contrib/opensides/ldap/slapd.conf

   1 # This is the main ldapd configuration file. See slapd.conf(5) for more
   2 # info on the configuration options.
   3
   4 ##
   5 ## NOTE: This is an example. You should use the template shipped
   6 ##       with your distribution and adapt it to your needs.
   7 ##
   8
   9 # Schema and objectClass definitions, depending on your
  10 # LDAP setup
  11 include         /etc/ldap/schema/core.schema
  12 include         /etc/ldap/schema/cosine.schema
  13 include         /etc/ldap/schema/inetorgperson.schema
  14 include         /etc/ldap/schema/openldap.schema
  15 include         /etc/ldap/schema/nis.schema
  16 include         /etc/ldap/schema/misc.schema
  17 #include        /etc/ldap/schema/krb5-kdc.schema
  18 #include        /etc/ldap/schema/trust.schema
  19
  20 # These should be present for GOsa. In case of samba3,
  21 # replace samba.schema and gosa.schema by samba3.schema
  22 # and gosa+samba3.schema. Don't include both and remember
  23 # to adjust the indexing and acl stuff below!
  24 include         /etc/ldap/schema/samba.schema
  25 #include                /etc/ldap/schema/pureftpd.schema
  26 include         /etc/ldap/schema/goconfig.schema
  27 include         /etc/ldap/schema/gohard.schema
  28 include         /etc/ldap/schema/gofon.schema
  29 include         /etc/ldap/schema/goto.schema
  30 include         /etc/ldap/schema/gosa+samba3.schema
  31 include         /etc/ldap/schema/gofax.schema
  32 include         /etc/ldap/schema/goserver.schema
  33 include         /etc/ldap/schema/gofirewall.schema
  34
  35
  36 # These should be present for egroupware mail attributes
  37 #include                /etc/ldap/schema/phpgwaccount.schema
  38 #include                /etc/ldap/schema/phpgwcontact.schema
  39
  40 # Schema check allows for forcing entries to
  41 # match schemas for their objectClasses's
  42 schemacheck             on
  43
  44 # Security settings
  45 # Parameters: sasl, ssf, tls, transport, update_sasl, update_ssf,
  46 #             update_tls, update_transport
  47 #security               update_sasl=128,uptate_tls=128
  48
  49 # Require settings
  50 # Paramters: none, authc, bind, LDAPv3, SASL (strong)
  51 #require                        authc, LDAPv3
  52
  53 # Allow settings
  54 # Parameters: none, bind_v2, tls_2_anon, bind_anon_cred, bind_anon_dn,
  55 #             update_anon
  56 allow                   bind_v2
  57
  58 # Disallow settings
  59 # Parameters: bind_anon, bind_simple_unprotected, tls_2_anon,
  60 #             bind_simple, bind_krbv4, tls_authc
  61
  62 # Password hash default value
  63 # Parameters: {SHA}, {SMD5}, {MD4}, {CRYPT}, {CLEARTEXT}
  64 password-hash           {CRYPT}
  65
  66 # Search base
  67 defaultsearchbase       dc=ccib,dc=be
  68
  69
  70 # Where clients are refered to if no
  71 # match is found locally
  72 #referral       ldap://some.other.ldap.server
  73
  74 ## TLS setup, needs certificates
  75 #TLSCipherSuite HIGH:MEDIUM:+SSLv2
  76 #TLSCertificateFile /etc/ssl/certs/slapd.pem
  77 #TLSCertificateKeyFile /etc/ssl/certs/slapd.pem
  78
  79 ## SASL setup
  80 #sasl-authz-policy
  81 #sasl-host      gosa.sweatshop.local
  82 #sasl-realm     sweatshop.LOCAL
  83 #sasl-regexp    cn=(.*),ou=(.*) cn=$1,ou=$2,ou=people,dc=ccib,dc=be
  84 #sasl-secprops  noanonymous
  85
  86 ## Kerberos setup
  87 #srvtab         /etc/krb5.keytab.ldap
  88
  89 # Where the pid file is put. The init.d script
  90 # will not stop the server if you change this.
  91 pidfile         /var/run/slapd/slapd.pid
  92
  93 # List of arguments that were passed to the server
  94 argsfile        /var/run/slapd.args
  95
  96 # Read slapd.conf(5) for possible values
  97 #loglevel       2528
  98 #loglevel       384
  99 #loglevel       8
 100
 101 # Where the dynamically loaded modules are stored
 102 modulepath      /usr/lib/ldap
 103 moduleload      back_bdb
 104 #moduleload      back_shell
 105
 106 # Some tuning parameters
 107 threads                 64
 108 concurrency             32
 109 conn_max_pending        100
 110 conn_max_pending_auth   250
 111 reverse-lookup          off
 112 sizelimit               1000
 113 timelimit               30
 114 idletimeout             30
 115
 116 # Limits
 117 #limits anonymous       size.soft=500 time.soft=5
 118 #limits user            size=none time.soft=30
 119
 120 #######################################################################
 121 # database definitions
 122 #######################################################################
 123
 124 # The backend type, ldbm, is the default standard
 125 database        bdb
 126 cachesize       5000
 127 checkpoint      512 720
 128 mode            0600
 129
 130 # The base of your directory
 131 suffix          "dc=ccib,dc=be"
 132
 133 # Sample password is "tester", generate a new one using the mkpasswd
 134 # utility and put the string after {crypt}
 135 rootdn  "cn=ldapadmin,dc=ccib,dc=be"
 136 rootpw  {crypt}2wTonoD6DWM/A
 137
 138 # Indexing
 139 index   default                                                sub
 140 index   uid,mail                                               eq
 141 index   gosaMailAlternateAddress,gosaMailForwardingAddress     eq
 142 index   cn,sn,givenName,ou                                     pres,eq,sub
 143 index   objectClass                                            pres,eq
 144 index   uidNumber,gidNumber,memberuid                          eq
 145 index   gosaSubtreeACL,gosaObject,gosaUser                     pres,eq
 146
 147 # Indexing for Samba 3
 148 index   sambaSID                                               eq
 149 index   sambaPrimaryGroupSID                                   eq
 150 index   sambaDomainName                                        eq
 151
 152
 153 # Where the database file are physically stored
 154 directory       "/var/lib/ldap"
 155
 156 # Save the time that the entry gets modified
 157 lastmod off
 158
 159 # The userPassword/shadow Emtries by default can be
 160 # changed by the entry owning it if they are authenticated.
 161 # Others should not be able to see it, except the admin
 162 # entry below
 163 access to attrs=userPassword,sambaPwdLastSet,sambaPwdMustChange,sambaPwdCanChange,shadowMax,shadowExpire
 164         by dn="cn=ldapadmin,dc=ccib,dc=be" write
 165         by anonymous auth
 166         by self write
 167         by self read
 168         by * none
 169
 170 # Deny access to imap/fax/kerberos admin passwords stored
 171 # in ldap tree
 172 access to attrs=goImapPassword
 173         by dn="cn=ldapadmin,dc=ccib,dc=be" write
 174         by * none
 175 access to attrs=goKrbPassword
 176         by dn="cn=ldapadmin,dc=ccib,dc=be" write
 177         by * none
 178 access to attrs=goFaxPassword
 179         by dn="cn=ldapadmin,dc=ccib,dc=be" write
 180         by * none
 181
 182 # Let servers write last user attribute
 183 access to attrs=gotoLastUser
 184         by * write
 185
 186 # Samba passwords by default can be changed
 187 # by the entry owning it if they are authenticated.
 188 # Others should not be able to see it, except the
 189 # admin entry below
 190 access to attrs=sambaLmPassword,sambaNtPassword
 191         by dn="cn=ldapadmin,dc=ccib,dc=be" write
 192         by anonymous auth
 193         by self write
 194         by self read
 195         by * none
 196
 197 # Enable write create access for the terminal admin
 198 access to dn="ou=incoming,dc=ccib,dc=be"
 199         by dn="cn=terminal-admin,dc=ccib,dc=be" write
 200         by dn="cn=ldapadmin,dc=ccib,dc=be" write
 201
 202 #access to dn=".*,ou=incoming,dc=ccib,dc=be"
 203 #       by dn="cn=terminal-admin,dc=ccib,dc=be" write
 204 #       by dn="cn=ldapadmin,dc=ccib,dc=be" write
 205
 206 # What trees should be readable, depends on your policy. Either
 207 # use this entry and specify what should be readable, or leave
 208 # the access to * => by * read below untouched
 209 #access to dn="ou=(people|groups)"
 210 #       by * read
 211
 212 # The admin dn has full write access
 213 access to *
 214         by dn="cn=ldapadmin,dc=ccib,dc=be" =wrscx
 215         by * read
 216
 217 # Example replication using admin account. This will require taking the
 218 # out put of this database using slapcat(8C), and then importing that into
 219 # the replica using slapadd(8C).
 220
 221 # Replication setup
 222 #replogfile /var/log/ldap-replicalog
 223 #replica host=ldap-2.sweatshop.local
 224 #       binddn="cn=replicator,dc=ccib,dc=be bindmethod=simple credentials=secret
 225
 226 # Dummy database for config replication
 227 #database        shell
 228 #suffix          "dc=ccib,dc=shell"
 229 #search          /etc/ldap/shell/process.pl
 230 #add             /etc/ldap/shell/process.pl
 231
 232 # End of ldapd configuration file
 233