *add*](#dsconf~253) Creates Automembership regex. [**dsconf plugin automember definition regex** *set*](#dsconf~254) Edits Automembership regex. [**dsconf plugin automember definition regex** *delete*](#dsconf~255) Removes Automembership regex. [**dsconf plugin automember definition regex** *show*](#dsconf~256) Displays Automembership regex. # COMMAND *'dsconf* *plugin* *automember* *definition* *regex* *add'* usage: dsconf \[-v] \[-j] instance plugin automember definition DEFNAME regex REGEXNAME add \[-h] \[--exclusive EXCLUSIVE \[EXCLUSIVE ...]] \[--inclusive INCLUSIVE \[INCLUSIVE ...]] --target-group TARGET\_GROUP # OPTIONS *'dsconf* *plugin* *automember* *definition* *regex* *add'* [**--exclusive** *EXCLUSIVE \[EXCLUSIVE ...\]*](#exclusive) Sets a single regular expression to use to identify entries to exclude (autoMemberExclusiveRegex) [**--inclusive** *INCLUSIVE \[INCLUSIVE ...\]*](#inclusive) Sets a single regular expression to use to identify entries to include (autoMemberInclusiveRegex) [**--target-group** *TARGET\_GROUP*](#target) Sets which group to add the entry to as a member, if it meets the regular expression conditions (autoMemberTargetGroup) # COMMAND *'dsconf* *plugin* *automember* *definition* *regex* *set'* usage: dsconf \[-v] \[-j] instance plugin automember definition DEFNAME regex REGEXNAME set \[-h] \[--exclusive EXCLUSIVE \[EXCLUSIVE ...]] \[--inclusive INCLUSIVE \[INCLUSIVE ...]] --target-group TARGET\_GROUP # OPTIONS *'dsconf* *plugin* *automember* *definition* *regex* *set'* [**--exclusive** *EXCLUSIVE \[EXCLUSIVE ...\]*](#exclusive~2) Sets a single regular expression to use to identify entries to exclude (autoMemberExclusiveRegex) [**--inclusive** *INCLUSIVE \[INCLUSIVE ...\]*](#inclusive~2) Sets a single regular expression to use to identify entries to include (autoMemberInclusiveRegex) [**--target-group** *TARGET\_GROUP*](#target~2) Sets which group to add the entry to as a member, if it meets the regular expression conditions (autoMemberTargetGroup) # COMMAND *'dsconf* *plugin* *automember* *definition* *regex* *delete'* usage: dsconf \[-v] \[-j] instance plugin automember definition DEFNAME regex REGEXNAME delete \[-h] # COMMAND *'dsconf* *plugin* *automember* *definition* *regex* *show'* usage: dsconf \[-v] \[-j] instance plugin automember definition DEFNAME regex REGEXNAME show \[-h] # COMMAND *'dsconf* *plugin* *automember* *fixup'* usage: dsconf \[-v] \[-j] instance plugin automember fixup \[-h] -f FILTER \-s {sub,base,one} \[--cleanup] \[--wait] \[--timeout TIMEOUT] DN [**DN**](#DN~8) Base DN that contains entries to fix up # OPTIONS *'dsconf* *plugin* *automember* *fixup'* [**-f** *FILTER*, **--filter** *FILTER*](#f~2) Sets the LDAP filter for entries to fix up [**-s** *{sub,base,one}*, **--scope** *{sub,base,one}*](#s~3) Sets the LDAP search scope for entries to fix up [**--cleanup**](#cleanup) Clean up previous group memberships before rebuilding [**--wait**](#wait~3) Wait for the task to finish, this could take a long time [**--timeout** *TIMEOUT*](#timeout~7) Set a timeout to wait for the fixup task. Default is 0 (no timeout) # COMMAND *'dsconf* *plugin* *automember* *fixup-status'* usage: dsconf \[-v] \[-j] instance plugin automember fixup-status \[-h] \[--dn DN] \[--show-log] \[--watch] # OPTIONS *'dsconf* *plugin* *automember* *fixup-status'* [**--dn** *DN*](#dn~3) The task entry's DN [**--show-log**](#show~2) Display the task log [**--watch**](#watch~5) Watch the task's status and wait for it to finish # COMMAND *'dsconf* *plugin* *automember* *abort-fixup'* usage: dsconf \[-v] \[-j] instance plugin automember abort-fixup \[-h] \[--timeout TIMEOUT] # OPTIONS *'dsconf* *plugin* *automember* *abort-fixup'* [**--timeout** *TIMEOUT*](#timeout~8) Set a timeout to wait for the abort task. Default is 0 (no timeout) # COMMAND *'dsconf* *plugin* *referential-integrity'* usage: dsconf instance \[-v] \[-j] plugin referential-integrity \[-h] {show,enable,disable,status,set,config-entry} ... # POSITIONAL ARGUMENTS *'dsconf plugin referential-integrity'* [**dsconf plugin referential-integrity** *show*](#dsconf~257) Displays the plugin configuration [**dsconf plugin referential-integrity** *enable*](#dsconf~258) Enables the plugin [**dsconf plugin referential-integrity** *disable*](#dsconf~259) Disables the plugin [**dsconf plugin referential-integrity** *status*](#dsconf~260) Displays the plugin status [**dsconf plugin referential-integrity** *set*](#dsconf~261) Edit the plugin settings [**dsconf plugin referential-integrity** *config-entry*](#dsconf~262) Manage the config entry # COMMAND *'dsconf* *plugin* *referential-integrity* *show'* usage: dsconf \[-v] \[-j] instance plugin referential-integrity show \[-h] # COMMAND *'dsconf* *plugin* *referential-integrity* *enable'* usage: dsconf \[-v] \[-j] instance plugin referential-integrity enable \[-h] # COMMAND *'dsconf* *plugin* *referential-integrity* *disable'* usage: dsconf \[-v] \[-j] instance plugin referential-integrity disable \[-h] # COMMAND *'dsconf* *plugin* *referential-integrity* *status'* usage: dsconf \[-v] \[-j] instance plugin referential-integrity status \[-h] # COMMAND *'dsconf* *plugin* *referential-integrity* *set'* usage: dsconf \[-v] \[-j] instance plugin referential-integrity set \[-h] \[--update-delay UPDATE\_DELAY] \[--membership-attr MEMBERSHIP\_ATTR \[MEMBERSHIP\_ATTR ...]] \[--entry-scope ENTRY\_SCOPE] \[--exclude-entry-scope EXCLUDE\_ENTRY\_SCOPE] \[--container-scope CONTAINER\_SCOPE] \[--log-file LOG\_FILE] \[--config-entry CONFIG\_ENTRY] # OPTIONS *'dsconf* *plugin* *referential-integrity* *set'* [**--update-delay** *UPDATE\_DELAY*](#update) Sets the update interval. Special values: 0 - The check is performed immediately, -1 - No check is performed (referint-update-delay) [**--membership-attr** *MEMBERSHIP\_ATTR \[MEMBERSHIP\_ATTR ...\]*](#membership) Specifies attributes to check for and update (referint-membership-attr) [**--entry-scope** *ENTRY\_SCOPE*](#entry) Defines the subtree in which the plug-in looks for the delete or rename operations of a user entry (nsslapd-pluginEntryScope) [**--exclude-entry-scope** *EXCLUDE\_ENTRY\_SCOPE*](#exclude~12) Defines the subtree in which the plug-in ignores any operations for deleting or renaming a user (nsslapd-pluginExcludeEntryScope) [**--container-scope** *CONTAINER\_SCOPE*](#container) Specifies which branch the plug-in searches for the groups to which the user belongs. It only updates groups that are under the specified container branch, and leaves all other groups not updated (nsslapd-pluginContainerScope) [**--log-file** *LOG\_FILE*](#log) Specifies a path to the Referential integrity logfile.For example: /var/log/dirsrv/slapd-YOUR\_INSTANCE/referint [**--config-entry** *CONFIG\_ENTRY*](#config~2) The value to set as nsslapd-pluginConfigArea # COMMAND *'dsconf* *plugin* *referential-integrity* *config-entry'* usage: dsconf \[-v] \[-j] instance plugin referential-integrity config-entry \[-h] {add,set,show,delete} ... # POSITIONAL ARGUMENTS *'dsconf plugin referential-integrity config-entry'* [**dsconf plugin referential-integrity config-entry** *add*](#dsconf~263) Add the config entry [**dsconf plugin referential-integrity config-entry** *set*](#dsconf~264) Edit the config entry [**dsconf plugin referential-integrity config-entry** *show*](#dsconf~265) Display the config entry [**dsconf plugin referential-integrity config-entry** *delete*](#dsconf~266) Delete the config entry and remove the reference in the plugin entry # COMMAND *'dsconf* *plugin* *referential-integrity* *config-entry* *add'* usage: dsconf \[-v] \[-j] instance plugin referential-integrity config-entry add \[-h] \[--update-delay UPDATE\_DELAY] \[--membership-attr MEMBERSHIP\_ATTR \[MEMBERSHIP\_ATTR ...]] \[--entry-scope ENTRY\_SCOPE] \[--exclude-entry-scope EXCLUDE\_ENTRY\_SCOPE] \[--container-scope CONTAINER\_SCOPE] \[--log-file LOG\_FILE] DN [**DN**](#DN~9) The config entry full DN # OPTIONS *'dsconf* *plugin* *referential-integrity* *config-entry* *add'* [**--update-delay** *UPDATE\_DELAY*](#update~2) Sets the update interval. Special values: 0 - The check is performed immediately, -1 - No check is performed (referint-update-delay) [**--membership-attr** *MEMBERSHIP\_ATTR \[MEMBERSHIP\_ATTR ...\]*](#membership~2) Specifies attributes to check for and update (referint-membership-attr) [**--entry-scope** *ENTRY\_SCOPE*](#entry~2) Defines the subtree in which the plug-in looks for the delete or rename operations of a user entry (nsslapd-pluginEntryScope) [**--exclude-entry-scope** *EXCLUDE\_ENTRY\_SCOPE*](#exclude~13) Defines the subtree in which the plug-in ignores any operations for deleting or renaming a user (nsslapd-pluginExcludeEntryScope) [**--container-scope** *CONTAINER\_SCOPE*](#container~2) Specifies which branch the plug-in searches for the groups to which the user belongs. It only updates groups that are under the specified container branch, and leaves all other groups not updated (nsslapd-pluginContainerScope) [**--log-file** *LOG\_FILE*](#log~2) Specifies a path to the Referential integrity logfile.For example: /var/log/dirsrv/slapd-YOUR\_INSTANCE/referint # COMMAND *'dsconf* *plugin* *referential-integrity* *config-entry* *set'* usage: dsconf \[-v] \[-j] instance plugin referential-integrity config-entry set \[-h] \[--update-delay UPDATE\_DELAY] \[--membership-attr MEMBERSHIP\_ATTR \[MEMBERSHIP\_ATTR ...]] \[--entry-scope ENTRY\_SCOPE] \[--exclude-entry-scope EXCLUDE\_ENTRY\_SCOPE] \[--container-scope CONTAINER\_SCOPE] \[--log-file LOG\_FILE] DN [**DN**](#DN~10) The config entry full DN # OPTIONS *'dsconf* *plugin* *referential-integrity* *config-entry* *set'* [**--update-delay** *UPDATE\_DELAY*](#update~3) Sets the update interval. Special values: 0 - The check is performed immediately, -1 - No check is performed (referint-update-delay) [**--membership-attr** *MEMBERSHIP\_ATTR \[MEMBERSHIP\_ATTR ...\]*](#membership~3) Specifies attributes to check for and update (referint-membership-attr) [**--entry-scope** *ENTRY\_SCOPE*](#entry~3) Defines the subtree in which the plug-in looks for the delete or rename operations of a user entry (nsslapd-pluginEntryScope) [**--exclude-entry-scope** *EXCLUDE\_ENTRY\_SCOPE*](#exclude~14) Defines the subtree in which the plug-in ignores any operations for deleting or renaming a user (nsslapd-pluginExcludeEntryScope) [**--container-scope** *CONTAINER\_SCOPE*](#container~3) Specifies which branch the plug-in searches for the groups to which the user belongs. It only updates groups that are under the specified container branch, and leaves all other groups not updated (nsslapd-pluginContainerScope) [**--log-file** *LOG\_FILE*](#log~3) Specifies a path to the Referential integrity logfile.For example: /var/log/dirsrv/slapd-YOUR\_INSTANCE/referint # COMMAND *'dsconf* *plugin* *referential-integrity* *config-entry* *show'* usage: dsconf \[-v] \[-j] instance plugin referential-integrity config-entry show \[-h] DN [**DN**](#DN~11) The config entry full DN # COMMAND *'dsconf* *plugin* *referential-integrity* *config-entry* *delete'* usage: dsconf \[-v] \[-j] instance plugin referential-integrity config-entry delete \[-h] DN [**DN**](#DN~12) The config entry full DN # COMMAND *'dsconf* *plugin* *root-dn'* usage: dsconf \[-v] \[-j] instance plugin root-dn \[-h] {show,enable,disable,status,set} ... # POSITIONAL ARGUMENTS *'dsconf plugin root-dn'* [**dsconf plugin root-dn** *show*](#dsconf~267) Displays the plugin configuration [**dsconf plugin root-dn** *enable*](#dsconf~268) Enables the plugin [**dsconf plugin root-dn** *disable*](#dsconf~269) Disables the plugin [**dsconf plugin root-dn** *status*](#dsconf~270) Displays the plugin status [**dsconf plugin root-dn** *set*](#dsconf~271) Edit the plugin settings # COMMAND *'dsconf* *plugin* *root-dn* *show'* usage: dsconf \[-v] \[-j] instance plugin root-dn show \[-h] # COMMAND *'dsconf* *plugin* *root-dn* *enable'* usage: dsconf \[-v] \[-j] instance plugin root-dn enable \[-h] # COMMAND *'dsconf* *plugin* *root-dn* *disable'* usage: dsconf \[-v] \[-j] instance plugin root-dn disable \[-h] # COMMAND *'dsconf* *plugin* *root-dn* *status'* usage: dsconf \[-v] \[-j] instance plugin root-dn status \[-h] # COMMAND *'dsconf* *plugin* *root-dn* *set'* usage: dsconf \[-v] \[-j] instance plugin root-dn set \[-h] \[--allow-host ALLOW\_HOST \[ALLOW\_HOST ...]] \[--deny-host DENY\_HOST \[DENY\_HOST ...]] \[--allow-ip ALLOW\_IP \[ALLOW\_IP ...]] \[--deny-ip DENY\_IP \[DENY\_IP ...]] \[--open-time OPEN\_TIME] \[--close-time CLOSE\_TIME] \[--days-allowed DAYS\_ALLOWED] # OPTIONS *'dsconf* *plugin* *root-dn* *set'* [**--allow-host** *ALLOW\_HOST \[ALLOW\_HOST ...\]*](#allow) Sets what hosts, by fully-qualified domain name, the root user is allowed to use to access Directory Server. Any hosts not listed are implicitly denied (rootdn-allow-host) [**--deny-host** *DENY\_HOST \[DENY\_HOST ...\]*](#deny) Sets what hosts, by fully-qualified domain name, the root user is not allowed to use to access Directory Server. Any hosts not listed are implicitly allowed (rootdn-deny-host). If a host address is listed in both the rootdn-allow-host and rootdn-deny-host attributes, it is denied access. [**--allow-ip** *ALLOW\_IP \[ALLOW\_IP ...\]*](#allow~2) Sets what IP addresses, either IPv4 or IPv6, for machines the root user is allowed to use to access Directory Server. Any IP addresses not listed are implicitly denied (rootdn-allow-ip) [**--deny-ip** *DENY\_IP \[DENY\_IP ...\]*](#deny~2) Sets what IP addresses, either IPv4 or IPv6, for machines the root user is not allowed to use to access Directory Server. Any IP addresses not listed are implicitly allowed (rootdn-deny-ip). If an IP address is listed in both the rootdn-allow-ip and rootdn-deny-ip attributes, it is denied access. [**--open-time** *OPEN\_TIME*](#open) Sets part of a time period or range when the root user is allowed to access Directory Server. This sets when the time-based access begins (rootdn-open- time) [**--close-time** *CLOSE\_TIME*](#close) Sets part of a time period or range when the root user is allowed to access Directory Server. This sets when the time-based access ends (rootdn-close- time) [**--days-allowed** *DAYS\_ALLOWED*](#days) Sets a comma-separated list of what days the root user is allowed to use to access Directory Server. Any days listed are implicitly denied (rootdn-days- allowed) # COMMAND *'dsconf* *plugin* *usn'* usage: dsconf \[-v] \[-j] instance plugin usn \[-h] {show,enable,disable,status,global,cleanup} ... # POSITIONAL ARGUMENTS *'dsconf plugin usn'* [**dsconf plugin usn** *show*](#dsconf~272) Displays the plugin configuration [**dsconf plugin usn** *enable*](#dsconf~273) Enables the plugin [**dsconf plugin usn** *disable*](#dsconf~274) Disables the plugin [**dsconf plugin usn** *status*](#dsconf~275) Displays the plugin status [**dsconf plugin usn** *global*](#dsconf~276) Get or manage global USN mode (nsslapd-entryusn-global) [**dsconf plugin usn** *cleanup*](#dsconf~277) Runs the USN tombstone cleanup task # COMMAND *'dsconf* *plugin* *usn* *show'* usage: dsconf \[-v] \[-j] instance plugin usn show \[-h] # COMMAND *'dsconf* *plugin* *usn* *enable'* usage: dsconf \[-v] \[-j] instance plugin usn enable \[-h] # COMMAND *'dsconf* *plugin* *usn* *disable'* usage: dsconf \[-v] \[-j] instance plugin usn disable \[-h] # COMMAND *'dsconf* *plugin* *usn* *status'* usage: dsconf \[-v] \[-j] instance plugin usn status \[-h] # COMMAND *'dsconf* *plugin* *usn* *global'* usage: dsconf \[-v] \[-j] instance plugin usn global \[-h] {on,off} ... # POSITIONAL ARGUMENTS *'dsconf plugin usn global'* [**dsconf plugin usn global** *on*](#dsconf~278) Enables USN global mode [**dsconf plugin usn global** *off*](#dsconf~279) Disables USN global mode # COMMAND *'dsconf* *plugin* *usn* *global* *on'* usage: dsconf \[-v] \[-j] instance plugin usn global on \[-h] # COMMAND *'dsconf* *plugin* *usn* *global* *off'* usage: dsconf \[-v] \[-j] instance plugin usn global off \[-h] # COMMAND *'dsconf* *plugin* *usn* *cleanup'* usage: dsconf \[-v] \[-j] instance plugin usn cleanup \[-h] (-s SUFFIX | \-n BACKEND) \[-m MAX\_USN] \[--timeout TIMEOUT] # OPTIONS *'dsconf* *plugin* *usn* *cleanup'* [**-s** *SUFFIX*, **--suffix** *SUFFIX*](#s~4) Sets the suffix or subtree in Directory Server to run the cleanup operation against. If the suffix is not specified, then the back end must be specified (suffix). [**-n** *BACKEND*, **--backend** *BACKEND*](#n) Sets the Directory Server instance back end, or database, to run the cleanup operation against. If the back end is not specified, then the suffix must be specified. Backend instance in which USN tombstone entries (backend) [**-m** *MAX\_USN*, **--max-usn** *MAX\_USN*](#m~2) Sets the highest USN value to delete when removing tombstone entries (max\_usn\_to\_delete) [**--timeout** *TIMEOUT*](#timeout~9) Sets the cleanup task timeout. Default is 120 seconds, # COMMAND *'dsconf* *plugin* *account-policy'* usage: dsconf \[-v] \[-j] instance plugin account-policy \[-h] {show,enable,disable,status,set,config-entry} ... # POSITIONAL ARGUMENTS *'dsconf plugin account-policy'* [**dsconf plugin account-policy** *show*](#dsconf~280) Displays the plugin configuration [**dsconf plugin account-policy** *enable*](#dsconf~281) Enables the plugin [**dsconf plugin account-policy** *disable*](#dsconf~282) Disables the plugin [**dsconf plugin account-policy** *status*](#dsconf~283) Displays the plugin status [**dsconf plugin account-policy** *set*](#dsconf~284) Edit the plugin settings [**dsconf plugin account-policy** *config-entry*](#dsconf~285) Manage the config entry # COMMAND *'dsconf* *plugin* *account-policy* *show'* usage: dsconf \[-v] \[-j] instance plugin account-policy show \[-h] # COMMAND *'dsconf* *plugin* *account-policy* *enable'* usage: dsconf \[-v] \[-j] instance plugin account-policy enable \[-h] # COMMAND *'dsconf* *plugin* *account-policy* *disable'* usage: dsconf \[-v] \[-j] instance plugin account-policy disable \[-h] # COMMAND *'dsconf* *plugin* *account-policy* *status'* usage: dsconf \[-v] \[-j] instance plugin account-policy status \[-h] # COMMAND *'dsconf* *plugin* *account-policy* *set'* usage: dsconf \[-v] \[-j] instance plugin account-policy set \[-h] \[--config-entry CONFIG\_ENTRY] # OPTIONS *'dsconf* *plugin* *account-policy* *set'* [**--config-entry** *CONFIG\_ENTRY*](#config~3) Sets the nsslapd-pluginarg0 attribute # COMMAND *'dsconf* *plugin* *account-policy* *config-entry'* usage: dsconf \[-v] \[-j] instance plugin account-policy config-entry \[-h] {add,set,show,delete} ... # POSITIONAL ARGUMENTS *'dsconf plugin account-policy config-entry'* [**dsconf plugin account-policy config-entry** *add*](#dsconf~286) Add the config entry [**dsconf plugin account-policy config-entry** *set*](#dsconf~287) Edit the config entry [**dsconf plugin account-policy config-entry** *show*](#dsconf~288) Display the config entry [**dsconf plugin account-policy config-entry** *delete*](#dsconf~289) Delete the config entry and remove the reference in the plugin entry # COMMAND *'dsconf* *plugin* *account-policy* *config-entry* *add'* usage: dsconf \[-v] \[-j] instance plugin account-policy config-entry add \[-h] \[--always-record-login {yes,no}] \[--alt-state-attr ALT\_STATE\_ATTR] \[--always-record-login-attr ALWAYS\_RECORD\_LOGIN\_ATTR] \[--limit-attr LIMIT\_ATTR] \[--spec-attr SPEC\_ATTR] \[--state-attr STATE\_ATTR] \[--login-history-size LOGIN\_HISTORY\_SIZE] \[--check-all-state-attrs {yes,no}] DN [**DN**](#DN~13) The full DN of the config entry # OPTIONS *'dsconf* *plugin* *account-policy* *config-entry* *add'* [**--always-record-login** *{yes,no}*](#always) Sets that every entry records its last login time (alwaysRecordLogin) [**--alt-state-attr** *ALT\_STATE\_ATTR*](#alt) Provides a backup attribute for the server to reference to evaluate the expiration time (altStateAttrName) [**--always-record-login-attr** *ALWAYS\_RECORD\_LOGIN\_ATTR*](#always~2) Specifies the attribute to store the time of the last successful login in this attribute in the users directory entry (alwaysRecordLoginAttr) [**--limit-attr** *LIMIT\_ATTR*](#limit) Specifies the attribute within the policy to use for the account inactivation limit (limitAttrName) [**--spec-attr** *SPEC\_ATTR*](#spec) Specifies the attribute to identify which entries are account policy configuration entries (specAttrName) [**--state-attr** *STATE\_ATTR*](#state~2) Specifies the primary time attribute used to evaluate an account policy (stateAttrName) [**--login-history-size** *LOGIN\_HISTORY\_SIZE*](#login) Specifies the number of login timestamps to store (lastLoginHistorySize) [**--check-all-state-attrs** *{yes,no}*](#check~4) Check both state and alternate state attributes for account state # COMMAND *'dsconf* *plugin* *account-policy* *config-entry* *set'* usage: dsconf \[-v] \[-j] instance plugin account-policy config-entry set \[-h] \[--always-record-login {yes,no}] \[--alt-state-attr ALT\_STATE\_ATTR] \[--always-record-login-attr ALWAYS\_RECORD\_LOGIN\_ATTR] \[--limit-attr LIMIT\_ATTR] \[--spec-attr SPEC\_ATTR] \[--state-attr STATE\_ATTR] \[--login-history-size LOGIN\_HISTORY\_SIZE] \[--check-all-state-attrs {yes,no}] DN [**DN**](#DN~14) The full DN of the config entry # OPTIONS *'dsconf* *plugin* *account-policy* *config-entry* *set'* [**--always-record-login** *{yes,no}*](#always~3) Sets that every entry records its last login time (alwaysRecordLogin) [**--alt-state-attr** *ALT\_STATE\_ATTR*](#alt~2) Provides a backup attribute for the server to reference to evaluate the expiration time (altStateAttrName) [**--always-record-login-attr** *ALWAYS\_RECORD\_LOGIN\_ATTR*](#always~4) Specifies the attribute to store the time of the last successful login in this attribute in the users directory entry (alwaysRecordLoginAttr) [**--limit-attr** *LIMIT\_ATTR*](#limit~2) Specifies the attribute within the policy to use for the account inactivation limit (limitAttrName) [**--spec-attr** *SPEC\_ATTR*](#spec~2) Specifies the attribute to identify which entries are account policy configuration entries (specAttrName) [**--state-attr** *STATE\_ATTR*](#state~3) Specifies the primary time attribute used to evaluate an account policy (stateAttrName) [**--login-history-size** *LOGIN\_HISTORY\_SIZE*](#login~2) Specifies the number of login timestamps to store (lastLoginHistorySize) [**--check-all-state-attrs** *{yes,no}*](#check~5) Check both state and alternate state attributes for account state # COMMAND *'dsconf* *plugin* *account-policy* *config-entry* *show'* usage: dsconf \[-v] \[-j] instance plugin account-policy config-entry show \[-h] DN [**DN**](#DN~15) The full DN of the config entry # COMMAND *'dsconf* *plugin* *account-policy* *config-entry* *delete'* usage: dsconf \[-v] \[-j] instance plugin account-policy config-entry delete \[-h] DN [**DN**](#DN~16) The full DN of the config entry # COMMAND *'dsconf* *plugin* *attr-uniq'* usage: dsconf \[-v] \[-j] instance plugin attr-uniq \[-h] {list,add,set,show,delete,enable,disable,status} ... # POSITIONAL ARGUMENTS *'dsconf plugin attr-uniq'* [**dsconf plugin attr-uniq** *list*](#dsconf~290) Lists available plugin configs [**dsconf plugin attr-uniq** *add*](#dsconf~291) Add the config entry [**dsconf plugin attr-uniq** *set*](#dsconf~292) Edit the config entry [**dsconf plugin attr-uniq** *show*](#dsconf~293) Display the config entry [**dsconf plugin attr-uniq** *delete*](#dsconf~294) Delete the config entry [**dsconf plugin attr-uniq** *enable*](#dsconf~295) enable plugin [**dsconf plugin attr-uniq** *disable*](#dsconf~296) disable plugin [**dsconf plugin attr-uniq** *status*](#dsconf~297) display plugin status # COMMAND *'dsconf* *plugin* *attr-uniq* *list'* usage: dsconf \[-v] \[-j] instance plugin attr-uniq list \[-h] # COMMAND *'dsconf* *plugin* *attr-uniq* *add'* usage: dsconf \[-v] \[-j] instance plugin attr-uniq add \[-h] \[--enabled {on,off}] \[--attr-name ATTR\_NAME \[ATTR\_NAME ...]] \[--subtree SUBTREE \[SUBTREE ...]] \[--exclude-subtree EXCLUDE\_SUBTREE \[EXCLUDE\_SUBTREE ...]] \[--across-all-subtrees {on,off}] \[--top-entry-oc TOP\_ENTRY\_OC] \[--subtree-entries-oc SUBTREE\_ENTRIES\_OC] NAME **NAME** The name of the plug-in configuration record. (cn) You can use any string, but "attribute\_name Attribute Uniqueness" is recommended. # OPTIONS *'dsconf* *plugin* *attr-uniq* *add'* [**--enabled** *{on,off}*](#enabled) Identifies whether or not the config is enabled. [**--attr-name** *ATTR\_NAME \[ATTR\_NAME ...\]*](#attr~12) Sets the name of the attribute whose values must be unique. This attribute is multi-valued. (uniqueness-attribute-name) [**--subtree** *SUBTREE \[SUBTREE ...