DSCTL(8)
💖 DSCTL(8) 💖
okay bestie, buckle UP, because this is the dsctl manual page — an actual Python-generated manpage from section 8, and she is LONG. This is part 1 of 4, so we're not even done yet. Let's go 🫶
✨ NAME ✨
dsctl
🎀 SYNOPSIS 🎀
dsctl [-h] [-v] [-j] [-l] [instance]
{restart,start,stop,status,remove,db2index,db2bak,db2ldif,dbverify,bak2db,ldif2db,backups,ldifs,index-check,tls,healthcheck,get-nsstate,ldifgen,dsrc,cockpit,dblib,thread-pool} ...🌸 POSITIONAL ARGUMENTS 🌸
so like, you pick an instance (or don't) and then you pick ONE of these moves. each one is a whole vibe:
dsctl restart— restart an instance of Directory Server, but only if it's already running; otherwise it just starts it. no cap.dsctl start— start an instance of Directory Server, assuming it isn't currently running.dsctl stop— stop an instance of Directory Server, assuming it is currently running.dsctl status— peek at whether an instance of Directory Server is running or not.dsctl remove— destroy an instance of Directory Server and yeet all its data. 💀dsctl db2index— kick off a reindex of the server database. the server must be stopped for this to proceed.dsctl db2bak— kick off a BDB backup of the database. the server must be stopped for this to proceed.dsctl db2ldif— kick off an LDIF dump of the database. the server must be stopped for this to proceed.dsctl dbverify— perform a db verification. you should only do this at the direction of support, fr fr. 🙈dsctl bak2db— restore a BDB backup of the database. the server must be stopped for this to proceed.dsctl ldif2db— restore an LDIF dump of the database. the server must be stopped for this to proceed.dsctl backups— list the backup's found in the server's default backup directory.dsctl ldifs— list all the LDIF files chillin' in the server's LDIF directory.dsctl index-check— check for index ordering mismatches (parentid/ancestorid). the server must be stopped.dsctl tls— manage TLS certificates. queen behavior 👑dsctl healthcheck— run a healthcheck report on a local Directory Server instance. this is a safe and read-only operation. do not try to run this on a remote Directory Server, because this tool needs access to local resources — otherwise the report may be inaccurate.dsctl get-nsstate— get the replication nsState in a human readable format. here's what all the fields mean:- Replica DN: — The DN of the replication configuration entry
- Replica Suffix: — The replicated suffix
- Replica ID: — The Replica identifier
- Gen Time — The time the CSN generator was created
- Gen Time String: — The time string of generator
- Gen as CSN: — The generation CSN
- Local Offset: — The offset due to the local clock being set back
- Local Offset String: — The offset in a nice human format
- Remote Offset: — The offset due to clock difference with remote systems
- Remote Offset String: — The offset in a nice human format
- Time Skew: — The time skew between this server and its replicas
- Time Skew String: — The time skew in a nice human format
- Seq Num: — The number of multiple csns within a second
- System Time: — The local system time
- Diff in Seconds: — The time difference in seconds from the CSN generator creation to now
- Diff in days/secs: — The time difference broken up into days and seconds
- Endian: — Little/Big Endian
dsctl ldifgen— LDIF generator to make sample LDIF files for testing.dsctl dsrc— manage the.dsrcfile.dsctl cockpit— enable the Cockpit interface/UI.dsctl dblib— database library (i.e bdb/lmdb) migration.dsctl thread-pool— offline thread pool diagnostics, read from the local mmap status file.
🔥 COMMAND dsctl restart 🔥
usage: dsctl [-v] [-j] [instance] restart [-h]🔥 COMMAND dsctl start 🔥
usage: dsctl [-v] [-j] [instance] start [-h]🔥 COMMAND dsctl stop 🔥
usage: dsctl [-v] [-j] [instance] stop [-h]🔥 COMMAND dsctl status 🔥
usage: dsctl [-v] [-j] [instance] status [-h]🔥 COMMAND dsctl remove 🔥
usage: dsctl [-v] [-j] [instance] remove [-h] [--do-it]✨ OPTIONS 'dsctl remove' ✨
--do-it— by default we do a dry run. this actually initiates the removal of the instance. like, for real for real.
🔥 COMMAND dsctl db2index 🔥
usage: dsctl [-v] [-j] [instance] db2index [-h] [--attr ATTR] backendbackend— the backend to reindex. IEuserRoot
✨ OPTIONS 'dsctl db2index' ✨
--attr ATTR— an attribute to reindex. IE:--attr member --attr cn ...
