Chapter 2. Setting up an instance using the command line On the command line, you can use either a .inf file or interactive installer to set up a new instance. Additionally, you can set up a new instance as a non-root user. 2.1. Prerequisites The server meets the requirements of the latest Red Hat Directory Server version as described in the Red Hat Directory Server 12 Release Notes 2.2. Setting up a new instance on the command line using a .inf file When you set up Directory Server using a .inf file on the command line you can customize advanced settings. For example, you can customize in the .inf file the following settings: The user and group the ns-slapd Directory Server process uses after the service has started. Note that, if you use a different user and group, you must manually create the user and group before you start the installation. Paths, such as the configuration, backup, and data directory. Certificate validity. 2.2.1. Installing the Directory Server packages Use the following procedure to install the Directory Server packages. Prerequisites You enabled RHEL and Directory Server repositories as described in Enabling Directory Server repositories . Procedure Enable the redhat-ds:12 module and install Directory Server packages: 2.2.2. Creating a .inf file for a Directory Server instance installation Create a .inf file for the dscreate utility, and adjust the file to your environment. In a later step, you will use this file to create the new Directory Server instance. Prerequisites You installed the redhat-ds:12 module. Procedure Use the dscreate create-template command to create a template .inf file. For example, to store the template in the /root/instance_name.inf file, enter: # dscreate create-template /root/instance_name.inf The created file contains all available parameters including descriptions. Edit the file that you created in the step: Uncomment the parameters that you want to set to customize the installation. All parameters have defaults. However, Red Hat recommends that you customize certain parameters for a production environment. For example, set at least the following parameters in the [slapd] section: To install an instance with the LMDB backend, set the following parameters: Note that mdb_max_size must be an integer value that depends on your directory size. For more details, see nsslapd-mdb-max-size attribute description. To automatically create a suffix during instance creation, set the following parameters in the [backend-userroot] section: Important If you do not create a suffix during instance creation, you must create it later manually before you can store data in this instance. Optional: Uncomment other parameters and set them to appropriate values for your environment. For example, use these parameters to specify replication options, such as authentication credentials and changelog trimming, or set different ports for the LDAP and LDAPS protocols. Note By default, new instances that you create include a self-signed certificate and TLS enabled. For increased security, Red Hat recommends that you do not disable this feature. Note that you can replace the self-signed certificate with a certificate issued by a Certificate Authority (CA) at a later date. Additional resources Enabling TLS-encrypted connections to Directory Server 2.2.3. Using a .inf file to set up a new Directory Server instance This section describes how to use a .inf file to set up a new Directory Server instance using the command line. Prerequisites You created a .inf file for the Directory Server instance. Procedure Pass the .inf file to the dscreate from-file command to create the new instance: # dscreate from-file /root/instance_name.inf Starting installation ... Validate installation settings ... Create file system structures ... Create self-signed certificate database ... Perform SELinux labeling ... Perform post-installation tasks ... Completed installation for instance: slapd-instance_name The dscreate utility automatically starts the instance and configures RHEL to start the service when the system boots. Open the required ports in the firewall: # firewall-cmd --permanent --add-port={389/tcp,636/tcp} Reload the firewall configuration: # firewall-cmd --reload 2.3. Setting up a new instance on the command line using the interactive installer Administrators can use the Directory Server interactive installer to set up a new instance by answering questions about the configuration for the new instance. If you want to customize additional settings during the installation, use a .inf file instead of the interactive installer. For details, see Setting up a new instance on the command line using a .inf file . 2.3.1. Prerequisites The server meets the requirements of the latest Red Hat Directory Server version as described in the Red Hat Directory Server 12 Release Notes . 2.3.2. Installing the Directory Server packages Use the following procedure to install the Directory Server packages. Prerequisites You enabled RHEL and Directory Server repositories as described in Enabling Directory Server repositories . Procedure Enable the redhat-ds:12 module and install Directory Server packages: 2.3.3. Creating an instance using the interactive installer This section explains how to use the interactive installer to create a new Directory Server instance. Procedure Start the interactive installer: # dscreate interactive Answer the questions of the interactive installer. To use the default values displayed in square brackets behind most questions in the installer, press Enter without entering a value. Install Directory Server (interactive mode) =========================================== Enter system's hostname [server.example.com]: Enter the instance name [server]: instance_name Enter port number [389]: Create self-signed certificate database [yes]: Enter secure port number [636]: Enter Directory Manager DN [cn=Directory Manager]: Enter the Directory Manager password: password Confirm the Directory Manager Password: password Choose whether mdb or bdb is used. [bdb]: mdb Enter the lmdb database size [15154167808.0]: database_size_in_bytes Enter the database suffix (or enter "none" to skip) [dc=server,dc=example,dc=com]: dc=example,dc=com Create sample entries in the suffix [no]: Create just the top suffix entry [no]: yes Do you want to start the instance after the installation? [yes]: Are you ready to install? [no]: yes Note Instead of setting a password in clear text you can set a { algorithm } hash string generated by the pwdhash utility. Open the required ports in the firewall: # firewall-cmd --permanent --add-port={389/tcp,636/tcp} Reload the firewall configuration: # firewall-cmd --reload 2.4. Setting up a new instance as a non-root user If you do not have root permissions, you can perform the Directory Server installation as a user. Use this method to test Directory Server and develop LDAP applications. However, note that instances running by a non-root user have limitations, such as: They do not support Simple Network Management Protocol (SNMP). They can use only ports higher or equal to 1024. 2.4.1. Preparing the environment to install Directory Server as a user Without root permissions, before you can create and administer Directory Server instances, you need to prepare a proper environment using the dscreate ds-root command. Prerequisites You installed the Directory Server packages as a root user. Procedure Ensure you have USDHOME/bin in your PATH variable. If not: Append the following to the ~/.bash_profile file: PATH="USDHOME/bin:USDPATH" Re-read the ~/bash_profile file: USD source ~/.bash_profile Configure the environment for an instance creation to use the custom location: USD dscreate ds-root USDHOME/dsroot USDHOME/bin This command replaces the standard installation paths with USDHOME/dsroot/ and creates a copy of the standard Directory Server administration utilities in the USDHOME/bin/ directory. To make the shell use new paths: Clear the cache: USD hash -r dscreate Verify that the shell uses the correct path to the command: USD which dscreate ~/bin/dscreate For the dscreate command, the shell now uses the USDHOME/bin/dscreate instead of /usr/bin/dscreate . 2.4.2. Installing a new instance as non-root user To install Directory Server without root permissions, you can use the interactive installer. After the installation, Directory Server creates an instance in the custom location and a user can run dscreate , dsctl , dsconf utilities as usual. Prerequisites You prepared the environment for non-root installation. You have sudo permissions to use the firewall-cmd utility If you want to make the Directory Server instance available from the outside. Procedure Create an instance using the interactive installer Start the interactive installer: USD dscreate interactive Answer the questions of the interactive installer. To use the default values displayed in square brackets behind most questions in the installer, press Enter without entering a value. Note During the installation, you must choose the instance port and secure port number higher than 1024 (for example, 1389 and 1636). Otherwise, a user does not have permissions to bind to a privileged port (1-1023). Install Directory Server (interactive mode) =========================================== Non privileged user cannot use semanage, will not relabel ports or files. Selinux support will be disabled, continue? [yes]: yes Enter system's hostname [server.example.com]: Enter the instance name [server]: instance_name Enter port number [389]: 1389 Create self-signed certificate database [yes]: Enter secure port number [636]: 1636 Enter Directory Manager DN [cn=Directory Manager]: Enter the Directory Manager password: password Confirm the Directory Manager Password: password Enter the database suffix (or enter "none" to skip) [dc=server,dc=example,dc=com]: dc=example,dc=com Create sample entries in the suffix [no]: Create just the top suffix entry [no]: yes Do you want to start the instance after the installation? [yes]: Are you ready to install? [no]: yes Note Instead of setting a password in clear text you can set a { algorithm } hash string generated by the pwdhash utility. Optional: If you want to make the Directory Server instance available from the outside: Open the ports in the firewall: # sudo firewall-cmd --permanent --add-port={1389/tcp,1636/tcp} Reload the firewall configuration: # sudo firewall-cmd --reload Verification Run ldapsearch command to test that a user can connect to the instance: USD ldapsearch -D "cn=Directory Manager" -W -H ldap://server.example.com:1389 -b "dc=example,dc=com" -s sub -x "(objectclass=*)" Additional resources Preparing the environment for non root user installation How to bind ports below 1024 with non-root privilege

Commands:
dnf module enable redhat-ds:12 dnf install 389-ds-base cockpit-389-ds
dscreate create-template /root/instance_name.inf
instance_name = instance_name root_password = password
db_lib = mdb mdb_max_size = 21474836480
create_suffix_entry = True suffix = dc=example,dc=com
dscreate from-file /root/instance_name.inf Starting installation Validate installation settings Create file system structures Create self-signed certificate database Perform SELinux labeling Perform post-installation tasks Completed installation for instance: slapd-instance_name
firewall-cmd --permanent --add-port={389/tcp,636/tcp}
firewall-cmd --reload
dnf module enable redhat-ds:12 dnf install 389-ds-base cockpit-389-ds
dscreate interactive
Install Directory Server (interactive mode) =========================================== Enter system's hostname [server.example.com]: Enter the instance name [server]: instance_name Enter port number [389]: Create self-signed certificate database [yes]: Enter secure port number [636]: Enter Directory Manager DN [cn=Directory Manager]: Enter the Directory Manager password: password Confirm the Directory Manager Password: password Choose whether mdb or bdb is used. [bdb]: mdb Enter the lmdb database size [15154167808.0]: database_size_in_bytes Enter the database suffix (or enter "none" to skip) [dc=server,dc=example,dc=com]: dc=example,dc=com Create sample entries in the suffix [no]: Create just the top suffix entry [no]: yes Do you want to start the instance after the installation? [yes]: Are you ready to install? [no]: yes
firewall-cmd --permanent --add-port={389/tcp,636/tcp}
firewall-cmd --reload
PATH="USDHOME/bin:USDPATH"
source ~/.bash_profile
dscreate ds-root USDHOME/dsroot USDHOME/bin
hash -r dscreate
which dscreate ~/bin/dscreate
dscreate interactive
Install Directory Server (interactive mode) =========================================== Non privileged user cannot use semanage, will not relabel ports or files. Selinux support will be disabled, continue? [yes]: yes Enter system's hostname [server.example.com]: Enter the instance name [server]: instance_name Enter port number [389]: 1389 Create self-signed certificate database [yes]: Enter secure port number [636]: 1636 Enter Directory Manager DN [cn=Directory Manager]: Enter the Directory Manager password: password Confirm the Directory Manager Password: password Enter the database suffix (or enter "none" to skip) [dc=server,dc=example,dc=com]: dc=example,dc=com Create sample entries in the suffix [no]: Create just the top suffix entry [no]: yes Do you want to start the instance after the installation? [yes]: Are you ready to install? [no]: yes
sudo firewall-cmd --permanent --add-port={1389/tcp,1636/tcp}
sudo firewall-cmd --reload
ldapsearch -D "cn=Directory Manager" -W -H ldap://server.example.com:1389 -b "dc=example,dc=com" -s sub -x "(objectclass=*)"