gosa-core/contrib/openldap/slapd.conf

   1 # This is the main ldapd configuration file. See slapd.conf(5) for more
   2 # info on the configuration options.
   3
   4 ##
   5 ## NOTE: This is an example. You should use the template shipped
   6 ##       with your distribution and adapt it to your needs.
   7 ##
   8
   9 # Schema and objectClass definitions, depending on your
  10 # LDAP setup
  11 include         /etc/ldap/schema/core.schema
  12 include         /etc/ldap/schema/cosine.schema
  13 include         /etc/ldap/schema/inetorgperson.schema
  14 include         /etc/ldap/schema/openldap.schema
  15 include         /etc/ldap/schema/nis.schema
  16 include         /etc/ldap/schema/misc.schema
  17
  18 # These should be present for GOsa.
  19 include         /etc/ldap/schema/gosa/samba3.schema
  20 include         /etc/ldap/schema/gosa/gosystem.schema
  21 include         /etc/ldap/schema/gosa/gofon.schema
  22 include         /etc/ldap/schema/gosa/gofax.schema
  23 include         /etc/ldap/schema/gosa/goto.schema
  24 include         /etc/ldap/schema/gosa/goserver.schema
  25 include         /etc/ldap/schema/gosa/gosa-samba3.schema
  26 include         /etc/ldap/schema/gosa/trust.schema
  27
  28 # Security settings
  29 # Parameters: sasl, ssf, tls, transport, update_sasl, update_ssf,
  30 #             update_tls, update_transport
  31 #security               update_sasl=128,uptate_tls=128
  32
  33 # Require settings
  34 # Paramters: none, authc, bind, LDAPv3, SASL (strong)
  35 #require                        authc, LDAPv3
  36
  37 # Allow settings
  38 # Parameters: none, bind_v2, tls_2_anon, bind_anon_cred, bind_anon_dn,
  39 #             update_anon
  40 #allow                  bind_v2
  41
  42 # Disallow settings
  43 # Parameters: bind_anon, bind_simple_unprotected, tls_2_anon,
  44 #             bind_simple, bind_krbv4, tls_authc
  45
  46 # Password hash default value
  47 # Parameters: {SHA}, {SMD5}, {MD4}, {CRYPT}, {CLEARTEXT}
  48 password-hash           {CRYPT}
  49
  50 # Search base
  51 defaultsearchbase       dc=gonicus,dc=de
  52
  53 # Where clients are refered to if no
  54 # match is found locally
  55 #referral       ldap://some.other.ldap.server
  56
  57 ## TLS setup, needs certificates
  58 #TLSCipherSuite HIGH:MEDIUM:+SSLv2
  59 #TLSCertificateFile /etc/ssl/certs/slapd.pem
  60 #TLSCertificateKeyFile /etc/ssl/certs/slapd.pem
  61
  62 ## SASL setup
  63 #sasl-authz-policy
  64 #sasl-host      gosa.gonicus.local
  65 #sasl-realm     GONICUS.LOCAL
  66 #sasl-regexp    cn=(.*),ou=(.*) cn=$1,ou=$2,ou=People,dc=gonicus,dc=de
  67 #sasl-secprops  noanonymous
  68
  69 ## Kerberos setup
  70 #srvtab         /etc/krb5.keytab.ldap
  71
  72 # Where the pid file is put. The init.d script
  73 # will not stop the server if you change this.
  74 pidfile         /var/run/slapd/slapd.pid
  75
  76 # List of arguments that were passed to the server
  77 argsfile        /var/run/slapd/slapd.args
  78
  79 # Read slapd.conf(5) for possible values
  80 loglevel        1024
  81
  82 # Where the dynamically loaded modules are stored
  83 modulepath      /usr/lib/ldap
  84 moduleload      back_hdb
  85 moduleload      back_monitor
  86 #moduleload      back_shell
  87
  88 # Some tuning parameters
  89 #threads                64
  90 #concurrency            32
  91 #conn_max_pending       100
  92 #conn_max_pending_auth  250
  93 #reverse-lookup         off
  94 #sizelimit              1000
  95 #timelimit              30
  96 #idletimeout            30
  97
  98 # Limits
  99 #limits anonymous       size.soft=500 time.soft=5
 100 #limits user            size=none time.soft=30
 101
 102 # Speed up member add/mod/delete operations
 103 sortvals member memberUid roleOccupant
 104
 105 access to dn.base=""
 106         by * read
 107
 108 access to dn.subtree=cn=Monitor
 109         by * read
 110
 111 # Access to schema information
 112 #access to dn.subtree=""
 113 #        by * read
 114
 115 # The userPassword/shadow Emtries by default can be
 116 # changed by the entry owning it if they are authenticated.