\]*](#subtree) Sets the DN under which the plug-in checks for uniqueness of the attributes value. This attribute is multi-valued (uniqueness-subtrees) [**--exclude-subtree** *EXCLUDE\_SUBTREE \[EXCLUDE\_SUBTREE ...\]*](#exclude~15) Sets subtrees that should be excluded from attribute uniqueness checks. This attribute is multi-valued (uniqueness-exclude-subtrees) [**--across-all-subtrees** *{on,off}*](#across) If enabled (on), the plug-in checks that the attribute is unique across all subtrees set. If you set the attribute to off, uniqueness is only enforced within the subtree of the updated entry (uniqueness-across-all-subtrees) [**--top-entry-oc** *TOP\_ENTRY\_OC*](#top) Verifies that the value of the attribute set in uniqueness-attribute-name is unique in this subtree (uniqueness-top-entry-oc) [**--subtree-entries-oc** *SUBTREE\_ENTRIES\_OC*](#subtree~2) Verifies if an attribute is unique, if the entry contains the object class set in this parameter (uniqueness-subtree-entries-oc) # COMMAND *'dsconf* *plugin* *attr-uniq* *set'* usage: dsconf \[-v] \[-j] instance plugin attr-uniq set \[-h] \[--enabled {on,off}] \[--attr-name ATTR\_NAME \[ATTR\_NAME ...]] \[--subtree SUBTREE \[SUBTREE ...]] \[--exclude-subtree EXCLUDE\_SUBTREE \[EXCLUDE\_SUBTREE ...]] \[--across-all-subtrees {on,off}] \[--top-entry-oc TOP\_ENTRY\_OC] \[--subtree-entries-oc SUBTREE\_ENTRIES\_OC] NAME **NAME** The name of the plug-in configuration record. (cn) You can use any string, but "attribute\_name Attribute Uniqueness" is recommended. # OPTIONS *'dsconf* *plugin* *attr-uniq* *set'* [**--enabled** *{on,off}*](#enabled~2) Identifies whether or not the config is enabled. [**--attr-name** *ATTR\_NAME \[ATTR\_NAME ...\]*](#attr~13) Sets the name of the attribute whose values must be unique. This attribute is multi-valued. (uniqueness-attribute-name) [**--subtree** *SUBTREE \[SUBTREE ...\]*](#subtree~3) Sets the DN under which the plug-in checks for uniqueness of the attributes value. This attribute is multi-valued (uniqueness-subtrees) [**--exclude-subtree** *EXCLUDE\_SUBTREE \[EXCLUDE\_SUBTREE ...\]*](#exclude~16) Sets subtrees that should be excluded from attribute uniqueness checks. This attribute is multi-valued (uniqueness-exclude-subtrees) [**--across-all-subtrees** *{on,off}*](#across~2) If enabled (on), the plug-in checks that the attribute is unique across all subtrees set. If you set the attribute to off, uniqueness is only enforced within the subtree of the updated entry (uniqueness-across-all-subtrees) [**--top-entry-oc** *TOP\_ENTRY\_OC*](#top~2) Verifies that the value of the attribute set in uniqueness-attribute-name is unique in this subtree (uniqueness-top-entry-oc) [**--subtree-entries-oc** *SUBTREE\_ENTRIES\_OC*](#subtree~4) Verifies if an attribute is unique, if the entry contains the object class set in this parameter (uniqueness-subtree-entries-oc) # COMMAND *'dsconf* *plugin* *attr-uniq* *show'* usage: dsconf \[-v] \[-j] instance plugin attr-uniq show \[-h] NAME **NAME** The name of the plug-in configuration record # COMMAND *'dsconf* *plugin* *attr-uniq* *delete'* usage: dsconf \[-v] \[-j] instance plugin attr-uniq delete \[-h] NAME **NAME** The name of the plug-in configuration record # COMMAND *'dsconf* *plugin* *attr-uniq* *enable'* usage: dsconf \[-v] \[-j] instance plugin attr-uniq enable \[-h] NAME **NAME** The name of the plug-in configuration record # COMMAND *'dsconf* *plugin* *attr-uniq* *disable'* usage: dsconf \[-v] \[-j] instance plugin attr-uniq disable \[-h] NAME **NAME** The name of the plug-in configuration record # COMMAND *'dsconf* *plugin* *attr-uniq* *status'* usage: dsconf \[-v] \[-j] instance plugin attr-uniq status \[-h] NAME **NAME** The name of the plug-in configuration record # COMMAND *'dsconf* *plugin* *dna'* usage: dsconf \[-v] \[-j] instance plugin dna \[-h] {show,enable,disable,status,list,config} ... # POSITIONAL ARGUMENTS *'dsconf plugin dna'* [**dsconf plugin dna** *show*](#dsconf~298) Displays the plugin configuration [**dsconf plugin dna** *enable*](#dsconf~299) Enables the plugin [**dsconf plugin dna** *disable*](#dsconf~300) Disables the plugin [**dsconf plugin dna** *status*](#dsconf~301) Displays the plugin status [**dsconf plugin dna** *list*](#dsconf~302) List available plugin configs [**dsconf plugin dna** *config*](#dsconf~303) Manage plugin configs # COMMAND *'dsconf* *plugin* *dna* *show'* usage: dsconf \[-v] \[-j] instance plugin dna show \[-h] # COMMAND *'dsconf* *plugin* *dna* *enable'* usage: dsconf \[-v] \[-j] instance plugin dna enable \[-h] # COMMAND *'dsconf* *plugin* *dna* *disable'* usage: dsconf \[-v] \[-j] instance plugin dna disable \[-h] # COMMAND *'dsconf* *plugin* *dna* *status'* usage: dsconf \[-v] \[-j] instance plugin dna status \[-h] # COMMAND *'dsconf* *plugin* *dna* *list'* usage: dsconf \[-v] \[-j] instance plugin dna list \[-h] {configs,shared-configs} ... # POSITIONAL ARGUMENTS *'dsconf plugin dna list'* [**dsconf plugin dna list** *configs*](#dsconf~304) List main DNA plugin config entries [**dsconf plugin dna list** *shared-configs*](#dsconf~305) List DNA plugin shared config entries # COMMAND *'dsconf* *plugin* *dna* *list* *configs'* usage: dsconf \[-v] \[-j] instance plugin dna list configs \[-h] # COMMAND *'dsconf* *plugin* *dna* *list* *shared-configs'* usage: dsconf \[-v] \[-j] instance plugin dna list shared-configs \[-h] BASEDN [**BASEDN**](#BASEDN) The search DN # COMMAND *'dsconf* *plugin* *dna* *config'* usage: dsconf \[-v] \[-j] instance plugin dna config \[-h] NAME {add,set,show,delete,shared-config-entry} ... # POSITIONAL ARGUMENTS *'dsconf plugin dna config'* [**dsconf plugin dna config** *add*](#dsconf~306) Add the config entry [**dsconf plugin dna config** *set*](#dsconf~307) Edit the config entry [**dsconf plugin dna config** *show*](#dsconf~308) Display the config entry [**dsconf plugin dna config** *delete*](#dsconf~309) Delete the config entry [**dsconf plugin dna config** *shared-config-entry*](#dsconf~310) Manage the shared config entry # COMMAND *'dsconf* *plugin* *dna* *config* *add'* usage: dsconf \[-v] \[-j] instance plugin dna config NAME add \[-h] \[--type TYPE \[TYPE ...]] \[--prefix PREFIX] \[--next-value NEXT\_VALUE] \[--max-value MAX\_VALUE] \[--interval INTERVAL] \[--magic-regen MAGIC\_REGEN] \[--filter FILTER] \[--scope SCOPE] \[--remote-bind-dn REMOTE\_BIND\_DN] \[--remote-bind-cred REMOTE\_BIND\_CRED] \[--shared-config-entry SHARED\_CONFIG\_ENTRY] \[--threshold THRESHOLD] \[--next-range NEXT\_RANGE] \[--range-request-timeout RANGE\_REQUEST\_TIMEOUT] # OPTIONS *'dsconf* *plugin* *dna* *config* *add'* [**--type** *TYPE \[TYPE ...\]*](#type) Sets which attributes have unique numbers being generated for them (dnaType) [**--prefix** *PREFIX*](#prefix) Defines a prefix that can be prepended to the generated number values for the attribute (dnaPrefix) [**--next-value** *NEXT\_VALUE*](#next) Sets the next available number which can be assigned (dnaNextValue) [**--max-value** *MAX\_VALUE*](#max) Sets the maximum value that can be assigned for the range (dnaMaxValue) [**--interval** *INTERVAL*](#interval) Sets an interval to use to increment through numbers in a range (dnaInterval) [**--magic-regen** *MAGIC\_REGEN*](#magic) Sets a user-defined value that instructs the plug-in to assign a new value for the entry (dnaMagicRegen) [**--filter** *FILTER*](#filter~3) Sets an LDAP filter to use to search for and identify the entries to which to apply the distributed numeric assignment range (dnaFilter) [**--scope** *SCOPE*](#scope~6) Sets the base DN to search for entries to which to apply the distributed numeric assignment (dnaScope) [**--remote-bind-dn** *REMOTE\_BIND\_DN*](#remote) Specifies the Replication Manager DN (dnaRemoteBindDN) [**--remote-bind-cred** *REMOTE\_BIND\_CRED*](#remote~2) Specifies the Replication Manager's password (dnaRemoteBindCred) [**--shared-config-entry** *SHARED\_CONFIG\_ENTRY*](#shared) Defines a shared identity that the servers can use to transfer ranges to one another (dnaSharedCfgDN) [**--threshold** *THRESHOLD*](#threshold) Sets a threshold of remaining available numbers in the range. When the server hits the threshold, it sends a request for a new range (dnaThreshold) [**--next-range** *NEXT\_RANGE*](#next~2) Defines the next range to use when the current range is exhausted (dnaNextRange) [**--range-request-timeout** *RANGE\_REQUEST\_TIMEOUT*](#range) Sets a timeout period, in seconds, for range requests so that the server does not stall waiting on a new range from one server and can request a range from a new server (dnaRangeRequestTimeout) # COMMAND *'dsconf* *plugin* *dna* *config* *set'* usage: dsconf \[-v] \[-j] instance plugin dna config NAME set \[-h] \[--type TYPE \[TYPE ...]] \[--prefix PREFIX] \[--next-value NEXT\_VALUE] \[--max-value MAX\_VALUE] \[--interval INTERVAL] \[--magic-regen MAGIC\_REGEN] \[--filter FILTER] \[--scope SCOPE] \[--remote-bind-dn REMOTE\_BIND\_DN] \[--remote-bind-cred REMOTE\_BIND\_CRED] \[--shared-config-entry SHARED\_CONFIG\_ENTRY] \[--threshold THRESHOLD] \[--next-range NEXT\_RANGE] \[--range-request-timeout RANGE\_REQUEST\_TIMEOUT] # OPTIONS *'dsconf* *plugin* *dna* *config* *set'* [**--type** *TYPE \[TYPE ...\]*](#type~2) Sets which attributes have unique numbers being generated for them (dnaType) [**--prefix** *PREFIX*](#prefix~2) Defines a prefix that can be prepended to the generated number values for the attribute (dnaPrefix) [**--next-value** *NEXT\_VALUE*](#next~3) Sets the next available number which can be assigned (dnaNextValue) [**--max-value** *MAX\_VALUE*](#max~2) Sets the maximum value that can be assigned for the range (dnaMaxValue) [**--interval** *INTERVAL*](#interval~2) Sets an interval to use to increment through numbers in a range (dnaInterval) [**--magic-regen** *MAGIC\_REGEN*](#magic~2) Sets a user-defined value that instructs the plug-in to assign a new value for the entry (dnaMagicRegen) [**--filter** *FILTER*](#filter~4) Sets an LDAP filter to use to search for and identify the entries to which to apply the distributed numeric assignment range (dnaFilter) [**--scope** *SCOPE*](#scope~7) Sets the base DN to search for entries to which to apply the distributed numeric assignment (dnaScope) [**--remote-bind-dn** *REMOTE\_BIND\_DN*](#remote~3) Specifies the Replication Manager DN (dnaRemoteBindDN) [**--remote-bind-cred** *REMOTE\_BIND\_CRED*](#remote~4) Specifies the Replication Manager's password (dnaRemoteBindCred) [**--shared-config-entry** *SHARED\_CONFIG\_ENTRY*](#shared~2) Defines a shared identity that the servers can use to transfer ranges to one another (dnaSharedCfgDN) [**--threshold** *THRESHOLD*](#threshold~2) Sets a threshold of remaining available numbers in the range. When the server hits the threshold, it sends a request for a new range (dnaThreshold) [**--next-range** *NEXT\_RANGE*](#next~4) Defines the next range to use when the current range is exhausted (dnaNextRange) [**--range-request-timeout** *RANGE\_REQUEST\_TIMEOUT*](#range~2) Sets a timeout period, in seconds, for range requests so that the server does not stall waiting on a new range from one server and can request a range from a new server (dnaRangeRequestTimeout) # COMMAND *'dsconf* *plugin* *dna* *config* *show'* usage: dsconf \[-v] \[-j] instance plugin dna config NAME show \[-h] # COMMAND *'dsconf* *plugin* *dna* *config* *delete'* usage: dsconf \[-v] \[-j] instance plugin dna config NAME delete \[-h] # COMMAND *'dsconf* *plugin* *dna* *config* *shared-config-entry'* usage: dsconf \[-v] \[-j] instance plugin dna config NAME shared-config-entry \[-h] SHARED\_CFG {set,show,delete} ... # POSITIONAL ARGUMENTS *'dsconf plugin dna config shared-config-entry'* [**dsconf plugin dna config shared-config-entry** *set*](#dsconf~311) Edit the shared config entry [**dsconf plugin dna config shared-config-entry** *show*](#dsconf~312) Display the shared config entry [**dsconf plugin dna config shared-config-entry** *delete*](#dsconf~313) Delete the shared config entry # COMMAND *'dsconf* *plugin* *dna* *config* *shared-config-entry* *set'* usage: dsconf \[-v] \[-j] instance plugin dna config NAME shared-config-entry SHARED\_CFG set \[-h] \[--remote-bind-method REMOTE\_BIND\_METHOD] \[--remote-conn-protocol REMOTE\_CONN\_PROTOCOL] # OPTIONS *'dsconf* *plugin* *dna* *config* *shared-config-entry* *set'* [**--remote-bind-method** *REMOTE\_BIND\_METHOD*](#remote~5) Specifies the remote bind method "SIMPLE", "SSL" (for SSL client auth), "SASL/GSSAPI", or "SASL/DIGEST-MD5" (dnaRemoteBindMethod) [**--remote-conn-protocol** *REMOTE\_CONN\_PROTOCOL*](#remote~6) Specifies the remote connection protocol "LDAP", or "TLS" (dnaRemoteConnProtocol) # COMMAND *'dsconf* *plugin* *dna* *config* *shared-config-entry* *show'* usage: dsconf \[-v] \[-j] instance plugin dna config NAME shared-config-entry SHARED\_CFG show \[-h] # COMMAND *'dsconf* *plugin* *dna* *config* *shared-config-entry* *delete'* usage: dsconf \[-v] \[-j] instance plugin dna config NAME shared-config-entry SHARED\_CFG delete \[-h] # COMMAND *'dsconf* *plugin* *ldap-pass-through-auth'* usage: dsconf instance \[-v] \[-j] plugin ldap-pass-through-auth \[-h] {show,enable,disable,status,list,add,modify,delete} ... # POSITIONAL ARGUMENTS *'dsconf plugin ldap-pass-through-auth'* [**dsconf plugin ldap-pass-through-auth** *show*](#dsconf~314) Displays the plugin configuration [**dsconf plugin ldap-pass-through-auth** *enable*](#dsconf~315) Enables the plugin [**dsconf plugin ldap-pass-through-auth** *disable*](#dsconf~316) Disables the plugin [**dsconf plugin ldap-pass-through-auth** *status*](#dsconf~317) Displays the plugin status [**dsconf plugin ldap-pass-through-auth** *list*](#dsconf~318) Lists LDAP URLs [**dsconf plugin ldap-pass-through-auth** *add*](#dsconf~319) Add an LDAP url to the config entry [**dsconf plugin ldap-pass-through-auth** *modify*](#dsconf~320) Edit the LDAP pass through config entry [**dsconf plugin ldap-pass-through-auth** *delete*](#dsconf~321) Delete a URL from the config entry # COMMAND *'dsconf* *plugin* *ldap-pass-through-auth* *show'* usage: dsconf \[-v] \[-j] instance plugin ldap-pass-through-auth show \[-h] # COMMAND *'dsconf* *plugin* *ldap-pass-through-auth* *enable'* usage: dsconf \[-v] \[-j] instance plugin ldap-pass-through-auth enable \[-h] # COMMAND *'dsconf* *plugin* *ldap-pass-through-auth* *disable'* usage: dsconf \[-v] \[-j] instance plugin ldap-pass-through-auth disable \[-h] # COMMAND *'dsconf* *plugin* *ldap-pass-through-auth* *status'* usage: dsconf \[-v] \[-j] instance plugin ldap-pass-through-auth status \[-h] # COMMAND *'dsconf* *plugin* *ldap-pass-through-auth* *list'* usage: dsconf \[-v] \[-j] instance plugin ldap-pass-through-auth list \[-h] # COMMAND *'dsconf* *plugin* *ldap-pass-through-auth* *add'* usage: dsconf \[-v] \[-j] instance plugin ldap-pass-through-auth add \[-h] URL [**URL**](#URL) The full LDAP URL in format "ldap|ldaps://authDS/subtree maxconns,maxops,timeout,ldver,connlifetime,startTLS". If one optional parameter is specified the rest should be specified too # COMMAND *'dsconf* *plugin* *ldap-pass-through-auth* *modify'* usage: dsconf \[-v] \[-j] instance plugin ldap-pass-through-auth modify \[-h] OLD\_URL NEW\_URL [**OLD\_URL**](#OLD_URL) The full LDAP URL you get from the "list" command [**NEW\_URL**](#NEW_URL) Sets the full LDAP URL in format "ldap|ldaps://authDS/subtree maxconns,maxops,timeout,ldver,connlifetime,startTLS". If one optional parameter is specified the rest should be specified too. # COMMAND *'dsconf* *plugin* *ldap-pass-through-auth* *delete'* usage: dsconf \[-v] \[-j] instance plugin ldap-pass-through-auth delete \[-h] URL [**URL**](#URL~2) The full LDAP URL you get from the "list" command # COMMAND *'dsconf* *plugin* *linked-attr'* usage: dsconf \[-v] \[-j] instance plugin linked-attr \[-h] {show,enable,disable,status,fixup,fixup-status,list,config} ... # POSITIONAL ARGUMENTS *'dsconf plugin linked-attr'* [**dsconf plugin linked-attr** *show*](#dsconf~322) Displays the plugin configuration [**dsconf plugin linked-attr** *enable*](#dsconf~323) Enables the plugin [**dsconf plugin linked-attr** *disable*](#dsconf~324) Disables the plugin [**dsconf plugin linked-attr** *status*](#dsconf~325) Displays the plugin status [**dsconf plugin linked-attr** *fixup*](#dsconf~326) Run the fix-up task for linked attributes plugin [**dsconf plugin linked-attr** *fixup-status*](#dsconf~327) Check the status of a fix-up task [**dsconf plugin linked-attr** *list*](#dsconf~328) List available plugin configs [**dsconf plugin linked-attr** *config*](#dsconf~329) Manage plugin configs # COMMAND *'dsconf* *plugin* *linked-attr* *show'* usage: dsconf \[-v] \[-j] instance plugin linked-attr show \[-h] # COMMAND *'dsconf* *plugin* *linked-attr* *enable'* usage: dsconf \[-v] \[-j] instance plugin linked-attr enable \[-h] # COMMAND *'dsconf* *plugin* *linked-attr* *disable'* usage: dsconf \[-v] \[-j] instance plugin linked-attr disable \[-h] # COMMAND *'dsconf* *plugin* *linked-attr* *status'* usage: dsconf \[-v] \[-j] instance plugin linked-attr status \[-h] # COMMAND *'dsconf* *plugin* *linked-attr* *fixup'* usage: dsconf \[-v] \[-j] instance plugin linked-attr fixup \[-h] \[-l LINKDN] \[--wait] # OPTIONS *'dsconf* *plugin* *linked-attr* *fixup'* [**-l** *LINKDN*, **--linkdn** *LINKDN*](#l~2) Sets the base DN that contains entries to fix up [**--wait**](#wait~4) Wait for the task to finish, this could take a long time # COMMAND *'dsconf* *plugin* *linked-attr* *fixup-status'* usage: dsconf \[-v] \[-j] instance plugin linked-attr fixup-status \[-h] \[--dn DN] \[--show-log] \[--watch] # OPTIONS *'dsconf* *plugin* *linked-attr* *fixup-status'* [**--dn** *DN*](#dn~4) The task entry's DN [**--show-log**](#show~3) Display the task log [**--watch**](#watch~6) Watch the task's status and wait for it to finish # COMMAND *'dsconf* *plugin* *linked-attr* *list'* usage: dsconf \[-v] \[-j] instance plugin linked-attr list \[-h] # COMMAND *'dsconf* *plugin* *linked-attr* *config'* usage: dsconf \[-v] \[-j] instance plugin linked-attr config \[-h] NAME {add,set,show,delete} ... # POSITIONAL ARGUMENTS *'dsconf plugin linked-attr config'* [**dsconf plugin linked-attr config** *add*](#dsconf~330) Add the config entry [**dsconf plugin linked-attr config** *set*](#dsconf~331) Edit the config entry [**dsconf plugin linked-attr config** *show*](#dsconf~332) Display the config entry [**dsconf plugin linked-attr config** *delete*](#dsconf~333) Delete the config entry # COMMAND *'dsconf* *plugin* *linked-attr* *config* *add'* usage: dsconf \[-v] \[-j] instance plugin linked-attr config NAME add \[-h] \[--link-type LINK\_TYPE] \[--managed-type MANAGED\_TYPE] \[--link-scope LINK\_SCOPE] # OPTIONS *'dsconf* *plugin* *linked-attr* *config* *add'* [**--link-type** *LINK\_TYPE*](#link) Sets the attribute that is managed manually by administrators (linkType) [**--managed-type** *MANAGED\_TYPE*](#managed) Sets the attribute that is created dynamically by the plugin (managedType) [**--link-scope** *LINK\_SCOPE*](#link~2) Sets the scope that restricts the plugin to a specific part of the directory tree (linkScope) # COMMAND *'dsconf* *plugin* *linked-attr* *config* *set'* usage: dsconf \[-v] \[-j] instance plugin linked-attr config NAME set \[-h] \[--link-type LINK\_TYPE] \[--managed-type MANAGED\_TYPE] \[--link-scope LINK\_SCOPE] # OPTIONS *'dsconf* *plugin* *linked-attr* *config* *set'* [**--link-type** *LINK\_TYPE*](#link~3) Sets the attribute that is managed manually by administrators (linkType) [**--managed-type** *MANAGED\_TYPE*](#managed~2) Sets the attribute that is created dynamically by the plugin (managedType) [**--link-scope** *LINK\_SCOPE*](#link~4) Sets the scope that restricts the plugin to a specific part of the directory tree (linkScope) # COMMAND *'dsconf* *plugin* *linked-attr* *config* *show'* usage: dsconf \[-v] \[-j] instance plugin linked-attr config NAME show \[-h] # COMMAND *'dsconf* *plugin* *linked-attr* *config* *delete'* usage: dsconf \[-v] \[-j] instance plugin linked-attr config NAME delete \[-h] # COMMAND *'dsconf* *plugin* *managed-entries'* usage: dsconf \[-v] \[-j] instance plugin managed-entries \[-h] {show,enable,disable,status,set,list,config,template} ... # POSITIONAL ARGUMENTS *'dsconf plugin managed-entries'* [**dsconf plugin managed-entries** *show*](#dsconf~334) Displays the plugin configuration [**dsconf plugin managed-entries** *enable*](#dsconf~335) Enables the plugin [**dsconf plugin managed-entries** *disable*](#dsconf~336) Disables the plugin [**dsconf plugin managed-entries** *status*](#dsconf~337) Displays the plugin status [**dsconf plugin managed-entries** *set*](#dsconf~338) Edit the plugin settings [**dsconf plugin managed-entries** *list*](#dsconf~339) List Managed Entries Plugin configs and templates [**dsconf plugin managed-entries** *config*](#dsconf~340) Handle Managed Entries Plugin configs [**dsconf plugin managed-entries** *template*](#dsconf~341) Handle Managed Entries Plugin templates # COMMAND *'dsconf* *plugin* *managed-entries* *show'* usage: dsconf \[-v] \[-j] instance plugin managed-entries show \[-h] # COMMAND *'dsconf* *plugin* *managed-entries* *enable'* usage: dsconf \[-v] \[-j] instance plugin managed-entries enable \[-h] # COMMAND *'dsconf* *plugin* *managed-entries* *disable'* usage: dsconf \[-v] \[-j] instance plugin managed-entries disable \[-h] # COMMAND *'dsconf* *plugin* *managed-entries* *status'* usage: dsconf \[-v] \[-j] instance plugin managed-entries status \[-h] # COMMAND *'dsconf* *plugin* *managed-entries* *set'* usage: dsconf \[-v] \[-j] instance plugin managed-entries set \[-h] \[--config-area CONFIG\_AREA] # OPTIONS *'dsconf* *plugin* *managed-entries* *set'* [**--config-area** *CONFIG\_AREA*](#config~4) Sets the value of the nsslapd-pluginConfigArea attribute # COMMAND *'dsconf* *plugin* *managed-entries* *list'* usage: dsconf \[-v] \[-j] instance plugin managed-entries list \[-h] {configs,templates} ... # POSITIONAL ARGUMENTS *'dsconf plugin managed-entries list'* [**dsconf plugin managed-entries list** *configs*](#dsconf~342) List Managed Entries Plugin configs (list config-area if specified in the main plugin entry) [**dsconf plugin managed-entries list** *templates*](#dsconf~343) List Managed Entries Plugin templates in the directory # COMMAND *'dsconf* *plugin* *managed-entries* *list* *configs'* usage: dsconf instance \[-v] \[-j] plugin managed-entries list configs \[-h] # COMMAND *'dsconf* *plugin* *managed-entries* *list* *templates'* usage: dsconf instance \[-v] \[-j] plugin managed-entries list templates \[-h] \[BASEDN] [**BASEDN**](#BASEDN~2) The base DN where to search the templates # COMMAND *'dsconf* *plugin* *managed-entries* *config'* usage: dsconf \[-v] \[-j] instance plugin managed-entries config \[-h] NAME {add,set,show,delete} ... # POSITIONAL ARGUMENTS *'dsconf plugin managed-entries config'* [**dsconf plugin managed-entries config** *add*](#dsconf~344) Add the config entry [**dsconf plugin managed-entries config** *set*](#dsconf~345) Edit the config entry [**dsconf plugin managed-entries config** *show*](#dsconf~346) Display the config entry [**dsconf plugin managed-entries config** *delete*](#dsconf~347) Delete the config entry # COMMAND *'dsconf* *plugin* *managed-entries* *config* *add'* usage: dsconf \[-v] \[-j] instance plugin managed-entries config NAME add \[-h] \[--scope SCOPE] \[--filter FILTER] \[--managed-base MANAGED\_BASE] \[--managed-template MANAGED\_TEMPLATE] # OPTIONS *'dsconf* *plugin* *managed-entries* *config* *add'* [**--scope** *SCOPE*](#scope~8) Sets the scope of the search to use to see which entries the plug-in monitors (originScope) [**--filter** *FILTER*](#filter~5) Sets the search filter to use to search for and identify the entries within the subtree which require a managed entry (originFilter) [**--managed-base** *MANAGED\_BASE*](#managed~3) Sets the subtree under which to create the managed entries (managedBase) [**--managed-template** *MANAGED\_TEMPLATE*](#managed~4) Identifies the template entry to use to create the managed entry (managedTemplate) # COMMAND *'dsconf* *plugin* *managed-entries* *config* *set'* usage: dsconf \[-v] \[-j] instance plugin managed-entries config NAME set \[-h] \[--scope SCOPE] \[--filter FILTER] \[--managed-base MANAGED\_BASE] \[--managed-template MANAGED\_TEMPLATE] # OPTIONS *'dsconf* *plugin* *managed-entries* *config* *set'* [**--scope** *SCOPE*](#scope~9) Sets the scope of the search to use to see which entries the plug-in monitors (originScope) [**--filter** *FILTER*](#filter~6) Sets the search filter to use to search for and identify the entries within the subtree which require a managed entry (originFilter) [**--managed-base** *MANAGED\_BASE*](#managed~5) Sets the subtree under which to create the managed entries (managedBase) [**--managed-template** *MANAGED\_TEMPLATE*](#managed~6) Identifies the template entry to use to create the managed entry (managedTemplate) # COMMAND *'dsconf* *plugin* *managed-entries* *config* *show'* usage: dsconf \[-v] \[-j] instance plugin managed-entries config NAME show \[-h] # COMMAND *'dsconf* *plugin* *managed-entries* *config* *delete'* usage: dsconf \[-v] \[-j] instance plugin managed-entries config NAME delete \[-h] # COMMAND *'dsconf* *plugin* *managed-entries* *template'* usage: dsconf \[-v] \[-j] instance plugin managed-entries template \[-h] DN {add,set,show,delete} ... # POSITIONAL ARGUMENTS *'dsconf plugin managed-entries template'* [**dsconf plugin managed-entries template** *add*](#dsconf~348) Add the template entry [**dsconf plugin managed-entries template** *set*](#dsconf~349) Edit the template entry [**dsconf plugin managed-entries template** *show*](#dsconf~350) Display the template entry [**dsconf plugin managed-entries template** *delete*](#dsconf~351) Delete the template entry # COMMAND *'dsconf* *plugin* *managed-entries* *template* *add'* usage: dsconf \[-v] \[-j] instance plugin managed-entries template DN add \[-h] \[--rdn-attr RDN\_ATTR] \[--static-attr STATIC\_ATTR \[STATIC\_ATTR ...]] \[--mapped-attr MAPPED\_ATTR \[MAPPED\_ATTR ...]] # OPTIONS *'dsconf* *plugin* *managed-entries* *template* *add'* [**--rdn-attr** *RDN\_ATTR*](#rdn) Sets which attribute to use as the naming attribute in the automatically- generated entry (mepRDNAttr) [**--static-attr** *STATIC\_ATTR \[STATIC\_ATTR ...