LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

ktutil: rkt domainC.keytab
ktutil: wkt krb5.keytab
ktutil: quit
Use klist -k to show the different entries in the keytab file /etc/krb5.keytab should be
readable only by the supervisor.
Considering Performance Impacts
The advantage of an LDAP directory over flat files for naming and authentication services is its
design for quick access to information in large databases. Still, with very large databases,
administrators, and users should be aware of the following performance impacts:
Enumeration Requests
Enumeration requests are directory queries that request all of a database, for example all users
or all groups. Enumeration requests of large databases can reduce network and server
performance. For this reason, you may want to restrict the use of the following commands that
generate enumeration requests:
• finger(1)
• grget(1) with no options
• pwget(1) with no options
• groups(1)
• listusers(1)
• logins(1M)
Also, applications written with the ggetpwent(3C) or getgrent(3C) family of routines can
enumerate a map, depending on how they are written.
It may be possible to rewrite these applications so that an LDAP search request is used instead
of a call to getpwent or getgrent.
Search Limits
The default configuration for Active Directory sets the search size limit to 1,000 entries and the
search time limit to two minutes. Setting search limits prevents users from consuming all the
resources of a directory and helps to minimize "denial of service" attacks; however, on large
databases they will not be enough to service commands or applications that generate enumeration
requests. You can use the support tool ntdsutil to change these two values. ntdsutil can be
installed from the Windows 2000 or 2003 Server CD in the \SUPPORT\TOOLS folder.
NOTE: The search time limit set during the setup procedure specifies the search timeout on
the client side. To service enumeration requests, this parameter may need to be adjusted
accordingly.
1. On your domain controller, click Start, then Run.
In the Open box, enter ntdsutil, then click OK.
2. Enter ldap policies, and then press the Enter key. You can enter the ? symbol at any of
the prompts in the ntdsutiltool to see a list of available commands.
3. Enter connections, and then press the Enter key.
4. Enter connect to server <servername>, where <servername>is the name of server
you want to use, and then press the Enter key.
5. At the server connections: prompt, enter quit, and then press the Enter key.
Considering Performance Impacts 143