====== SunOne Directory Server ======

===== Administration =====

==== SSL ====

===Initialize the database===

<code>
# ./shared/bin/certutil -N -d alias -P slapd-<instance>
</code>

===Import the CA certificate===

<code>
# ./shared/bin/certutil -A -n "<name>" -t "CT,c,c" -i /tmp/cacert.pem -d <directory> -P slapd-<instance>
</code>

=== Create a CSR ===

<code>
# ./shared/bin/certutil -R -s "cn=<dns name>" -a -d <directory> -P slapd-<instance>
</code>

=== Import a certificate ===

<code>
# ./shared/bin/certutil -A -n "<name>" -t "u,," -a -i /tmp/sunone.pem -d alias -P slapd-<instance>
</code>

=== List certificates ===

<code>
# ./shared/bin/certutil -d alias -L -P slapd-<instance>
</code>

==== Backup, restore ====

=== Backup ===

<code>
# cd <prefix>/slapd-<instance>
# ./db2ldif -s '<suffix>'
</code>

===== ACI =====

   * Prevent an OU to be read by anonymous user
<code>
aci: (targetattr != "userPassword || passwordHistory || passwordExpirationTime
 || passwordExpWarned || passwordRetryCount || retryCountResetTime || accountU
 nlockTime || passwordAllowChangeTime ")(target != "ldap:///ou=contacts,ou=Peo
 ple, dc=asyd, dc=net") (version 3.0; acl "Anonymous access"; allow (read, sea
 rch, compare)userdn = "ldap:///anyone";)
</code>

    * Grant to a group all access to a single OU 

<code>
aci: (targetattr = "*")(target="ldap:///ou=People,dc=asyd,dc=net")(version 3.0
 ;acl "Write access to bureau"; allow (all) groupdn="ldap:///cn=Bureau,ou=Grou
 ps,dc=asyd,dc=net";)
</code>

The (targetattr = "*") is **required**

~~DISCUSSION~~