🔥 COMMAND dsctl db2bak 🔥
usage: dsctl [-v] [-j] [instance] db2bak [-h] [--watch] [archive]archive— the destination for the archive. this will be created during the db2bak process.
✨ OPTIONS 'dsctl db2bak' ✨
--watch— watch the status of the db2bak task
🔥 COMMAND dsctl db2ldif 🔥
usage: dsctl [-v] [-j] [instance] db2ldif [-h] [--replication] [--encrypted] [--watch] backend [ldif]backend— the backend to output as an LDIF. IEuserRootldif— the path to the ldif output location.
✨ OPTIONS 'dsctl db2ldif' ✨
--replication— export replication information, suitable for importing on a new consumer or backups.--encrypted— export encrypted attributes--watch— watch the status of the db2ldif task
🔥 COMMAND dsctl dbverify 🔥
usage: dsctl [-v] [-j] [instance] dbverify [-h] backendbackend— the backend to verify. IEuserRoot
🔥 COMMAND dsctl bak2db 🔥
usage: dsctl [-v] [-j] [instance] bak2db [-h] [--watch] archivearchive— the archive to restore. this will erase all current server databases. 😭
✨ OPTIONS 'dsctl bak2db' ✨
--watch— watch the status of the bak2db task
🔥 COMMAND dsctl ldif2db 🔥
usage: dsctl [-v] [-j] [instance] ldif2db [-h] [--encrypted] [--watch] backend ldifbackend— the backend to restore from an LDIF. IEuserRootldif— the path to the ldif to import
✨ OPTIONS 'dsctl ldif2db' ✨
--encrypted— import encrypted attributes--watch— watch the status of the ldif2db task
🔥 COMMAND dsctl backups 🔥
usage: dsctl [-v] [-j] [instance] backups [-h] [--delete DELETE]✨ OPTIONS 'dsctl backups' ✨
--delete DELETE— delete backup directory
🔥 COMMAND dsctl ldifs 🔥
usage: dsctl [-v] [-j] [instance] ldifs [-h] [--delete DELETE]✨ OPTIONS 'dsctl ldifs' ✨
--delete DELETE— delete LDIF file
🔥 COMMAND dsctl index-check 🔥
usage: dsctl [-v] [-j] [instance] index-check [-h] [--fix] [backend]backend— backend to check. if not specified, all backends are checked.
✨ OPTIONS 'dsctl index-check' ✨
--fix— fix mismatches by adjusting config to match on-disk data
🔥 COMMAND dsctl tls 🔥
usage: dsctl [-v] [-j] [instance] tls [-h] {list-ca,list-client-ca,show-server-cert,show-cert,generate-server-cert-csr,import-client-ca,import-ca,import-server-cert,import-server-key-cert,remove-cert,export-cert} ...🌈 POSITIONAL ARGUMENTS 'dsctl tls' 🌈
dsctl tls list-ca— list server certificate authorities including intermediatesdsctl tls list-client-ca— list client certificate authorities including intermediatesdsctl tls show-server-cert— show the active server certificate that clients will see and verifydsctl tls show-cert— show a certificate's details referenced by it's nickname. this is analogous tocertutil -L -d <path> -n <nickname>dsctl tls generate-server-cert-csr— generate a Server-Cert certificate signing request — the csr is then submitted to a CA for verification, and when signed you import with import-ca and import-server-certdsctl tls import-client-ca— import a CA trusted to issue user (client) certificates. this is part of how client certificate authentication functions.dsctl tls import-ca— import a CA or intermediate CA for signing this servers certificates (aka Server-Cert). you should import all the CA's in the chain as required. PEM bundles are accepteddsctl tls import-server-cert— import a new Server-Cert after the csr has been signed from a CA.dsctl tls import-server-key-cert— import a new key and Server-Cert after having been signed from a CA. this is used if you have an external csr tool or a service like lets encrypt that generates PEM keys externally.dsctl tls remove-cert— delete a certificate from this database. this will remove it from acting as a CA, a client CA or the Server-Cert role.dsctl tls export-cert— export a certificate to PEM or DER/Binary format. PEM format is the default
🔥 COMMAND dsctl tls list-ca 🔥
usage: dsctl [-v] [-j] [instance] tls list-ca [-h]🔥 COMMAND dsctl tls list-client-ca 🔥
usage: dsctl [-v] [-j] [instance] tls list-client-ca [-h]🔥 COMMAND dsctl tls show-server-cert 🔥
usage: dsctl [-v] [-j] [instance] tls show-server-cert [-h] [--nickname NICKNAME]✨ OPTIONS 'dsctl tls show-server-cert' ✨
--nickname NICKNAME— the nickname (friendly name) of the certificate to display if different than
