Procédure

1. Pour afficher le temps de recherche actuel et les limites de taille dans l'interface CLI, utilisez la commande ipa config-show:

   $ ipa config-show
   
   Search time limit: 2
   Search size limit: 100

2. Pour ajuster les limites globally pour toutes les requêtes, utilisez la commande ipa config-mod et ajoutez les options --searchrecordslimit et --searchtimelimit. Par exemple :

   $ ipa config-mod --searchrecordslimit=500 --searchtimelimit=5

3. Pour que temporarily ajuste les limites uniquement pour une requête spécifique, ajoutez les options --sizelimit ou --timelimit à la commande. Par exemple :

Procédure

1. Connectez-vous à l'interface Web IdM.

2. Cliquez sur IPA Server.

   

3. Dans l'onglet IPA Server, cliquez sur Configuration.

4. Réglez les valeurs requises dans la zone Search Options.

   Les valeurs par défaut sont les suivantes :

   • Limite de la taille de la recherche : 100 entrées
   • Limite de temps de recherche : 2 secondes

5. Cliquez sur Save en haut de la page.

   

Procédure

1. Disable automatic cache tuning.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend config set --cache-autosize=0

2. Display the database suffixes and their corresponding back ends.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list
   cn=changelog (changelog)
   dc=example,dc=com (userroot)
   o=ipaca (ipaca)

   This command displays the name of the back end database next to each suffix. Use the suffix’s database name in the next step.

3. Set the entry cache size for the database. This example sets the entry cache for the userroot database to 2 gigabytes.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix set --cache-memsize=2147483648 userroot

4. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

5. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust cache-memsize to a different value, or re-enable cache auto-sizing.

Procédure

1. Disable automatic cache tuning, and set the database cache size. This example sets the database cache to 256 megabytes.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend config set --cache-autosize=0 --dbcachesize=268435456

2. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

3. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust dbcachesize to a different value, or re-enable cache auto-sizing.

Procédure

1. Stop the Directory Server.

   [root@server ~]# systemctl stop dirsrv.target

2. Backup the /etc/dirsrv/slapd-instance_name/dse.ldif file before making any further modifications.

   [root@server ~]# *cp /etc/dirsrv/slapd-instance_name/dse.ldif \
        /etc/dirsrv/slapd-instance_name/dse.ldif.bak.$(date "+%F_%H-%M-%S")

3. Edit the /etc/dirsrv/slapd-instance_name/dse.ldif file:

   1. Set the percentage of free system RAM to use for the database and entry caches back to the default of 10% of free RAM.

      nsslapd-cache-autosize: 10

   2. Set the percentage used from the free system RAM for the database cache to the default of 25%:

      nsslapd-cache-autosize-split: 25

4. Save your changes to the /etc/dirsrv/slapd-instance_name/dse.ldif file.

5. Start the Directory Server.

   [root@server ~]# systemctl start dirsrv.target

Procédure

1. (Optional) Display the database suffixes and their corresponding database names.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list
   dc=example,dc=com (userroot)

   This command displays the name of the back end database next to each suffix. Use the suffix’s database name in the next step.

2. Set the DN cache size for the database. This example sets the DN cache to 20 megabytes.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix set --dncache-memsize=20971520 userroot

3. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust dncache-memsize to a different value, or back to the default of 10 MB.

Procédure

1. Ensure the NDN cache is enabled.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-ndn-cache-enabled
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-ndn-cache-enabled: on

   If the cache is off, enable it with the following command.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-ndn-cache-enabled=on
   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-ndn-cache-enabled"

2. Retrieve the current value of the nsslapd-ndn-cache-max-size parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-ndn-cache-max-size
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-ndn-cache-max-size: 20971520

3. Modify the value of the nsslapd-ndn-cache-max-size attribute. This example increases the value to 41943040 (40 MB).

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-ndn-cache-max-size=41943040

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-ndn-cache-max-size to a different value, or re-enable cache auto-sizing.

Procédure

1. Retrieve the current value of the nsslapd-maxbersize parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-maxbersize
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-maxbersize: 2097152

2. Modify the value of the nsslapd-maxbersize attribute. This example increases the value to 4194304, 4 MB.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-maxbersize=4194304

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-maxbersize"

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-maxbersize to a different value, or back to the default of 2097152.

Procédure

1. Retrieve the current value of the nsslapd-maxdescriptors parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-maxdescriptors
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-maxdescriptors: 4096

2. Modify the value of the nsslapd-maxdescriptors attribute. This example increases the value to 8192.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-maxdescriptors=8192

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-maxdescriptors"

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-maxdescriptors to a different value, or back to the default of 4096.

Procédure

1. Retrieve the current value of the nsslapd-listen-backlog-size parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-listen-backlog-size
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-listen-backlog-size: 128

2. Modify the value of the nsslapd-listen-backlog-size attribute. This example increases the value to 192.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-listen-backlog-size=192

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-listen-backlog-size"

Procédure

1. Retrieve the current value of the nsslapd-db-locks parameter and make a note of it before making any adjustments, in case it needs to be restored.

   [root@server ~]# ldapsearch -D "cn=directory manager" -w DirectoryManagerPassword -b "cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config" | grep nsslapd-db-locks
   nsslapd-db-locks: 50000

2. Modify the value of the locks attribute. This example doubles the value to 100000 locks.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend config set --locks=100000

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully updated database configuration

4. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

Procédure

1. Retrieve the current value of the nsslapd-ioblocktimeout parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-ioblocktimeout
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-ioblocktimeout: 10000

2. Modify the value of the nsslapd-ioblocktimeout attribute. This example lowers the value to 8000.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-ioblocktimeout=8000

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-ioblocktimeout"

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-ioblocktimeout to a different value, or back to the default of 10000.

Procédure

1. Retrieve the current value of the nsslapd-idletimeout parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-idletimeout
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-idletimeout: 3600

2. Modify the value of the nsslapd-idletimeout attribute. This example lowers the value to 1800 (30 minutes).

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-idletimeout=1800

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-idletimeout"

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-idletimeout to a different value, or back to the default of 3600.

Procédure

1. Display the database suffixes and their corresponding back ends.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list
   cn=changelog (changelog)
   dc=example,dc=com (userroot)
   o=ipaca (ipaca)

   This command displays the names of the back end databases next to their suffix. Use the suffix name in the next step.

2. Modify the value of the repl-release-timeout attribute for the main userroot database. This example increases the value to 90 seconds.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com replication set --suffix="dc=example,dc=com" --repl-release-timeout=90

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "repl-release-timeout"

4. (Optional) If your IdM environment uses the IdM Certificate Authority (CA), you can modify the value of the repl-release-timeout attribute for the CA database. This example increases the value to 90 seconds.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com replication set --suffix="o=ipaca" --repl-release-timeout=90
   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "repl-release-timeout"

5. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

6. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust repl-release-timeout to a different value, or back to the default of 60 seconds.

Procédure

1. Créez un fichier texte au format LDIF avec vos paramètres de base de données personnalisés. Séparez les modifications d'attributs LDAP par un tiret (-). Cet exemple définit des valeurs par défaut pour le délai d'inactivité et le nombre maximum de descripteurs de fichiers.

   dn: cn=config
   changetype: modify
   replace: nsslapd-idletimeout
   nsslapd-idletimeout=1800
   -
   replace: nsslapd-maxdescriptors
   nsslapd-maxdescriptors=8192

2. Utilisez le paramètre --dirsrv-config-file pour transmettre le fichier LDIF au script d'installation.

   1. Pour installer un serveur IdM :

      # ipa-server-install --dirsrv-config-file filename.ldif

   2. Pour installer une réplique IdM :

      # ipa-replica-install --dirsrv-config-file filename.ldif

Procédure

1. Open the /var/kerberos/krb5kdc/kdc.conf file in a text editor.

2. Set the TCP listen backlog to your desired value, such as 7.

   [kdcdefaults]
    ...
    kdc_tcp_listen_backlog = 7

3. Save and close the /var/kerberos/krb5kdc/kdc.conf file.
4. Restart the KDC to load the new settings.

Procédure

1. Open the /etc/krb5.conf file in a text editor.

2. Specify any options and their desired values within the [dbmodules] section, and in the respective Kerberos realm. In this example, you are setting the disable_last_success variable for the EXAMPLE.COM Kerberos realm.

   [dbmodules]
       EXAMPLE.COM = {
           disable_last_success = true
       }

3. Save and close the /etc/krb5.conf file.
4. Restart the KDC to load the new settings.

Procédure

1. Open the /etc/sysconfig/krb5kdc file in a text editor.

2. Specify the value of the KRB5KDC_ARGS parameter. In this example, you are setting the number of processes to 10:

   KRB5KDC_ARGS='-w 10'
   [...]

3. Save and close the /etc/sysconfig/krb5kdc file.

4. Reload the systemd configuration:

   # systemctl daemon-reload

5. Restart the krb5kdc service:

   # systemctl restart krb5kdc.service

Procédure

1. Ouvrez le fichier de configuration /etc/sssd/sssd.conf dans un éditeur de texte.

2. Add the following options to the [domain] section for your Active Directory domain. If you do not already have a domain section for your AD domain, create one.

   [domain/ad.example.com]
   ignore_group_members = true
   subdomain_inherit = ignore_group_members
   ...

3. Save and close the /etc/sssd/sssd.conf file on the server.

4. Redémarrez le service SSSD pour charger les modifications de configuration.

   [root@client ~]# systemctl restart sssd

Procédure

1. Retrieve the total number of worker threads.

   # ldapsearch -xLLLD cn=directory\ manager -W -b cn=config -s base nsslapd-threadnumber
   Enter LDAP Password:
   dn: cn=config
   nsslapd-threadnumber: 16

   This means that the current value for ipaExtdomMaxInstances is 13.

2. Adjust the maximum number of instances. This example changes the value to 14:

   # ldapmodify -D "cn=directory manager" -W
   dn: cn=ipa_extdom_extop,cn=plugins,cn=config
   changetype: modify
   replace: ipaExtdomMaxInstances
   ipaExtdomMaxInstances: 14

3. Monitor the IdM directory server’s performance and if it does not improve, repeat this procedure and adjust the value of the ipaExtdomMaxInstances variable.

Procédure

1. Determine the number of seconds a single un-cached login takes.

   1. Clear the SSSD cache on the IdM client client.example.com.

      [root@client ~]# sss_cache -E

   2. Measure how long it takes to log in as an AD user with the time command. In this example, from the IdM client client.example.com, log into the same host as the user ad-user from the ad.example.com AD domain.

      [root@client ~]# time ssh ad-user@ad.example.com@client.example.com

   3. Type in the password as soon as possible.

      Password:
      Last login: Sat Jan 23 06:29:54 2021 from 10.0.2.15
      [ad-user@ad.example.com@client ~]$

   4. Log out as soon as possible to display elapsed time. In this example, a single un-cached login takes about 9 seconds.

      [ad-user@ad.example.com@client /]$ exit
      logout
      Connection to client.example.com closed.
      
      real 0m8.755s
      user    0m0.017s
      sys     0m0.013s

2. Ouvrez le fichier de configuration /etc/sssd/sssd.conf dans un éditeur de texte.

3. Add the following options to the [domain] section for your Active Directory domain. Set the pam_id_timeout and krb5_auth_timeout options to the number of seconds an un-cached login takes. If you do not already have a domain section for your AD domain, create one.

   [domain/example.com/ad.example.com]
   krb5_auth_timeout = 9
   ldap_deref_threshold = 0
   ...

4. Add the following option to the [pam] section:

   [pam]
   pam_id_timeout = 9

5. Save and close the /etc/sssd/sssd.conf file on the server.

6. Redémarrez le service SSSD pour charger les modifications de configuration.

   [root@client ~]# systemctl restart sssd

Procédure

1. Create a tmpfs temporary filesystem:

   1. On RHEL 8.6 and later, confirm that the SSSD user owns the config.ldb file:

      # ls -al /var/lib/sss/db/config.ldb
      -rw-------. 1 sssd sssd 1286144 Jun  8 16:41 /var/lib/sss/db/config.ldb

      In this case, add the following entry to the /etc/fstab file as a single line:

      tmpfs /var/lib/sss/db/ tmpfs size=300M,mode=0700,uid=sssd,gid=sssd,rootcontext=system_u:object_r:sssd_var_lib_t:s0 0 0

   2. On RHEL 8 versions lower than 8.6, the config.ldb file is owned by the root user:

      # ls -al /var/lib/sss/db/config.ldb
      -rw-------. 1 root root 1286144 Jun  8 14:15 /var/lib/sss/db/config.ldb

      In this case, add the following entry to the /etc/fstab file as a single line:

      tmpfs /var/lib/sss/db/ tmpfs size=300M,mode=0700,rootcontext=system_u:object_r:sssd_var_lib_t:s0 0 0

      This example creates a 300MB cache. Tune the size parameter according to your IdM and AD directory size, estimating 100 MBs per 10,000 LDAP entries.

2. Mount the new SSSD cache directory.

   [root@host ~]# mount /var/lib/sss/db/

3. Restart SSSD to reflect this configuration change.

   [root@host ~]# systemctl restart sssd