 117 # Others should not be able to see it, except the admin
 118 # entry below
 119 access to attrs=userPassword,sambaPwdLastSet,sambaPwdMustChange,sambaPwdCanChange,shadowMax,shadowExpire
 120         by dn.regex="uid=[^/]+/admin\+(realm=GONICUS.LOCAL)?" write
 121         by anonymous auth
 122         by self write
 123         by * none
 124
 125 # Deny access to imap/fax/kerberos admin passwords stored
 126 # in ldap tree
 127 access to attrs=goImapPassword
 128         by dn.regex="uid=[^/]+/admin\+(realm=GONICUS.LOCAL)?" write
 129         by * none
 130 access to attrs=goKrbPassword
 131         by dn.regex="uid=[^/]+/admin\+(realm=GONICUS.LOCAL)?" write
 132         by * none
 133 access to attrs=goFaxPassword
 134         by dn.regex="uid=[^/]+/admin\+(realm=GONICUS.LOCAL)?" write
 135         by * none
 136
 137 # Let servers write last user attribute
 138 access to attrs=gotoLastUser
 139         by * write
 140
 141 # Samba passwords by default can be changed
 142 # by the entry owning it if they are authenticated.
 143 # Others should not be able to see it, except the
 144 # admin entry below
 145 access to attrs=sambaLmPassword,sambaNtPassword
 146         by dn.regex="uid=[^/]+/admin\+(realm=GONICUS.LOCAL)?" write
 147         by anonymous auth
 148         by self write
 149         by * none
 150
 151 # What trees should be readable, depends on your policy. Either
 152 # use this entry and specify what should be readable, or leave
 153 # the access to * => by * read below untouched
 154 #access to dn="ou=(people|groups)"
 155 #       by * read
 156
 157 # The admin dn has full write access
 158 access to *
 159         by dn.regex="uid=[^/]+/admin\+(realm=GONICUS.LOCAL)?" =wrscx
 160         by * read
 161 #       by peername="ip=127\.0\.0\.1" read
 162 #       by * none
 163
 164 #######################################################################
 165 # database definitions
 166 #######################################################################
 167
 168 # Monitor backend
 169 database        monitor
 170
 171 # The backend type, ldbm, is the default standard
 172 database        hdb
 173 cachesize 5000
 174 mode              0600
 175
 176 # The base of your directory
 177 suffix          "dc=gonicus,dc=de"
 178 checkpoint      512 720
 179
 180 # Sample password is "tester", generate a new one using the mkpasswd
 181 # utility and put the string after {crypt}
 182 rootdn  "cn=ldapadmin,dc=gonicus,dc=de"
 183 rootpw  {crypt}OuorOLd3VqvC2
 184
 185 # Indexing
 186 index   default                                                sub
 187 index   uid,mail                                               eq
 188 index   gosaSnapshotDN                                         eq
 189 index   gosaSnapshotTimestamp                                  eq,sub
 190 index   gosaMailAlternateAddress,gosaMailForwardingAddress     eq
 191 index   cn,sn,givenName,ou                                     pres,eq,sub
 192 index   objectClass                                            pres,eq
 193 index   uidNumber,gidNumber,memberuid                          eq
 194 index   roleOccupant                                           eq
 195 index   gosaSubtreeACL,gosaObject,gosaUser                     pres,eq
 196
 197 # Indexing for Kolab
 198 #index  alias                                                   eq,sub
 199 #index  kolabDeleteflag                                         eq
 200 #index  kolabHomeServer                                         eq
 201 #index  member                                                  pres,eq
 202
 203 # Indexing for Samba 3
 204 index   sambaSID                                               eq
 205 index   sambaPrimaryGroupSID                                   eq
 206 index   sambaDomainName                                        eq
 207
 208 # Indexing for DHCP
 209 #index  dhcpHWAddress                                          eq
 210 #index  dhcpClassData                                          eq
 211
 212 # Indexing for DNS
 213 #index  zoneName                                               eq
 214 #index  relativeDomainName                                     eq
 215
 216 # Where the database file are physically stored
 217 directory       "/var/lib/ldap"
 218
 219 # Log modifications and write entryUUID
 220 lastmod on
 221
 222
 223 # Example replication using admin account. This will require taking the
 224 # out put of this database using slapcat(8C), and then importing that into
 225 # the replica using slapadd(8C).
 226
 227 # Replication setup
 228 #replogfile /var/log/ldap-replicalog
 229 #replica host=ldap-2.gonicus.local
 230 #       binddn="cn=replicator,dc=gonicus,dc=de" bindmethod=simple credentials=secret
 231
 232 # Dummy database for config replication
 233 #database        shell
 234 #suffix          "dc=gonicus,dc=shell"
 235 #search          /etc/ldap/shell/process.pl
 236 #add             /etc/ldap/shell/process.pl
 237
 238 # End of ldapd configuration file
 239