Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION 11-05-2007 Installation Manual page 689

rootdn determines who owns administrator rights to this server. The user declared
here does not need to have an LDAP entry or exist as regular user.
rootpw sets the administrator password. Instead of using secret here, it is
possible to enter the hash of the administrator password created by slappasswd.
The directory directive indicates the directory in the file system where the
database directories are stored on the server.
The last directive, index objectClass eq, results in the maintenance of
an index of all object classes. Attributes for which users search most often can be
added here according to experience.
overlay ppolicy adds a layer of password control mechanisms.
ppolicy_default specifies the DN of the pwdPolicy object to use when no
specific policy is set on a given user's entry. If there is no specific policy for an
entry and no default is given, no policies are enforced.
ppolicy_hash_cleartext specifies that clear text passwords present in
add and modify requests are hashed before being stored in the database. When
this option is used, it is recommended to deny compare, search, and read access
to the userPassword attribute for all directory users, because
ppolicy_hash_cleartext violates the X.500/LDAP information model.
ppolicy_use_lockout sends a specific error code when a client tries to
connect to a locked account. When your site is sensitive to security issues, disable
this option as the error code provides useful information to attackers.
Custom Access rules defined here for the database are used instead of the global
Access rules.
36.3.3 Starting and Stopping the Servers
Once the LDAP server is fully configured and all desired entries have been made ac-
cording to the pattern described in
(page 672), start the LDAP server as root by entering rcldap start. To stop the
server manually, enter the command rcldap stop. Request the status of the running
LDAP server with rcldap status.
Section 36.4, "Data Handling in the LDAP Directory"
LDAP—A Directory Service 671