🔥 COMMAND dsctl tls show-cert 🔥
usage: dsctl [-v] [-j] [instance] tls show-cert [-h] nicknamenickname— the nickname (friendly name) of the certificate to display
🔥 COMMAND dsctl tls generate-server-cert-csr 🔥
usage: dsctl [-v] [-j] [instance] tls generate-server-cert-csr [-h] [--subject SUBJECT] [--nickname NICKNAME] [alt_names ...]alt_names— certificate requests subject alternative names. these are auto-detected if not provided
✨ OPTIONS 'dsctl tls generate-server-cert-csr' ✨
--subject SUBJECT,-s SUBJECT— certificate Subject field to use--nickname NICKNAME— the name of the certificate if different than'Server-Cert'
🔥 COMMAND dsctl tls import-client-ca 🔥
usage: dsctl [-v] [-j] [instance] tls import-client-ca [-h] cert_path nicknamecert_path— the path to the x509 cert to import as a client trust rootnickname— the name of the certificate once imported
🔥 COMMAND dsctl tls import-ca 🔥
usage: dsctl [-v] [-j] [instance] tls import-ca [-h] cert_path nickname [nickname ...]cert_path— the path to the x509 cert to import as a server CAnickname— the name of the certificate once imported
🔥 COMMAND dsctl tls import-server-cert 🔥
usage: dsctl [-v] [-j] [instance] tls import-server-cert [-h] [--nickname NICKNAME] cert_pathcert_path— the path to the x509 cert to import as Server-Cert
✨ OPTIONS 'dsctl tls import-server-cert' ✨
--nickname NICKNAME— the name of the certificate, if you wanna call it something other thanServer-Cert💅
🎀 COMMAND 'dsctl tls import-server-key-cert' 🎀
usage: dsctl [-v] [-j] [instance] tls import-server-key-cert [-h] [--nickname NICKNAME] cert_path key_pathcert_path— the path to the x509 cert you're importing asServer-Cert🦋key_path— the path to the x509 key that goes withServer-Cert, like they're a matching set bestie 💖
✨ OPTIONS 'dsctl tls import-server-key-cert' ✨
--nickname NICKNAME— the name of the certificate, if you want it to be something other thanServer-Cert🎀
💀 COMMAND 'dsctl tls remove-cert' 💀
usage: dsctl [-v] [-j] [instance] tls remove-cert [-h] nicknamenickname— the name of the certificate you want to delete. yes we're really doing this 😭
🌸 COMMAND 'dsctl tls export-cert' 🌸
usage: dsctl [-v] [-j] [instance] tls export-cert [-h] [--binary-format] [--output-file OUTPUT_FILE] nicknamenickname— the name of the certificate you want to export 🫶
✨ OPTIONS 'dsctl tls export-cert' ✨
--binary-format— export the certificate in DER/binary format, for when you're feeling raw and unfiltered 🔥--output-file OUTPUT_FILE— the name for the exported certificate. the default name is the certificate nickname with an extension of.pemor.crt— iconic default behaviour tbh 👑
👑 COMMAND 'dsctl healthcheck' 👑
usage: dsctl [instance] healthcheck [-h] [--list-checks] [--list-errors] [--dry-run] [--check CHECK [CHECK ...]] [--exclude-check EXCLUDE_CHECK [EXCLUDE_CHECK ...]]✨ OPTIONS 'dsctl healthcheck' ✨
--list-checks— lists all the known checks, so you know what's on the menu 📋--list-errors— lists all the known error codes ✨--dry-run— doesn't actually run the check, just tells you what would have been done. window shopping, basically 🛍️--check CHECK [CHECK ...]— the areas to check. you can get these from--list-checks. and here's the little trick: every element on the left of the colon (:) can be swapped out for an asterisk if there are multiple options on the right side available 🌟--exclude-check EXCLUDE_CHECK [EXCLUDE_CHECK ...]— the areas to skip. also obtainable from--list-checks. same deal here — any element on the left of the colon (:) can be replaced with an asterisk if multiple options on the right are available 🚫
🧚 COMMAND 'dsctl get-nsstate' 🧚
usage: dsctl [instance] get-nsstate [-h] [--suffix SUFFIX] [--flip FLIP]✨ OPTIONS 'dsctl get-nsstate' ✨
--suffix SUFFIX— the DN of the replication suffix to read the state from 🔍--flip FLIP— flips between Little/Big Endian. you might need this on certain architectures, so like… architecture-dependent bestie, don't @ me 💅
🌈 COMMAND 'dsctl ldifgen' 🌈
okay bestie, this one is THE main character of the whole page. look at this:
usage: dsctl [-v] [-j] [instance] ldifgen [-h] {users,groups,cos-def,cos-template,roles,mod-load,nested} ...seven whole little generators living inside it. obsessed. 💖