\]*](#static) Sets an attribute with a defined value that must be added to the automatically-generated entry (mepStaticAttr) [**--mapped-attr** *MAPPED\_ATTR \[MAPPED\_ATTR ...\]*](#mapped) Sets attributes in the Managed Entries template entry which must exist in the generated entry (mepMappedAttr) # COMMAND *'dsconf* *plugin* *managed-entries* *template* *set'* usage: dsconf \[-v] \[-j] instance plugin managed-entries template DN set \[-h] \[--rdn-attr RDN\_ATTR] \[--static-attr STATIC\_ATTR \[STATIC\_ATTR ...]] \[--mapped-attr MAPPED\_ATTR \[MAPPED\_ATTR ...]] # OPTIONS *'dsconf* *plugin* *managed-entries* *template* *set'* [**--rdn-attr** *RDN\_ATTR*](#rdn~2) Sets which attribute to use as the naming attribute in the automatically- generated entry (mepRDNAttr) [**--static-attr** *STATIC\_ATTR \[STATIC\_ATTR ...\]*](#static~2) Sets an attribute with a defined value that must be added to the automatically-generated entry (mepStaticAttr) [**--mapped-attr** *MAPPED\_ATTR \[MAPPED\_ATTR ...\]*](#mapped~2) Sets attributes in the Managed Entries template entry which must exist in the generated entry (mepMappedAttr) # COMMAND *'dsconf* *plugin* *managed-entries* *template* *show'* usage: dsconf \[-v] \[-j] instance plugin managed-entries template DN show \[-h] # COMMAND *'dsconf* *plugin* *managed-entries* *template* *delete'* usage: dsconf \[-v] \[-j] instance plugin managed-entries template DN delete \[-h] # COMMAND *'dsconf* *plugin* *pam-pass-through-auth'* usage: dsconf instance \[-v] \[-j] plugin pam-pass-through-auth \[-h] {show,enable,disable,status,list,config} ... # POSITIONAL ARGUMENTS *'dsconf plugin pam-pass-through-auth'* [**dsconf plugin pam-pass-through-auth** *show*](#dsconf~352) Displays the plugin configuration [**dsconf plugin pam-pass-through-auth** *enable*](#dsconf~353) Enables the plugin [**dsconf plugin pam-pass-through-auth** *disable*](#dsconf~354) Disables the plugin [**dsconf plugin pam-pass-through-auth** *status*](#dsconf~355) Displays the plugin status [**dsconf plugin pam-pass-through-auth** *list*](#dsconf~356) Lists PAM configurations [**dsconf plugin pam-pass-through-auth** *config*](#dsconf~357) Manage PAM PTA configurations. # COMMAND *'dsconf* *plugin* *pam-pass-through-auth* *show'* usage: dsconf \[-v] \[-j] instance plugin pam-pass-through-auth show \[-h] # COMMAND *'dsconf* *plugin* *pam-pass-through-auth* *enable'* usage: dsconf \[-v] \[-j] instance plugin pam-pass-through-auth enable \[-h] # COMMAND *'dsconf* *plugin* *pam-pass-through-auth* *disable'* usage: dsconf \[-v] \[-j] instance plugin pam-pass-through-auth disable \[-h] # COMMAND *'dsconf* *plugin* *pam-pass-through-auth* *status'* usage: dsconf \[-v] \[-j] instance plugin pam-pass-through-auth status \[-h] # COMMAND *'dsconf* *plugin* *pam-pass-through-auth* *list'* usage: dsconf \[-v] \[-j] instance plugin pam-pass-through-auth list \[-h] # COMMAND *'dsconf* *plugin* *pam-pass-through-auth* *config'* usage: dsconf \[-v] \[-j] instance plugin pam-pass-through-auth config \[-h] NAME {add,set,show,delete} ... # POSITIONAL ARGUMENTS *'dsconf plugin pam-pass-through-auth config'* [**dsconf plugin pam-pass-through-auth config** *add*](#dsconf~358) Add the config entry [**dsconf plugin pam-pass-through-auth config** *set*](#dsconf~359) Edit the config entry [**dsconf plugin pam-pass-through-auth config** *show*](#dsconf~360) Display the config entry [**dsconf plugin pam-pass-through-auth config** *delete*](#dsconf~361) Delete the config entry # COMMAND *'dsconf* *plugin* *pam-pass-through-auth* *config* *add'* usage: dsconf \[-v] \[-j] instance plugin pam-pass-through-auth config NAME add \[-h] \[--exclude-suffix EXCLUDE\_SUFFIX \[EXCLUDE\_SUFFIX ...]] \[--include-suffix INCLUDE\_SUFFIX \[INCLUDE\_SUFFIX ...]] \[--missing-suffix {ERROR,ALLOW,IGNORE,delete,}] \[--filter FILTER] \[--id-attr ID\_ATTR] \[--id\_map\_method ID\_MAP\_METHOD] \[--fallback {TRUE,FALSE}] \[--secure {TRUE,FALSE}] \[--service SERVICE] # OPTIONS *'dsconf* *plugin* *pam-pass-through-auth* *config* *add'* [**--exclude-suffix** *EXCLUDE\_SUFFIX \[EXCLUDE\_SUFFIX ...\]*](#exclude~17) Specifies a suffix to exclude from PAM authentication (pamExcludeSuffix) [**--include-suffix** *INCLUDE\_SUFFIX \[INCLUDE\_SUFFIX ...\]*](#include) Sets a suffix to include for PAM authentication (pamIncludeSuffix) [**--missing-suffix** *{ERROR,ALLOW,IGNORE,delete,}*](#missing) Identifies how to handle missing include or exclude suffixes (pamMissingSuffix) [**--filter** *FILTER*](#filter~7) Sets an LDAP filter to use to identify specific entries within the included suffixes for which to use PAM pass-through authentication (pamFilter) [**--id-attr** *ID\_ATTR*](#id) Contains the attribute name which is used to hold the PAM user ID (pamIDAttr) [**--id\_map\_method** *ID\_MAP\_METHOD*](#id_map_method) Sets the method to use to map the LDAP bind DN to a PAM identity (pamIDMapMethod) [**--fallback** *{TRUE,FALSE}*](#fallback) Sets whether to fallback to regular LDAP authentication if PAM authentication fails (pamFallback) [**--secure** *{TRUE,FALSE}*](#secure) Requires secure TLS connection for PAM authentication (pamSecure) [**--service** *SERVICE*](#service) Contains the service name to pass to PAM (pamService) # COMMAND *'dsconf* *plugin* *pam-pass-through-auth* *config* *set'* usage: dsconf \[-v] \[-j] instance plugin pam-pass-through-auth config NAME set \[-h] \[--exclude-suffix EXCLUDE\_SUFFIX \[EXCLUDE\_SUFFIX ...]] \[--include-suffix INCLUDE\_SUFFIX \[INCLUDE\_SUFFIX ...]] \[--missing-suffix {ERROR,ALLOW,IGNORE,delete,}] \[--filter FILTER] \[--id-attr ID\_ATTR] \[--id\_map\_method ID\_MAP\_METHOD] \[--fallback {TRUE,FALSE}] \[--secure {TRUE,FALSE}] \[--service SERVICE] # OPTIONS *'dsconf* *plugin* *pam-pass-through-auth* *config* *set'* [**--exclude-suffix** *EXCLUDE\_SUFFIX \[EXCLUDE\_SUFFIX ...\]*](#exclude~18) Specifies a suffix to exclude from PAM authentication (pamExcludeSuffix) [**--include-suffix** *INCLUDE\_SUFFIX \[INCLUDE\_SUFFIX ...\]*](#include~2) Sets a suffix to include for PAM authentication (pamIncludeSuffix) [**--missing-suffix** *{ERROR,ALLOW,IGNORE,delete,}*](#missing~2) Identifies how to handle missing include or exclude suffixes (pamMissingSuffix) [**--filter** *FILTER*](#filter~8) Sets an LDAP filter to use to identify specific entries within the included suffixes for which to use PAM pass-through authentication (pamFilter) [**--id-attr** *ID\_ATTR*](#id~2) Contains the attribute name which is used to hold the PAM user ID (pamIDAttr) [**--id\_map\_method** *ID\_MAP\_METHOD*](#id_map_method~2) Sets the method to use to map the LDAP bind DN to a PAM identity (pamIDMapMethod) [**--fallback** *{TRUE,FALSE}*](#fallback~2) Sets whether to fallback to regular LDAP authentication if PAM authentication fails (pamFallback) [**--secure** *{TRUE,FALSE}*](#secure~2) Requires secure TLS connection for PAM authentication (pamSecure) [**--service** *SERVICE*](#service~2) Contains the service name to pass to PAM (pamService) # COMMAND *'dsconf* *plugin* *pam-pass-through-auth* *config* *show'* usage: dsconf \[-v] \[-j] instance plugin pam-pass-through-auth config NAME show \[-h] # COMMAND *'dsconf* *plugin* *pam-pass-through-auth* *config* *delete'* usage: dsconf \[-v] \[-j] instance plugin pam-pass-through-auth config NAME delete \[-h] # COMMAND *'dsconf* *plugin* *retro-changelog'* usage: dsconf \[-v] \[-j] instance plugin retro-changelog \[-h] {show,enable,disable,status,set,add,del} ... # POSITIONAL ARGUMENTS *'dsconf plugin retro-changelog'* [**dsconf plugin retro-changelog** *show*](#dsconf~362) Displays the plugin configuration [**dsconf plugin retro-changelog** *enable*](#dsconf~363) Enables the plugin [**dsconf plugin retro-changelog** *disable*](#dsconf~364) Disables the plugin [**dsconf plugin retro-changelog** *status*](#dsconf~365) Displays the plugin status [**dsconf plugin retro-changelog** *set*](#dsconf~366) Edit the plugin [**dsconf plugin retro-changelog** *add*](#dsconf~367) Add attributes to the plugin [**dsconf plugin retro-changelog** *del*](#dsconf~368) Delete an attribute from plugin scope # COMMAND *'dsconf* *plugin* *retro-changelog* *show'* usage: dsconf \[-v] \[-j] instance plugin retro-changelog show \[-h] # COMMAND *'dsconf* *plugin* *retro-changelog* *enable'* usage: dsconf \[-v] \[-j] instance plugin retro-changelog enable \[-h] # COMMAND *'dsconf* *plugin* *retro-changelog* *disable'* usage: dsconf \[-v] \[-j] instance plugin retro-changelog disable \[-h] # COMMAND *'dsconf* *plugin* *retro-changelog* *status'* usage: dsconf \[-v] \[-j] instance plugin retro-changelog status \[-h] # COMMAND *'dsconf* *plugin* *retro-changelog* *set'* usage: dsconf \[-v] \[-j] instance plugin retro-changelog set \[-h] \[--is-replicated {TRUE,FALSE}] \[--attribute ATTRIBUTE] \[--directory DIRECTORY] \[--max-age MAX\_AGE] \[--trim-interval TRIM\_INTERVAL] \[--exclude-suffix \[EXCLUDE\_SUFFIX ...]] \[--exclude-attrs \[EXCLUDE\_ATTRS ...]] # OPTIONS *'dsconf* *plugin* *retro-changelog* *set'* [**--is-replicated** *{TRUE,FALSE}*](#is) Sets a flag to indicate on a change in the changelog whether the change is newly made on that server or whether it was replicated over from another server (isReplicated) [**--attribute** *ATTRIBUTE*](#attribute) Specifies another Directory Server attribute which must be included in the retro changelog entries (nsslapd-attribute) [**--directory** *DIRECTORY*](#directory~2) Specifies the name of the directory in which the changelog database is created the first time the plug-in is run [**--max-age** *MAX\_AGE*](#max~3) Specifies the maximum age of any entry in the changelog. The value must be a number followed by a duration unit \[sSmMhHdDwW]. Used to trim the changelog (nsslapd-changelogmaxage) [**--trim-interval** *TRIM\_INTERVAL*](#trim) [**--exclude-suffix** *\[EXCLUDE\_SUFFIX ...\]*](#exclude~19) Specifies the suffix which will be excluded from the scope of the plugin (nsslapd-exclude-suffix) [**--exclude-attrs** *\[EXCLUDE\_ATTRS ...\]*](#exclude~20) Specifies the attributes which will be excluded from the scope of the plugin (nsslapd-exclude-attrs) # COMMAND *'dsconf* *plugin* *retro-changelog* *add'* usage: dsconf \[-v] \[-j] instance plugin retro-changelog add \[-h] \[--is-replicated {TRUE,FALSE}] \[--attribute ATTRIBUTE] \[--directory DIRECTORY] \[--max-age MAX\_AGE] \[--trim-interval TRIM\_INTERVAL] \[--exclude-suffix \[EXCLUDE\_SUFFIX ...]] \[--exclude-attrs \[EXCLUDE\_ATTRS ...]] # OPTIONS *'dsconf* *plugin* *retro-changelog* *add'* [**--is-replicated** *{TRUE,FALSE}*](#is~2) Sets a flag to indicate on a change in the changelog whether the change is newly made on that server or whether it was replicated over from another server (isReplicated) [**--attribute** *ATTRIBUTE*](#attribute~2) Specifies another Directory Server attribute which must be included in the retro changelog entries (nsslapd-attribute) [**--directory** *DIRECTORY*](#directory~3) Specifies the name of the directory in which the changelog database is created the first time the plug-in is run [**--max-age** *MAX\_AGE*](#max~4) Specifies the maximum age of any entry in the changelog. The value must be a number followed by a duration unit \[sSmMhHdDwW]. Used to trim the changelog (nsslapd-changelogmaxage) [**--trim-interval** *TRIM\_INTERVAL*](#trim~2) [**--exclude-suffix** *\[EXCLUDE\_SUFFIX ...\]*](#exclude~21) Specifies the suffix which will be excluded from the scope of the plugin (nsslapd-exclude-suffix) [**--exclude-attrs** *\[EXCLUDE\_ATTRS ...\]*](#exclude~22) Specifies the attributes which will be excluded from the scope of the plugin (nsslapd-exclude-attrs) # COMMAND *'dsconf* *plugin* *retro-changelog* *del'* usage: dsconf \[-v] \[-j] instance plugin retro-changelog del \[-h] \[--is-replicated {TRUE,FALSE}] \[--attribute ATTRIBUTE] \[--directory DIRECTORY] \[--max-age MAX\_AGE] \[--trim-interval TRIM\_INTERVAL] \[--exclude-suffix \[EXCLUDE\_SUFFIX ...]] \[--exclude-attrs \[EXCLUDE\_ATTRS ...]] # OPTIONS *'dsconf* *plugin* *retro-changelog* *del'* [**--is-replicated** *{TRUE,FALSE}*](#is~3) Sets a flag to indicate on a change in the changelog whether the change is newly made on that server or whether it was replicated over from another server (isReplicated) [**--attribute** *ATTRIBUTE*](#attribute~3) Specifies another Directory Server attribute which must be included in the retro changelog entries (nsslapd-attribute) [**--directory** *DIRECTORY*](#directory~4) Specifies the name of the directory in which the changelog database is created the first time the plug-in is run [**--max-age** *MAX\_AGE*](#max~5) Specifies the maximum age of any entry in the changelog. The value must be a number followed by a duration unit \[sSmMhHdDwW]. Used to trim the changelog (nsslapd-changelogmaxage) [**--trim-interval** *TRIM\_INTERVAL*](#trim~3) [**--exclude-suffix** *\[EXCLUDE\_SUFFIX ...\]*](#exclude~23) Specifies the suffix which will be excluded from the scope of the plugin (nsslapd-exclude-suffix) [**--exclude-attrs** *\[EXCLUDE\_ATTRS ...\]*](#exclude~24) Specifies the attributes which will be excluded from the scope of the plugin (nsslapd-exclude-attrs) # COMMAND *'dsconf* *plugin* *posix-winsync'* usage: dsconf \[-v] \[-j] instance plugin posix-winsync \[-h] {show,enable,disable,status,set,fixup} ... # POSITIONAL ARGUMENTS *'dsconf plugin posix-winsync'* [**dsconf plugin posix-winsync** *show*](#dsconf~369) Displays the plugin configuration [**dsconf plugin posix-winsync** *enable*](#dsconf~370) Enables the plugin [**dsconf plugin posix-winsync** *disable*](#dsconf~371) Disables the plugin [**dsconf plugin posix-winsync** *status*](#dsconf~372) Displays the plugin status [**dsconf plugin posix-winsync** *set*](#dsconf~373) Edit the plugin settings [**dsconf plugin posix-winsync** *fixup*](#dsconf~374) Run the memberOf fix-up task to correct mismatched member and uniquemember values for synced users # COMMAND *'dsconf* *plugin* *posix-winsync* *show'* usage: dsconf \[-v] \[-j] instance plugin posix-winsync show \[-h] # COMMAND *'dsconf* *plugin* *posix-winsync* *enable'* usage: dsconf \[-v] \[-j] instance plugin posix-winsync enable \[-h] # COMMAND *'dsconf* *plugin* *posix-winsync* *disable'* usage: dsconf \[-v] \[-j] instance plugin posix-winsync disable \[-h] # COMMAND *'dsconf* *plugin* *posix-winsync* *status'* usage: dsconf \[-v] \[-j] instance plugin posix-winsync status \[-h] # COMMAND *'dsconf* *plugin* *posix-winsync* *set'* usage: dsconf \[-v] \[-j] instance plugin posix-winsync set \[-h] \[--create-memberof-task {true,false}] \[--lower-case-uid {true,false}] \[--map-member-uid {true,false}] \[--map-nested-grouping {true,false}] \[--ms-sfu-schema {true,false}] # OPTIONS *'dsconf* *plugin* *posix-winsync* *set'* [**--create-memberof-task** *{true,false}*](#create~3) Sets whether to run the memberUID fix-up task immediately after a sync run in order to update group memberships for synced users (posixWinsyncCreateMemberOfTask) [**--lower-case-uid** *{true,false}*](#lower) Sets whether to store (and, if necessary, convert) the UID value in the memberUID attribute in lower case.(posixWinsyncLowerCaseUID) [**--map-member-uid** *{true,false}*](#map) Sets whether to map the memberUID attribute in an Active Directory group to the uniqueMember attribute in a Directory Server group (posixWinsyncMapMemberUID) [**--map-nested-grouping** *{true,false}*](#map~2) Manages if nested groups are updated when memberUID attributes in an Active Directory POSIX group change (posixWinsyncMapNestedGrouping) [**--ms-sfu-schema** *{true,false}*](#ms) Sets whether to the older Microsoft System Services for Unix 3.0 (msSFU30) schema when syncing Posix attributes from Active Directory (posixWinsyncMsSFUSchema) # COMMAND *'dsconf* *plugin* *posix-winsync* *fixup'* usage: dsconf \[-v] \[-j] instance plugin posix-winsync fixup \[-h] \[-f FILTER] \[--timeout TIMEOUT] DN [**DN**](#DN~17) Set the base DN that contains entries to fix up # OPTIONS *'dsconf* *plugin* *posix-winsync* *fixup'* [**-f** *FILTER*, **--filter** *FILTER*](#f~3) Filter for entries to fix up. If omitted, all entries with objectclass inetuser/inetadmin/nsmemberof under the specified base will have their memberOf attribute regenerated. [**--timeout** *TIMEOUT*](#timeout~10) Set a timeout to wait for the fixup task. Default is 120 seconds # COMMAND *'dsconf* *plugin* *contentsync'* usage: dsconf \[-v] \[-j] instance plugin contentsync \[-h] {show,enable,disable,status,set,add} ... # POSITIONAL ARGUMENTS *'dsconf plugin contentsync'* [**dsconf plugin contentsync** *show*](#dsconf~375) Displays the plugin configuration [**dsconf plugin contentsync** *enable*](#dsconf~376) Enables the plugin [**dsconf plugin contentsync** *disable*](#dsconf~377) Disables the plugin [**dsconf plugin contentsync** *status*](#dsconf~378) Displays the plugin status [**dsconf plugin contentsync** *set*](#dsconf~379) Edit the plugin settings [**dsconf plugin contentsync** *add*](#dsconf~380) Add attributes to the plugin # COMMAND *'dsconf* *plugin* *contentsync* *show'* usage: dsconf \[-v] \[-j] instance plugin contentsync show \[-h] # COMMAND *'dsconf* *plugin* *contentsync* *enable'* usage: dsconf \[-v] \[-j] instance plugin contentsync enable \[-h] # COMMAND *'dsconf* *plugin* *contentsync* *disable'* usage: dsconf \[-v] \[-j] instance plugin contentsync disable \[-h] # COMMAND *'dsconf* *plugin* *contentsync* *status'* usage: dsconf \[-v] \[-j] instance plugin contentsync status \[-h] # COMMAND *'dsconf* *plugin* *contentsync* *set'* usage: dsconf \[-v] \[-j] instance plugin contentsync set \[-h] \[--allow-openldap {on,off}] \[--queue-max-size QUEUE\_MAX\_SIZE] \[--max-concurrent MAX\_CONCURRENT] # OPTIONS *'dsconf* *plugin* *contentsync* *set'* [**--allow-openldap** *{on,off}*](#allow~3) Allows openldap servers to act as read only consumers of this server via syncrepl [**--queue-max-size** *QUEUE\_MAX\_SIZE*](#queue) Limits the number of entries not yet processed (range \[100, 100000]) [**--max-concurrent** *MAX\_CONCURRENT*](#max~6) Limits the number of persistent searches running at the same time # COMMAND *'dsconf* *plugin* *contentsync* *add'* usage: dsconf \[-v] \[-j] instance plugin contentsync add \[-h] \[--allow-openldap {on,off}] \[--queue-max-size QUEUE\_MAX\_SIZE] \[--max-concurrent MAX\_CONCURRENT] # OPTIONS *'dsconf* *plugin* *contentsync* *add'* [**--allow-openldap** *{on,off}*](#allow~4) Allows openldap servers to act as read only consumers of this server via syncrepl [**--queue-max-size** *QUEUE\_MAX\_SIZE*](#queue~2) Limits the number of entries not yet processed (range \[100, 100000]) [**--max-concurrent** *MAX\_CONCURRENT*](#max~7) Limits the number of persistent searches running at the same time # COMMAND *'dsconf* *plugin* *entryuuid'* usage: dsconf \[-v] \[-j] instance plugin entryuuid \[-h] {show,enable,disable,status,fixup,fixup-status} ... # POSITIONAL ARGUMENTS *'dsconf plugin entryuuid'* [**dsconf plugin entryuuid** *show*](#dsconf~381) Displays the plugin configuration [**dsconf plugin entryuuid** *enable*](#dsconf~382) Enables the plugin [**dsconf plugin entryuuid** *disable*](#dsconf~383) Disables the plugin [**dsconf plugin entryuuid** *status*](#dsconf~384) Displays the plugin status [**dsconf plugin entryuuid** *fixup*](#dsconf~385) Run the fix-up task for EntryUUID plugin [**dsconf plugin entryuuid** *fixup-status*](#dsconf~386) Check the status of a fix-up task # COMMAND *'dsconf* *plugin* *entryuuid* *show'* usage: dsconf \[-v] \[-j] instance plugin entryuuid show \[-h] # COMMAND *'dsconf* *plugin* *entryuuid* *enable'* usage: dsconf \[-v] \[-j] instance plugin entryuuid enable \[-h] # COMMAND *'dsconf* *plugin* *entryuuid* *disable'* usage: dsconf \[-v] \[-j] instance plugin entryuuid disable \[-h] # COMMAND *'dsconf* *plugin* *entryuuid* *status'* usage: dsconf \[-v] \[-j] instance plugin entryuuid status \[-h] # COMMAND *'dsconf* *plugin* *entryuuid* *fixup'* usage: dsconf \[-v] \[-j] instance plugin entryuuid fixup \[-h] \[-f FILTER] \[--wait] \[--timeout TIMEOUT] DN [**DN**](#DN~18) Base DN that contains entries to fix up # OPTIONS *'dsconf* *plugin* *entryuuid* *fixup'* [**-f** *FILTER*, **--filter** *FILTER*](#f~4) Filter for entries to fix up. If omitted, all entries under base DNwill have their EntryUUID attribute regenerated if not present. [**--wait**](#wait~5) Wait for the task to finish, this could take a long time [**--timeout** *TIMEOUT*](#timeout~11) Sets the task timeout. Default is 0 (no timeout) # COMMAND *'dsconf* *plugin* *entryuuid* *fixup-status'* usage: dsconf \[-v] \[-j] instance plugin entryuuid fixup-status \[-h] \[--dn DN] \[--show-log] \[--watch] # OPTIONS *'dsconf* *plugin* *entryuuid* *fixup-status'* [**--dn** *DN*](#dn~5) The task entry's DN [**--show-log**](#show~4) Display the task log [**--watch**](#watch~7) Watch the task's status and wait for it to finish # COMMAND *'dsconf* *plugin* *pwstorage-scheme'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme \[-h] {pbkdf2,pbkdf2-sha1,pbkdf2-sha256,pbkdf2-sha256-legacy,pbkdf2-sha512} ... # POSITIONAL ARGUMENTS *'dsconf plugin pwstorage-scheme'* [**dsconf plugin pwstorage-scheme** *pbkdf2*](#dsconf~387) Manage legacy PBKDF2 scheme ({PBKDF2}); settings are independent of pbkdf2-sha1 even though both use SHA-1 [**dsconf plugin pwstorage-scheme** *pbkdf2-sha1*](#dsconf~388) Manage PBKDF2-SHA1 scheme ({PBKDF2-SHA1}); settings are independent of legacy pbkdf2 even though both use SHA-1 [**dsconf plugin pwstorage-scheme** *pbkdf2-sha256*](#dsconf~389) Manage PBKDF2-SHA256 scheme [**dsconf plugin pwstorage-scheme** *pbkdf2-sha256-legacy*](#dsconf~390) Manage PBKDF2-SHA256-LEGACY scheme [**dsconf plugin pwstorage-scheme** *pbkdf2-sha512*](#dsconf~391) Manage PBKDF2-SHA512 scheme # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2 \[-h] {get-num-iterations,set-num-iterations,get-accept-max-iterations,set-accept-max-iterations,delete-accept-max-iterations} ... # POSITIONAL ARGUMENTS *'dsconf plugin pwstorage-scheme pbkdf2'* [**dsconf plugin pwstorage-scheme pbkdf2** *get-num-iterations*](#dsconf~392) Get number of iterations [**dsconf plugin pwstorage-scheme pbkdf2** *set-num-iterations*](#dsconf~393) Set number of iterations [**dsconf plugin pwstorage-scheme pbkdf2** *get-accept-max-iterations*](#dsconf~394) Get maximum iterations accepted from stored hashes on bind [**dsconf plugin pwstorage-scheme pbkdf2** *set-accept-max-iterations*](#dsconf~395) Set maximum iterations accepted from stored hashes on bind [**dsconf plugin pwstorage-scheme pbkdf2** *delete-accept-max-iterations*](#dsconf~396) Remove accept max iterations override, revert to default # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2* *get-num-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2 get-num-iterations \[-h] # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2* *set-num-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2 set-num-iterations \[-h] iterations [**iterations**](#iterations) Number