TID-10086669 Using SDIDiag - Switches and Options ( 23SEP2005)
SECURITY DOMAIN SERVER
MANAGEMENT
Name
|
Shortcut Command |
Command |
| Add All Write Partition Servers |
ADDPARTITIONSERVERS |
AP |
| Add Domain Server |
ADD |
AS |
| List Domain Server |
LISTSERVERS |
LS |
| Remove Domain Server |
REMOVE |
RS |
| Sync Domain Server |
SYNCDOMAIN |
SD |
SERVER
MANAGEMENT
| Name |
Shortcut Command |
Command |
| Find Servers in Container |
FINDSERVERS |
FS |
| List Server Keys |
LISTKEYS |
LK |
| Resync Keys for Container |
RESYNC |
RD |
| Sync Server Keys from Domain |
SYNCSERVER |
SS |
DIAGNOSTIC
| Name |
Shortcut Command |
Command |
| Check Key or Domain Problems |
CHECK |
CK |
OTHER
COMMANDS
| Name |
Shortcut Command |
Command |
| Help on most used commands |
HELP |
HE |
| Exit SDIDiag |
EXIT or QUIT |
E or I |
| > |
Redirected output to a file using the '>' redirection switch. |
| >> |
Append output to an existing file. |
| -A |
Access servers regardless of their eDirectory or NICI versions. By default
SDIDiag Version 2.00 Thursday, May 22, 2003, references only servers running
eDirectory version 8.7.1 or higher.
NOTE: It is
strongly recommended that all servers be running a minimum of
NICI 2.4.2 or higher. |
| -F |
Force operation. Depending on the command, the -F switch removes any
Security Domain Servers that do not hold a writeable replica of the
W0.KAP.Security object. |
| -G |
Generate a new key. When used with the SD command, all Security Domain
Servers will be synchronized to hold this new key. |
| -I file |
Specify an input file of server names to access. This switch specifies a
file that holds a list of serverDNs for the command to process. In most
cases, the objects are fully qualified dot delimited distinguish names with one
server per line. Normally the -O file switch creates this
file. |
| -N containerDN |
Specifies with a fully qualified dot delimited distinguished name of a
container that the command will reference. |
| -O file |
Create an output file of server names. This switch defines a file
to hold output information that may be passed to a command via the -I file
switch. Normally, the -O file switch will contain a fully
qualified dot delimited distinguished name list of servers. |
| -R |
Revoke all keys. The -R switch will implicitly perform a -G switch operation
after revoking all the keys. |
| -S serverDN |
Specifies with a fully qualified dot delimited distinguished name a server
name.
NOTE: serverDN includes the tree name, for example: -S
SERVERA.NOVELL.TEST-TREE |
| -T |
Two pass "Comprehensive" switch for the RD command. |
| -U file |
Create a file of server with incompatible NICI SDI support. The -U switch
creates a file that contains a fully qualified dot delimited
distinguished name of servers on which NICI must be upgraded to fully support
multiple SDI keys. Server names are not displayed when this switch is
omitted. |
| -V |
Verbose, display all messages to SDIDiag console. |
| -X |
Limit the search for servers to the container specified with the -n
containerDN switch. |
EXAMPLES OF SDIDiag COMMANDS
SECURITY DOMAIN MANAGEMENT
AS [-A] [-V] [-S serverDN] [> file | >> file]
Add server -S serverDN as a Security Domain Server.
Another way to do this
is to open Console One and go to the W0 object in the Security Container. Select
the "Other" tab on the W0 object and add an additional server as an attribute
value to the "NDSPKI:SD Key Server DN" attribute.
LK [-A] [-V] [-S serverDN]
[> file | >> file]
List keys held by the Security Domain Servers.
All servers which are
listed under the "NDSPKI:SD Key Server DN" attribute on the other tab of the W0
object will be displayed with their associated SD Keys.
LS [-A] [-V] [-S serverDN] [> file | >> file]
List the current Security Domain Servers.
Another way to gather this
information is to open Console One and go to the W0 object in the Security
Container. Select the "Other" tab on the W0 object and view the values of the
"NDSPKI:SD Key Server DN" attribute.
RS [-A] [-V] [-S serverDN] [> file | >> file]
Remove server -S serverDN as a Security Domain Server.
This can also
been done through Console One by going to the W0 object in the Security
Container. Select the "Other" tab on ther W0 object and delete a server shown as
an attribute balue to the "NDSPKI:SD Key Server DN" attribute.
AP [-A] [-V] [-F] [> file | >> file]
Add any server hosting a writeable replica of the
.W0.KAP.Security.Tree-Name object as a Security Domain Server.
If the -F
switch is given, additionally remove any servers that do not hold a writeable
replica.
SD [-A] [-V] [-R] [-G] [-S serverDN ] [> file | >> file]
Synchronize the Security Domain Servers. The optional -R switch revokes
all existing keys and generates a new SD key for use within the tree. The
optional -G switch generates a new SD key.
NOTE: If either the -R or -G
switches are used, then the RD command may need to be used to resynchronize the
new keys to the other servers in the tree.
Revoked keys are retained and used
to access any existing items, however, they are not used to manage new keys.
SERVER MANAGEMENT
FS [-N containerDN] [-X] [-O file] [-U file]
Find all servers starting with the -N containerDN and all sub-containers
unless the -X switch is given, in which case, limit the search to the -N
containerDN only. Output all eDirectory 8.7.1 servers or higher to a file using
the -O file while all other server that are listed are outputed to the -U file.
The -O file may be used as an input to any commands that the support the -I
file switch.
LK [-A] [-V] [-S serverDN ] [> file | >> file]
List keys held by -s serverDN.
Example of using LK is:
SDIDIAG>
LK -A -S .servername.org.tree_name
RD [-A] [-V] [-T] [-N containerDN] [> file | >> file]
Resynchronize the Security Domain Servers with other servers in the tree.
If the -T switch is given, RD or RESYNC, performs a two pass operation by
first ensuring that the Security Domain Servers have a copy of all keys on all
referenced servers.
Secondly, RD resynchronizes all servers with the updated
Security Domain Servers.
If the -N switch is omitted, RD attempts to resync
all servers within the tree; whereas when the -N containerDN switch is provided,
RD only resynchronizes the Security Domain with all servers holding writeable
replicas of the specified containerDN partition. It 1460 persist, then a full
RESYNC may be attempted which may take a considerable time as every server will
need to be contacted.
Examples of using RD are:
SDIDIAG> RD -T -n
.orgUnit.org.tree_name.
SS [-A] [-V] [-R] [-S serverDN] [-I file] [-N containerDN]
Synchronize all keys on the specified -S serverDN, severs in listed in
the -I file, or server hosting a writeable replica of the -N containerDN with
the Security Domain Servers. The -R switch may optionally be given to revoke all
the existing keys on the server before synchronizing with the Security Domain
Servers.
Example of using SS is:
SDIDIAG> SS -A -R -S
.servername.org.tree_name
DIAGNOSTIC
CK [-A] [-V] [-N containerDN] [> file | >> file]
Check and display possible problems and display recommendations for the
Security Domain Servers. If the -N containerDN is provided, also check the
servers hosting a writeable replica of the -N containerDN object for possible
problems and provide recommendations.
Examples of using CK
are:
SDIDIAG> CK
SDIDIAG> CK -N
.orgUnit.org.tree-name
SDIDIAG> CK -A -N .orgUnit.org.tree-name >>
SYS:\TEMP\OUTPUT.TXT