💜 POSITIONAL ARGUMENTS 'dsctl ldifgen' 💜
dsctl ldifgen users— generates an LDIF stuffed with user entries 🧑🤝🧑dsctl ldifgen groups— generates an LDIF with groups and members 🫂dsctl ldifgen cos-def— generates an LDIF with a COS definition (that's classic, pointer, or indirect) ✨dsctl ldifgen cos-template— generates an LDIF with a COS template 🎀dsctl ldifgen roles— generates an LDIF with a role entry (managed, filtered, or indirect) 👑dsctl ldifgen mod-load— generates an LDIF full of modify operations. this one is meant to be eaten byldapmodify🍽️dsctl ldifgen nested— generates a heavily nested database LDIF in a cascading/fractal tree design. yes, fractal. it's giving recursion 🌳
🦋 COMMAND 'dsctl ldifgen users' 🦋
usage: dsctl [-v] [-j] [instance] ldifgen users [-h] [--number NUMBER] [--suffix SUFFIX] [--parent PARENT] [--generic] [--start-idx START_IDX] [--rdn-cn] [--localize] [--ldif-file LDIF_FILE]✨ OPTIONS 'dsctl ldifgen users' ✨
--number NUMBER— how many users to create 🔢--suffix SUFFIX— the database suffix where the entries will get created 🗂️--parent PARENT— the parent entry the user entries should be created under. if you don't specify one, they get scattered under random Organizational Units 🙈--generic— creates generic entries in the format of"uid=user####". these are also compatible withldclt🤝--start-idx START_IDX— for generic LDIFs you can pick the starting index for the user entries. the default is"0"💅--rdn-cn— uses the attribute"cn"as the RDN attribute in the DN instead of"uid"✨--localize— localizes the LDIF data 🌍--ldif-file LDIF_FILE— the LDIF file name. default location is the server's LDIF directory, using the nameldifgen.ldif📄
🍓 COMMAND 'dsctl ldifgen groups' 🍓
usage: dsctl [-v] [-j] [instance] ldifgen groups [-h] [--number NUMBER] [--suffix SUFFIX] [--parent PARENT] [--num-members NUM_MEMBERS] [--create-members] [--member-parent MEMBER_PARENT] [--member-attr MEMBER_ATTR] [--ldif-file LDIF_FILE] NAMENAME— the group name 🏷️
✨ OPTIONS 'dsctl ldifgen groups' ✨
--number NUMBER— the number of groups to create 🔢--suffix SUFFIX— the database suffix where the groups will be created 🗂️--parent PARENT— the parent entry the group entries should be created under. if you don't specify one, the groups are stored under the suffix 🫶--num-members NUM_MEMBERS— the number of members in the group. default is10000😳 yes, ten thousand--create-members— actually creates those member user entries 🙌--member-parent MEMBER_PARENT— the entry DN the members should be created under. the default is the suffix entry ✨--member-attr MEMBER_ATTR— the membership attribute to use in the group. default is"uniquemember"💅--ldif-file LDIF_FILE— the LDIF file name. default location is the server's LDIF directory, using the nameldifgen.ldif📄
🧁 COMMAND 'dsctl ldifgen cos-def' 🧁
usage: dsctl [-v] [-j] [instance] ldifgen cos-def [-h] [--type TYPE] [--parent PARENT] [--create-parent] [--cos-specifier COS_SPECIFIER] [--cos-template COS_TEMPLATE] [--cos-attr [COS_ATTR ...]] [--ldif-file LDIF_FILE] NAMENAME— the COS definition name 🏷️
✨ OPTIONS 'dsctl ldifgen cos-def' ✨
--type TYPE— the COS definition type:"classic","pointer", or"indirect"🎭--parent PARENT— the parent entry the COS definition should be created under 🌳--create-parent— creates that parent entry 👶--cos-specifier COS_SPECIFIER— used in a classic COS definition. this attribute lives in the user entry and decides which COS template gets used 🔍--cos-template COS_TEMPLATE— the DN of the COS template entry. only used for"classic"and"pointer"COS definitions ✨--cos-attr [COS_ATTR ...]— a list of attributes defining which attribute the COS generates values for 📋--ldif-file LDIF_FILE— the LDIF file name. default location is the server's LDIF directory, using the nameldifgen.ldif📄
🎀 COMMAND 'dsctl ldifgen cos-template' 🎀
usage: dsctl [-v] [-j] [instance] ldifgen cos-template [-h] [--parent PARENT] [--create-parent] [--cos-priority COS_PRIORITY] [--cos-attr-val COS_ATTR_VAL] [--ldif-file LDIF_FILE] NAMENAME— the COS template name 🏷️
✨ OPTIONS 'dsctl ldifgen cos-template' ✨