of iterations (10,000-10,000,000) # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2* *get-accept-max-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2 get-accept-max-iterations \[-h] # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2* *set-accept-max-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2 set-accept-max-iterations \[-h] iterations [**iterations**](#iterations~2) Maximum iterations accepted on bind (10,000-10,000,000) # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2* *delete-accept-max-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2 delete-accept-max-iterations \[-h] # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha1'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha1 \[-h] {get-num-iterations,set-num-iterations,get-accept-max-iterations,set-accept-max-iterations,delete-accept-max-iterations} ... # POSITIONAL ARGUMENTS *'dsconf plugin pwstorage-scheme pbkdf2-sha1'* [**dsconf plugin pwstorage-scheme pbkdf2-sha1** *get-num-iterations*](#dsconf~397) Get number of iterations [**dsconf plugin pwstorage-scheme pbkdf2-sha1** *set-num-iterations*](#dsconf~398) Set number of iterations [**dsconf plugin pwstorage-scheme pbkdf2-sha1** *get-accept-max-iterations*](#dsconf~399) Get maximum iterations accepted from stored hashes on bind [**dsconf plugin pwstorage-scheme pbkdf2-sha1** *set-accept-max-iterations*](#dsconf~400) Set maximum iterations accepted from stored hashes on bind [**dsconf plugin pwstorage-scheme pbkdf2-sha1** *delete-accept-max-iterations*](#dsconf~401) Remove accept max iterations override, revert to default # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha1* *get-num-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha1 get-num-iterations \[-h] # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha1* *set-num-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha1 set-num-iterations \[-h] iterations [**iterations**](#iterations~3) Number of iterations (10,000-10,000,000) # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha1* *get-accept-max-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha1 get-accept-max-iterations \[-h] # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha1* *set-accept-max-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha1 set-accept-max-iterations \[-h] iterations [**iterations**](#iterations~4) Maximum iterations accepted on bind (10,000-10,000,000) # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha1* *delete-accept-max-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha1 delete-accept-max-iterations \[-h] # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha256'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha256 \[-h] {get-num-iterations,set-num-iterations,get-accept-max-iterations,set-accept-max-iterations,delete-accept-max-iterations} ... # POSITIONAL ARGUMENTS *'dsconf plugin pwstorage-scheme pbkdf2-sha256'* [**dsconf plugin pwstorage-scheme pbkdf2-sha256** *get-num-iterations*](#dsconf~402) Get number of iterations [**dsconf plugin pwstorage-scheme pbkdf2-sha256** *set-num-iterations*](#dsconf~403) Set number of iterations [**dsconf plugin pwstorage-scheme pbkdf2-sha256** *get-accept-max-iterations*](#dsconf~404) Get maximum iterations accepted from stored hashes on bind [**dsconf plugin pwstorage-scheme pbkdf2-sha256** *set-accept-max-iterations*](#dsconf~405) Set maximum iterations accepted from stored hashes on bind [**dsconf plugin pwstorage-scheme pbkdf2-sha256** *delete-accept-max-iterations*](#dsconf~406) Remove accept max iterations override, revert to default # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha256* *get-num-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha256 get-num-iterations \[-h] # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha256* *set-num-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha256 set-num-iterations \[-h] iterations [**iterations**](#iterations~5) Number of iterations (10,000-10,000,000) # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha256* *get-accept-max-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha256 get-accept-max-iterations \[-h] # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha256* *set-accept-max-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha256 set-accept-max-iterations \[-h] iterations [**iterations**](#iterations~6) Maximum iterations accepted on bind (10,000-10,000,000) # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha256* *delete-accept-max-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha256 delete-accept-max-iterations \[-h] # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha256-legacy'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha256-legacy \[-h] {get-accept-max-iterations,set-accept-max-iterations} ... # POSITIONAL ARGUMENTS *'dsconf plugin pwstorage-scheme pbkdf2-sha256-legacy'* [**dsconf plugin pwstorage-scheme pbkdf2-sha256-legacy** *get-accept-max-iterations*](#dsconf~407) Get maximum accepted iterations [**dsconf plugin pwstorage-scheme pbkdf2-sha256-legacy** *set-accept-max-iterations*](#dsconf~408) Set maximum accepted iterations # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha256-legacy* *get-accept-max-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha256-legacy get-accept-max-iterations \[-h] # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha256-legacy* *set-accept-max-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha256-legacy set-accept-max-iterations \[-h] iterations [**iterations**](#iterations~7) Maximum accepted iterations (2,048-2,147,483,647) # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha512'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha512 \[-h] {get-num-iterations,set-num-iterations,get-accept-max-iterations,set-accept-max-iterations,delete-accept-max-iterations} ... # POSITIONAL ARGUMENTS *'dsconf plugin pwstorage-scheme pbkdf2-sha512'* [**dsconf plugin pwstorage-scheme pbkdf2-sha512** *get-num-iterations*](#dsconf~409) Get number of iterations [**dsconf plugin pwstorage-scheme pbkdf2-sha512** *set-num-iterations*](#dsconf~410) Set number of iterations [**dsconf plugin pwstorage-scheme pbkdf2-sha512** *get-accept-max-iterations*](#dsconf~411) Get maximum iterations accepted from stored hashes on bind [**dsconf plugin pwstorage-scheme pbkdf2-sha512** *set-accept-max-iterations*](#dsconf~412) Set maximum iterations accepted from stored hashes on bind [**dsconf plugin pwstorage-scheme pbkdf2-sha512** *delete-accept-max-iterations*](#dsconf~413) Remove accept max iterations override, revert to default # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha512* *get-num-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha512 get-num-iterations \[-h] # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha512* *set-num-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha512 set-num-iterations \[-h] iterations [**iterations**](#iterations~8) Number of iterations (10,000-10,000,000) # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha512* *get-accept-max-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha512 get-accept-max-iterations \[-h] # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha512* *set-accept-max-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha512 set-accept-max-iterations \[-h] iterations [**iterations**](#iterations~9) Maximum iterations accepted on bind (10,000-10,000,000) # COMMAND *'dsconf* *plugin* *pwstorage-scheme* *pbkdf2-sha512* *delete-accept-max-iterations'* usage: dsconf \[-v] \[-j] instance plugin pwstorage-scheme pbkdf2-sha512 delete-accept-max-iterations \[-h] # COMMAND *'dsconf* *plugin* *list'* usage: dsconf \[-v] \[-j] instance plugin list \[-h] # COMMAND *'dsconf* *plugin* *show'* usage: dsconf \[-v] \[-j] instance plugin show \[-h] \[selector] [**selector**](#selector~2) The plugin to search for # COMMAND *'dsconf* *plugin* *set'* usage: dsconf \[-v] \[-j] instance plugin set \[-h] \[--type TYPE] \[--enabled {on,off}] \[--path PATH] \[--initfunc INITFUNC] \[--id ID] \[--vendor VENDOR] \[--version VERSION] \[--description DESCRIPTION] \[--depends-on-type DEPENDS\_ON\_TYPE] \[--depends-on-named DEPENDS\_ON\_NAMED] \[--precedence PRECEDENCE] \[selector] [**selector**](#selector~3) The plugin to edit # OPTIONS *'dsconf* *plugin* *set'* [**--type** *TYPE*](#type~3) The type of plugin. [**--enabled** *{on,off}*](#enabled~3) Identifies whether or not the plugin is enabled. [**--path** *PATH*](#path) The plugin library name (without the library suffix). [**--initfunc** *INITFUNC*](#initfunc) An initialization function of the plugin. [**--id** *ID*](#id~3) The plugin ID. [**--vendor** *VENDOR*](#vendor) The vendor of plugin. [**--version** *VERSION*](#version) The version of plugin. [**--description** *DESCRIPTION*](#description) The description of the plugin. [**--depends-on-type** *DEPENDS\_ON\_TYPE*](#depends) All plug-ins with a type value which matches one of the values in the following valid range will be started by the server prior to this plug-in. [**--depends-on-named** *DEPENDS\_ON\_NAMED*](#depends~2) The plug-in name matching one of the following values will be started by the server prior to this plug-in [**--precedence** *PRECEDENCE*](#precedence) The priority it has in the execution order of plug-ins # COMMAND *'dsconf* *pwpolicy'* usage: dsconf \[-v] \[-j] instance pwpolicy \[-h] {get,set,list-schemes,fixup-shadow} ... # POSITIONAL ARGUMENTS *'dsconf pwpolicy'* [**dsconf pwpolicy** *get*](#dsconf~414) Get the global password policy entry [**dsconf pwpolicy** *set*](#dsconf~415) Set an attribute in a global password policy [**dsconf pwpolicy** *list-schemes*](#dsconf~416) Get a list of the current password storage schemes [**dsconf pwpolicy** *fixup-shadow*](#dsconf~417) Create a task to set shadowLastChange on ShadowAccount entries # COMMAND *'dsconf* *pwpolicy* *get'* usage: dsconf \[-v] \[-j] instance pwpolicy get \[-h] # COMMAND *'dsconf* *pwpolicy* *set'* usage: dsconf instance \[-v] \[-j] pwpolicy set \[-h] \[--pwdscheme PWDSCHEME] \[--pwdchange PWDCHANGE] \[--pwdmustchange PWDMUSTCHANGE] \[--pwdhistory PWDHISTORY] \[--pwdhistorycount PWDHISTORYCOUNT] \[--pwdadmin PWDADMIN] \[--pwdadminskipupdates PWDADMINSKIPUPDATES] \[--pwdtrack PWDTRACK] \[--pwdwarning PWDWARNING] \[--pwdexpire PWDEXPIRE] \[--pwdmaxage PWDMAXAGE] \[--pwdminage PWDMINAGE] \[--pwdgracelimit PWDGRACELIMIT] \[--pwdsendexpiring PWDSENDEXPIRING] \[--pwdlockout PWDLOCKOUT] \[--pwdunlock PWDUNLOCK] \[--pwdlockoutduration PWDLOCKOUTDURATION] \[--pwdmaxfailures PWDMAXFAILURES] \[--pwdresetfailcount PWDRESETFAILCOUNT] \[--pwdchecksyntax PWDCHECKSYNTAX] \[--pwdminlen PWDMINLEN] \[--pwdmindigits PWDMINDIGITS] \[--pwdminalphas PWDMINALPHAS] \[--pwdminuppers PWDMINUPPERS] \[--pwdminlowers PWDMINLOWERS] \[--pwdminspecials PWDMINSPECIALS] \[--pwdmin8bits PWDMIN8BITS] \[--pwdmaxrepeats PWDMAXREPEATS] \[--pwdpalindrome PWDPALINDROME] \[--pwdmaxseq PWDMAXSEQ] \[--pwdmaxseqsets PWDMAXSEQSETS] \[--pwdmaxclasschars PWDMAXCLASSCHARS] \[--pwdmincatagories PWDMINCATAGORIES] \[--pwdmintokenlen PWDMINTOKENLEN] \[--pwdbadwords PWDBADWORDS] \[--pwduserattrs PWDUSERATTRS] \[--pwddictcheck PWDDICTCHECK] \[--pwddictpath PWDDICTPATH] \[--pwptprmaxuse PWPTPRMAXUSE] \[--pwptprdelayexpireat PWPTPRDELAYEXPIREAT] \[--pwptprdelayvalidfrom PWPTPRDELAYVALIDFROM] \[--pwdlocal PWDLOCAL] \[--pwdisglobal PWDISGLOBAL] \[--pwdallowhash PWDALLOWHASH] \[--pwpinheritglobal PWPINHERITGLOBAL] # OPTIONS *'dsconf* *pwpolicy* *set'* [**--pwdscheme** *PWDSCHEME*](#pwdscheme) The password storage scheme [**--pwdchange** *PWDCHANGE*](#pwdchange) Allow users to change their passwords [**--pwdmustchange** *PWDMUSTCHANGE*](#pwdmustchange) Users must change their password after it was reset by an administrator [**--pwdhistory** *PWDHISTORY*](#pwdhistory) To enable password history set this to "on", otherwise "off" [**--pwdhistorycount** *PWDHISTORYCOUNT*](#pwdhistorycount) The number of passwords to keep in history [**--pwdadmin** *PWDADMIN*](#pwdadmin) The DN of an entry or a group of account that can bypass password policy constraints [**--pwdadminskipupdates** *PWDADMINSKIPUPDATES*](#pwdadminskipupdates) Set to "on" if the Password Admin's password update should not trigger updates to the password state attributes (passwordExpirationtime, passwordHistory, etc). [**--pwdtrack** *PWDTRACK*](#pwdtrack) Set to "on" to track the time the password was last changed [**--pwdwarning** *PWDWARNING*](#pwdwarning) Send an expiring warning if password expires within this time (in seconds) [**--pwdexpire** *PWDEXPIRE*](#pwdexpire) Set to "on" to enable password expiration [**--pwdmaxage** *PWDMAXAGE*](#pwdmaxage) The password expiration time in seconds [**--pwdminage** *PWDMINAGE*](#pwdminage) The number of seconds that must pass before a user can change their password [**--pwdgracelimit** *PWDGRACELIMIT*](#pwdgracelimit) The number of allowed logins after the password has expired [**--pwdsendexpiring** *PWDSENDEXPIRING*](#pwdsendexpiring) Set to "on" to always send the expiring control regardless of the warning period [**--pwdlockout** *PWDLOCKOUT*](#pwdlockout) Set to "on" to enable account lockout [**--pwdunlock** *PWDUNLOCK*](#pwdunlock) Set to "on" to allow an account to become unlocked after the lockout duration [**--pwdlockoutduration** *PWDLOCKOUTDURATION*](#pwdlockoutduration) The number of seconds an account stays locked out [**--pwdmaxfailures** *PWDMAXFAILURES*](#pwdmaxfailures) The maximum number of allowed failed password attempts before the account gets locked [**--pwdresetfailcount** *PWDRESETFAILCOUNT*](#pwdresetfailcount) The number of seconds to wait before reducing the failed login count on an account [**--pwdchecksyntax** *PWDCHECKSYNTAX*](#pwdchecksyntax) Set to "on" to enable password syntax checking [**--pwdminlen** *PWDMINLEN*](#pwdminlen) The minimum number of characters required in a password [**--pwdmindigits** *PWDMINDIGITS*](#pwdmindigits) The minimum number of digit/number characters in a password [**--pwdminalphas** *PWDMINALPHAS*](#pwdminalphas) The minimum number of alpha characters required in a password [**--pwdminuppers** *PWDMINUPPERS*](#pwdminuppers) The minimum number of uppercase characters required in a password [**--pwdminlowers** *PWDMINLOWERS*](#pwdminlowers) The minimum number of lowercase characters required in a password [**--pwdminspecials** *PWDMINSPECIALS*](#pwdminspecials) The minimum number of special characters required in a password [**--pwdmin8bits** *PWDMIN8BITS*](#pwdmin8bits) The minimum number of 8-bit characters required in a password [**--pwdmaxrepeats** *PWDMAXREPEATS*](#pwdmaxrepeats) The maximum number of times the same character can appear sequentially in the password [**--pwdpalindrome** *PWDPALINDROME*](#pwdpalindrome) Set to "on" to reject passwords that are palindromes [**--pwdmaxseq** *PWDMAXSEQ*](#pwdmaxseq) The maximum number of allowed monotonic character sequences in a password [**--pwdmaxseqsets** *PWDMAXSEQSETS*](#pwdmaxseqsets) The maximum number of allowed monotonic character sequences that can be duplicated in a password [**--pwdmaxclasschars** *PWDMAXCLASSCHARS*](#pwdmaxclasschars) The maximum number of sequential characters from the same character class that is allowed in a password [**--pwdmincatagories** *PWDMINCATAGORIES*](#pwdmincatagories) The minimum number of syntax category checks [**--pwdmintokenlen** *PWDMINTOKENLEN*](#pwdmintokenlen) Sets the smallest attribute value length that is used for trivial/user words checking. This also impacts "--pwduserattrs" [**--pwdbadwords** *PWDBADWORDS*](#pwdbadwords) A space-separated list of words that can not be in a password [**--pwduserattrs** *PWDUSERATTRS*](#pwduserattrs) A space-separated list of attributes whose values can not appear in the password (See "--pwdmintokenlen") [**--pwddictcheck** *PWDDICTCHECK*](#pwddictcheck) Set to "on" to enforce CrackLib dictionary checking [**--pwddictpath** *PWDDICTPATH*](#pwddictpath) Filesystem path to specific/custom CrackLib dictionary files [**--pwptprmaxuse** *PWPTPRMAXUSE*](#pwptprmaxuse) Number of times a reset password can be used for authentication [**--pwptprdelayexpireat** *PWPTPRDELAYEXPIREAT*](#pwptprdelayexpireat) Number of seconds after which a reset password expires [**--pwptprdelayvalidfrom** *PWPTPRDELAYVALIDFROM*](#pwptprdelayvalidfrom) Number of seconds to wait before using a reset password to authenticated [**--pwdlocal** *PWDLOCAL*](#pwdlocal) Set to "on" to enable fine-grained (subtree/user-level) password policies [**--pwdisglobal** *PWDISGLOBAL*](#pwdisglobal) Set to "on" to enable password policy state attributes to be replicated [**--pwdallowhash** *PWDALLOWHASH*](#pwdallowhash) Set to "on" to allow adding prehashed passwords [**--pwpinheritglobal** *PWPINHERITGLOBAL*](#pwpinheritglobal) Set to "on" to allow local policies to inherit the global policy # COMMAND *'dsconf* *pwpolicy* *list-schemes'* usage: dsconf \[-v] \[-j] instance pwpolicy list-schemes \[-h] # COMMAND *'dsconf* *pwpolicy* *fixup-shadow'* usage: dsconf \[-v] \[-j] instance pwpolicy fixup-shadow \[-h] \[--force] \[--watch] suffix [**suffix**](#suffix~7) LDAP suffix to search (subtree) for objectClass ShadowAccount # OPTIONS *'dsconf* *pwpolicy* *fixup-shadow'* [**--force**](#force) Update all users under the suffix regardless if shadowLastChange is set. [**--watch**](#watch~8) Watch the task's status and wait for it to finish. # COMMAND *'dsconf* *localpwp'* usage: dsconf \[-v] \[-j] instance localpwp \[-h] {list,get,set,remove,adduser,addsubtree} ... # POSITIONAL ARGUMENTS *'dsconf localpwp'* [**dsconf localpwp** *list*](#dsconf~418) List all the local password policies [**dsconf localpwp** *get*](#dsconf~419) Get local password policy entry [**dsconf localpwp** *set*](#dsconf~420) Set an attribute in a local password policy [**dsconf localpwp** *remove*](#dsconf~421) Remove a local password policy [**dsconf localpwp** *adduser*](#dsconf~422) Add new user password policy [**dsconf localpwp** *addsubtree*](#dsconf~423) Add new subtree password policy # COMMAND *'dsconf* *localpwp* *list'* usage: dsconf \[-v] \[-j] instance localpwp list \[-h] \[DN] [**DN**](#DN~19) Suffix to search for local password policies # COMMAND *'dsconf* *localpwp* *get'* usage: dsconf \[-v] \[-j] instance localpwp get \[-h] DN [**DN**](#DN~20) Get the local policy for this entry DN # COMMAND *'dsconf* *localpwp* *set'* usage: dsconf \[-v] \[-j] instance localpwp set \[-h] \[--pwdscheme PWDSCHEME] \[--pwdchange PWDCHANGE] \[--pwdmustchange PWDMUSTCHANGE] \[--pwdhistory PWDHISTORY] \[--pwdhistorycount PWDHISTORYCOUNT] \[--pwdadmin PWDADMIN] \[--pwdadminskipupdates PWDADMINSKIPUPDATES] \[--pwdtrack PWDTRACK] \[--pwdwarning PWDWARNING] \[--pwdexpire PWDEXPIRE] \[--pwdmaxage PWDMAXAGE] \[--pwdminage PWDMINAGE] \[--pwdgracelimit PWDGRACELIMIT] \[--pwdsendexpiring PWDSENDEXPIRING] \[--pwdlockout PWDLOCKOUT] \[--pwdunlock PWDUNLOCK] \[--pwdlockoutduration PWDLOCKOUTDURATION] \[--pwdmaxfailures PWDMAXFAILURES] \[--pwdresetfailcount PWDRESETFAILCOUNT] \[--pwdchecksyntax PWDCHECKSYNTAX] \[--pwdminlen PWDMINLEN] \[--pwdmindigits PWDMINDIGITS] \[--pwdminalphas PWDMINALPHAS] \[--pwdminuppers PWDMINUPPERS] \[--pwdminlowers PWDMINLOWERS] \[--pwdminspecials PWDMINSPECIALS] \[--pwdmin8bits PWDMIN8BITS] \[--pwdmaxrepeats PWDMAXREPEATS] \[--pwdpalindrome PWDPALINDROME] \[--pwdmaxseq PWDMAXSEQ] \[--pwdmaxseqsets PWDMAXSEQSETS] \[--pwdmaxclasschars PWDMAXCLASSCHARS] \[--pwdmincatagories PWDMINCATAGORIES] \[--pwdmintokenlen PWDMINTOKENLEN] \[--pwdbadwords PWDBADWORDS] \[--pwduserattrs PWDUSERATTRS] \[--pwddictcheck PWDDICTCHECK] \[--pwddictpath PWDDICTPATH] \[--pwptprmaxuse PWPTPRMAXUSE] \[--pwptprdelayexpireat PWPTPRDELAYEXPIREAT] \[--pwptprdelayvalidfrom PWPTPRDELAYVALIDFROM] DN [**DN**](#DN~21) Set the local policy for this entry DN # OPTIONS *'dsconf* *localpwp* *set'* [**--pwdscheme** *PWDSCHEME*](#pwdscheme~2) The password storage scheme [**--pwdchange** *PWDCHANGE*](#pwdchange~2) Allow users to change their passwords [**--pwdmustchange** *PWDMUSTCHANGE*](#pwdmustchange~2) Users must change their password after it was reset by an administrator [**--pwdhistory** *PWDHISTORY*](#pwdhistory~2) To enable password history set this to "on", otherwise "off" [**--pwdhistorycount** *PWDHISTORYCOUNT*](#pwdhistorycount~2) The number of passwords to keep in history [**--pwdadmin** *PWDADMIN*](#pwdadmin~2) The DN of an entry or a group of account that can bypass password policy constraints [**--pwdadminskipupdates** *PWDADMINSKIPUPDATES*](#pwdadminskipupdates~2) Set to "on" if the Password Admin's password update should not trigger updates to the password state attributes (passwordExpirationtime, passwordHistory, etc). [**--pwdtrack** *PWDTRACK*](#pwdtrack~2) Set to "on" to track the time the password was last changed [**--pwdwarning** *PWDWARNING*](#pwdwarning~2) Send an expiring warning if password expires within this time (in seconds) [**--pwdexpire** *PWDEXPIRE*](#pwdexpire~2) Set to "on" to enable password expiration [**--pwdmaxage** *PWDMAXAGE*](#pwdmaxage~2) The password expiration time in seconds [**--pwdminage** *PWDMINAGE*](#pwdminage~2) The number of seconds that must pass before a user can change their password [**--pwdgracelimit** *PWDGRACELIMIT*](#pwdgracelimit~2) The number of allowed logins after the password has expired [**--pwdsendexpiring** *PWDSENDEXPIRING*](#pwdsendexpiring~2) Set to "on" to always send the expiring control regardless of the warning period [**--pwdlockout** *PWDLOCKOUT*](#pwdlockout~2) Set to "on" to enable account lockout [**--pwdunlock** *PWDUNLOCK*](#pwdunlock~2) Set to "on" to allow an account to become unlocked after the lockout duration [**--pwdlockoutduration** *PWDLOCKOUTDURATION*](#pwdlockoutduration~2) The number of seconds an account stays locked out [**--pwdmaxfailures** *PWDMAXFAILURES*](#pwdmaxfailures~2) The maximum number of allowed failed password attempts before the account gets locked [**--pwdresetfailcount** *PWDRESETFAILCOUNT*](#pwdresetfailcount~2) The number of seconds to wait before reducing the failed login count on an account [**--pwdchecksyntax** *PWDCHECKSYNTAX*](#pwdchecksyntax~2) Set to "on" to enable password syntax checking [**--pwdminlen** *PWDMINLEN*](#pwdminlen~2) The minimum number of characters required in a password [**--pwdmindigits** *PWDMINDIGITS*](#pwdmindigits~2) The minimum number of digit/number characters in a password [**--pwdminalphas** *PWDMINALPHAS*](#pwdminalphas~2) The minimum number of alpha characters required in a password [**--pwdminuppers** *PWDMINUPPERS*](#pwdminuppers~2) The minimum number of uppercase characters required in a password [**--pwdminlowers** *PWDMINLOWERS*](#pwdminlowers~2) The minimum number of lowercase characters required in a password [**--pwdminspecials** *PWDMINSPECIALS*](#pwdminspecials~2) The minimum number of special characters required in a password [**--pwdmin8bits** *PWDMIN8BITS*](#pwdmin8bits~2) The minimum number of 8-bit characters required in a password [**--pwdmaxrepeats** *PWDMAXREPEATS*](#pwdmaxrepeats~2) The maximum number of times the same character can appear sequentially in the password [**--pwdpalindrome** *PWDPALINDROME*](#pwdpalindrome~2) Set to "on" to reject passwords that are palindromes [**--pwdmaxseq** *PWDMAXSEQ*](#pwdmaxseq~2) The maximum number of allowed monotonic character sequences in a password [**--pwdmaxseqsets** *PWDMAXSEQSETS*](#pwdmaxseqsets~2) The maximum number of allowed monotonic character sequences that can be duplicated in a password [**--pwdmaxclasschars** *PWDMAXCLASSCHARS*](#pwdmaxclasschars~2) The maximum number of sequential characters from the same character class that is allowed in a password [**--pwdmincatagories** *PWDMINCATAGORIES*](#pwdmincatagories~2) The minimum number of syntax category checks [**--pwdmintokenlen** *PWDMINTOKENLEN*](#pwdmintokenlen~2) Sets the smallest attribute value length that is used for trivial/user words checking. This also impacts "--pwduserattrs" [**--pwdbadwords** *PWDBADWORDS*](#pwdbadwords~2) A space-separated list of words that can not be in a password [**--pwduserattrs** *PWDUSERATTRS*](#pwduserattrs~2) A space-separated list of attributes whose values can not appear in the password (See "--pwdmintokenlen") [**--pwddictcheck** *PWDDICTCHECK*](#pwddictcheck~2) Set to "on" to enforce CrackLib dictionary checking [**--pwddictpath** *PWDDICTPATH*](#pwddictpath~2) Filesystem path to specific/custom CrackLib dictionary files [**--pwptprmaxuse** *PWPTPRMAXUSE*](#pwptprmaxuse~2) Number of times a reset password can be used for authentication [**--pwptprdelayexpireat** *PWPTPRDELAYEXPIREAT*](#pwptprdelayexpireat~2) Number of seconds after