Directory Server, Version 6.1

 

Appendix J. Synchronizing two-way cryptography between server instances

If you want to use replication, use a distributed directory, or import and export LDIF data between server instances, cryptographically synchronize the server instances to obtain the best performance.

If you already have a server instance, and you have another server instance that you want to cryptographically synchronize with the first server instance, use the following procedure before you do any of the following:

  • Start the second server instance

  • Run the idsbulkload command from the second server instance

  • Run the idsldif2db command from the second server instance

To cryptographically synchronize two server instances, assuming that you have already created the first server instance:

  1. Create the second server instance, but do not start the server instance, run the idsbulkload command, or run the idsldif2db command on the second server instance.

  2. Use the idsgendirksf utility on the second server instance to recreate the ibmslapddir.ksf file (the key stash file) from the first server instance. This file is used to replace the second server instance's original ibmslapddir.ksf file. See the idsgendirksf command information in the IBM® Tivoli® Directory Server version 6.1 Command Reference for more information about the idsgendirksf utility. The file is in the idsslapd-instance_name\etc directory on Windows® systems, or in the idsslapd-instance_name/etc directory on AIX®, Linux®, Solaris, and HP-UX systems. (instance_name is the name of the server instance).

  3. Start the second server instance, run the idsbulkload command, or run the idsldif2db command on the second server instance.

The server instances are now cryptographically synchronized, and AES-encrypted data will load correctly.

Although the procedure discusses two server instances, you might need a group of server instances that are cryptographically synchronized.

Note:

When importing LDIF data, if the LDIF import file is not cryptographically synchronized with the server instance that is importing the LDIF data, any AES-encrypted entries in the LDIF import file will not be imported.



[ Top of Page | Previous Page | Next Page | Contents | Index ]