--parent PARENT— the DN of the entry to store the COS template entry under 📂--create-parent— creates the parent entry 👶--cos-priority COS_PRIORITY— sets the priority of this conflicting/competing COS template. drama between templates, basically 💅--cos-attr-val COS_ATTR_VAL— defines the attribute and the value that the template provides 🎁--ldif-file LDIF_FILE— the LDIF file name. default location is the server's LDIF directory, using the nameldifgen.ldif📄
💜 COMMAND 'dsctl ldifgen roles' 💜
usage: dsctl [-v] [-j] [instance] ldifgen roles [-h] [--type TYPE] [--parent PARENT] [--create-parent] [--filter FILTER] [--role-dn [ROLE_DN ...]] [--ldif-file LDIF_FILE] NAMENAME— the Role name 🏷️
✨ OPTIONS 'dsctl ldifgen roles' ✨
--type TYPE— the Role type:"managed","filtered", or"nested"🎭--parent PARENT— the DN of the entry to store the Role entry under 📂--create-parent— creates the parent entry 👶--filter FILTER— a search filter for gathering Role members. required for a"filtered"role 🔍--role-dn [ROLE_DN ...]— a DN of a role entry that should be included in this role. used for"nested"roles only 🪆--ldif-file LDIF_FILE— the LDIF file name. default location is the server's LDIF directory, using the nameldifgen.ldif📄
💖 COMMAND 'dsctl ldifgen mod-load' ✨
okay bestie, this one is the chaos gremlin of ldifgen — it generates an LDIF full of modify, add, delete and modrdn operations so you can stress-test your server with actual churn. it's giving "load test but make it messy" 🦋
usage: dsctl [-v] [-j] [instance] ldifgen mod-load [-h] [--create-users]
[--delete-users]
[--num-users
NUM_USERS]
[--parent PARENT]
[--create-parent]
[--add-users
ADD_USERS]
[--del-users
DEL_USERS]
[--modrdn-users
MODRDN_USERS]
[--mod-users
MOD_USERS]
[--mod-attrs
[MOD_ATTRS ...]]
[--randomize]
[--ldif-file
LDIF_FILE]🌸 OPTIONS 'dsctl ldifgen mod-load' 🎀
--create-users— make the entries that are gonna get modified or deleted. by default the script just assumes those user entries already exist, so if they don't… nothing to play with 🙈--delete-users— yeet all the user entries at the end of the LDIF. cleanup era 💅--num-users NUM_USERS— how many user entries will be modified or deleted. the headcount, bestie--parent PARENT— the DN of the parent entry where the user entries live. their home address 🏠--create-parent— create the parent entry too. build the house first, then move in ✨--add-users ADD_USERS— how many additional entries get added during the load--del-users DEL_USERS— how many entries get deleted during the load--modrdn-users MODRDN_USERS— how many entries get a modrdn operation performed on them. renaming arc 👑--mod-users MOD_USERS— how many entries get modified--mod-attrs [MOD_ATTRS ...]— the list of attributes the script randomly picks from when modifying an entry. default is"description". you can pass a whole lil list here--randomize— randomly perform the specified add, mod, delete, and modrdn operations. pure chaos, no notes 💀--ldif-file LDIF_FILE— the LDIF file name. default location is the server's LDIF directory using the name'ldifgen.ldif'
🧚 COMMAND 'dsctl ldifgen nested' 🦋
nested time!! this generates a tree of user entries, split up under nodes/subtrees. very "directory within a directory" of it 🌈
usage: dsctl [-v] [-j] [instance] ldifgen nested [-h] [--num-users
NUM_USERS]
[--node-limit
NODE_LIMIT]
[--suffix SUFFIX]
[--ldif-file LDIF_FILE]⭐ OPTIONS 'dsctl ldifgen nested' 🌸
--num-users NUM_USERS— the total number of user entries to create in the entire LDIF. ngl this one does not include the container entries, so the final count is bigger than this number. math is math 💅--node-limit NODE_LIMIT— the total number of user entries to create under each node/subtree. so yes, it multiplies. buckle up 🎀--suffix SUFFIX— the suffix DN for the LDIF--ldif-file LDIF_FILE— the LDIF file name. default location is the server's LDIF directory using the name'ldifgen.ldif'
💜 COMMAND 'dsctl dsrc' 💅
the .dsrc era!! this command group reads and writes your .dsrc file (that's the lil config file the LDAP CLI tools use to remember your instance's settings so you don't have to type them every single time). it's giving quality-of-life, fr fr.
