Provided by: python3-lib389_2.0.15-1_all bug

NAME

       dsctl

SYNOPSIS

       dsctl            [-h]            [-v]            [-j]            [-l]           [instance]
       {restart,start,stop,status,remove,db2index,db2bak,db2ldif,dbverify,bak2db,ldif2db,backups,ldifs,tls,healthcheck,get-
       nsstate,ldifgen,dsrc,cockpit} ...

OPTIONS

       instance
              The name of the instance to act upon

   Sub-commands
       dsctl restart
              Restart an instance of Directory Server, if it is running: else start it.

       dsctl start
              Start an instance of Directory Server, if it is not currently running

       dsctl stop
              Stop an instance of Directory Server, if it is currently running

       dsctl status
              Check running status of an instance of Directory Server

       dsctl remove
              Destroy an instance of Directory Server, and remove all data.

       dsctl db2index
              Initialise a reindex of the server database. The server must be stopped for this to
              proceed.

       dsctl db2bak
              Initialise a BDB backup of the database. The server must be  stopped  for  this  to
              proceed.

       dsctl db2ldif
              Initialise  an  LDIF  dump  of the database. The server must be stopped for this to
              proceed.

       dsctl dbverify
              Perform a db verification. You should only do this at direction of support

       dsctl bak2db
              Restore a BDB backup of the database. The  server  must  be  stopped  for  this  to
              proceed.

       dsctl ldif2db
              Restore  an  LDIF  dump  of  the  database.  The server must be stopped for this to
              proceed.

       dsctl backups
              List backup's found in the server's default backup directory

       dsctl ldifs
              List all the LDIF files located in the server's LDIF directory

       dsctl tls
              Manage TLS certificates

       dsctl healthcheck
              Run a healthcheck report on a local Directory Server instance. This is a  safe  and
              read-only  operation.   Do  not attempt to run this on a remote Directory Server as
              this tool needs access to local resources, otherwise the report may be inaccurate.

       dsctl get-nsstate
              Get the replication nsState in a human readable format

              Replica DN:           The DN of the replication configuration entry Replica Suffix:
              The  replicated  suffix  Replica  ID:            The  Replica  identifier  Gen Time
              The time the CSN generator was created Gen Time String:       The  time  string  of
              generator Gen as CSN:           The generation CSN Local Offset:         The offset
              due to the local clock being set back Local Offset String:  The offset  in  a  nice
              human  format  Remote Offset:        The offset due to clock difference with remote
              systems Remote Offset String:  The  offset  in  a  nice  human  format  Time  Skew:
              The  time  skew between this server and its replicas Time Skew String:     The time
              skew in a nice human format Seq  Num:               The  number  of  multiple  csns
              within  a  second  System  Time:           The  local  system time Diff in Seconds:
              The time difference in seconds from the CSN  generator  creation  to  now  Diff  in
              days/secs:     The  time  difference  broken  up  into  days  and  seconds  Endian:
              Little/Big Endian

       dsctl ldifgen
              LDIF generator to make sample LDIF files for testing

       dsctl dsrc
              Manage the .dsrc file

       dsctl cockpit
              Enable the Cockpit interface/UI

OPTIONS 'dsctl restart'

       usage: dsctl [instance] restart [-h]

OPTIONS 'dsctl start'

       usage: dsctl [instance] start [-h]

OPTIONS 'dsctl stop'

       usage: dsctl [instance] stop [-h]

OPTIONS 'dsctl status'

       usage: dsctl [instance] status [-h]

OPTIONS 'dsctl remove'

       usage: dsctl [instance] remove [-h] [--do-it]

       --do-it
              By default we do a dry run. This actually initiates the removal of the
              instance.

OPTIONS 'dsctl db2index'

       usage: dsctl [instance] db2index [-h] [--attr [ATTR ...]] [backend]

       backend
              The backend to reindex. IE userRoot

       --attr [ATTR ...]
              The attribute's to reindex. IE --attr aci cn givenname

OPTIONS 'dsctl db2bak'

       usage: dsctl [instance] db2bak [-h] [archive]

       archive
              The destination for the archive. This will be created during the db2bak
              process.

OPTIONS 'dsctl db2ldif'

       usage: dsctl [instance] db2ldif [-h] [--replication] [--encrypted]
                                       backend [ldif]

       backend
              The backend to output as an LDIF. IE userRoot

       ldif   The path to the ldif output location.

       --replication
              Export replication information, suitable for importing on a new consumer or
              backups.

       --encrypted
              Export encrypted attributes

OPTIONS 'dsctl dbverify'

       usage: dsctl [instance] dbverify [-h] backend

       backend
              The backend to verify. IE userRoot

OPTIONS 'dsctl bak2db'

       usage: dsctl [instance] bak2db [-h] archive

       archive
              The archive to restore. This will erase all current server databases.

OPTIONS 'dsctl ldif2db'

       usage: dsctl [instance] ldif2db [-h] [--encrypted] backend ldif

       backend
              The backend to restore from an LDIF. IE userRoot

       ldif   The path to the ldif to import

       --encrypted
              Import encrypted attributes

OPTIONS 'dsctl backups'

       usage: dsctl [instance] backups [-h] [--delete DELETE]

       --delete DELETE
              Delete backup directory

OPTIONS 'dsctl ldifs'

       usage: dsctl [instance] ldifs [-h] [--delete DELETE]

       --delete DELETE
              Delete LDIF file

OPTIONS 'dsctl tls'

       usage: dsctl [instance] tls [-h]
                                   {list-ca,list-client-ca,show-server-cert,show-cert,generate-
       server-cert-csr,import-client-ca,import-ca,import-server-cert,import-server-key-
       cert,remove-cert}
                                   ...

   Sub-commands
       dsctl tls list-ca
              list server certificate authorities including intermediates

       dsctl tls list-client-ca
              list client certificate authorities including intermediates

       dsctl tls show-server-cert
              Show the active server certificate that clients will see and verify

       dsctl tls show-cert
              Show a certificate's details referenced by it's  nickname.  This  is  analogous  to
              certutil -L -d <path> -n <nickname>

       dsctl tls generate-server-cert-csr
              Generate a Server-Cert certificate signing request - the csr is then submitted to a
              CA for verification, and when signed you import with import-ca  and  import-server-
              cert

       dsctl tls import-client-ca
              Import a CA trusted to issue user (client) certificates. This is part of how client
              certificate authentication functions.

       dsctl tls import-ca
              Import a CA or intermediate CA for signing this servers certificates  (aka  Server-
              Cert). You should import all the CA's in the chain as required.

       dsctl tls import-server-cert
              Import a new Server-Cert after the csr has been signed from a CA.

       dsctl tls import-server-key-cert
              Import  a  new key and Server-Cert after having been signed from a CA. This is used
              if you have an external csr tool or a service like lets encrypt that generates  PEM
              keys externally.

       dsctl tls remove-cert
              Delete a certificate from this database. This will remove it from acting as a CA, a
              client CA or the Server-Cert role.

OPTIONS 'dsctl tls list-ca'

       usage: dsctl [instance] tls list-ca [-h]

OPTIONS 'dsctl tls list-client-ca'

       usage: dsctl [instance] tls list-client-ca [-h]

OPTIONS 'dsctl tls show-server-cert'

       usage: dsctl [instance] tls show-server-cert [-h]

OPTIONS 'dsctl tls show-cert'

       usage: dsctl [instance] tls show-cert [-h] nickname

       nickname
              The nickname (friendly name) of the certificate to display

OPTIONS 'dsctl tls generate-server-cert-csr'

       usage: dsctl [instance] tls generate-server-cert-csr [-h] [--subject SUBJECT]
                                                            [alt_names ...]

       alt_names
              Certificate requests subject alternative names. These are auto-detected if not
              provided

       --subject SUBJECT, -s SUBJECT
              Certificate Subject field to use

OPTIONS 'dsctl tls import-client-ca'

       usage: dsctl [instance] tls import-client-ca [-h] cert_path nickname

       cert_path
              The path to the x509 cert to import as a client trust root

       nickname
              The name of the certificate once imported

OPTIONS 'dsctl tls import-ca'

       usage: dsctl [instance] tls import-ca [-h] cert_path nickname

       cert_path
              The path to the x509 cert to import as a server CA

       nickname
              The name of the certificate once imported

OPTIONS 'dsctl tls import-server-cert'

       usage: dsctl [instance] tls import-server-cert [-h] cert_path

       cert_path
              The path to the x509 cert to import as Server-Cert

OPTIONS 'dsctl tls import-server-key-cert'

       usage: dsctl [instance] tls import-server-key-cert [-h] cert_path key_path

       cert_path
              The path to the x509 cert to import as Server-Cert

       key_path
              The path to the x509 key to import associated to Server-Cert

OPTIONS 'dsctl tls remove-cert'

       usage: dsctl [instance] tls remove-cert [-h] nickname

       nickname
              The name of the certificate to delete

OPTIONS 'dsctl healthcheck'

       usage: dsctl [instance] healthcheck [-h] [--list-checks] [--list-errors]
                                           [--dry-run] [--check CHECK [CHECK ...]]

       --list-checks
              List of known checks

       --list-errors
              List of known error codes

       --dry-run
              Do not execute the actual check, only list what would be done

       --check CHECK [CHECK ...]
              Areas to check. These can be obtained by --list-checks. Every element on the
              left of the colon (:) may be replaced by an asterisk if multiple options on
              the right are available.

OPTIONS 'dsctl get-nsstate'

       usage: dsctl [instance] get-nsstate [-h] [--suffix SUFFIX] [--flip FLIP]

       --suffix SUFFIX
              The DN of the replication suffix to read the state from

       --flip FLIP
              Flip between Little/Big Endian, this might be required for certain
              architectures

OPTIONS 'dsctl ldifgen'

       usage: dsctl [instance] ldifgen [-h]
                                       {users,groups,cos-def,cos-template,roles,mod-load,nested}
                                       ...

   Sub-commands
       dsctl ldifgen users
              Generate a LDIF containing user entries

       dsctl ldifgen groups
              Generate a LDIF containing groups and members

       dsctl ldifgen cos-def
              Generate a LDIF containing a COS definition (classic, pointer, or indirect)

       dsctl ldifgen cos-template
              Generate a LDIF containing a COS template

       dsctl ldifgen roles
              Generate a LDIF containing a role entry (managed, filtered, or indirect)

       dsctl ldifgen mod-load
              Generate a LDIF containing modify operations.  This is intended to be  consumed  by
              ldapmodify.

       dsctl ldifgen nested
              Generate a heavily nested database LDIF in a cascading/fractal tree design

OPTIONS 'dsctl ldifgen users'

       usage: dsctl [instance] ldifgen users [-h] [--number NUMBER] [--suffix SUFFIX]
                                             [--parent PARENT] [--generic]
                                             [--start-idx START_IDX] [--rdn-cn]
                                             [--localize] [--ldif-file LDIF_FILE]

       --number NUMBER
              The number of users to create.

       --suffix SUFFIX
              The database suffix where the entries will be created.

       --parent PARENT
              The parent entry that the user entries should be created under. If not
              specified, the entries are stored under random Organizational Units.

       --generic
              Create generic entries in the format of "uid=user####". These entries are also
              compatible with ldclt.

       --start-idx START_IDX
              For generic LDIF's you can choose the starting index for the user entries. The
              default is "0".

       --rdn-cn
              Use the attribute "cn" as the RDN attribute in the DN instead of "uid"

       --localize
              Localize the LDIF data

       --ldif-file LDIF_FILE
              The LDIF file name. Default location is the server's LDIF directory using the
              name 'users.ldif'

OPTIONS 'dsctl ldifgen groups'

       usage: dsctl [instance] ldifgen groups [-h] [--number NUMBER]
                                              [--suffix SUFFIX] [--parent PARENT]
                                              [--num-members NUM_MEMBERS]
                                              [--create-members]
                                              [--member-parent MEMBER_PARENT]
                                              [--member-attr MEMBER_ATTR]
                                              [--ldif-file LDIF_FILE]
                                              NAME

       NAME   The group name.

       --number NUMBER
              The number of groups to create.

       --suffix SUFFIX
              The database suffix where the groups will be created.

       --parent PARENT
              The parent entry that the group entries should be created under. If not
              specified the groups are stored under the suffix.

       --num-members NUM_MEMBERS
              The number of members in the group. Default is 10000

       --create-members
              Create the member user entries.

       --member-parent MEMBER_PARENT
              The entry DN that the members should be created under. The default is the
              suffix entry.

       --member-attr MEMBER_ATTR
              The membership attribute to use in the group. Default is "uniquemember".

       --ldif-file LDIF_FILE
              The LDIF file name. Default is "/tmp/ldifgen.ldif"

OPTIONS 'dsctl ldifgen cos-def'

       usage: dsctl [instance] ldifgen cos-def [-h] [--type TYPE] [--parent PARENT]
                                               [--create-parent]
                                               [--cos-specifier COS_SPECIFIER]
                                               [--cos-template COS_TEMPLATE]
                                               [--cos-attr [COS_ATTR ...]]
                                               [--ldif-file LDIF_FILE]
                                               NAME

       NAME   The COS definition name.

       --type TYPE
              The COS definition type: "classic", "pointer", or "indirect".

       --parent PARENT
              The parent entry that the COS definition should be created under.

       --create-parent
              Create the parent entry

       --cos-specifier COS_SPECIFIER
              Used in a classic COS definition, this attribute located in the user entry is
              used to select which COS template to use.

       --cos-template COS_TEMPLATE
              The DN of the COS template entry, only used for "classic" and "pointer" COS
              definitions.

       --cos-attr [COS_ATTR ...]
              A list of attributes which defines which attribute the COS generates values
              for.

       --ldif-file LDIF_FILE
              The LDIF file name. Default is "/tmp/ldifgen.ldif"

OPTIONS 'dsctl ldifgen cos-template'

       usage: dsctl [instance] ldifgen cos-template [-h] [--parent PARENT]
                                                    [--create-parent]
                                                    [--cos-priority COS_PRIORITY]
                                                    [--cos-attr-val COS_ATTR_VAL]
                                                    [--ldif-file LDIF_FILE]
                                                    NAME

       NAME   The COS template name.

       --parent PARENT
              The DN of the entry to store the COS template entry under.

       --create-parent
              Create the parent entry

       --cos-priority COS_PRIORITY
              Sets the priority of this conflicting/competing COS templates.

       --cos-attr-val COS_ATTR_VAL
              defines the attribute and value that the template provides.

       --ldif-file LDIF_FILE
              The LDIF file name. Default is "/tmp/ldifgen.ldif"

OPTIONS 'dsctl ldifgen roles'

       usage: dsctl [instance] ldifgen roles [-h] [--type TYPE] [--parent PARENT]
                                             [--create-parent] [--filter FILTER]
                                             [--role-dn [ROLE_DN ...]]
                                             [--ldif-file LDIF_FILE]
                                             NAME

       NAME   The Role name.

       --type TYPE
              The Role type: "managed", "filtered", or "nested".

       --parent PARENT
              The DN of the entry to store the Role entry under

       --create-parent
              Create the parent entry

       --filter FILTER
              A search filter for gathering Role members. Required for a "filtered" role.

       --role-dn [ROLE_DN ...]
              A DN of a role entry that should be included in this role. Used for "nested"
              roles only.

       --ldif-file LDIF_FILE
              The LDIF file name. Default is "/tmp/ldifgen.ldif"

OPTIONS 'dsctl ldifgen mod-load'

       usage: dsctl [instance] ldifgen mod-load [-h] [--create-users]
                                                [--delete-users]
                                                [--num-users NUM_USERS]
                                                [--parent PARENT] [--create-parent]
                                                [--add-users ADD_USERS]
                                                [--del-users DEL_USERS]
                                                [--modrdn-users MODRDN_USERS]
                                                [--mod-users MOD_USERS]
                                                [--mod-attrs [MOD_ATTRS ...]]
                                                [--randomize] [--ldif-file LDIF_FILE]

       --create-users
              Create the entries that will be modified or deleted. By default the script
              assumes the user entries already exist.

       --delete-users
              Delete all the user entries at the end of the LDIF.

       --num-users NUM_USERS
              The number of user entries that will be modified or deleted

       --parent PARENT
              The DN of the parent entry where the user entries are located.

       --create-parent
              Create the parent entry

       --add-users ADD_USERS
              The number of additional entries to add during the load.

       --del-users DEL_USERS
              The number of entries to delete during the load.

       --modrdn-users MODRDN_USERS
              The number of entries to perform a modrdn operation on.

       --mod-users MOD_USERS
              The number of entries to modify.

       --mod-attrs [MOD_ATTRS ...]
              List of attributes the script will randomly choose from when modifying an
              entry. The default is "description".

       --randomize
              Randomly perform the specified add, mod, delete, and modrdn operations

       --ldif-file LDIF_FILE
              The LDIF file name. Default is "/tmp/ldifgen.ldif"

OPTIONS 'dsctl ldifgen nested'

       usage: dsctl [instance] ldifgen nested [-h] [--num-users NUM_USERS]
                                              [--node-limit NODE_LIMIT]
                                              [--suffix SUFFIX]
                                              [--ldif-file LDIF_FILE]

       --num-users NUM_USERS
              The total number of user entries to create in the entire LDIF (does not
              include the container entries).

       --node-limit NODE_LIMIT
              The total number of user entries to create under each node/subtree

       --suffix SUFFIX
              The suffix DN for the LDIF

       --ldif-file LDIF_FILE
              The LDIF file name. Default location is the server's LDIF directory using the
              name 'users.ldif'

OPTIONS 'dsctl dsrc'

       usage: dsctl [instance] dsrc [-h] {create,modify,delete,display} ...

   Sub-commands
       dsctl dsrc create
              Generate the .dsrc file

       dsctl dsrc modify
              Modify the .dsrc file

       dsctl dsrc delete
              Delete instance configuration from the .dsrc file.

       dsctl dsrc display
              Display the contents of the .dsrc file.

OPTIONS 'dsctl dsrc create'

       usage: dsctl [instance] dsrc create [-h] [--uri URI] [--basedn BASEDN]
                                           [--binddn BINDDN] [--saslmech SASLMECH]
                                           [--tls-cacertdir TLS_CACERTDIR]
                                           [--tls-cert TLS_CERT] [--tls-key TLS_KEY]
                                           [--tls-reqcert TLS_REQCERT] [--starttls]
                                           [--pwdfile PWDFILE] [--do-it]

       --uri URI
              The URI (LDAP URL) for the Directory Server instance.

       --basedn BASEDN
              The default database suffix.

       --binddn BINDDN
              The default Bind DN used or authentication.

       --saslmech SASLMECH
              The SASL mechanism to use: PLAIN or EXTERNAL.

       --tls-cacertdir TLS_CACERTDIR
              The directory containing the Trusted Certificate Authority certificate.

       --tls-cert TLS_CERT
              The absolute file name to the server certificate.

       --tls-key TLS_KEY
              The absolute file name to the server certificate key.

       --tls-reqcert TLS_REQCERT
              Request certificate strength: 'never', 'allow', 'hard'

       --starttls
              Use startTLS for connection to the server.

       --pwdfile PWDFILE
              The absolute path to a file containing the Bind DN's password.

       --do-it
              Create the file without any confirmation.

OPTIONS 'dsctl dsrc modify'

       usage: dsctl [instance] dsrc modify [-h] [--uri [URI]] [--basedn [BASEDN]]
                                           [--binddn [BINDDN]]
                                           [--saslmech [SASLMECH]]
                                           [--tls-cacertdir [TLS_CACERTDIR]]
                                           [--tls-cert [TLS_CERT]]
                                           [--tls-key [TLS_KEY]]
                                           [--tls-reqcert [TLS_REQCERT]] [--starttls]
                                           [--cancel-starttls] [--pwdfile [PWDFILE]]
                                           [--do-it]

       --uri [URI]
              The URI (LDAP URL) for the Directory Server instance.

       --basedn [BASEDN]
              The default database suffix.

       --binddn [BINDDN]
              The default Bind DN used or authentication.

       --saslmech [SASLMECH]
              The SASL mechanism to use: PLAIN or EXTERNAL.

       --tls-cacertdir [TLS_CACERTDIR]
              The directory containing the Trusted Certificate Authority certificate.

       --tls-cert [TLS_CERT]
              The absolute file name to the server certificate.

       --tls-key [TLS_KEY]
              The absolute file name to the server certificate key.

       --tls-reqcert [TLS_REQCERT]
              Request certificate strength: 'never', 'allow', 'hard'

       --starttls
              Use startTLS for connection to the server.

       --cancel-starttls
              Do not use startTLS for connection to the server.

       --pwdfile [PWDFILE]
              The absolute path to a file containing the Bind DN's password.

       --do-it
              Update the file without any confirmation.

OPTIONS 'dsctl dsrc delete'

       usage: dsctl [instance] dsrc delete [-h] [--do-it]

       --do-it
              Delete this instance's configuration from the .dsrc file.

OPTIONS 'dsctl dsrc display'

       usage: dsctl [instance] dsrc display [-h]

OPTIONS 'dsctl cockpit'

       usage: dsctl [instance] cockpit [-h]
                                       {enable,open-firewall,disable,close-firewall}
                                       ...

   Sub-commands
       dsctl cockpit enable
              Enable the Cockpit socket

       dsctl cockpit open-firewall
              Open the firewall for the "cockpit" service

       dsctl cockpit disable
              Disable the Cockpit socket

       dsctl cockpit close-firewall
              Remove the "cockpit" service from the firewall settings

OPTIONS 'dsctl cockpit enable'

       usage: dsctl [instance] cockpit enable [-h]

OPTIONS 'dsctl cockpit open-firewall'

       usage: dsctl [instance] cockpit open-firewall [-h] [--zone ZONE]

       --zone ZONE
              The firewall zone

OPTIONS 'dsctl cockpit disable'

       usage: dsctl [instance] cockpit disable [-h]

OPTIONS 'dsctl cockpit close-firewall'

       usage: dsctl [instance] cockpit close-firewall [-h]

       -v, --verbose
              Display verbose operation tracing during command execution

       -j, --json
              Return result in JSON object

       -l, --list
              List available Directory Server instances

AUTHORS

       lib389 was written by Red Hat Inc., and William Brown <389-devel@lists.fedoraproject.org>.

DISTRIBUTION

       The      latest      version      of      lib389      may      be      downloaded     from
       ⟨http://www.port389.org/docs/389ds/FAQ/upstream-test-framework.html⟩

                                              Manual                                     dsctl(8)