which a reset password expires [**--pwptprdelayvalidfrom** *PWPTPRDELAYVALIDFROM*](#pwptprdelayvalidfrom~2) Number of seconds to wait before using a reset password to authenticated # COMMAND *'dsconf* *localpwp* *remove'* usage: dsconf \[-v] \[-j] instance localpwp remove \[-h] DN [**DN**](#DN~22) Remove local policy for this entry DN # COMMAND *'dsconf* *localpwp* *adduser'* usage: dsconf \[-v] \[-j] instance localpwp adduser \[-h] \[--pwdscheme PWDSCHEME] \[--pwdchange PWDCHANGE] \[--pwdmustchange PWDMUSTCHANGE] \[--pwdhistory PWDHISTORY] \[--pwdhistorycount PWDHISTORYCOUNT] \[--pwdadmin PWDADMIN] \[--pwdadminskipupdates PWDADMINSKIPUPDATES] \[--pwdtrack PWDTRACK] \[--pwdwarning PWDWARNING] \[--pwdexpire PWDEXPIRE] \[--pwdmaxage PWDMAXAGE] \[--pwdminage PWDMINAGE] \[--pwdgracelimit PWDGRACELIMIT] \[--pwdsendexpiring PWDSENDEXPIRING] \[--pwdlockout PWDLOCKOUT] \[--pwdunlock PWDUNLOCK] \[--pwdlockoutduration PWDLOCKOUTDURATION] \[--pwdmaxfailures PWDMAXFAILURES] \[--pwdresetfailcount PWDRESETFAILCOUNT] \[--pwdchecksyntax PWDCHECKSYNTAX] \[--pwdminlen PWDMINLEN] \[--pwdmindigits PWDMINDIGITS] \[--pwdminalphas PWDMINALPHAS] \[--pwdminuppers PWDMINUPPERS] \[--pwdminlowers PWDMINLOWERS] \[--pwdminspecials PWDMINSPECIALS] \[--pwdmin8bits PWDMIN8BITS] \[--pwdmaxrepeats PWDMAXREPEATS] \[--pwdpalindrome PWDPALINDROME] \[--pwdmaxseq PWDMAXSEQ] \[--pwdmaxseqsets PWDMAXSEQSETS] \[--pwdmaxclasschars PWDMAXCLASSCHARS] \[--pwdmincatagories PWDMINCATAGORIES] \[--pwdmintokenlen PWDMINTOKENLEN] \[--pwdbadwords PWDBADWORDS] \[--pwduserattrs PWDUSERATTRS] \[--pwddictcheck PWDDICTCHECK] \[--pwddictpath PWDDICTPATH] \[--pwptprmaxuse PWPTPRMAXUSE] \[--pwptprdelayexpireat PWPTPRDELAYEXPIREAT] \[--pwptprdelayvalidfrom PWPTPRDELAYVALIDFROM] DN [**DN**](#DN~23) Add/replace the local password policy for this entry DN # OPTIONS *'dsconf* *localpwp* *adduser'* [**--pwdscheme** *PWDSCHEME*](#pwdscheme~3) The password storage scheme [**--pwdchange** *PWDCHANGE*](#pwdchange~3) Allow users to change their passwords [**--pwdmustchange** *PWDMUSTCHANGE*](#pwdmustchange~3) Users must change their password after it was reset by an administrator [**--pwdhistory** *PWDHISTORY*](#pwdhistory~3) To enable password history set this to "on", otherwise "off" [**--pwdhistorycount** *PWDHISTORYCOUNT*](#pwdhistorycount~3) The number of passwords to keep in history [**--pwdadmin** *PWDADMIN*](#pwdadmin~3) The DN of an entry or a group of account that can bypass password policy constraints [**--pwdadminskipupdates** *PWDADMINSKIPUPDATES*](#pwdadminskipupdates~3) Set to "on" if the Password Admin's password update should not trigger updates to the password state attributes (passwordExpirationtime, passwordHistory, etc). [**--pwdtrack** *PWDTRACK*](#pwdtrack~3) Set to "on" to track the time the password was last changed [**--pwdwarning** *PWDWARNING*](#pwdwarning~3) Send an expiring warning if password expires within this time (in seconds) [**--pwdexpire** *PWDEXPIRE*](#pwdexpire~3) Set to "on" to enable password expiration [**--pwdmaxage** *PWDMAXAGE*](#pwdmaxage~3) The password expiration time in seconds [**--pwdminage** *PWDMINAGE*](#pwdminage~3) The number of seconds that must pass before a user can change their password [**--pwdgracelimit** *PWDGRACELIMIT*](#pwdgracelimit~3) The number of allowed logins after the password has expired [**--pwdsendexpiring** *PWDSENDEXPIRING*](#pwdsendexpiring~3) Set to "on" to always send the expiring control regardless of the warning period [**--pwdlockout** *PWDLOCKOUT*](#pwdlockout~3) Set to "on" to enable account lockout [**--pwdunlock** *PWDUNLOCK*](#pwdunlock~3) Set to "on" to allow an account to become unlocked after the lockout duration [**--pwdlockoutduration** *PWDLOCKOUTDURATION*](#pwdlockoutduration~3) The number of seconds an account stays locked out [**--pwdmaxfailures** *PWDMAXFAILURES*](#pwdmaxfailures~3) The maximum number of allowed failed password attempts before the account gets locked [**--pwdresetfailcount** *PWDRESETFAILCOUNT*](#pwdresetfailcount~3) The number of seconds to wait before reducing the failed login count on an account [**--pwdchecksyntax** *PWDCHECKSYNTAX*](#pwdchecksyntax~3) Set to "on" to enable password syntax checking [**--pwdminlen** *PWDMINLEN*](#pwdminlen~3) The minimum number of characters required in a password [**--pwdmindigits** *PWDMINDIGITS*](#pwdmindigits~3) The minimum number of digit/number characters in a password [**--pwdminalphas** *PWDMINALPHAS*](#pwdminalphas~3) The minimum number of alpha characters required in a password [**--pwdminuppers** *PWDMINUPPERS*](#pwdminuppers~3) The minimum number of uppercase characters required in a password [**--pwdminlowers** *PWDMINLOWERS*](#pwdminlowers~3) The minimum number of lowercase characters required in a password [**--pwdminspecials** *PWDMINSPECIALS*](#pwdminspecials~3) The minimum number of special characters required in a password [**--pwdmin8bits** *PWDMIN8BITS*](#pwdmin8bits~3) The minimum number of 8-bit characters required in a password [**--pwdmaxrepeats** *PWDMAXREPEATS*](#pwdmaxrepeats~3) The maximum number of times the same character can appear sequentially in the password [**--pwdpalindrome** *PWDPALINDROME*](#pwdpalindrome~3) Set to "on" to reject passwords that are palindromes [**--pwdmaxseq** *PWDMAXSEQ*](#pwdmaxseq~3) The maximum number of allowed monotonic character sequences in a password [**--pwdmaxseqsets** *PWDMAXSEQSETS*](#pwdmaxseqsets~3) The maximum number of allowed monotonic character sequences that can be duplicated in a password [**--pwdmaxclasschars** *PWDMAXCLASSCHARS*](#pwdmaxclasschars~3) The maximum number of sequential characters from the same character class that is allowed in a password [**--pwdmincatagories** *PWDMINCATAGORIES*](#pwdmincatagories~3) The minimum number of syntax category checks [**--pwdmintokenlen** *PWDMINTOKENLEN*](#pwdmintokenlen~3) Sets the smallest attribute value length that is used for trivial/user words checking. This also impacts "--pwduserattrs" [**--pwdbadwords** *PWDBADWORDS*](#pwdbadwords~3) A space-separated list of words that can not be in a password [**--pwduserattrs** *PWDUSERATTRS*](#pwduserattrs~3) A space-separated list of attributes whose values can not appear in the password (See "--pwdmintokenlen") [**--pwddictcheck** *PWDDICTCHECK*](#pwddictcheck~3) Set to "on" to enforce CrackLib dictionary checking [**--pwddictpath** *PWDDICTPATH*](#pwddictpath~3) Filesystem path to specific/custom CrackLib dictionary files [**--pwptprmaxuse** *PWPTPRMAXUSE*](#pwptprmaxuse~3) Number of times a reset password can be used for authentication [**--pwptprdelayexpireat** *PWPTPRDELAYEXPIREAT*](#pwptprdelayexpireat~3) Number of seconds after which a reset password expires [**--pwptprdelayvalidfrom** *PWPTPRDELAYVALIDFROM*](#pwptprdelayvalidfrom~3) Number of seconds to wait before using a reset password to authenticated # COMMAND *'dsconf* *localpwp* *addsubtree'* usage: dsconf \[-v] \[-j] instance localpwp addsubtree \[-h] \[--pwdscheme PWDSCHEME] \[--pwdchange PWDCHANGE] \[--pwdmustchange PWDMUSTCHANGE] \[--pwdhistory PWDHISTORY] \[--pwdhistorycount PWDHISTORYCOUNT] \[--pwdadmin PWDADMIN] \[--pwdadminskipupdates PWDADMINSKIPUPDATES] \[--pwdtrack PWDTRACK] \[--pwdwarning PWDWARNING] \[--pwdexpire PWDEXPIRE] \[--pwdmaxage PWDMAXAGE] \[--pwdminage PWDMINAGE] \[--pwdgracelimit PWDGRACELIMIT] \[--pwdsendexpiring PWDSENDEXPIRING] \[--pwdlockout PWDLOCKOUT] \[--pwdunlock PWDUNLOCK] \[--pwdlockoutduration PWDLOCKOUTDURATION] \[--pwdmaxfailures PWDMAXFAILURES] \[--pwdresetfailcount PWDRESETFAILCOUNT] \[--pwdchecksyntax PWDCHECKSYNTAX] \[--pwdminlen PWDMINLEN] \[--pwdmindigits PWDMINDIGITS] \[--pwdminalphas PWDMINALPHAS] \[--pwdminuppers PWDMINUPPERS] \[--pwdminlowers PWDMINLOWERS] \[--pwdminspecials PWDMINSPECIALS] \[--pwdmin8bits PWDMIN8BITS] \[--pwdmaxrepeats PWDMAXREPEATS] \[--pwdpalindrome PWDPALINDROME] \[--pwdmaxseq PWDMAXSEQ] \[--pwdmaxseqsets PWDMAXSEQSETS] \[--pwdmaxclasschars PWDMAXCLASSCHARS] \[--pwdmincatagories PWDMINCATAGORIES] \[--pwdmintokenlen PWDMINTOKENLEN] \[--pwdbadwords PWDBADWORDS] \[--pwduserattrs PWDUSERATTRS] \[--pwddictcheck PWDDICTCHECK] \[--pwddictpath PWDDICTPATH] \[--pwptprmaxuse PWPTPRMAXUSE] \[--pwptprdelayexpireat PWPTPRDELAYEXPIREAT] \[--pwptprdelayvalidfrom PWPTPRDELAYVALIDFROM] DN [**DN**](#DN~24) Add/replace the subtree policy for this entry DN # OPTIONS *'dsconf* *localpwp* *addsubtree'* [**--pwdscheme** *PWDSCHEME*](#pwdscheme~4) The password storage scheme [**--pwdchange** *PWDCHANGE*](#pwdchange~4) Allow users to change their passwords [**--pwdmustchange** *PWDMUSTCHANGE*](#pwdmustchange~4) Users must change their password after it was reset by an administrator [**--pwdhistory** *PWDHISTORY*](#pwdhistory~4) To enable password history set this to "on", otherwise "off" [**--pwdhistorycount** *PWDHISTORYCOUNT*](#pwdhistorycount~4) The number of passwords to keep in history [**--pwdadmin** *PWDADMIN*](#pwdadmin~4) The DN of an entry or a group of account that can bypass password policy constraints [**--pwdadminskipupdates** *PWDADMINSKIPUPDATES*](#pwdadminskipupdates~4) Set to "on" if the Password Admin's password update should not trigger updates to the password state attributes (passwordExpirationtime, passwordHistory, etc). [**--pwdtrack** *PWDTRACK*](#pwdtrack~4) Set to "on" to track the time the password was last changed [**--pwdwarning** *PWDWARNING*](#pwdwarning~4) Send an expiring warning if password expires within this time (in seconds) [**--pwdexpire** *PWDEXPIRE*](#pwdexpire~4) Set to "on" to enable password expiration [**--pwdmaxage** *PWDMAXAGE*](#pwdmaxage~4) The password expiration time in seconds [**--pwdminage** *PWDMINAGE*](#pwdminage~4) The number of seconds that must pass before a user can change their password [**--pwdgracelimit** *PWDGRACELIMIT*](#pwdgracelimit~4) The number of allowed logins after the password has expired [**--pwdsendexpiring** *PWDSENDEXPIRING*](#pwdsendexpiring~4) Set to "on" to always send the expiring control regardless of the warning period [**--pwdlockout** *PWDLOCKOUT*](#pwdlockout~4) Set to "on" to enable account lockout [**--pwdunlock** *PWDUNLOCK*](#pwdunlock~4) Set to "on" to allow an account to become unlocked after the lockout duration [**--pwdlockoutduration** *PWDLOCKOUTDURATION*](#pwdlockoutduration~4) The number of seconds an account stays locked out [**--pwdmaxfailures** *PWDMAXFAILURES*](#pwdmaxfailures~4) The maximum number of allowed failed password attempts before the account gets locked [**--pwdresetfailcount** *PWDRESETFAILCOUNT*](#pwdresetfailcount~4) The number of seconds to wait before reducing the failed login count on an account [**--pwdchecksyntax** *PWDCHECKSYNTAX*](#pwdchecksyntax~4) Set to "on" to enable password syntax checking [**--pwdminlen** *PWDMINLEN*](#pwdminlen~4) The minimum number of characters required in a password [**--pwdmindigits** *PWDMINDIGITS*](#pwdmindigits~4) The minimum number of digit/number characters in a password [**--pwdminalphas** *PWDMINALPHAS*](#pwdminalphas~4) The minimum number of alpha characters required in a password [**--pwdminuppers** *PWDMINUPPERS*](#pwdminuppers~4) The minimum number of uppercase characters required in a password [**--pwdminlowers** *PWDMINLOWERS*](#pwdminlowers~4) The minimum number of lowercase characters required in a password [**--pwdminspecials** *PWDMINSPECIALS*](#pwdminspecials~4) The minimum number of special characters required in a password [**--pwdmin8bits** *PWDMIN8BITS*](#pwdmin8bits~4) The minimum number of 8-bit characters required in a password [**--pwdmaxrepeats** *PWDMAXREPEATS*](#pwdmaxrepeats~4) The maximum number of times the same character can appear sequentially in the password [**--pwdpalindrome** *PWDPALINDROME*](#pwdpalindrome~4) Set to "on" to reject passwords that are palindromes [**--pwdmaxseq** *PWDMAXSEQ*](#pwdmaxseq~4) The maximum number of allowed monotonic character sequences in a password [**--pwdmaxseqsets** *PWDMAXSEQSETS*](#pwdmaxseqsets~4) The maximum number of allowed monotonic character sequences that can be duplicated in a password [**--pwdmaxclasschars** *PWDMAXCLASSCHARS*](#pwdmaxclasschars~4) The maximum number of sequential characters from the same character class that is allowed in a password [**--pwdmincatagories** *PWDMINCATAGORIES*](#pwdmincatagories~4) The minimum number of syntax category checks [**--pwdmintokenlen** *PWDMINTOKENLEN*](#pwdmintokenlen~4) Sets the smallest attribute value length that is used for trivial/user words checking. This also impacts "--pwduserattrs" [**--pwdbadwords** *PWDBADWORDS*](#pwdbadwords~4) A space-separated list of words that can not be in a password [**--pwduserattrs** *PWDUSERATTRS*](#pwduserattrs~4) A space-separated list of attributes whose values can not appear in the password (See "--pwdmintokenlen") [**--pwddictcheck** *PWDDICTCHECK*](#pwddictcheck~4) Set to "on" to enforce CrackLib dictionary checking [**--pwddictpath** *PWDDICTPATH*](#pwddictpath~4) Filesystem path to specific/custom CrackLib dictionary files [**--pwptprmaxuse** *PWPTPRMAXUSE*](#pwptprmaxuse~4) Number of times a reset password can be used for authentication [**--pwptprdelayexpireat** *PWPTPRDELAYEXPIREAT*](#pwptprdelayexpireat~4) Number of seconds after which a reset password expires [**--pwptprdelayvalidfrom** *PWPTPRDELAYVALIDFROM*](#pwptprdelayvalidfrom~4) Number of seconds to wait before using a reset password to authenticated # COMMAND *'dsconf* *replication'* usage: dsconf \[-v] \[-j] instance replication \[-h] {enable,disable,get-ruv,list,status,winsync-status,promote,create-manager,delete-manager,demote,get,set-changelog,get-changelog,export-changelog,import-changelog,set,monitor,lag-report} ... # POSITIONAL ARGUMENTS *'dsconf replication'* [**dsconf replication** *enable*](#dsconf~424) Enable replication for a suffix [**dsconf replication** *disable*](#dsconf~425) Disable replication for a suffix [**dsconf replication** *get-ruv*](#dsconf~426) Display the database RUV entry for a suffix [**dsconf replication** *list*](#dsconf~427) Lists all the replicated suffixes [**dsconf replication** *status*](#dsconf~428) Display the current status of all the replication agreements [**dsconf replication** *winsync-status*](#dsconf~429) Display the current status of all the replication agreements [**dsconf replication** *promote*](#dsconf~430) Promote a replica to a hub or supplier [**dsconf replication** *create-manager*](#dsconf~431) Create a replication manager entry [**dsconf replication** *delete-manager*](#dsconf~432) Delete a replication manager entry [**dsconf replication** *demote*](#dsconf~433) Demote replica to a hub or consumer [**dsconf replication** *get*](#dsconf~434) Display the replication configuration [**dsconf replication** *set-changelog*](#dsconf~435) Set replication changelog attributes [**dsconf replication** *get-changelog*](#dsconf~436) Display replication changelog attributes [**dsconf replication** *export-changelog*](#dsconf~437) Export the Directory Server replication changelog to an LDIF file [**dsconf replication** *import-changelog*](#dsconf~438) Restore/import Directory Server replication change log from an LDIF file. This is typically used when managing changelog encryption [**dsconf replication** *set*](#dsconf~439) Set an attribute in the replication configuration [**dsconf replication** *monitor*](#dsconf~440) Display the full replication topology report [**dsconf replication** *lag-report*](#dsconf~441) Generate detailed replication lag monitoring report # COMMAND *'dsconf* *replication* *enable'* usage: dsconf \[-v] \[-j] instance replication enable \[-h] --suffix SUFFIX \--role ROLE \[--replica-id REPLICA\_ID] \[--bind-group-dn BIND\_GROUP\_DN] \[--bind-dn BIND\_DN] \[--bind-passwd BIND\_PASSWD] \[--bind-passwd-file BIND\_PASSWD\_FILE] \[--bind-passwd-prompt] # OPTIONS *'dsconf* *replication* *enable'* [**--suffix** *SUFFIX*](#suffix~8) Sets the DN of the suffix to be enabled for replication [**--role** *ROLE*](#role) Sets the replication role: "supplier", "hub", or "consumer" [**--replica-id** *REPLICA\_ID*](#replica) Sets the replication identifier for a "supplier". Values range from 1 - 65534 [**--bind-group-dn** *BIND\_GROUP\_DN*](#bind~20) Sets a group entry DN containing members that are "bind/supplier" DNs [**--bind-dn** *BIND\_DN*](#bind~21) Sets the bind or supplier DN that can make replication updates [**--bind-passwd** *BIND\_PASSWD*](#bind~22) Sets the password for replication manager (--bind-dn). This will create the manager entry if a value is set [**--bind-passwd-file** *BIND\_PASSWD\_FILE*](#bind~23) File containing the password [**--bind-passwd-prompt**](#bind~24) Prompt for password # COMMAND *'dsconf* *replication* *disable'* usage: dsconf \[-v] \[-j] instance replication disable \[-h] --suffix SUFFIX # OPTIONS *'dsconf* *replication* *disable'* [**--suffix** *SUFFIX*](#suffix~9) Sets the DN of the suffix to have replication disabled # COMMAND *'dsconf* *replication* *get-ruv'* usage: dsconf \[-v] \[-j] instance replication get-ruv \[-h] --suffix SUFFIX # OPTIONS *'dsconf* *replication* *get-ruv'* [**--suffix** *SUFFIX*](#suffix~10) Sets the DN of the replicated suffix # COMMAND *'dsconf* *replication* *list'* usage: dsconf \[-v] \[-j] instance replication list \[-h] # COMMAND *'dsconf* *replication* *status'* usage: dsconf \[-v] \[-j] instance replication status \[-h] --suffix SUFFIX \[--bind-dn BIND\_DN] \[--bind-passwd BIND\_PASSWD] \[--bind-passwd-file BIND\_PASSWD\_FILE] \[--bind-passwd-prompt] # OPTIONS *'dsconf* *replication* *status'* [**--suffix** *SUFFIX*](#suffix~11) Sets the DN of the replication suffix [**--bind-dn** *BIND\_DN*](#bind~25) Sets the DN to use to authenticate to the consumer. If not set, current instance's root DN will be used. It will be used for all agreements [**--bind-passwd** *BIND\_PASSWD*](#bind~26) Sets the password for the bind DN. It will be used for all agreements [**--bind-passwd-file** *BIND\_PASSWD\_FILE*](#bind~27) File containing the password. It will be used for all agreements [**--bind-passwd-prompt**](#bind~28) Prompt for passwords for each agreement's instance separately # COMMAND *'dsconf* *replication* *winsync-status'* usage: dsconf instance \[-v] \[-j] replication winsync-status \[-h] --suffix SUFFIX \[--bind-dn BIND\_DN] \[--bind-passwd BIND\_PASSWD] \[--bind-passwd-file BIND\_PASSWD\_FILE] \[--bind-passwd-prompt] # OPTIONS *'dsconf* *replication* *winsync-status'* [**--suffix** *SUFFIX*](#suffix~12) Sets the DN of the replication suffix [**--bind-dn** *BIND\_DN*](#bind~29) Sets the DN to use to authenticate to the consumer. Currectly not used [**--bind-passwd** *BIND\_PASSWD*](#bind~30) Sets the password of the bind DN. Currectly not used [**--bind-passwd-file** *BIND\_PASSWD\_FILE*](#bind~31) File containing the password. Currectly not used [**--bind-passwd-prompt**](#bind~32) Prompt for password. Currectly not used # COMMAND *'dsconf* *replication* *promote'* usage: dsconf \[-v] \[-j] instance replication promote \[-h] --suffix SUFFIX \--newrole NEWROLE \[--replica-id REPLICA\_ID] \[--bind-group-dn BIND\_GROUP\_DN] \[--bind-dn BIND\_DN] # OPTIONS *'dsconf* *replication* *promote'* [**--suffix** *SUFFIX*](#suffix~13) Sets the DN of the replication suffix to promote [**--newrole** *NEWROLE*](#newrole) Sets the new replica role to "hub" or "supplier" [**--replica-id** *REPLICA\_ID*](#replica~2) Sets the replication identifier for a "supplier". Values range from 1 - 65534 [**--bind-group-dn** *BIND\_GROUP\_DN*](#bind~33) Sets a group entry DN containing members that are "bind/supplier" DNs [**--bind-dn** *BIND\_DN*](#bind~34) Sets the bind or supplier DN that can make replication updates # COMMAND *'dsconf* *replication* *create-manager'* usage: dsconf \[-v] \[-j] instance replication create-manager \[-h] \[--name NAME] \[--passwd PASSWD] \[--passwd-file PASSWD\_FILE] \[--bind-passwd-file BIND\_PASSWD\_FILE] \[--suffix SUFFIX] # OPTIONS *'dsconf* *replication* *create-manager'* [**--name** *NAME*](#name~5) Sets the name of the new replication manager entry.For example, if the name is "replication manager" then the new manager entry's DN would be "cn=replication manager,cn=config". [**--passwd** *PASSWD*](#passwd) Sets the password for replication manager. If not provided, you will be prompted for the password [**--passwd-file** *PASSWD\_FILE*](#passwd~2) File containing the password for back compatibility [**--bind-passwd-file** *BIND\_PASSWD\_FILE*](#bind~35) File containing the password [**--suffix** *SUFFIX*](#suffix~14) The DN of the replication suffix whose replication configuration you want to add this new manager to (OPTIONAL) # COMMAND *'dsconf* *replication* *delete-manager'* usage: dsconf \[-v] \[-j] instance replication delete-manager \[-h] \[--name NAME] \[--suffix SUFFIX] # OPTIONS *'dsconf* *replication* *delete-manager'* [**--name** *NAME*](#name~6) Sets the name of the replication manager entry under cn=config: "cn=NAME,cn=config" [**--suffix** *SUFFIX*](#suffix~15) Sets the DN of the replication suffix whose replication configuration you want to remove this manager from (OPTIONAL) # COMMAND *'dsconf* *replication* *demote'* usage: dsconf \[-v] \[-j] instance replication demote \[-h] --suffix SUFFIX \--newrole NEWROLE # OPTIONS *'dsconf* *replication* *demote'* [**--suffix** *SUFFIX*](#suffix~16) Sets the DN of the replication suffix [**--newrole** *NEWROLE*](#newrole~2) Sets the new replication role to "hub", or "consumer" # COMMAND *'dsconf* *replication* *get'* usage: dsconf \[-v] \[-j] instance replication get \[-h] --suffix SUFFIX # OPTIONS *'dsconf* *replication* *get'* [**--suffix** *SUFFIX*](#suffix~17) Sets the suffix DN for the replication configuration to display # COMMAND *'dsconf* *replication* *set-changelog'* usage: dsconf \[-v] \[-j] instance replication set-changelog \[-h] \--suffix SUFFIX \[--max-entries MAX\_ENTRIES] \[--max-age MAX\_AGE] \[--trim-interval TRIM\_INTERVAL] \[--encrypt] \[--disable-encrypt] # OPTIONS *'dsconf* *replication* *set-changelog'* [**--suffix** *SUFFIX*](#suffix~18) Sets the suffix that uses the changelog [**--max-entries** *MAX\_ENTRIES*](#max~8) Sets the maximum number of entries to get in the replication changelog [**--max-age** *MAX\_AGE*](#max~9) Specifies the maximum age of any entry in the changelog. The value must be a number followed by a duration unit \[sSmMhHdDwW]. [**--trim-interval** *TRIM\_INTERVAL*](#trim~4) Sets the interval to check if the replication changelog can be trimmed [**--encrypt**](#encrypt) Sets the replication changelog to use encryption. You must export and import the changelog after setting this. [**--disable-encrypt**](#disable~5) Sets the replication changelog to not use encryption. You must export and import the changelog after setting this. # COMMAND *'dsconf* *replication* *get-changelog'* usage: dsconf \[-v] \[-j] instance replication get-changelog \[-h] \--suffix SUFFIX # OPTIONS *'dsconf* *replication* *get-changelog'* [**--suffix** *SUFFIX*](#suffix~19) Sets the suffix that uses the changelog # COMMAND *'dsconf* *replication* *export-changelog'* usage: dsconf \[-v] \[-j] instance replication export-changelog \[-h] {to-ldif,default} ... # POSITIONAL ARGUMENTS *'dsconf replication export-changelog'* [**dsconf replication export-changelog** *to-ldif*](#dsconf~442) Sets the LDIF file name. This is typically used for setting up changelog encryption [**dsconf replication export-changelog** *default*](#dsconf~443) Export the replication changelog to the server's default LDIF directory # COMMAND *'dsconf* *replication* *export-changelog* *to-ldif'* usage: dsconf instance \[-v] \[-j] replication export-changelog to-ldif \[-h] \[-c] \[-d] \[-l] \[-i CHANGELOG\_LDIF] -o OUTPUT\_FILE -r REPLICA\_ROOT # OPTIONS *'dsconf* *replication* *export-changelog* *to-ldif'* [**-c**, **--csn-only**](#c~2) Enables to export and interpret CSN only. This option can be used with or without -i option. The LDIF file that is generated can not be imported and is only used for debugging purposes. [**-d**, **--decode**](#d) Decodes the base64 values in each changelog entry. The LDIF file that is generated can not be imported and is only used for debugging purposes. [**-l**, **--preserve-ldif-done**](#l~3) Preserves generated LDIF "files.done" files in changelog directory. [**-i** *CHANGELOG\_LDIF*, **--changelog-ldif** *CHANGELOG\_LDIF*](#i) Decodes changes in an LDIF file. Use this option if you already have a changelog LDIF file, but the changes in that file are encoded. [**-o** *OUTPUT\_FILE*, **--output-file** *OUTPUT\_FILE*](#o) Sets the path name for the final result [**-r** *REPLICA\_ROOT*, **--replica-root** *REPLICA\_ROOT*](#r~3) Specifies