usage: dsctl [-v] [-j] [instance] dsrc [-h]
{create,modify,delete,display,repl-mon} ...🫶 POSITIONAL ARGUMENTS 'dsctl dsrc' ✨
dsctl dsrc create— generate the.dsrcfiledsctl dsrc modify— modify the.dsrcfiledsctl dsrc delete— delete instance configuration from the.dsrcfile.dsctl dsrc display— display the contents of the.dsrcfile.dsctl dsrc repl-mon— display the contents of the.dsrcfile.
yes bestie,displayandrepl-monboth say "display the contents of the .dsrc file" in the original. i'm not fixing it, i'm not merging it, i'm just reporting the lore 💀
🌈 COMMAND 'dsctl dsrc create' 🎀
brand new .dsrc file, who dis. this one walks you through all the connection details 💖
usage: dsctl [-v] [-j] [instance] dsrc create [-h] [--uri URI]
[--basedn BASEDN]
[--people-rdn PEOPLE_RDN]
[--groups-rdn GROUPS_RDN]
[--binddn BINDDN]
[--saslmech SASLMECH]
[--tls-cacertdir
TLS_CACERTDIR]
[--tls-cert TLS_CERT]
[--tls-key TLS_KEY]
[--tls-reqcert
TLS_REQCERT]
[--starttls] [--pwdfile
PWDFILE]
[--do-it]✨ OPTIONS 'dsctl dsrc create' 🌸
--uri URI— the URI (LDAP URL) for the Directory Server instance. where your server lives, basically 🏠--basedn BASEDN— the default database suffix--people-rdn PEOPLE_RDN— set the RDN for the'people'subtree. default is"ou=people"--groups-rdn GROUPS_RDN— set the RDN for the'groups'subtree. default is"ou=groups"--binddn BINDDN— the default Bind DN used or authentication.--saslmech SASLMECH— the SASL mechanism to use:PLAINorEXTERNAL.--tls-cacertdir TLS_CACERTDIR— the directory containing the Trusted Certificate Authority certificate.--tls-cert TLS_CERT— the absolute file name to the server certificate.--tls-key TLS_KEY— the absolute file name to the server certificate key.--tls-reqcert TLS_REQCERT— request certificate strength:'never','allow','hard'--starttls— use startTLS for connection to the server. glow up your connection 🔒--pwdfile PWDFILE— the absolute path to a file containing the Bind DN's password.--do-it— create the file without any confirmation. no takebacks, bestie 💅
🦋 COMMAND 'dsctl dsrc modify' 🧚
same energy as create, except every argument is now optional-ish (they're wrapped in brackets) so you can just poke the one thing you wanna change. lowkey the superior workflow ⭐
usage: dsctl [-v] [-j] [instance] dsrc modify [-h] [--uri [URI]]
[--basedn [BASEDN]]
[--people-rdn
[PEOPLE_RDN]]
[--groups-rdn
[GROUPS_RDN]]
[--binddn [BINDDN]]
[--saslmech [SASLMECH]]
[--tls-cacertdir
[TLS_CACERTDIR]]
[--tls-cert [TLS_CERT]]
[--tls-key [TLS_KEY]]
[--tls-reqcert
[TLS_REQCERT]]
[--starttls]
[--cancel-starttls]
[--pwdfile [PWDFILE]]
[--do-it]💖 OPTIONS 'dsctl dsrc modify' 👑
--uri [URI]— the URI (LDAP URL) for the Directory Server instance.--basedn [BASEDN]— the default database suffix.--people-rdn [PEOPLE_RDN]— sets the RDN used for the'people'container--groups-rdn [GROUPS_RDN]— sets the RDN used for the'groups'container--binddn [BINDDN]— the default Bind DN used or authentication.--saslmech [SASLMECH]— the SASL mechanism to use:PLAINorEXTERNAL.--tls-cacertdir [TLS_CACERTDIR]— the directory containing the Trusted Certificate Authority certificate.--tls-cert [TLS_CERT]— the absolute file name to the server certificate.--tls-key [TLS_KEY]— the absolute file name to the server certificate key.--tls-reqcert [TLS_REQCERT]— request certificate strength:'never','allow','hard'--starttls— use startTLS for connection to the server. (no brackets on this one, it's a straight toggle 🎀)--cancel-starttls— do not use startTLS for connection to the server. the anti-starttls, if you will 🙈--pwdfile [PWDFILE]— the absolute path to a file containing the Bind DN's password.--do-it— update the file without any confirmation. periodt.
