Chapter 10. Enabling members of a group to back up Directory Server and performing the backup as one of the group members You can configure that members of a group have permissions to back up an instance and perform the backup. This increases the security because you no longer need to set the credentials of cn=Directory Manager in your backup script or cron jobs. Additionally, you can easily grant and revoke the backup permissions by modifying the group. 10.1. Enabling a group to back up Directory Server Use this procedure to add the cn=backup_users,ou=groups,dc=example,dc=com group and enable members of this group to create backup tasks. Prerequisites The entry ou=groups,dc=example,dc=com exists in the database. Procedure Create the cn=backup_users,ou=groups,dc=example,dc=com group: # dsidm -D "cn=Directory manager" ldap://server.example.com -b " dc=example,dc=com " group create --cn backup_users Add an access control instruction (ACI) that allows members of the cn=backup_users,ou=groups,dc=example,dc=com group to create backup tasks: # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com dn: cn=config changetype: modify add: aci aci: (target = " ldap:///cn=backup,cn=tasks,cn=config ")(targetattr="*") (version 3.0 ; acl " permission: Allow backup_users group to create backup tasks " ; allow (add, read, search) groupdn = " ldap:///cn=backup_users,ou=groups,dc=example,dc=com ";) - add: aci aci: (target = "ldap:///cn=config")(targetattr = "nsslapd-bakdir || objectClass") (version 3.0 ; acl " permission: Allow backup_users group to access bakdir attribute " ; allow (read,search) groupdn = " ldap:///cn=backup_users,ou=groups,dc=example,dc=com ";) Create a user: Create a user account: # dsidm -D "cn=Directory manager" ldap://server.example.com -b " dc=example,dc=com " user create --uid=" example " --cn=" example " --uidNumber=" 1000 " --gidNumber=" 1000 " --homeDirectory=" /home/example/ " --displayName=" Example User " Set a password on the user account: # dsidm -D "cn=Directory manager" ldap://server.example.com -b " dc=example,dc=com " account reset_password " uid=example,ou=People,dc=example,dc=com " " password " Add the uid=example,ou=People,dc=example,dc=com user to the cn=backup_users,ou=groups,dc=example,dc=com group: # dsidm -D "cn=Directory manager" ldap://server.example.com -b " dc=example,dc=com " group add_member backup_users uid=example,ou=People,dc=example,dc=com Verification Display the ACIs set on the cn=config entry: # ldapsearch -o ldif-wrap=no -LLLx -D "cn=directory manager" -W -H ldap://server.example.com -b cn=config aci=* aci -s base dn: cn=config aci: (target = "ldap:///cn=backup,cn=tasks,cn=config")(targetattr="*")(version 3.0 ; acl "permission: Allow backup_users group to create backup tasks" ; allow (add, read, search) groupdn = "ldap:///cn=backup_users,ou=groups,dc=example,dc=com";) aci: (target = "ldap:///cn=config")(targetattr = "nsslapd-bakdir || objectClass")(version 3.0 ; acl "permission: Allow backup_users group to access bakdir attribute" ; allow (read,search) groupdn = "ldap:///cn=backup_users,ou=groups,dc=example,dc=com";) ... 10.2. Performing a backup as a regular user You can perform backups as a regular user instead of cn=Directory Manager . Prerequisites You enabled members of the cn=backup_users,ou=groups,dc=example,dc=com group to perform backups. The user you use to perform the backup is a member of the cn=backup_users,ou=groups,dc=example,dc=com group. Procedure Create a backup task using one of the following methods: Using the dsconf backup create command: # dsconf -D " uid=example,ou=People,dc=example,dc=com " ldap://server.example.com backup create By manually creating the task: # ldapadd -D " uid=example,ou=People,dc=example,dc=com " -W -H ldap://server.example.com dn: cn= backup-2021_07_23_12:55_00 ,cn=backup,cn=tasks,cn=config changetype: add objectClass: extensibleObject nsarchivedir: /var/lib/dirsrv/slapd-instance_name/bak/backup-2021_07_23_12:55_00 nsdatabasetype: ldbm database cn: backup-2021_07_23_12:55_00 Verification Verify that the backup was created: # ls -l /var/lib/dirsrv/slapd-instance_name/bak/ total 0 drwx------. 3 dirsrv dirsrv 108 Jul 23 12:55 backup-2021_07_23_12_55_00 ... Additional resources Enabling a group to back up Directory Server

Commands:
dsidm -D "cn=Directory manager" ldap://server.example.com -b " dc=example,dc=com " group create --cn backup_users
ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com dn: cn=config changetype: modify add: aci aci: (target = " ldap:///cn=backup,cn=tasks,cn=config ")(targetattr="*") (version 3.0 ; acl " permission: Allow backup_users group to create backup tasks " ; allow (add, read, search) groupdn = " ldap:///cn=backup_users,ou=groups,dc=example,dc=com ";) - add: aci aci: (target = "ldap:///cn=config")(targetattr = "nsslapd-bakdir || objectClass") (version 3.0 ; acl " permission: Allow backup_users group to access bakdir attribute " ; allow (read,search) groupdn = " ldap:///cn=backup_users,ou=groups,dc=example,dc=com ";)
dsidm -D "cn=Directory manager" ldap://server.example.com -b " dc=example,dc=com " user create --uid=" example " --cn=" example " --uidNumber=" 1000 " --gidNumber=" 1000 " --homeDirectory=" /home/example/ " --displayName=" Example User "
dsidm -D "cn=Directory manager" ldap://server.example.com -b " dc=example,dc=com " account reset_password " uid=example,ou=People,dc=example,dc=com " " password "
dsidm -D "cn=Directory manager" ldap://server.example.com -b " dc=example,dc=com " group add_member backup_users uid=example,ou=People,dc=example,dc=com
ldapsearch -o ldif-wrap=no -LLLx -D "cn=directory manager" -W -H ldap://server.example.com -b cn=config aci=* aci -s base dn: cn=config aci: (target = "ldap:///cn=backup,cn=tasks,cn=config")(targetattr="*")(version 3.0 ; acl "permission: Allow backup_users group to create backup tasks" ; allow (add, read, search) groupdn = "ldap:///cn=backup_users,ou=groups,dc=example,dc=com";) aci: (target = "ldap:///cn=config")(targetattr = "nsslapd-bakdir || objectClass")(version 3.0 ; acl "permission: Allow backup_users group to access bakdir attribute" ; allow (read,search) groupdn = "ldap:///cn=backup_users,ou=groups,dc=example,dc=com";)
dsconf -D " uid=example,ou=People,dc=example,dc=com " ldap://server.example.com backup create
ldapadd -D " uid=example,ou=People,dc=example,dc=com " -W -H ldap://server.example.com dn: cn= backup-2021_07_23_12:55_00 ,cn=backup,cn=tasks,cn=config changetype: add objectClass: extensibleObject nsarchivedir: /var/lib/dirsrv/slapd-instance_name/bak/backup-2021_07_23_12:55_00 nsdatabasetype: ldbm database cn: backup-2021_07_23_12:55_00
ls -l /var/lib/dirsrv/slapd-instance_name/bak/ total 0 drwx------. 3 dirsrv dirsrv 108 Jul 23 12:55 backup-2021_07_23_12_55_00