the replica root whose changelog you want to export # COMMAND *'dsconf* *replication* *export-changelog* *default'* usage: dsconf \[-v] \[-j] instance replication export-changelog default \[-h] -r REPLICA\_ROOT # OPTIONS *'dsconf* *replication* *export-changelog* *default'* [**-r** *REPLICA\_ROOT*, **--replica-root** *REPLICA\_ROOT*](#r~4) Specifies the replica root whose changelog you want to export # COMMAND *'dsconf* *replication* *import-changelog'* usage: dsconf instance \[-v] \[-j] replication import-changelog \[-h] {from-ldif,default} ... # POSITIONAL ARGUMENTS *'dsconf replication import-changelog'* [**dsconf replication import-changelog** *from-ldif*](#dsconf~444) Restore/import a specific single LDIF file [**dsconf replication import-changelog** *default*](#dsconf~445) Import the default changelog LDIF file created by the server # COMMAND *'dsconf* *replication* *import-changelog* *from-ldif'* usage: dsconf \[-v] \[-j] instance replication import-changelog from-ldif \[-h] -r REPLICA\_ROOT LDIF\_PATH [**LDIF\_PATH**](#LDIF_PATH) The path of the changelog LDIF file # OPTIONS *'dsconf* *replication* *import-changelog* *from-ldif'* [**-r** *REPLICA\_ROOT*, **--replica-root** *REPLICA\_ROOT*](#r~5) Specifies the replica root whose changelog you want to import # COMMAND *'dsconf* *replication* *import-changelog* *default'* usage: dsconf instance \[-v] \[-j] replication import-changelog default \[-h] -r REPLICA\_ROOT # OPTIONS *'dsconf* *replication* *import-changelog* *default'* [**-r** *REPLICA\_ROOT*, **--replica-root** *REPLICA\_ROOT*](#r~6) Specifies the replica root whose changelog you want to import # COMMAND *'dsconf* *replication* *set'* usage: dsconf \[-v] \[-j] instance replication set \[-h] --suffix SUFFIX \[--repl-add-bind-dn REPL\_ADD\_BIND\_DN] \[--repl-del-bind-dn REPL\_DEL\_BIND\_DN] \[--repl-add-ref REPL\_ADD\_REF] \[--repl-del-ref REPL\_DEL\_REF] \[--repl-purge-delay REPL\_PURGE\_DELAY] \[--repl-tombstone-purge-interval REPL\_TOMBSTONE\_PURGE\_INTERVAL] \[--repl-fast-tombstone-purging REPL\_FAST\_TOMBSTONE\_PURGING] \[--repl-bind-group REPL\_BIND\_GROUP] \[--repl-bind-group-interval REPL\_BIND\_GROUP\_INTERVAL] \[--repl-protocol-timeout REPL\_PROTOCOL\_TIMEOUT] \[--repl-backoff-max REPL\_BACKOFF\_MAX] \[--repl-backoff-min REPL\_BACKOFF\_MIN] \[--repl-release-timeout REPL\_RELEASE\_TIMEOUT] \[--repl-keepalive-update-interval REPL\_KEEPALIVE\_UPDATE\_INTERVAL] # OPTIONS *'dsconf* *replication* *set'* [**--suffix** *SUFFIX*](#suffix~20) Sets the DN of the replication suffix [**--repl-add-bind-dn** *REPL\_ADD\_BIND\_DN*](#repl) Adds a bind (supplier) DN [**--repl-del-bind-dn** *REPL\_DEL\_BIND\_DN*](#repl~2) Removes a bind (supplier) DN [**--repl-add-ref** *REPL\_ADD\_REF*](#repl~3) Adds a replication referral (for consumers only) [**--repl-del-ref** *REPL\_DEL\_REF*](#repl~4) Removes a replication referral (for conusmers only) [**--repl-purge-delay** *REPL\_PURGE\_DELAY*](#repl~5) Sets the replication purge delay [**--repl-tombstone-purge-interval** *REPL\_TOMBSTONE\_PURGE\_INTERVAL*](#repl~6) Sets the interval in seconds to check for tombstones that can be purged [**--repl-fast-tombstone-purging** *REPL\_FAST\_TOMBSTONE\_PURGING*](#repl~7) Enables or disables improving the tombstone purging performance [**--repl-bind-group** *REPL\_BIND\_GROUP*](#repl~8) Sets a group entry DN containing members that are "bind/supplier" DNs [**--repl-bind-group-interval** *REPL\_BIND\_GROUP\_INTERVAL*](#repl~9) Sets an interval in seconds to check if the bind group has been updated [**--repl-protocol-timeout** *REPL\_PROTOCOL\_TIMEOUT*](#repl~10) Sets a timeout in seconds on how long to wait before stopping replication when the server is under load [**--repl-backoff-max** *REPL\_BACKOFF\_MAX*](#repl~11) The maximum time in seconds a replication agreement should stay in a backoff state while waiting to acquire the consumer. Default is 300 seconds [**--repl-backoff-min** *REPL\_BACKOFF\_MIN*](#repl~12) The starting time in seconds a replication agreement should stay in a backoff state while waiting to acquire the consumer. Default is 3 seconds [**--repl-release-timeout** *REPL\_RELEASE\_TIMEOUT*](#repl~13) A timeout in seconds a replication supplier should send updates before it yields its replication session [**--repl-keepalive-update-interval** *REPL\_KEEPALIVE\_UPDATE\_INTERVAL*](#repl~14) Interval in seconds for how often the server will apply an internal update to keep the RUV from getting stale. The default is 1 hour (3600 seconds) # COMMAND *'dsconf* *replication* *monitor'* usage: dsconf \[-v] \[-j] instance replication monitor \[-h] \[-c \[CONNECTIONS ...]] \[-a \[ALIASES ...]] # OPTIONS *'dsconf* *replication* *monitor'* [**-c** *\[CONNECTIONS ...\]*, **--connections** *\[CONNECTIONS ...\]*](#c~3) Sets the connection values for monitoring other not connected topologies. The format: 'host:port:binddn:bindpwd'. You can use regex for host and port. You can set bindpwd to * and it will be requested at the runtime or you can include the path to the password file in square brackets - \[~/pwd.txt] [**-a** *\[ALIASES ...\]*, **--aliases** *\[ALIASES ...\]*](#a) Enables displaying an alias instead of host:port, if an alias is assigned to a host:port combination. The format: alias=host:port # COMMAND *'dsconf* *replication* *lag-report'* usage: dsconf \[-v] \[-j] instance replication lag-report \[-h] \--log-dirs LOG\_DIRS \[LOG\_DIRS ...] \--suffixes SUFFIXES \[SUFFIXES ...] \--output-dir OUTPUT\_DIR \[--output-format OUTPUT\_FORMAT \[OUTPUT\_FORMAT ...]] \[--json] [--only-fully-replicated | \--only-not-replicated] \[--lag-time-lowest LAG\_TIME\_LOWEST] \[--etime-lowest ETIME\_LOWEST] \[--start-time START\_TIME] \[--end-time END\_TIME] \[--utc-offset UTC\_OFFSET] \[--anonymous] \[--precision {fast,balanced,full}] \[--max-chart-points MAX\_CHART\_POINTS] # [INPUT OPTIONS *'dsconf* *replication* *lag-report'*](#INPUT_OPTIONS_) [**--log-dirs** *LOG\_DIRS \[LOG\_DIRS ...\]*](#log~4) List of log directories to analyze [**--suffixes** *SUFFIXES \[SUFFIXES ...\]*](#suffixes) List of suffixes to analyze # [OUTPUT OPTIONS *'dsconf* *replication* *lag-report'*](#OUTPUT_OPTIONS_) [**--output-dir** *OUTPUT\_DIR*](#output) Directory to write analysis reports to [**--output-format** *OUTPUT\_FORMAT \[OUTPUT\_FORMAT ...\]*](#output~2) One or more output formats: html, json, png, csv. Default: html [**--json**](#json) Output the result as JSON (for UI integration/programmatic use) # [FILTERING OPTIONS *'dsconf* *replication* *lag-report'*](#FILTERING_OPTIONS_) [**--only-fully-replicated**](#only~2) Show only fully replicated entries [**--only-not-replicated**](#only~3) Show only entries that failed to replicate [**--lag-time-lowest** *LAG\_TIME\_LOWEST*](#lag) Filter entries with lag time above this threshold (seconds) [**--etime-lowest** *ETIME\_LOWEST*](#etime) Filter entries with etime above this threshold (seconds) # [TIME RANGE OPTIONS *'dsconf* *replication* *lag-report'*](#TIME_RANGE_OPTIONS_) [**--start-time** *START\_TIME*](#start) Start time for analysis (YYYY-MM-DD HH:MM:SS) [**--end-time** *END\_TIME*](#end) End time for analysis (YYYY-MM-DD HH:MM:SS) # [ADDITIONAL OPTIONS *'dsconf* *replication* *lag-report'*](#ADDITIONAL_OPTIONS_) [**--utc-offset** *UTC\_OFFSET*](#utc) UTC offset in ±HHMM format (e.g., -0400, +0530) [**--anonymous**](#anonymous) Anonymize server names in the report # [PERFORMANCE OPTIONS *'dsconf* *replication* *lag-report'*](#PERFORMANCE_OPTIONS_) [**--precision** *{fast,balanced,full}*](#precision) Analysis precision vs speed: fast (more sampling), balanced (default), full (no sampling) [**--max-chart-points** *MAX\_CHART\_POINTS*](#max~10) Maximum total data points to include across all chart series (sampling applied if exceeded). Default depends on --precision # COMMAND *'dsconf* *repl-agmt'* usage: dsconf \[-v] \[-j] instance repl-agmt \[-h] {list,enable,disable,init,init-status,poke,status,delete,create,set,get} ... # POSITIONAL ARGUMENTS *'dsconf repl-agmt'* [**dsconf repl-agmt** *list*](#dsconf~446) List all replication agreements [**dsconf repl-agmt** *enable*](#dsconf~447) Enable replication agreement [**dsconf repl-agmt** *disable*](#dsconf~448) Disable replication agreement [**dsconf repl-agmt** *init*](#dsconf~449) Initialize replication agreement [**dsconf repl-agmt** *init-status*](#dsconf~450) Check the agreement initialization status [**dsconf repl-agmt** *poke*](#dsconf~451) Trigger replication to send updates now [**dsconf repl-agmt** *status*](#dsconf~452) Displays the current status of the replication agreement [**dsconf repl-agmt** *delete*](#dsconf~453) Delete replication agreement [**dsconf repl-agmt** *create*](#dsconf~454) Initialize replication agreement [**dsconf repl-agmt** *set*](#dsconf~455) Set an attribute in the replication agreement [**dsconf repl-agmt** *get*](#dsconf~456) Get replication configuration # COMMAND *'dsconf* *repl-agmt* *list'* usage: dsconf \[-v] \[-j] instance repl-agmt list \[-h] --suffix SUFFIX \[--entry ENTRY] # OPTIONS *'dsconf* *repl-agmt* *list'* [**--suffix** *SUFFIX*](#suffix~21) Sets the DN of the suffix to look up replication agreements for [**--entry** *ENTRY*](#entry~4) Returns the entire entry for each agreement # COMMAND *'dsconf* *repl-agmt* *enable'* usage: dsconf \[-v] \[-j] instance repl-agmt enable \[-h] --suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME) The name of the replication agreement # OPTIONS *'dsconf* *repl-agmt* *enable'* [**--suffix** *SUFFIX*](#suffix~22) Sets the DN of the replication suffix # COMMAND *'dsconf* *repl-agmt* *disable'* usage: dsconf \[-v] \[-j] instance repl-agmt disable \[-h] --suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~2) The name of the replication agreement # OPTIONS *'dsconf* *repl-agmt* *disable'* [**--suffix** *SUFFIX*](#suffix~23) Sets the DN of the replication suffix # COMMAND *'dsconf* *repl-agmt* *init'* usage: dsconf \[-v] \[-j] instance repl-agmt init \[-h] --suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~3) The name of the replication agreement # OPTIONS *'dsconf* *repl-agmt* *init'* [**--suffix** *SUFFIX*](#suffix~24) Sets the DN of the replication suffix # COMMAND *'dsconf* *repl-agmt* *init-status'* usage: dsconf \[-v] \[-j] instance repl-agmt init-status \[-h] --suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~4) The name of the replication agreement # OPTIONS *'dsconf* *repl-agmt* *init-status'* [**--suffix** *SUFFIX*](#suffix~25) Sets the DN of the replication suffix # COMMAND *'dsconf* *repl-agmt* *poke'* usage: dsconf \[-v] \[-j] instance repl-agmt poke \[-h] --suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~5) The name of the replication agreement # OPTIONS *'dsconf* *repl-agmt* *poke'* [**--suffix** *SUFFIX*](#suffix~26) Sets the DN of the replication suffix # COMMAND *'dsconf* *repl-agmt* *status'* usage: dsconf \[-v] \[-j] instance repl-agmt status \[-h] --suffix SUFFIX \[--bind-dn BIND\_DN] \[--bind-passwd BIND\_PASSWD] \[--bind-passwd-file BIND\_PASSWD\_FILE] \[--bind-passwd-prompt] AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~6) The name of the replication agreement # OPTIONS *'dsconf* *repl-agmt* *status'* [**--suffix** *SUFFIX*](#suffix~27) Sets the DN of the replication suffix [**--bind-dn** *BIND\_DN*](#bind~36) Sets the DN to use to authenticate to the consumer. If not set, current instance's root DN will be used. It will be used for all agreements [**--bind-passwd** *BIND\_PASSWD*](#bind~37) Sets the password for the bind DN. It will be used for all agreements [**--bind-passwd-file** *BIND\_PASSWD\_FILE*](#bind~38) File containing the password. It will be used for all agreements [**--bind-passwd-prompt**](#bind~39) Prompt for passwords for each agreement's instance separately # COMMAND *'dsconf* *repl-agmt* *delete'* usage: dsconf \[-v] \[-j] instance repl-agmt delete \[-h] --suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~7) The name of the replication agreement # OPTIONS *'dsconf* *repl-agmt* *delete'* [**--suffix** *SUFFIX*](#suffix~28) Sets the DN of the replication suffix # COMMAND *'dsconf* *repl-agmt* *create'* usage: dsconf \[-v] \[-j] instance repl-agmt create \[-h] --suffix SUFFIX \--host HOST --port PORT \--conn-protocol CONN\_PROTOCOL \[--bind-dn BIND\_DN] \[--bind-passwd BIND\_PASSWD] \[--bind-passwd-file BIND\_PASSWD\_FILE] \[--bind-passwd-prompt] \--bind-method BIND\_METHOD \[--frac-list FRAC\_LIST] \[--frac-list-total FRAC\_LIST\_TOTAL] \[--strip-list STRIP\_LIST] \[--schedule SCHEDULE] \[--conn-timeout CONN\_TIMEOUT] \[--protocol-timeout PROTOCOL\_TIMEOUT] \[--wait-async-results WAIT\_ASYNC\_RESULTS] \[--busy-wait-time BUSY\_WAIT\_TIME] \[--session-pause-time SESSION\_PAUSE\_TIME] \[--flow-control-window FLOW\_CONTROL\_WINDOW] \[--flow-control-pause FLOW\_CONTROL\_PAUSE] \[--bootstrap-bind-dn BOOTSTRAP\_BIND\_DN] \[--bootstrap-bind-passwd BOOTSTRAP\_BIND\_PASSWD] \[--bootstrap-bind-passwd-file BOOTSTRAP\_BIND\_PASSWD\_FILE] \[--bootstrap-bind-passwd-prompt] \[--bootstrap-conn-protocol BOOTSTRAP\_CONN\_PROTOCOL] \[--bootstrap-bind-method BOOTSTRAP\_BIND\_METHOD] \[--init] AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~8) The name of the replication agreement # OPTIONS *'dsconf* *repl-agmt* *create'* [**--suffix** *SUFFIX*](#suffix~29) Sets the DN of the replication suffix [**--host** *HOST*](#host) Sets the hostname of the remote replica [**--port** *PORT*](#port) Sets the port number of the remote replica [**--conn-protocol** *CONN\_PROTOCOL*](#conn~10) Sets the replication connection protocol: LDAP, LDAPS, or StartTLS [**--bind-dn** *BIND\_DN*](#bind~40) Sets the bind DN the agreement uses to authenticate to the replica [**--bind-passwd** *BIND\_PASSWD*](#bind~41) Sets the credentials for the bind DN [**--bind-passwd-file** *BIND\_PASSWD\_FILE*](#bind~42) File containing the password [**--bind-passwd-prompt**](#bind~43) Prompt for password [**--bind-method** *BIND\_METHOD*](#bind~44) Sets the bind method: "SIMPLE", "SSLCLIENTAUTH", "SASL/DIGEST", or "SASL/GSSAPI" [**--frac-list** *FRAC\_LIST*](#frac) Sets the list of attributes to NOT replicate to the consumer during incremental updates [**--frac-list-total** *FRAC\_LIST\_TOTAL*](#frac~2) Sets the list of attributes to NOT replicate during a total initialization [**--strip-list** *STRIP\_LIST*](#strip) Sets a list of attributes that are removed from updates only if the event would otherwise be empty. Typically this is set to "modifiersname" and "modifytimestmap" [**--schedule** *SCHEDULE*](#schedule) Sets the replication update schedule: 'HHMM-HHMM DDDDDDD' D = 0-6 (Sunday - Saturday). [**--conn-timeout** *CONN\_TIMEOUT*](#conn~11) Sets the timeout used for replication connections [**--protocol-timeout** *PROTOCOL\_TIMEOUT*](#protocol) Sets a timeout in seconds on how long to wait before stopping replication when the server is under load [**--wait-async-results** *WAIT\_ASYNC\_RESULTS*](#wait~6) Sets the amount of time in milliseconds the server waits if the consumer is not ready before resending data [**--busy-wait-time** *BUSY\_WAIT\_TIME*](#busy) Sets the amount of time in seconds a supplier should wait after a consumer sends back a busy response before making another attempt to acquire access. [**--session-pause-time** *SESSION\_PAUSE\_TIME*](#session) Sets the amount of time in seconds a supplier should wait between update sessions. [**--flow-control-window** *FLOW\_CONTROL\_WINDOW*](#flow) Sets the maximum number of entries and updates sent by a supplier, which are not acknowledged by the consumer. [**--flow-control-pause** *FLOW\_CONTROL\_PAUSE*](#flow~2) Sets the time in milliseconds to pause after reaching the number of entries and updates set in "--flow-control-window" [**--bootstrap-bind-dn** *BOOTSTRAP\_BIND\_DN*](#bootstrap) Sets an optional bind DN the agreement can use to bootstrap initialization when bind groups are being used [**--bootstrap-bind-passwd** *BOOTSTRAP\_BIND\_PASSWD*](#bootstrap~2) Sets the bootstrap credentials for the bind DN [**--bootstrap-bind-passwd-file** *BOOTSTRAP\_BIND\_PASSWD\_FILE*](#bootstrap~3) File containing the password [**--bootstrap-bind-passwd-prompt**](#bootstrap~4) File containing the password [**--bootstrap-conn-protocol** *BOOTSTRAP\_CONN\_PROTOCOL*](#bootstrap~5) Sets the replication bootstrap connection protocol: LDAP, LDAPS, or StartTLS [**--bootstrap-bind-method** *BOOTSTRAP\_BIND\_METHOD*](#bootstrap~6) Sets the bind method: "SIMPLE", or "SSLCLIENTAUTH" [**--init**](#init) Initializes the agreement after creating it # COMMAND *'dsconf* *repl-agmt* *set'* usage: dsconf \[-v] \[-j] instance repl-agmt set \[-h] --suffix SUFFIX \[--host HOST] \[--port PORT] \[--conn-protocol CONN\_PROTOCOL] \[--bind-dn BIND\_DN] \[--bind-passwd BIND\_PASSWD] \[--bind-passwd-file BIND\_PASSWD\_FILE] \[--bind-passwd-prompt] \[--bind-method BIND\_METHOD] \[--frac-list FRAC\_LIST] \[--frac-list-total FRAC\_LIST\_TOTAL] \[--strip-list STRIP\_LIST] \[--schedule SCHEDULE] \[--conn-timeout CONN\_TIMEOUT] \[--protocol-timeout PROTOCOL\_TIMEOUT] \[--wait-async-results WAIT\_ASYNC\_RESULTS] \[--busy-wait-time BUSY\_WAIT\_TIME] \[--session-pause-time SESSION\_PAUSE\_TIME] \[--flow-control-window FLOW\_CONTROL\_WINDOW] \[--flow-control-pause FLOW\_CONTROL\_PAUSE] \[--bootstrap-bind-dn BOOTSTRAP\_BIND\_DN] \[--bootstrap-bind-passwd BOOTSTRAP\_BIND\_PASSWD] \[--bootstrap-bind-passwd-file BOOTSTRAP\_BIND\_PASSWD\_FILE] \[--bootstrap-bind-passwd-prompt] \[--bootstrap-conn-protocol BOOTSTRAP\_CONN\_PROTOCOL] \[--bootstrap-bind-method BOOTSTRAP\_BIND\_METHOD] AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~9) The name of the replication agreement # OPTIONS *'dsconf* *repl-agmt* *set'* [**--suffix** *SUFFIX*](#suffix~30) Sets the DN of the replication suffix [**--host** *HOST*](#host~2) Sets the hostname of the remote replica [**--port** *PORT*](#port~2) Sets the port number of the remote replica [**--conn-protocol** *CONN\_PROTOCOL*](#conn~12) Sets the replication connection protocol: LDAP, LDAPS, or StartTLS [**--bind-dn** *BIND\_DN*](#bind~45) Sets the Bind DN the agreement uses to authenticate to the replica [**--bind-passwd** *BIND\_PASSWD*](#bind~46) Sets the credentials for the bind DN [**--bind-passwd-file** *BIND\_PASSWD\_FILE*](#bind~47) File containing the password [**--bind-passwd-prompt**](#bind~48) Prompt for password [**--bind-method** *BIND\_METHOD*](#bind~49) Sets the bind method: "SIMPLE", "SSLCLIENTAUTH", "SASL/DIGEST", or "SASL/GSSAPI" [**--frac-list** *FRAC\_LIST*](#frac~3) Sets a list of attributes to NOT replicate to the consumer during incremental updates [**--frac-list-total** *FRAC\_LIST\_TOTAL*](#frac~4) Sets a list of attributes to NOT replicate during a total initialization [**--strip-list** *STRIP\_LIST*](#strip~2) Sets a list of attributes that are removed from updates only if the event would otherwise be empty. Typically this is set to "modifiersname" and "modifytimestmap" [**--schedule** *SCHEDULE*](#schedule~2) Sets the replication update schedule: 'HHMM-HHMM DDDDDDD' D = 0-6 (Sunday - Saturday). [**--conn-timeout** *CONN\_TIMEOUT*](#conn~13) Sets the timeout used for replication connections [**--protocol-timeout** *PROTOCOL\_TIMEOUT*](#protocol~2) Sets a timeout in seconds on how long to wait before stopping replication when the server is under load [**--wait-async-results** *WAIT\_ASYNC\_RESULTS*](#wait~7) Sets the amount of time in milliseconds the server waits if the consumer is not ready before resending data [**--busy-wait-time** *BUSY\_WAIT\_TIME*](#busy~2) Sets the amount of time in seconds a supplier should wait after a consumer sends back a busy response before making another attempt to acquire access. [**--session-pause-time** *SESSION\_PAUSE\_TIME*](#session~2) Sets the amount of time in seconds a supplier should wait between update sessions. [**--flow-control-window** *FLOW\_CONTROL\_WINDOW*](#flow~3) Sets the maximum number of entries and updates sent by a supplier, which are not acknowledged by the consumer. [**--flow-control-pause** *FLOW\_CONTROL\_PAUSE*](#flow~4) Sets the time in milliseconds to pause after reaching the number of entries and updates set in "--flow-control-window" [**--bootstrap-bind-dn** *BOOTSTRAP\_BIND\_DN*](#bootstrap~7) Sets an optional bind DN the agreement can use to bootstrap initialization when bind groups are being used [**--bootstrap-bind-passwd** *BOOTSTRAP\_BIND\_PASSWD*](#bootstrap~8) sets the bootstrap credentials for the bind DN [**--bootstrap-bind-passwd-file** *BOOTSTRAP\_BIND\_PASSWD\_FILE*](#bootstrap~9) File containing the password [**--bootstrap-bind-passwd-prompt**](#bootstrap~10) Prompt for password [**--bootstrap-conn-protocol** *BOOTSTRAP\_CONN\_PROTOCOL*](#bootstrap~11) Sets the replication bootstrap connection protocol: LDAP, LDAPS, or StartTLS [**--bootstrap-bind-method** *BOOTSTRAP\_BIND\_METHOD*](#bootstrap~12) Sets the bind method: "SIMPLE", or "SSLCLIENTAUTH" # COMMAND *'dsconf* *repl-agmt* *get'* usage: dsconf \[-v] \[-j] instance repl-agmt get \[-h] --suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~10) The suffix DN for which to display the replication configuration # OPTIONS *'dsconf* *repl-agmt* *get'* [**--suffix** *SUFFIX*](#suffix~31) Sets the DN of the replication suffix # COMMAND *'dsconf* *repl-winsync-agmt'* usage: dsconf \[-v] \[-j] instance repl-winsync-agmt \[-h] {list,enable,disable,init,init-status,poke,status,delete,create,set,get} ... # POSITIONAL ARGUMENTS *'dsconf repl-winsync-agmt'* [**dsconf repl-winsync-agmt** *list*](#dsconf~457) List all the replication winsync agreements [**dsconf repl-winsync-agmt** *enable*](#dsconf~458) Enable replication winsync agreement [**dsconf repl-winsync-agmt** *disable*](#dsconf~459) Disable replication winsync agreement [**dsconf repl-winsync-agmt** *init*](#dsconf~460) Initialize replication winsync agreement [**dsconf repl-winsync-agmt** *init-status*](#dsconf~461) Check the agreement initialization status [**dsconf repl-winsync-agmt** *poke*](#dsconf~462) Trigger replication to send updates now [**dsconf repl-winsync-agmt** *status*](#dsconf~463) Display the current status of the replication agreement [**dsconf repl-winsync-agmt** *delete*](#dsconf~464) Delete replication winsync agreement [**dsconf repl-winsync-agmt** *create*](#dsconf~465) Initialize replication winsync agreement [**dsconf repl-winsync-agmt** *set*](#dsconf~466) Set an attribute in the replication winsync agreement [**dsconf repl-winsync-agmt** *get*](#dsconf~467) Display replication configuration # COMMAND *'dsconf* *repl-winsync-agmt* *list'* usage: dsconf \[-v] \[-j] instance repl-winsync-agmt list \[-h] --suffix SUFFIX # OPTIONS *'dsconf* *repl-winsync-agmt* *list'* [**--suffix** *SUFFIX*](#suffix~32) Sets the DN of the suffix to look up replication winsync agreements # COMMAND *'dsconf* *repl-winsync-agmt* *enable'* usage: dsconf \[-v] \[-j] instance repl-winsync-agmt enable \[-h] --suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~11) The name of the replication winsync agreement # OPTIONS *'dsconf* *repl-winsync-agmt* *enable'* [**--suffix** *SUFFIX*](#suffix~33) Sets the DN of the replication winsync suffix # COMMAND *'dsconf* *repl-winsync-agmt* *disable'* usage: dsconf \[-v] \[-j] instance repl-winsync-agmt disable \[-h] \--suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~12) The name of the replication winsync agreement # OPTIONS *'dsconf* *repl-winsync-agmt* *disable'* [**--suffix** *SUFFIX*](#suffix~34) Sets the DN of the replication winsync suffix # COMMAND *'dsconf* *repl-winsync-agmt* *init'* usage: dsconf \[-v] \[-j] instance repl-winsync-agmt init \[-h] --suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~13) The name of the replication winsync agreement # OPTIONS *'dsconf* *repl-winsync-agmt* *init'* [**--suffix** *SUFFIX*](#suffix~35) Sets the DN of the replication winsync suffix # COMMAND *'dsconf* *repl-winsync-agmt* *init-status'* usage: dsconf \[-v] \[-j] instance repl-winsync-agmt init-status \[-h] --suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~14) The name of the replication agreement # OPTIONS *'dsconf* *repl-winsync-agmt* *init-status'* [**--suffix** *SUFFIX*](#suffix~36) Sets the DN of the replication suffix # COMMAND *'dsconf* *repl-winsync-agmt* *poke'* usage: dsconf \[-v] \[-j] instance repl-winsync-agmt poke \[-h] --suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~15) The name of the replication winsync agreement # OPTIONS *'dsconf* *repl-winsync-agmt* *poke'* [**--suffix** *SUFFIX*](#suffix~37) Sets the DN of the replication winsync suffix # COMMAND *'dsconf* *repl-winsync-agmt* *status'* usage: dsconf \[-v] \[-j] instance