💅 COMMAND 'dsctl dsrc delete' 🌸
removing this instance's config from the .dsrc file. it's giving spring cleaning ✨
usage: dsctl [-v] [-j] [instance] dsrc delete [-h] [--do-it]🎀 OPTIONS 'dsctl dsrc delete' 💜
--do-it— delete this instance's configuration from the.dsrcfile.
🌟 COMMAND 'dsctl dsrc display' 🌈
just shows you what's inside your .dsrc file. no flags, no drama, pure vibes ✨
usage: dsctl [-v] [-j] [instance] dsrc display [-h]🔥 COMMAND 'dsctl dsrc repl-mon' 🔥
this is the replica-monitor corner of your .dsrc — you add and delete replica connections and host/port aliases here. very "keeping the family tree tidy" of it 👑
usage: dsctl [-v] [-j] [instance] dsrc repl-mon [-h]
[--add-conn ADD_CONN
[ADD_CONN ...]]
[--del-conn DEL_CONN
[DEL_CONN ...]]
[--add-alias ADD_ALIAS
[ADD_ALIAS ...]]
[--del-alias DEL_ALIAS
[DEL_ALIAS ...]]⭐ OPTIONS 'dsctl dsrc repl-mon' 🦋
--add-conn ADD_CONN [ADD_CONN ...]— add a replica connection:'NAME:HOST:PORT:BINDDN:CREDENTIAL'. yes the whole thing, colons and all 💅--del-conn DEL_CONN [DEL_CONN ...]— delete a replica connection by its NAME--add-alias ADD_ALIAS [ADD_ALIAS ...]— add a host/port alias:'ALIAS_NAME:HOST:PORT'--del-alias DEL_ALIAS [DEL_ALIAS ...]— delete a host/port alias by its ALIAS_NAME
🦋 COMMAND 'dsctl cockpit' 🎀
cockpit?? yes, the web console thing. this group flips the Cockpit socket on and off and fiddles with the firewall for the "cockpit" service. it's giving "dashboard era" 💖
usage: dsctl [-v] [-j] [instance] cockpit [-h]
{enable,open-firewall,disable,close-firewall}
...✨ POSITIONAL ARGUMENTS 'dsctl cockpit' 🌸
dsctl cockpit enable— enable the Cockpit socketdsctl cockpit open-firewall— open the firewall for the"cockpit"servicedsctl cockpit disable— disable the Cockpit socketdsctl cockpit close-firewall— remove the"cockpit"service from the firewall settings
💜 COMMAND 'dsctl cockpit enable' 🎀
socket goes brrr. (in the good way). no options for this one, bestie ✨
usage: dsctl [-v] [-j] [instance] cockpit enable [-h]🔥 COMMAND 'dsctl cockpit open-firewall' 🌈
let the outside world in, but politely, and only for one specific zone 💅
usage: dsctl [-v] [-j] [instance] cockpit open-firewall [-h] [--zone
ZONE]⭐ OPTIONS 'dsctl cockpit open-firewall' 🦋
--zone ZONE— the firewall zone
🧚 COMMAND 'dsctl cockpit disable' 🌸
socket goes off. no options here either 🎀
usage: dsctl [-v] [-j] [instance] cockpit disable [-h]🌟 COMMAND 'dsctl cockpit close-firewall' 💖
yeeting the "cockpit" service back out of the firewall settings. goodbye portal 🚪✨
usage: dsctl [-v] [-j] [instance] cockpit close-firewall [-h]👑 COMMAND 'dsctl dblib' 💅
okay SO. this is the database library migration corner. your backend is either bdb (Berkeley DB) or lmdb, and this group moves you back and forth between them. huge glow-up potential, but also: read the warnings when they show up, bestie 😭
usage: dsctl [-v] [-j] [instance] dblib [-h] {bdb2mdb,mdb2bdb,cleanup}
...🌈 POSITIONAL ARGUMENTS 'dsctl dblib' 🦋
dsctl dblib bdb2mdb— migrate bdb databases to lmdbdsctl dblib mdb2bdb— migrate lmdb databases to bdbdsctl dblib cleanup— remove migration ldif file and old database
⭐ COMMAND 'dsctl dblib bdb2mdb' 🔥
the great migration. bdb in, lmdb out 🧚
usage: dsctl [-v] [-j] [instance] dblib bdb2mdb [-h] [--tmpdir TMPDIR]💜 OPTIONS 'dsctl dblib bdb2mdb' 🌸
--tmpdir TMPDIR— ldif migration files directory path.
