Chapter 2   Computer System Requirements

Ensure that you have sufficient disk space before downloading the software.

Download drive: 120Mbyte
Installation drive: 2Gbyte

Directory Server is not supported on HP-UX 10 or earlier versions. The minimum system module required is HP-UX 11. Directory Server may only be used on a 64-bit HP-UX 11 environment as a 64-bit process and may contain up to 8Gbytes of process memory.

For best results, Directory Server requires an HP 9000 architecture with a PA-RISC 2.0 CPU.

Before you install Directory Server, ensure that the host system is updated with the latest patches recommended by the operating-system vendor. Because the list of recommended patches changes with time, you must always check the operating system vendor's site for a list of patches that you may need to install. Listed below are two URLs to aid you in this effort:

http://welcome.hp.com/country/us/eng/support.htm
http://www.hp.com/products1/unix/java/

Here are some recommendations:

• For HP-UX 11i, install the latest HP-UX 11i Quality Pack (GOLDQPK11i) patch. For details, see http://www.software.hp.com/SUPPORT_PLUS/qpk.html.
  
  
• The following patch is critical before installation of Directory Server:
  
  

  PHSS_30966:

  ld(1) and linker tools cumulative patch

       
  
• The following patches are recommended:
  
  

  GOLDAPPS11i:	B.11.11.0406.5 Gold Applications Patches for HP-UX 11i v1, June 2004
  GOLDBASE11i:	B.11.11.0406.5 Gold Base Patches for HP-UX 11i v1, June 2004

Set your kernel parameters as follows:

• Set maxfiles to 100.
  
  
• Set nkthread to 1328; nkthread is a computed value: (((NPROC*7)/4+16)
  
  
• Set max_thread_proc to 512.
  
  
• Set maxusers to 64.
  
  
• Set maxuprc to 512.
  
  
• Set nproc to 750.

Typically, client applications that do not properly shut down the socket cause it to linger in a TIME_WAIT state. To prevent this, you should consider changing the TIME_WAIT setting to a reasonable value. For example, setting

ndd -set /dev/tcp tcp_time_wait_interval 60000

will limit the TIME_WAIT state of sockets to 60 seconds.

You also need to turn on large file support in order for Directory Server to work properly. To change an existing file system (from one that has no large files to one that accepts large files):

You will need the gunzip utility to unpack the Directory Server software. The GNU gzip and gunzip programs are described in more detail at http://www.gnu.org/software/gzip/gzip.html and can be obtained from many software distribution sites.

You may need Adobe Acrobat Reader to read the documentation. If you do not have it installed, you can download it from http://www.adobe.com/products/acrobat/readstep2.html

Directory Server must be installed with a static IP address on a computer that is isolated from the public Internet by a network-level firewall. This is necessary to protect the operating system from IP-based attacks.

No other network functions should be provided by this computer. The computer should not be a dual-booting system or run other operating systems. At a minimum, the computer system should have at least 256Mbyte of RAM, 2Gbyte of disk, a Pentium 3 or later processor, and a 100MBps Ethernet connection.

Ensure that you have sufficient disk space before downloading the software.

Download drive: 120Mbyte
Installation drive: 200Mbyte

Directory Server is not supported on Windows 2000 Pro or Windows 2000 DataCenter Server.

During the installation of Windows 2000, observe the following:

• If there is already an operating system present on the computer, choose to perform a fresh install rather than an upgrade.
  
  
• Format the drives with NTFS rather than FAT, as NTFS allows access controls to be set on files and directories.
  
  
• Specify that the computer will be a standalone server and will not be a member of any existing domain or workgroup. This will reduce dependencies on the network security services.
  
  
• Choose an administrator password of at least 9 characters. Use punctuation or other non-alphabetic characters in the first 7 characters.
  
  
• Do not install Internet Information Server.
  
  
• Specify only TCP/IP as network protocol, and do not install any other network services.

You need an UNZIP utility to unpack the directory server software. There are many commercially licensed, free, and shareware tools available, such as PKZIP or Winzip. Shareware unregistered versions of PKZIP 2.70 maintain a TCP/IP connection to an Internet advertising service, so it may not be suitable for installation on this system.

You may need Adobe Acrobat Reader to read the documentation. If you do not have it installed, you can download it from http://www.adobe.com/products/acrobat/readstep2.html

To edit the server configuration file, you will need a text editor that is capable of handling large text files (Notepad and Wordpad are not suitable). If you are already familiar with Emacs text editor on UNIX, a port to Windows can be downloaded from ftp://ftp.cs.washington.edu/pub/ntemacs/. There are many other shareware and commercial text editors available.

To display non-English characters using any Netscape browser, you can obtain general internationalization advice and more specific information about the Bitstream Cyberbit font from the following URL:

http://developer.netscape.com/software/jdk/i18n.html

To download the Bitstream Cyberbit font use the following FTP link:

ftp://ftp.netscape.com/pub/communicator/extras/fonts/windows

Before downloading the font, read the READMEfirst.txt and ReadMe.htm files.

To facilitate the correlation of date and time stamps in log files with those of other computer systems, keep your system clock reasonably in sync. As the NET TIME command requires NetBIOS, which will be disabled during post-installation system configuration, either a TCP/IP based NTP client should be installed (such as the shareware program Tardis) or a time radio receiver attached. See http://www.ntp.org for more information on NTP clients for Windows.

Windows 2000 Service Packs include key fixes that are needed to maintain the security and reliability of the operating system. The hotfix series contains important changes for problems discovered after the service pack has been released.

Directory Server is certified with Service Pack 4 and security patches released by the OS vendor at the time of this certification. It is recommended that you install the latest service pack and all hotfixes and patches recommended by the OS vendor.

The Windows 2000 environment requires tuning to provide optimum performance for Directory Server in an operational environment. Consult the Windows 2000 system administrator's documentation or support channel for information on Windows 2000 tuning for multi-threaded internet services.

It is recommended that you set the LargeSystemCache registry key to 0 to limit the growth of system cache. The LargeSystemCache has a default value of 1, which is not suitable for applications such as Directory Server, which do caching internally.

Also, if there will be a lot of connections from clients, change the following:

• tcp_time_wait_interval from its default value, which is 240 seconds, to 60 seconds. To do this, at Registry HKEY_LOCAL_MACHINE\System\CurrectControlSet\services\Tcpip\Parameters, create a key TcpTimeWaitDelay with value 60.
  
  
• The upper range of ephemeral from the default value, which is 4999, to 65534. To do this, at Registry HKEY_LOCAL_MACHINE\System\CurrectControlSet\services\Tcpip\Parameters, create a key MaxUserPort with value 65534.

Ensure that you have sufficient disk space before downloading the software.

Download drive: 120Mbyte
Installation drive: 2Mbyte

Directory Server is certified to work on:

• The Intel Pentium series processors [i686].
  
  
• The default kernel/glibc revisions that comes along with Red Hat Linux Advanced Server 3 and the other kernel revisions with their corresponding glibc revisions as mentioned below.
  
  
  • Default kernel - kernel-2.4.21-3.EL
    Kernel used for certification - kernel-2.4.21-4.EL
    
    
  • Default glibc - glibc-2.3.2-95.3
    glibc used for certification - glibc-2.3.2-95.20
    
    
  • Required Filesytem:
    ext3 (LARGEFILES support enabled) filesystem has been used for the certification process.
    
    
• With certain installed packages on Red Hat, the server will not start.
  
  Red Hat distributes two RPM packages for glibc, one for 386 processors and higher, the other for 486 or Pentium processors and higher. The 386 package has no NPTL support. If the 386 package is installed on a machine, you will lose NPTL support. Once this has happened, it's very hard to detect because rpm -q reports the package name and version without the architecture tag.
  
  To determine which RPM package is installed, run the following command:
  
  getconf GNU_LIBPTHREAD_VERSION

Directory Server has been certified on Red Hat Linux Advanced Server 3 with kernel revisions 2.4.21-4.EL (kernel-2.4.21-4.EL.i686.rpm) / glibc version 2.3.2-95.20 (glibc-2.3.2-95.20.i686.rpm). It is recommended that you use these kernel and glibc versions. If the machine is a single CPU machine, the corresponding kernel would be of the form kernel-x.x.x.x. If the machine is a multi-CPU machine, the corresponding kernel would be of the form kernel-smp-x.x.x.x. 

You can get the list of installed software, including patches, on your system by running rpm -qa.

This section contains some basic system tuning information. Keep in mind that changing any of the following kernel-tuning parameters requires a system reboot.

• NFS Tuning -- This tuning is recommended if you are using Directory Server to write to NFS mounted drives. On Linux, NFS is typically recommended to be done over TCP and not over UDP. Make the following change to the /etc/rc.d/init.d/autofs file:
  
  + localoptions='rsize=8192,wsize=8192,vers=3,tcp'

• TCP Tuning -- You can increase number of local system ports available by running this command:
  
  echo "1024 65000" > /proc/sys/net/ipv4.ip_local_port_range
  
  You can also achive the same by editing this parameter in the /etc/sysctl.conf file:
  
  [echo "1024 65000" >> /etc/sysctl.conf]

• File Tuning -- You can increase the file descriptors by running these commands:
  
  echo "64000" > /proc/sys/fs/file-max
  
  or edit this parameter in the /etc/sysctl.conf file:
  
  [echo "fs.file-max = 64000" >> /etc/sysctl.conf]
  echo "* soft nofile 8192" >> /etc/security/limits.conf
  echo "* hard nofile 8192" >> /etc/security/limits.conf
  echo "ulimit -n 8192" >> /etc/profile
  echo "session required /lib/security/pam_limits.so" >> /etc/security/limits.conf

You will need the gunzip utility to unpack the Directory Server software. The GNU gzip and gunzip programs are described in more detail at http://www.gnu.org/software/gzip/gzip.html and can be obtained from many software distribution sites.

You may need Adobe Acrobat Reader to read the documentation. If you do not have it installed, you can download it from http://www.adobe.com/products/acrobat/readstep2.html

Ensure that you have sufficient disk space before downloading the Directory Server software.

Current working directory: 120Mbyte
Partition containing /usr/netscape: 2Gbyte

Directory Server requires the use of an UltraSPARC (SPARC v9) processor, as this processor includes support for high performance and multiprocessor systems. Earlier SPARC processors are not supported.

If you run Directory Server on a 64-bit Sun Solaris 8 UltraSPARC machine, it will run as a 32-bit application.

You must use Solaris 9 with the Sun recommended patches. The Sun recommended patch clusters can be obtained from your Solaris support representative or from the http://sunsolve.sun.com site.

Solaris patches are identified by two numbers; for example, 112233-04. The first number (112233) identifies the patch itself. The second number identifies the version of the patch; in the example above, the patch is version number 04.

Table 2-3 provides the list of Solaris 9 patches that were used during the testing of this release of Directory Server. You must install these patches on your machine before installing the Directory Server product. (The command showrev -p will list the patches that have been installed on your machine.)

Also, keep in mind that Directory Server provides a utility named dsktune that can help you verify whether you have the appropriate patches installed on your system. For details, see dsktune Utility.

In addition to the patches listed in Table 2-3 and the patches identified by the dsktune utility, we recommend that you check the operating system vendor's web site for information on installing the latest version of the patch clusters to benefit from the latest fixes.

You will need to reboot your machine after installing the patches.

Table 2-3   Solaris 9 Patch List

Basic Solaris tuning guidelines are available from several books, including Sun Performance and Tuning: Java and the Internet (ISBN 0-13-095249-4) . Advanced tuning information is available in the Solaris Tunable Parameters Reference Manual (816-7137), which can be obtained from http://docs.sun.com/db/doc/816-7137

The system-wide maximum file descriptor table size setting will limit the number of concurrent connections that can be established to Directory Server. The governing parameter, rlim_fd_max, is set in the /etc/system file. By default, if this parameter is not present, the maximum is 1024. It can be raised to 4096 by adding a line such as

set rlim_fd_max=4096

to /etc/system and rebooting the system.

By default, the TCP/IP implementation in a Solaris kernel is not correctly tuned for Internet or Intranet services. The following /dev/tcp tuning parameters should be inspected and, if necessary, changed to fit the network topology of the installation environment.

The tcp_time_wait_interval in Solaris 9 specifies the number of milliseconds that a TCP connection will be held in the kernel's table after it has been closed. If its value is above 30000 (30 seconds) and the directory is being used in a LAN, MAN, or under a single network administration, it should be reduced by adding a line to the /etc/init.d/inetinit file similar to the following:

ndd -set /dev/tcp tcp_time_wait_interval 30000

The tcp_conn_req_max_q0 and tcp_conn_req_max_q parameters control the maximum backlog of connections that the kernel will accept on behalf of the Directory Server process. If the directory is expected to be used by a large number of client hosts simultaneously, these values should be raised to at least 1024 by adding a line to the /etc/init.d/inetinit file similar to the following:

ndd -set /dev/tcp tcp_conn_req_max_q0 1024
ndd -set /dev/tcp tcp_conn_req_max_q 1024

The tcp_keepalive_interval specifies the interval in seconds between keepalive packets sent by Solaris for each open TCP connection. This can be used to remove connections to clients that have become disconnected from the network.

The tcp_rexmit_interval_initial value should be inspected when performing server performance testing on a LAN or high speed MAN or WAN. For operations on the wide area Internet, its value need not be changed.

The tcp_smallest_anon_port controls the number of simultaneous connections that can be made to the server. When rlim_fd_max has been increased to above 4096, this value should be decreased by adding a line to the /etc/init.d/inetinit file similar to the following :

ndd -set /dev/tcp tcp_smallest_anon_port 8192

The tcp_slow_start_initial parameter should be inspected if clients will predominately be using the Windows TCP/IP stack.