repl-winsync-agmt status \[-h] --suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~16) The name of the replication agreement # OPTIONS *'dsconf* *repl-winsync-agmt* *status'* [**--suffix** *SUFFIX*](#suffix~38) Sets the DN of the replication suffix # COMMAND *'dsconf* *repl-winsync-agmt* *delete'* usage: dsconf \[-v] \[-j] instance repl-winsync-agmt delete \[-h] --suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~17) The name of the replication winsync agreement # OPTIONS *'dsconf* *repl-winsync-agmt* *delete'* [**--suffix** *SUFFIX*](#suffix~39) Sets the DN of the replication winsync suffix # COMMAND *'dsconf* *repl-winsync-agmt* *create'* usage: dsconf \[-v] \[-j] instance repl-winsync-agmt create \[-h] --suffix SUFFIX \--host HOST \--port PORT \--conn-protocol CONN\_PROTOCOL \--bind-dn BIND\_DN \[--bind-passwd BIND\_PASSWD] \[--bind-passwd-file BIND\_PASSWD\_FILE] \[--bind-passwd-prompt] \[--frac-list FRAC\_LIST] \[--schedule SCHEDULE] \--win-subtree WIN\_SUBTREE \--ds-subtree DS\_SUBTREE \--win-domain WIN\_DOMAIN \[--sync-users SYNC\_USERS] \[--sync-groups SYNC\_GROUPS] \[--sync-interval SYNC\_INTERVAL] \[--one-way-sync ONE\_WAY\_SYNC] \[--move-action MOVE\_ACTION] \[--win-filter WIN\_FILTER] \[--ds-filter DS\_FILTER] \[--subtree-pair SUBTREE\_PAIR] \[--conn-timeout CONN\_TIMEOUT] \[--busy-wait-time BUSY\_WAIT\_TIME] \[--session-pause-time SESSION\_PAUSE\_TIME] \[--flatten-tree] \[--init] AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~18) The name of the replication winsync agreement # OPTIONS *'dsconf* *repl-winsync-agmt* *create'* [**--suffix** *SUFFIX*](#suffix~40) Sets the DN of the replication winsync suffix [**--host** *HOST*](#host~3) Sets the hostname of the AD server [**--port** *PORT*](#port~3) Sets the port number of the AD server [**--conn-protocol** *CONN\_PROTOCOL*](#conn~14) Sets the replication winsync connection protocol: LDAP, LDAPS, or StartTLS [**--bind-dn** *BIND\_DN*](#bind~50) Sets the bind DN the agreement uses to authenticate to the AD Server [**--bind-passwd** *BIND\_PASSWD*](#bind~51) Sets the credentials for the Bind DN [**--bind-passwd-file** *BIND\_PASSWD\_FILE*](#bind~52) File containing the password [**--bind-passwd-prompt**](#bind~53) Prompt for password [**--frac-list** *FRAC\_LIST*](#frac~5) Sets a list of attributes to NOT replicate to the consumer during incremental updates [**--schedule** *SCHEDULE*](#schedule~3) Sets the replication update schedule [**--win-subtree** *WIN\_SUBTREE*](#win) Sets the suffix of the AD Server [**--ds-subtree** *DS\_SUBTREE*](#ds) Sets the Directory Server suffix [**--win-domain** *WIN\_DOMAIN*](#win~2) Sets the AD Domain [**--sync-users** *SYNC\_USERS*](#sync) Synchronizes users between AD and DS [**--sync-groups** *SYNC\_GROUPS*](#sync~2) Synchronizes groups between AD and DS [**--sync-interval** *SYNC\_INTERVAL*](#sync~3) Sets the interval that DS checks AD for changes in entries [**--one-way-sync** *ONE\_WAY\_SYNC*](#one) Sets which direction to perform synchronization: "toWindows", or "fromWindows". By default sync occurs in both directions. [**--move-action** *MOVE\_ACTION*](#move) Sets instructions on how to handle moved or deleted entries: "none", "unsync", or "delete" [**--win-filter** *WIN\_FILTER*](#win~3) Sets a custom filter for finding users in AD Server [**--ds-filter** *DS\_FILTER*](#ds~2) Sets a custom filter for finding AD users in DS [**--subtree-pair** *SUBTREE\_PAIR*](#subtree~5) Sets the subtree pair: <DS\_SUBTREE>:<WINDOWS\_SUBTREE> [**--conn-timeout** *CONN\_TIMEOUT*](#conn~15) Sets the timeout used for replicaton connections [**--busy-wait-time** *BUSY\_WAIT\_TIME*](#busy~3) Sets the amount of time in seconds a supplier should wait after a consumer sends back a busy response before making another attempt to acquire access [**--session-pause-time** *SESSION\_PAUSE\_TIME*](#session~3) Sets the amount of time in seconds a supplier should wait between update sessions [**--flatten-tree**](#flatten) By default, the tree structure of AD is preserved into 389. This MAY cause replication to fail in some cases, as you may need to create missing OU's to recreate the same treestructure. This setting when enabled, removes the tree structure of AD and flattens all entries into the ds-subtree. This does NOT affect or change the tree structure of the AD directory. [**--init**](#init~2) Initializes the agreement after creating it # COMMAND *'dsconf* *repl-winsync-agmt* *set'* usage: dsconf \[-v] \[-j] instance repl-winsync-agmt set \[-h] \[--suffix SUFFIX] \[--host HOST] \[--port PORT] \[--conn-protocol CONN\_PROTOCOL] \[--bind-dn BIND\_DN] \[--bind-passwd BIND\_PASSWD] \[--bind-passwd-file BIND\_PASSWD\_FILE] \[--bind-passwd-prompt] \[--frac-list FRAC\_LIST] \[--schedule SCHEDULE] \[--win-subtree WIN\_SUBTREE] \[--ds-subtree DS\_SUBTREE] \[--win-domain WIN\_DOMAIN] \[--sync-users SYNC\_USERS] \[--sync-groups SYNC\_GROUPS] \[--sync-interval SYNC\_INTERVAL] \[--one-way-sync ONE\_WAY\_SYNC] \[--move-action MOVE\_ACTION] \[--win-filter WIN\_FILTER] \[--ds-filter DS\_FILTER] \[--subtree-pair SUBTREE\_PAIR] \[--conn-timeout CONN\_TIMEOUT] \[--busy-wait-time BUSY\_WAIT\_TIME] \[--session-pause-time SESSION\_PAUSE\_TIME] AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~19) The name of the replication winsync agreement # OPTIONS *'dsconf* *repl-winsync-agmt* *set'* [**--suffix** *SUFFIX*](#suffix~41) Sets the DN of the replication winsync suffix [**--host** *HOST*](#host~4) Sets the hostname of the AD server [**--port** *PORT*](#port~4) Sets the port number of the AD server [**--conn-protocol** *CONN\_PROTOCOL*](#conn~16) Sets the replication winsync connection protocol: LDAP, LDAPS, or StartTLS [**--bind-dn** *BIND\_DN*](#bind~54) Sets the bind DN the agreement uses to authenticate to the AD Server [**--bind-passwd** *BIND\_PASSWD*](#bind~55) Sets the credentials for the Bind DN [**--bind-passwd-file** *BIND\_PASSWD\_FILE*](#bind~56) File containing the password [**--bind-passwd-prompt**](#bind~57) Prompt for password [**--frac-list** *FRAC\_LIST*](#frac~6) Sets a list of attributes to NOT replicate to the consumer during incremental updates [**--schedule** *SCHEDULE*](#schedule~4) Sets the replication update schedule [**--win-subtree** *WIN\_SUBTREE*](#win~4) Sets the suffix of the AD Server [**--ds-subtree** *DS\_SUBTREE*](#ds~3) Sets the Directory Server suffix [**--win-domain** *WIN\_DOMAIN*](#win~5) Sets the AD Domain [**--sync-users** *SYNC\_USERS*](#sync~4) Synchronizes users between AD and DS [**--sync-groups** *SYNC\_GROUPS*](#sync~5) Synchronizes groups between AD and DS [**--sync-interval** *SYNC\_INTERVAL*](#sync~6) Sets the interval that DS checks AD for changes in entries [**--one-way-sync** *ONE\_WAY\_SYNC*](#one~2) Sets which direction to perform synchronization: "toWindows", or "fromWindows". By default sync occurs in both directions. [**--move-action** *MOVE\_ACTION*](#move~2) Sets instructions on how to handle moved or deleted entries: "none", "unsync", or "delete" [**--win-filter** *WIN\_FILTER*](#win~6) Sets a custom filter for finding users in AD Server [**--ds-filter** *DS\_FILTER*](#ds~4) Sets a custom filter for finding AD users in DS [**--subtree-pair** *SUBTREE\_PAIR*](#subtree~6) Sets the subtree pair: <DS\_SUBTREE>:<WINDOWS\_SUBTREE> [**--conn-timeout** *CONN\_TIMEOUT*](#conn~17) Sets the timeout used for replicaton connections [**--busy-wait-time** *BUSY\_WAIT\_TIME*](#busy~4) Sets the amount of time in seconds a supplier should wait after a consumer sends back a busy response before making another attempt to acquire access [**--session-pause-time** *SESSION\_PAUSE\_TIME*](#session~4) Sets the amount of time in seconds a supplier should wait between update sessions # COMMAND *'dsconf* *repl-winsync-agmt* *get'* usage: dsconf \[-v] \[-j] instance repl-winsync-agmt get \[-h] --suffix SUFFIX AGMT\_NAME [**AGMT\_NAME**](#AGMT_NAME~20) The suffix DN for the replication configuration to display # OPTIONS *'dsconf* *repl-winsync-agmt* *get'* [**--suffix** *SUFFIX*](#suffix~42) Sets the DN of the replication suffix # COMMAND *'dsconf* *repl-tasks'* usage: dsconf \[-v] \[-j] instance repl-tasks \[-h] {cleanallruv,list-cleanruv-tasks,abort-cleanallruv,list-abortruv-tasks} ... # POSITIONAL ARGUMENTS *'dsconf repl-tasks'* [**dsconf repl-tasks** *cleanallruv*](#dsconf~468) Cleanup old/removed replica IDs [**dsconf repl-tasks** *list-cleanruv-tasks*](#dsconf~469) List all the running CleanAllRUV tasks [**dsconf repl-tasks** *abort-cleanallruv*](#dsconf~470) Abort cleanallruv tasks [**dsconf repl-tasks** *list-abortruv-tasks*](#dsconf~471) List all the running CleanAllRUV abort tasks # COMMAND *'dsconf* *repl-tasks* *cleanallruv'* usage: dsconf \[-v] \[-j] instance repl-tasks cleanallruv \[-h] --suffix SUFFIX \--replica-id REPLICA\_ID \[--force-cleaning] # OPTIONS *'dsconf* *repl-tasks* *cleanallruv'* [**--suffix** *SUFFIX*](#suffix~43) Sets the Directory Server suffix [**--replica-id** *REPLICA\_ID*](#replica~3) Sets the replica ID to remove/clean [**--force-cleaning**](#force~2) Ignores errors and make a best attempt to clean all replicas # COMMAND *'dsconf* *repl-tasks* *list-cleanruv-tasks'* usage: dsconf \[-v] \[-j] instance repl-tasks list-cleanruv-tasks \[-h] \[--suffix SUFFIX] # OPTIONS *'dsconf* *repl-tasks* *list-cleanruv-tasks'* [**--suffix** *SUFFIX*](#suffix~44) Lists only tasks for the specified suffix # COMMAND *'dsconf* *repl-tasks* *abort-cleanallruv'* usage: dsconf \[-v] \[-j] instance repl-tasks abort-cleanallruv \[-h] --suffix SUFFIX --replica-id REPLICA\_ID \[--certify] # OPTIONS *'dsconf* *repl-tasks* *abort-cleanallruv'* [**--suffix** *SUFFIX*](#suffix~45) Sets the Directory Server suffix [**--replica-id** *REPLICA\_ID*](#replica~4) Sets the replica ID of the cleaning task to abort [**--certify**](#certify) Enforces that the abort task completed on all replicas # COMMAND *'dsconf* *repl-tasks* *list-abortruv-tasks'* usage: dsconf \[-v] \[-j] instance repl-tasks list-abortruv-tasks \[-h] \[--suffix SUFFIX] # OPTIONS *'dsconf* *repl-tasks* *list-abortruv-tasks'* [**--suffix** *SUFFIX*](#suffix~46) Lists only tasks for the specified suffix # COMMAND *'dsconf* *repl-conflict'* usage: dsconf \[-v] \[-j] instance repl-conflict \[-h] {list,compare,delete,delete-all,swap,convert,list-glue,delete-glue,convert-glue} ... # POSITIONAL ARGUMENTS *'dsconf repl-conflict'* [**dsconf repl-conflict** *list*](#dsconf~472) List conflict entries [**dsconf repl-conflict** *compare*](#dsconf~473) Compare the conflict entry with its valid counterpart [**dsconf repl-conflict** *delete*](#dsconf~474) Delete a conflict entry [**dsconf repl-conflict** *delete-all*](#dsconf~475) Delete all conflict entries [**dsconf repl-conflict** *swap*](#dsconf~476) Replace the valid entry with the conflict entry [**dsconf repl-conflict** *convert*](#dsconf~477) Convert the conflict entry to a valid entry, while keeping the original valid entry counterpart. This requires that the converted conflict entry have a new RDN value. For example: "cn=my\_new\_rdn\_value". [**dsconf repl-conflict** *list-glue*](#dsconf~478) List replication glue entries [**dsconf repl-conflict** *delete-glue*](#dsconf~479) Delete the glue entry and its child entries [**dsconf repl-conflict** *convert-glue*](#dsconf~480) Convert the glue entry into a regular entry # COMMAND *'dsconf* *repl-conflict* *list'* usage: dsconf \[-v] \[-j] instance repl-conflict list \[-h] suffix [**suffix**](#suffix~47) Sets the backend name, or suffix, to look for conflict entries # COMMAND *'dsconf* *repl-conflict* *compare'* usage: dsconf \[-v] \[-j] instance repl-conflict compare \[-h] DN [**DN**](#DN~25) The DN of the conflict entry # COMMAND *'dsconf* *repl-conflict* *delete'* usage: dsconf \[-v] \[-j] instance repl-conflict delete \[-h] DN [**DN**](#DN~26) The DN of the conflict entry # COMMAND *'dsconf* *repl-conflict* *delete-all'* usage: dsconf \[-v] \[-j] instance repl-conflict delete-all \[-h] suffix [**suffix**](#suffix~48) Sets the backend name, or suffix, to remove all conflict entries from # COMMAND *'dsconf* *repl-conflict* *swap'* usage: dsconf \[-v] \[-j] instance repl-conflict swap \[-h] DN [**DN**](#DN~27) The DN of the conflict entry # COMMAND *'dsconf* *repl-conflict* *convert'* usage: dsconf instance \[-v] \[-j] repl-conflict convert \[-h] --new-rdn NEW\_RDN DN [**DN**](#DN~28) The DN of the conflict entry # OPTIONS *'dsconf* *repl-conflict* *convert'* [**--new-rdn** *NEW\_RDN*](#new) Sets the new RDN for the converted conflict entry. For example: "cn=my\_new\_rdn\_value" # COMMAND *'dsconf* *repl-conflict* *list-glue'* usage: dsconf \[-v] \[-j] instance repl-conflict list-glue \[-h] suffix [**suffix**](#suffix~49) The backend name, or suffix, to look for glue entries # COMMAND *'dsconf* *repl-conflict* *delete-glue'* usage: dsconf \[-v] \[-j] instance repl-conflict delete-glue \[-h] DN [**DN**](#DN~29) The DN of the glue entry # COMMAND *'dsconf* *repl-conflict* *convert-glue'* usage: dsconf \[-v] \[-j] instance repl-conflict convert-glue \[-h] DN [**DN**](#DN~30) The DN of the glue entry # COMMAND *'dsconf* *sasl'* usage: dsconf \[-v] \[-j] instance sasl \[-h] {list,get-mechs,get-available-mechs,get,create,delete} ... # POSITIONAL ARGUMENTS *'dsconf sasl'* [**dsconf sasl** *list*](#dsconf~481) Display available SASL mappings [**dsconf sasl** *get-mechs*](#dsconf~482) Display the SASL mechanisms that the server will accept [**dsconf sasl** *get-available-mechs*](#dsconf~483) Display the SASL mechanisms that are available to the server [**dsconf sasl** *get*](#dsconf~484) Displays SASL mappings [**dsconf sasl** *create*](#dsconf~485) Create a SASL mapping [**dsconf sasl** *delete*](#dsconf~486) Deletes the SASL object # COMMAND *'dsconf* *sasl* *list'* usage: dsconf \[-v] \[-j] instance sasl list \[-h] \[--details] # OPTIONS *'dsconf* *sasl* *list'* [**--details**](#details) Displays each SASL mapping in detail # COMMAND *'dsconf* *sasl* *get-mechs'* usage: dsconf \[-v] \[-j] instance sasl get-mechs \[-h] # COMMAND *'dsconf* *sasl* *get-available-mechs'* usage: dsconf \[-v] \[-j] instance sasl get-available-mechs \[-h] # COMMAND *'dsconf* *sasl* *get'* usage: dsconf \[-v] \[-j] instance sasl get \[-h] \[selector] [**selector**](#selector~4) The SASL mapping name to display # COMMAND *'dsconf* *sasl* *create'* usage: dsconf \[-v] \[-j] instance sasl create \[-h] \[--cn \[CN]] \[--nsSaslMapRegexString \[NSSASLMAPREGEXSTRING]] \[--nsSaslMapBaseDNTemplate \[NSSASLMAPBASEDNTEMPLATE]] \[--nsSaslMapFilterTemplate \[NSSASLMAPFILTERTEMPLATE]] \[--nsSaslMapPriority \[NSSASLMAPPRIORITY]] # OPTIONS *'dsconf* *sasl* *create'* [**--cn** *\[CN\]*](#cn) Value of cn [**--nsSaslMapRegexString** *\[NSSASLMAPREGEXSTRING\]*](#nsSaslMapRegexString) Value of nsSaslMapRegexString [**--nsSaslMapBaseDNTemplate** *\[NSSASLMAPBASEDNTEMPLATE\]*](#nsSaslMapBaseDNTemplate) Value of nsSaslMapBaseDNTemplate [**--nsSaslMapFilterTemplate** *\[NSSASLMAPFILTERTEMPLATE\]*](#nsSaslMapFilterTemplate) Value of nsSaslMapFilterTemplate [**--nsSaslMapPriority** *\[NSSASLMAPPRIORITY\]*](#nsSaslMapPriority) Value of nsSaslMapPriority # COMMAND *'dsconf* *sasl* *delete'* usage: dsconf \[-v] \[-j] instance sasl delete \[-h] map\_name [**map\_name**](#map_name) The SASL mapping name ("cn" value) # COMMAND *'dsconf* *security'* usage: dsconf \[-v] \[-j] instance security \[-h] {set,get,enable,disable,disable\_plain\_port,certificate,ca-certificate,rsa,encryption-module,ciphers,csr,key,export-cert} ... # POSITIONAL ARGUMENTS *'dsconf security'* [**dsconf security** *set*](#dsconf~487) Set general security options [**dsconf security** *get*](#dsconf~488) Display general security options [**dsconf security** *enable*](#dsconf~489) Enable security [**dsconf security** *disable*](#dsconf~490) Disable security [**dsconf security** *disable\_plain\_port*](#dsconf~491) Disables the plain text LDAP port, allowing only LDAPS to function [**dsconf security** *certificate*](#dsconf~492) Manage TLS certificates [**dsconf security** *ca-certificate*](#dsconf~493) Manage TLS certificate authorities [**dsconf security** *rsa*](#dsconf~494) Query and update RSA security options [**dsconf security** *encryption-module*](#dsconf~495) Manage encryption modules [**dsconf security** *ciphers*](#dsconf~496) Manage secure ciphers [**dsconf security** *csr*](#dsconf~497) Manage certificate signing requests [**dsconf security** *key*](#dsconf~498) Manage keys in NSS DB [**dsconf security** *export-cert*](#dsconf~499) Export a certificate to PEM or DER/Binary format. PEM format is the default # COMMAND *'dsconf* *security* *set'* usage: dsconf \[-v] \[-j] instance security set \[-h] \[--security SECURITY] \[--listen-host LISTEN\_HOST] \[--secure-port SECURE\_PORT] \[--tls-client-auth TLS\_CLIENT\_AUTH] \[--tls-client-renegotiation TLS\_CLIENT\_RENEGOTIATION] \[--require-secure-authentication REQUIRE\_SECURE\_AUTHENTICATION] \[--check-hostname CHECK\_HOSTNAME] \[--extract-pemfiles EXTRACT\_PEMFILES] \[--verify-cert-chain-on-startup VERIFY\_CERT\_CHAIN\_ON\_STARTUP] \[--session-timeout SESSION\_TIMEOUT] \[--tls-protocol-min TLS\_PROTOCOL\_MIN] \[--tls-protocol-max TLS\_PROTOCOL\_MAX] \[--allow-insecure-ciphers ALLOW\_INSECURE\_CIPHERS] \[--allow-weak-dh-param ALLOW\_WEAK\_DH\_PARAM] \[--cipher-pref CIPHER\_PREF] Use this command for setting security related options located in cn=config and cn=encryption,cn=config. To enable/disable security you can use enable and disable commands instead. # OPTIONS *'dsconf* *security* *set'* [**--security** *SECURITY*](#security) Enables or disables security (nsslapd-security) [**--listen-host** *LISTEN\_HOST*](#listen) Sets the host or IP address to listen on for LDAPS (nsslapd-securelistenhost) [**--secure-port** *SECURE\_PORT*](#secure~3) Sets the port for LDAPS to listen on (nsslapd-securePort) [**--tls-client-auth** *TLS\_CLIENT\_AUTH*](#tls) Configures client authentication requirement (nsSSLClientAuth) [**--tls-client-renegotiation** *TLS\_CLIENT\_RENEGOTIATION*](#tls~2) Allows client TLS renegotiation (nsTLSAllowClientRenegotiation) [**--require-secure-authentication** *REQUIRE\_SECURE\_AUTHENTICATION*](#require~2) Configures whether binds over LDAPS, StartTLS, or SASL are required (nsslapd- require-secure-binds) [**--check-hostname** *CHECK\_HOSTNAME*](#check~6) Checks the subject of remote certificate against the hostname (nsslapd-ssl- check-hostname) [**--extract-pemfiles** *EXTRACT\_PEMFILES*](#extract) At server shutdown extract the server's certificates and keys to PEM files (nsslapd-extract-pemfiles) [**--verify-cert-chain-on-startup** *VERIFY\_CERT\_CHAIN\_ON\_STARTUP*](#verify) Validates the server certificate during startup (nsslapd-validate-cert) [**--session-timeout** *SESSION\_TIMEOUT*](#session~5) Sets the secure session timeout (nsSSLSessionTimeout) [**--tls-protocol-min** *TLS\_PROTOCOL\_MIN*](#tls~3) Sets the minimal allowed secure protocol version (sslVersionMin) [**--tls-protocol-max** *TLS\_PROTOCOL\_MAX*](#tls~4) Sets the maximal allowed secure protocol version (sslVersionMax) [**--allow-insecure-ciphers** *ALLOW\_INSECURE\_CIPHERS*](#allow~5) Allows weak ciphers for legacy use (allowWeakCipher) [**--allow-weak-dh-param** *ALLOW\_WEAK\_DH\_PARAM*](#allow~6) Allows short DH params for legacy use (allowWeakDHParam) [**--cipher-pref** *CIPHER\_PREF*](#cipher) Directly sets the nsSSL3Ciphers attribute. It is a comma-separated list of cipher names (prefixed with + or -), optionally including +all or -all. The attribute may optionally be prefixed by keyword "default". Please refer to documentation of the attribute for a more detailed description. (nsSSL3Ciphers) # COMMAND *'dsconf* *security* *get'* usage: dsconf \[-v] \[-j] instance security get \[-h] # COMMAND *'dsconf* *security* *enable'* usage: dsconf instance \[-v] \[-j] security enable \[-h] \[--cert-name CERT\_NAME] If missing, create security database, then turn on security functionality. Please note this is usually not enough for TLS connections to work - proper setup of CA and server certificate is necessary. # OPTIONS *'dsconf* *security* *enable'* [**--cert-name** *CERT\_NAME*](#cert) Sets the name of the certificate the server should use # COMMAND *'dsconf* *security* *disable'* usage: dsconf instance \[-v] \[-j] security disable \[-h] Turn off security functionality. The rest of the configuration will be left untouched. # COMMAND *'dsconf* *security* *disable\_plain\_port'* usage: dsconf instance \[-v] \[-j] security disable\_plain\_port \[-h] # COMMAND *'dsconf* *security* *certificate'* usage: dsconf \[-v] \[-j] instance security certificate \[-h] {add,set-trust-flags,del,get,list} ... # POSITIONAL ARGUMENTS *'dsconf security certificate'* [**dsconf security certificate** *add*](#dsconf~500) Add a server certificate [**dsconf security certificate** *set-trust-flags*](#dsconf~501) Set the Trust flags [**dsconf security certificate** *del*](#dsconf~502) Delete a certificate [**dsconf security certificate** *get*](#dsconf~503) Display a server certificate's information [**dsconf security certificate** *list*](#dsconf~504) List the server certificates # COMMAND *'dsconf* *security* *certificate* *add'* usage: dsconf instance \[-v] \[-j] security certificate add \[-h] --file FILE \--name NAME \[--primary-cert] \[--pkcs12-pin-text PKCS12\_PIN\_TEXT] \[--pkcs12-pin-stdin] \[--pkcs12-pin-path PKCS12\_PIN\_PATH] \[--do-it] Add a server certificate to the NSS database # OPTIONS *'dsconf* *security* *certificate* *add'* [**--file** *FILE*](#file) Sets the file name of the certificate [**--name** *NAME*](#name~7) Sets the name/nickname of the certificate [**--primary-cert**](#primary) Sets this certificate as the server's certificate [**--pkcs12-pin-text** *PKCS12\_PIN\_TEXT*](#pkcs12) The PKCS#12 password as plain text. WARNING: Password may appear in process list or shell history. Use --pkcs12-pin-stdin or --pkcs12-pin-path to prevent password exposure. [**--pkcs12-pin-stdin**](#pkcs12~2) Read the PKCS#12 password from stdin [**--pkcs12-pin-path** *PKCS12\_PIN\_PATH*](#pkcs12~3) Path to a file containing the PKCS#12 password [**--do-it**](#do~2) Force the addition of a certificate that cannot be verified # COMMAND *'dsconf* *security* *certificate* *set-trust-flags'* usage: dsconf instance \[-v] \[-j] security certificate set-trust-flags \[-h] --flags FLAGS name Change the trust flags of a server certificate [**name**](#name~8) The name/nickname of the certificate # OPTIONS *'dsconf* *security* *certificate* *set-trust-flags'* [**--flags** *FLAGS*](#flags) Sets the trust flags for the server certificate # COMMAND *'dsconf* *security* *certificate* *del'* usage: dsconf instance \[-v] \[-j] security certificate del \[-h] name Delete a server certificate from the NSS database or DynamicCerts backend. [**name**](#name~9) The name/nickname of the certificate # COMMAND *'dsconf* *security* *certificate* *get'* usage: dsconf instance \[-v] \[-j] security certificate get \[-h] name Displays detailed information about a certificate, such as trust attributes, expiration dates, Subject and Issuer DNs [**name**](#name~10) Set the name/nickname of the certificate # COMMAND *'dsconf* *security* *certificate* *list'* usage: dsconf instance \[-v] \[-j] security certificate list \[-h] List all server certificates in the NSS database or DynamicCerts backend. # COMMAND *'dsconf* *security* *ca-certificate'* usage: dsconf \[-v] \[-j] instance security ca-certificate \[-h] {add,set-trust-flags,del,get,list} ... # POSITIONAL ARGUMENTS *'dsconf security ca-certificate'* [**dsconf security ca-certificate** *add*](#dsconf~505) Add a Certificate Authority [**dsconf security ca-certificate** *set-trust-flags*](#dsconf~506) Set the Trust flags [**dsconf security ca-certificate** *del*](#dsconf~507) Delete a certificate [**dsconf security ca-certificate** *get*](#dsconf~508) Displays a Certificate Authority's information [**dsconf security ca-certificate** *list*](#dsconf~509) List the Certificate Authorities # COMMAND *'dsconf* *security* *ca-certificate* *add'* usage: dsconf instance \[-v] \[-j] security ca-certificate add \[-h] --file FILE --name NAME \[NAME ...] \[--do-it] Add a CA certificate (PEM or DER only) to the NSS database or DynamicCerts backend. # OPTIONS *'dsconf* *security* *ca-certificate* *add'* [**--file** *FILE*](#file~2) Path to the CA certificate file (PEM or DER). If adding a PEM bundle then specify multiple names one for each certificate, otherwise a number increment will be added to the previous name. [**--name** *NAME \[NAME ...\]*](#name~11) Sets the name/nickname of the CA certificate [**--do-it**](#do~3) Force the addition of a certificate that cannot be verified # COMMAND *'dsconf* *security* *ca-certificate* *set-trust-flags'* usage: dsconf instance \[-v] \[-j] security ca-certificate set-trust-flags \[-h] --flags FLAGS name Change the trust attributes of a CA certificate. Certificate Authorities typically use "CT,," [**name**](#name~12) The name/nickname of the CA certificate # OPTIONS *'dsconf* *security* *ca-certificate* *set-trust-flags'* [**--flags** *FLAGS*](#flags~2) Sets the trust flags for the CA certificate # COMMAND *'dsconf* *security* *ca-certificate* *del'* usage: dsconf instance \[-v] \[-j] security ca-certificate del \[-h] name Delete a CA certificate from the NSS database [**name**](#name~13) The name/nickname of the CA certificate # COMMAND *'dsconf* *security* *ca-certificate* *get'* usage: dsconf instance \[-v] \[-j] security ca-certificate get \[-h] name Get detailed information about a CA certificate, like trust attributes, expiration dates, Subject and Issuer DN [**name**](#name~14) The name/nickname of the CA certificate # COMMAND *'dsconf* *security* *ca-certificate* *list'* usage: dsconf instance \[-v] \[-j] security ca-certificate list \[-h] List the CA certificates in the NSS database # COMMAND *'dsconf* *security* *rsa'* usage: dsconf \[-v] \[-j] instance security rsa \[-h] {set,get,enable,disable} ... # POSITIONAL ARGUMENTS *'dsconf security rsa'* [**dsconf security rsa** *set*](#dsconf~510) Set RSA security options [**dsconf security rsa** *get*](#dsconf~511) Get RSA security options [**dsconf security rsa** *enable*](#dsconf~512) Enable RSA [**dsconf security rsa** *disable*](#dsconf~513) Disable RSA # COMMAND *'dsconf* *security* *rsa* *set'* usage: dsconf \[-v] \[-j] instance security rsa set \[-h] \[--tls-allow-rsa-certificates TLS\_ALLOW\_RSA\_CERTIFICATES] \[--nss-cert-name NSS\_CERT\_NAME] \[--nss-token NSS\_TOKEN] Use this command for setting RSA (private key) related options located in cn=RSA,cn=encryption,cn=config. To enable/disable RSA you can use enable and disable commands instead. # OPTIONS *'dsconf* *security* *rsa* *set'* [**--tls-allow-rsa-certificates** *TLS\_ALLOW\_RSA\_CERTIFICATES*](#tls~5) Activates the use of RSA certificates (nsSSLActivation) [**--nss-cert-name** *NSS\_CERT\_NAME*](#nss) Sets the server certificate name in NSS DB (nsSSLPersonalitySSL) [**--nss-token** *NSS\_TOKEN*](#nss~2) Sets the security token name (module of NSS DB) (nsSSLToken) # COMMAND *'dsconf* *security* *rsa* *get'* usage: dsconf \[-v] \[-j] instance security rsa get \[-h] # COMMAND *'dsconf* *security* *rsa* *enable'* usage: dsconf \[-v] \[-j] instance security rsa enable \[-h] # COMMAND *'dsconf* *security* *rsa* *disable'* usage: dsconf \[-v] \[-j] instance security rsa disable \[-h] # COMMAND *'dsconf* *security* *encryption-module'* usage: dsconf \[-v] \[-j] instance security encryption-module \[-h] {add,delete,edit,list,get} ... # POSITIONAL ARGUMENTS *'dsconf security encryption-module'* [**dsconf security encryption-module** *add*](#dsconf~514) Add an encryption module [**dsconf security encryption-module** *delete*](#dsconf~515) Delete an encryption module [**dsconf security encryption-module** *edit*](#dsconf~516) Edit an encryption module [**dsconf security encryption-module** *list*](#dsconf~517) List encryption modules [**dsconf security encryption-module** *get*](#dsconf~518) Get an encryption module # COMMAND *'dsconf* *security* *encryption-module* *add'* usage: dsconf instance \[-v] \[-j] security encryption-module add \[-h] --cert-nickname CERT\_NICKNAME \[--activated] \[--token TOKEN] \[--server-key-extract-file SERVER\_KEY\_EXTRACT\_FILE] \[--server-cert-extract-file SERVER\_CERT\_EXTRACT\_FILE] name Add a new encryption module to the encryption module list. [**name**](#name~15) The name of the encryption module # OPTIONS *'dsconf* *security* *encryption-module* *add'* [**--cert-nickname** *CERT\_NICKNAME*](#cert~2) The personality or nickname of the server certificate [**--activated**](#activated) Activate the encryption module. [**--token** *TOKEN*](#token) The token of the encryption module. Default is "internal (software)". [**--server-key-extract-file** *SERVER\_KEY\_EXTRACT\_FILE*](#server~3) The file name of the server key extract file [**--server-cert-extract-file** *SERVER\_CERT\_EXTRACT\_FILE*](#server~4) The file name of the server cert extract file # COMMAND *'dsconf* *security* *encryption-module* *delete'* usage: dsconf instance \[-v] \[-j] security encryption-module delete \[-h] name Delete an encryption module from the encryption module list. [**name**](#name~16) The name of the encryption module # COMMAND *'dsconf* *security* *encryption-module* *edit'* usage: dsconf instance \[-v] \[-j] security encryption-module edit \[-h] \[--cert-nickname CERT\_NICKNAME] \[--activate] \[--deactivate] \[--token TOKEN] \[--server-key-extract-file SERVER\_KEY\_EXTRACT\_FILE] \[--server-cert-extract-file SERVER\_CERT\_EXTRACT\_FILE] name Edit an encryption module in the encryption module list. [**name**](#name~17) The name of the encryption module # OPTIONS *'dsconf* *security* *encryption-module* *edit'* [**--cert-nickname** *CERT\_NICKNAME*](#cert~3) The personality or nickname of the server certificate [**--activate**](#activate) Activate the encryption module [**--deactivate**](#deactivate) Deactivate the encryption module [**--token** *TOKEN*](#token~2) The token of the encryption module. [**--server-key-extract-file** *SERVER\_KEY\_EXTRACT\_FILE*](#server~5) The file name of the server key extract file [**--server-cert-extract-file** *SERVER\_CERT\_EXTRACT\_FILE*](#server~6) The file name of the server cert extract file # COMMAND *'dsconf* *security* *encryption-module* *list'* usage: dsconf instance \[-v] \[-j] security encryption-module list \[-h] \[--just-names] List all encryption modules in the encryption module list. # OPTIONS *'dsconf* *security* *encryption-module* *list'* [**--just-names**](#just~4) Just list the modules by its name and not the full entry # COMMAND *'dsconf* *security* *encryption-module* *get'* usage: dsconf instance \[-v] \[-j] security encryption-module get \[-h] name Get an encryption module from the encryption module list. [**name**](#name~18) The name of the encryption module # COMMAND *'dsconf* *security* *ciphers'* usage: dsconf \[-v] \[-j] instance security ciphers \[-h] {enable,disable,get,set,list} ... # POSITIONAL ARGUMENTS *'dsconf security ciphers'* [**dsconf security ciphers** *enable*](#dsconf~519) Enable ciphers [**dsconf security ciphers** *disable*](#dsconf~520) Disable ciphers [**dsconf security ciphers** *get*](#dsconf~521) Get ciphers attribute [**dsconf security ciphers** *set*](#dsconf~522) Set ciphers attribute [**dsconf security ciphers** *list*](#dsconf~523) List ciphers # COMMAND *'dsconf* *security* *ciphers* *enable'* usage: dsconf instance \[-v] \[-j] security ciphers enable \[-h] cipher \[cipher ...] Use this command to enable specific ciphers. [**cipher**](#cipher~2) # COMMAND *'dsconf* *security* *ciphers* *disable'* usage: dsconf instance \[-v] \[-j] security ciphers disable \[-h] cipher \[cipher ...] Use this command to disable specific ciphers. [**cipher**](#cipher~3) # COMMAND *'dsconf* *security* *ciphers* *get'* usage: dsconf instance \[-v] \[-j] security ciphers get \[-h] Use this command to get contents of nsSSL3Ciphers attribute. # COMMAND *'dsconf* *security* *ciphers* *set'* usage: dsconf instance \[-v] \[-j] security ciphers set \[-h] cipher-string Use this command to directly set nsSSL3Ciphers attribute. It is a comma separated list of cipher names (prefixed with + or -), optionally including +all or -all. The attribute may optionally be set to keyword default. Please refer to documentation of the attribute for a more detailed description. [**cipher-string**](#cipher~4) # COMMAND *'dsconf* *security* *ciphers* *list'* usage: dsconf instance \[-v] \[-j] security ciphers list \[-h] [--enabled | \--supported | \--disabled] List secure ciphers. Without arguments, list ciphers as configured in nsSSL3Ciphers attribute. # OPTIONS *'dsconf* *security* *ciphers* *list'* [**--enabled**](#enabled~4) Lists only enabled ciphers [**--supported**](#supported) Lists only supported ciphers [**--disabled**](#disabled) Lists only supported ciphers but without enabled ciphers # COMMAND *'dsconf* *security* *csr'* usage: dsconf \[-v] \[-j] instance security csr \[-h] {list,get,req,del} ... # POSITIONAL ARGUMENTS *'dsconf security csr'* [**dsconf security csr** *list*](#dsconf~524) List CSRs [**dsconf security csr** *get*](#dsconf~525) Display CSR content [**dsconf security csr** *req*](#dsconf~526) Generate a Certificate Signing Request [**dsconf security csr** *del*](#dsconf~527) Delete a CSR file # COMMAND *'dsconf* *security* *csr* *list'* usage: dsconf instance \[-v] \[-j] security csr list \[-h] \[--path PATH] List all CSR files in instance configuration directiory # OPTIONS *'dsconf* *security* *csr* *list'* [**--path** *PATH*, **-p** *PATH*](#path~2) Directory contanining CSR file # COMMAND *'dsconf* *security* *csr* *get'* usage: dsconf instance \[-v] \[-j] security csr get \[-h] name Displays the contents of a CSR, which can be used for submittal to CA [**name**](#name~19) Name of the CSR file to display # COMMAND *'dsconf* *security* *csr* *req'* usage: dsconf instance \[-v] \[-j] security csr req \[-h] --subject SUBJECT \--name NAME \[alt\_names ...] Generate a CSR that can be submitted to a CA for verification [**alt\_names**](#alt_names) CSR alternative names. These are auto-detected if not provided # OPTIONS *'dsconf* *security* *csr* *req'* [**--subject** *SUBJECT*, **-s** *SUBJECT*](#subject) Subject field [**--name** *NAME*, **-n** *NAME*](#name~20) Name # COMMAND *'dsconf* *security* *csr* *del'* usage: dsconf \[-v] \[-j] instance security csr del \[-h] name Delete a CSR file [**name**](#name~21) Name of the CSR file to delete # COMMAND *'dsconf* *security* *key'* usage: dsconf \[-v] \[-j] instance security key \[-h] {list,del} ... # POSITIONAL ARGUMENTS *'dsconf security key'* [**dsconf security key** *list*](#dsconf~528) List all keys in NSS DB [**dsconf security key** *del*](#dsconf~529) Delete a key from NSS DB # COMMAND *'dsconf* *security* *key* *list'* usage: dsconf \[-v] \[-j] instance security key list \[-h] \[--orphan] # OPTIONS *'dsconf* *security* *key* *list'* [**--orphan**](#orphan) List orphan keys (An orphan key is a private key in the NSS DB for which there is NO cert with the corresponding public key). An orphan key is created during CSR generation, when the associated certificate is imported into the NSS DB, its orphan state will be removed. # COMMAND *'dsconf* *security* *key* *del'* usage: dsconf instance \[-v] \[-j] security key del \[-h] key\_id Remove a key from the NSS DB. Make sure the key is not in use before you delete [**key\_id**](#key_id) This is the key ID displayed when listing keys # COMMAND *'dsconf* *security* *export-cert'* usage: dsconf instance \[-v] \[-j] security export-cert \[-h] \[--binary-format] \[--output-file OUTPUT\_FILE] nickname [**nickname**](#nickname) The name of the certificate to export # OPTIONS *'dsconf* *security* *export-cert'* [**--binary-format**](#binary) Export certificate in DER/binary format [**--output-file** *OUTPUT\_FILE*](#output~3) The name for the exported certificate. Default name is the certificate nickname with an extension of ".pem" or ".crt" # COMMAND *'dsconf* *schema'* usage: dsconf \[-v] \[-j] instance schema \[-h] {list,attributetypes,objectclasses,matchingrules,reload,validate-syntax,import-openldap-file} ... # POSITIONAL ARGUMENTS *'dsconf schema'* [**dsconf schema** *list*](#dsconf~530) List all schema objects on this system [**dsconf schema** *attributetypes*](#dsconf~531) Work with attribute types on this system [**dsconf schema** *objectclasses*](#dsconf~532) Work with objectClasses on this system [**dsconf schema** *matchingrules*](#dsconf~533) Work with matching rules on this system [**dsconf schema** *reload*](#dsconf~534) Dynamically reload schema while server is running [**dsconf schema** *validate-syntax*](#dsconf~535) Run a task to check that all attributes in an entry have the correct syntax [**dsconf schema** *import-openldap-file*](#dsconf~536) Import an openldap formatted dynamic schema ldifs. These will contain values like olcAttributeTypes and olcObjectClasses. # COMMAND *'dsconf* *schema* *list'* usage: dsconf \[-v] \[-j] instance schema list \[-h] \[--include-oc-sup] # OPTIONS *'dsconf* *schema* *list'* [**--include-oc-sup**](#include~3) Include the superior objectclasses' "may" and "must" attributes # COMMAND *'dsconf* *schema* *attributetypes'* usage: dsconf \[-v] \[-j] instance schema attributetypes \[-h] {get\_syntaxes,list,query,add,replace,remove} ... # POSITIONAL ARGUMENTS *'dsconf schema attributetypes'* [**dsconf schema attributetypes** *get\_syntaxes*](#dsconf~537) List all available attribute type syntaxes [**dsconf schema attributetypes** *list*](#dsconf~538) List available attribute types on this system [**dsconf schema attributetypes** *query*](#dsconf~539) Query an attribute to determine object classes that may or must take it [**dsconf schema attributetypes** *add*](#dsconf~540) Add an attribute type to this system [**dsconf schema attributetypes** *replace*](#dsconf~541) Replace an attribute type on this system [**dsconf schema attributetypes** *remove*](#dsconf~542) Remove an attribute type on this system # COMMAND *'dsconf* *schema* *attributetypes* *get\_syntaxes'* usage: dsconf \[-v] \[-j] instance schema attributetypes get\_syntaxes \[-h] # COMMAND *'dsconf* *schema* *attributetypes* *list'* usage: dsconf \[-v] \[-j] instance schema attributetypes list \[-h] # COMMAND *'dsconf* *schema* *attributetypes* *query'* usage: dsconf \[-v] \[-j] instance schema attributetypes query \[-h] \[name] [**name**](#name~22) Attribute type to query # COMMAND *'dsconf* *schema* *attributetypes* *add'* usage: dsconf \[-v] \[-j] instance schema attributetypes add \[-h] \[--oid OID] \[--desc DESC] \[--x-origin X\_ORIGIN] \[--aliases ALIASES \[ALIASES ...]] \[--single-value] \[--multi-value] \[--no-user-mod] \[--user-mod] \[--equality EQUALITY] \[--substr SUBSTR] \[--ordering ORDERING] \[--usage USAGE] \[--sup SUP] \--syntax SYNTAX name [**name**](#name~23) NAME of the object # OPTIONS *'dsconf* *schema* *attributetypes* *add'* [**--oid** *OID*](#oid) OID assigned to the object [**--desc** *DESC*](#desc) Description text(DESC) of the object [**--x-origin** *X\_ORIGIN*](#x~4) Provides information about where the attribute type is defined [**--aliases** *ALIASES \[ALIASES ...\]*](#aliases) Additional NAMEs of the object. [**--single-value**](#single) True if the matching rule must have only one valueOnly one of the flags this or --multi-value should be specified [**--multi-value**](#multi) True if the matching rule may have multiple values (default)Only one of the flags this or --single-value should be specified [**--no-user-mod**](#no) True if the attribute is not modifiable by a client applicationOnly one of the flags this or --user-mod should be specified [**--user-mod**](#user) True if the attribute is modifiable by a client application (default)Only one of the flags this or --no-user-mode should be specified [**--equality** *EQUALITY*](#equality) NAME or OID of the matching rule used for checkingwhether attribute values are equal [**--substr** *SUBSTR*](#substr) NAME or OID of the matching rule used for checkingwhether an attribute value contains another value [**--ordering** *ORDERING*](#ordering) NAME or OID of the matching rule used for checkingwhether attribute values are lesser - equal than [**--usage** *USAGE*](#usage) The flag indicates how the attribute type is to be used. Choose from the list: userApplications (default), directoryOperation, distributedOperation, dSAOperation [**--sup** *SUP*](#sup) The NAME or OID of attribute type this attribute type is derived from [**--syntax** *SYNTAX*](#syntax) OID of the LDAP syntax assigned to the attribute # COMMAND *'dsconf* *schema* *attributetypes* *replace'* usage: dsconf \[-v] \[-j] instance schema attributetypes replace \[-h] \[--oid OID] \[--desc DESC] \[--x-origin X\_ORIGIN] \[--aliases ALIASES \[ALIASES ...]] \[--single-value] \[--multi-value] \[--no-user-mod] \[--user-mod] \[--equality EQUALITY] \[--substr SUBSTR] \[--ordering ORDERING] \[--usage USAGE] \[--sup SUP] \[--syntax SYNTAX] name [**name**](#name~24) NAME of the object # OPTIONS *'dsconf* *schema* *attributetypes* *replace'* [**--oid** *OID*](#oid~2) OID assigned to the object [**--desc** *DESC*](#desc~2) Description text(DESC) of the object [**--x-origin** *X\_ORIGIN*](#x~5) Provides information about where the attribute type is defined [**--aliases** *ALIASES \[ALIASES ...\]*](#aliases~2) Additional NAMEs of the object. [**--single-value**](#single~2) True if the matching rule must have only one valueOnly one of the flags this or --multi-value should be specified [**--multi-value**](#multi~2) True if the matching rule may have multiple values (default)Only one of the flags this or --single-value should be specified [**--no-user-mod**](#no~2) True if the attribute is not modifiable by a client applicationOnly one of the flags this or --user-mod should be specified [**--user-mod**](#user~2) True if the attribute is modifiable by a client application (default)Only one of the flags this or --no-user-mode should be specified [**--equality** *EQUALITY*](#equality~2) NAME or OID of the matching rule used for checkingwhether attribute values are equal [**--substr** *SUBSTR*](#substr~2) NAME or OID of the matching rule used for checkingwhether an attribute value contains another value [**--ordering** *ORDERING*](#ordering~2) NAME or OID of the matching rule used for checkingwhether attribute values are lesser - equal than [**--usage** *USAGE*](#usage~2) The flag indicates how the attribute type is to be used. Choose from the list: userApplications (default), directoryOperation, distributedOperation, dSAOperation [**--sup** *SUP*](#sup~2) The NAME or OID of attribute type this attribute type is derived from [**--syntax** *SYNTAX*](#syntax~2) OID of the LDAP syntax assigned to the attribute # COMMAND *'dsconf* *schema* *attributetypes* *remove'* usage: dsconf \[-v] \[-j] instance schema attributetypes remove \[-h] name [**name**](#name~25) NAME of the object # COMMAND *'dsconf* *schema* *objectclasses'* usage: dsconf \[-v] \[-j] instance schema objectclasses \[-h] {list,query,add,replace,remove} ... # POSITIONAL ARGUMENTS *'dsconf schema objectclasses'* [**dsconf schema objectclasses** *list*](#dsconf~543) List available objectClasses on this system [**dsconf schema objectclasses** *query*](#dsconf~544) Query an objectClass [**dsconf schema objectclasses** *add*](#dsconf~545) Add an objectClass to this system [**dsconf schema objectclasses** *replace*](#dsconf~546) Replace an objectClass on this system [**dsconf schema objectclasses** *remove*](#dsconf~547) Remove an objectClass on this system # COMMAND *'dsconf* *schema* *objectclasses* *list'* usage: dsconf \[-v] \[-j] instance schema objectclasses list \[-h] \[--include-sup] # OPTIONS *'dsconf* *schema* *objectclasses* *list'* [**--include-sup**](#include~4) Include the superior objectclasses' "may" and "must" attributes # COMMAND *'dsconf* *schema* *objectclasses* *query'* usage: dsconf \[-v] \[-j] instance schema objectclasses query \[-h] \[--include-sup] \[name] [**name**](#name~26) ObjectClass to query # OPTIONS *'dsconf* *schema* *objectclasses* *query'* [**--include-sup**](#include~5) Include the superior objectclasses' "may" and "must" attributes # COMMAND *'dsconf* *schema* *objectclasses* *add'* usage: dsconf \[-v] \[-j] instance schema objectclasses add \[-h] \[--oid OID] \[--desc DESC] \[--x-origin X\_ORIGIN] \[--must MUST \[MUST ...]] \[--may MAY \[MAY ...]] \[--kind KIND] \[--sup SUP \[SUP ...]] name [**name**](#name~27) NAME of the object # OPTIONS *'dsconf* *schema* *objectclasses* *add'* [**--oid** *OID*](#oid~3) OID assigned to the object [**--desc** *DESC*](#desc~3) Description text(DESC) of the object [**--x-origin** *X\_ORIGIN*](#x~6) Provides information about where the attribute type is defined [**--must** *MUST \[MUST ...\]*](#must) NAMEs or OIDs of all attributes an entry of the object must have [**--may** *MAY \[MAY ...\]*](#may) NAMEs or OIDs of additional attributes an entry of the object may have [**--kind** *KIND*](#kind) Kind of an object. STRUCTURAL (default), ABSTRACT, AUXILIARY [**--sup** *SUP \[SUP ...\]*](#sup~3) NAME or OIDs of object classes this object is derived from # COMMAND *'dsconf* *schema* *objectclasses* *replace'* usage: dsconf \[-v] \[-j] instance schema objectclasses replace \[-h] \[--oid OID] \[--desc DESC] \[--x-origin X\_ORIGIN] \[--must MUST \[MUST ...]] \[--may MAY \[MAY ...]] \[--kind KIND] \[--sup SUP \[SUP ...]] name [**name**](#name~28) NAME of the object # OPTIONS *'dsconf* *schema* *objectclasses* *replace'* [**--oid** *OID*](#oid~4) OID assigned to the object [**--desc** *DESC*](#desc~4) Description text(DESC) of the object [**--x-origin** *X\_ORIGIN*](#x~7) Provides information about where the attribute type is defined [**--must** *MUST \[MUST ...\]*](#must~2) NAMEs or OIDs of all attributes an entry of the object must have [**--may** *MAY \[MAY ...\]*](#may~2) NAMEs or OIDs of additional attributes an entry of the object may have [**--kind** *KIND*](#kind~2) Kind of an object. STRUCTURAL (default), ABSTRACT, AUXILIARY [**--sup** *SUP \[SUP ...\]*](#sup~4) NAME or OIDs of object classes this object is derived from # COMMAND *'dsconf* *schema* *objectclasses* *remove'* usage: dsconf \[-v] \[-j] instance schema objectclasses remove \[-h] name [**name**](#name~29) NAME of the object # COMMAND *'dsconf* *schema* *matchingrules'* usage: dsconf \[-v] \[-j] instance schema matchingrules \[-h] {list,query} ... # POSITIONAL ARGUMENTS *'dsconf schema matchingrules'* [**dsconf schema matchingrules** *list*](#dsconf~548) List available matching rules on this system [**dsconf schema matchingrules** *query*](#dsconf~549) Query a matching rule # COMMAND *'dsconf* *schema* *matchingrules* *list'* usage: dsconf \[-v] \[-j] instance schema matchingrules list \[-h] # COMMAND *'dsconf* *schema* *matchingrules* *query'* usage: dsconf \[-v] \[-j] instance schema matchingrules query \[-h] \[name] [**name**](#name~30) Matching rule to query # COMMAND *'dsconf* *schema* *reload'* usage: dsconf \[-v] \[-j] instance schema reload \[-h] \[-d SCHEMADIR] \[--wait] \[--timeout TIMEOUT] # OPTIONS *'dsconf* *schema* *reload'* [**-d** *SCHEMADIR*, **--schemadir** *SCHEMADIR*](#d~2) directory where schema files are located [**--wait**](#wait~8) Wait for the reload task to complete [**--timeout** *TIMEOUT*](#timeout~12) Set a timeout to wait for the reload task. Default is 120 seconds # COMMAND *'dsconf* *schema* *validate-syntax'* usage: dsconf instance \[-v] \[-j] schema validate-syntax \[-h] \[-f FILTER] \[--timeout TIMEOUT] DN [**DN**](#DN~31) Base DN that contains entries to validate # OPTIONS *'dsconf* *schema* *validate-syntax'* [**-f** *FILTER*, **--filter** *FILTER*](#f~5) Filter for entries to validate. If omitted, all entries with filter "(objectclass=\*)" are validated [**--timeout** *TIMEOUT*](#timeout~13) Set a timeout to wait for the validation task. Default is 120 seconds # COMMAND *'dsconf* *schema* *import-openldap-file'* usage: dsconf instance \[-v] \[-j] schema import-openldap-file \[-h] \[--confirm] schema\_file [**schema\_file**](#schema_file) Path to the openldap dynamic schema ldif to import # OPTIONS *'dsconf* *schema* *import-openldap-file'* [**--confirm**](#confirm) Confirm that you want to apply these schema migration actions to the 389-ds instance. By default no actions are taken. # [OPTIONS](#OPTIONS) [**-v**, **--verbose**](#v) Display verbose operation tracing during command execution [**-j**, **--json**](#j) Return result in JSON object [**-D** *BINDDN*, **--binddn** *BINDDN*](#D) The account to bind as for executing operations [**-w** *BINDPW*, **--bindpw** *BINDPW*](#w~3) Password for the bind DN [**-W**, **--prompt**](#W) Prompt for password of the bind DN [**-y** *PWDFILE*, **--pwdfile** *PWDFILE*](#y) Specifies a file containing the password of the bind DN [**-b** *BASEDN*, **--basedn** *BASEDN*](#b~2) Base DN (root naming context) of the instance to manage [**-Z**, **--starttls**](#Z) Connect with StartTLS # [AUTHOR](#AUTHOR) ``` "Red Hat, Inc., and William Brown" <389-devel@lists.fedoraproject.org> ``` 1980-01-01 lib389 3.3.1 --- Document: dsconf(8) from py3.13-lib389 3.3.1-r7 (Chainguard OS) Source: https://github.com/389ds/389-ds-base.git