🎀 COMMAND 'dsctl dblib mdb2bdb' ✨
reverse uno card. lmdb in, bdb out 🦋
usage: dsctl [-v] [-j] [instance] dblib mdb2bdb [-h] [--tmpdir TMPDIR]🌟 OPTIONS 'dsctl dblib mdb2bdb' 🌈
--tmpdir TMPDIR— ldif migration files directory path.
💖 COMMAND 'dsctl dblib cleanup' 🧹
cleans up after the migration — the ldif file and the old database both get swept away. tidy queen behavior 👑
usage: dsctl [-v] [-j] [instance] dblib cleanup [-h]🫶 COMMAND 'dsctl thread-pool' 🌸
peek behind the curtain at the server's worker threads. no LDAP connection required for the status subcommand, which is genuinely so convenient fr fr 💅
usage: dsctl [-v] [-j] [instance] thread-pool [-h] {status} ...🦋 POSITIONAL ARGUMENTS 'dsctl thread-pool' ⭐
dsctl thread-pool status— display pool gauges and per-worker activity without an LDAP connection
🧵 COMMAND dsctl thread-pool status
okay so this is the one you actually came here for bestie, the status check 💅 it shows you what the thread pool is doing right now, no cap:
usage: dsctl [-v] [-j] [instance] thread-pool status [-h] [--file FILE]that's the whole shape of it — optional -v and -j up front, optional [instance], then thread-pool status, then -h for help or --file FILE if you wanna peek at a file instead of the live thing. iconic ✨
🎀 OPTIONS — dsctl thread-pool status
--fileFILE — instead of reading the instance's live thread-pool status file, read this file instead. super handy for when the server went 💀 and left you a crash file that got preserved asthreadpool.YYYYMMDD-HHMMSS— you can still go back and read the receipts 🕵️♀️✨
✨ OPTIONS ✨
these ones are the general vibes for the whole dsctl situation, not just thread-pool stuff, iykyk:
-v,--verbose— show verbose operation tracing while the command runs. it's giving “tell me EVERYTHING that's happening” 🗣️ so you can watch it work step by step. main character behavior fr fr.-j,--json— return the result in a JSON object. perfect for when you want to pipe it into something else and be all programmatic about it 🧚 lowkey the move for scripting bestie.-l,--list— list the available Directory Server instances. your little roster of servers, all lined up like ✨attendees at the function✨ 👑
heads up bestie 💖-vand-jshow up both here as global options and in thethread-pool statususage line, and--fileis the status-specific one. don't mix 'em up —--fileonly means anything for reading a thread-pool status file. periodt.
👑 AUTHOR
"Red Hat, Inc., and William Brown" <389-devel@lists.fedoraproject.org>
and that's the whole page, bestie, we made it to the end and it ate 🌈💅 you now know more about dsctl than like 99% of people, fr fr. this whole thing shipped as lib389 3.3.1, dated 2026-09-11 🗓️✨ — go forth and wrangle your directory servers, you gorgeous genius 🫶💖 no cap, obsessed with you. bye bestie! 🎀🦋🌸
📦 where this page comes from
- ubuntu stonking: python3-lib389 3.3.1-3 · GPL-3.0-or-later AND Other
- 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms