contrib/openldap/slapd.conf

   1 # This is the main ldapd configuration file. See slapd.conf(5) for more
   2 # info on the configuration options.
   3
   4 ##
   5 ## NOTE: This is an example. You should use the template shipped
   6 ##       with your distribution and adapt it to your needs.
   7 ##
   8
   9 # Schema and objectClass definitions, depending on your
  10 # LDAP setup
  11 include         /etc/ldap/schema/core.schema
  12 include         /etc/ldap/schema/cosine.schema
  13 include         /etc/ldap/schema/inetorgperson.schema
  14 include         /etc/ldap/schema/openldap.schema
  15 include         /etc/ldap/schema/nis.schema
  16 include         /etc/ldap/schema/misc.schema
  17 #include        /etc/ldap/schema/krb5-kdc.schema
  18 #include        /etc/ldap/schema/trust.schema
  19
  20 # These should be present for GOsa. In case of samba3,
  21 # replace samba.schema and gosa.schema by samba3.schema
  22 # and gosa+samba3.schema. Don't include both and remember
  23 # to adjust the indexing and acl stuff below!
  24 include         /etc/ldap/schema/samba.schema
  25 include         /etc/ldap/schema/pureftpd.schema
  26 include         /etc/ldap/schema/gofon.schema
  27 include         /etc/ldap/schema/gosystem.schema
  28 include         /etc/ldap/schema/goto.schema
  29 include         /etc/ldap/schema/gosa+samba3.schema
  30 include         /etc/ldap/schema/gofax.schema
  31 include         /etc/ldap/schema/goserver.schema
  32 include         /etc/ldap/schema/goto-mime.schema
  33
  34 # Schema check allows for forcing entries to
  35 # match schemas for their objectClasses's
  36 schemacheck             on
  37
  38 # Security settings
  39 # Parameters: sasl, ssf, tls, transport, update_sasl, update_ssf,
  40 #             update_tls, update_transport
  41 #security               update_sasl=128,uptate_tls=128
  42
  43 # Require settings
  44 # Paramters: none, authc, bind, LDAPv3, SASL (strong)
  45 #require                        authc, LDAPv3
  46
  47 # Allow settings
  48 # Parameters: none, bind_v2, tls_2_anon, bind_anon_cred, bind_anon_dn,
  49 #             update_anon
  50 #allow                  bind_v2
  51
  52 # Disallow settings
  53 # Parameters: bind_anon, bind_simple_unprotected, tls_2_anon,
  54 #             bind_simple, bind_krbv4, tls_authc
  55
  56 # Password hash default value
  57 # Parameters: {SHA}, {SMD5}, {MD4}, {CRYPT}, {CLEARTEXT}
  58 password-hash           {CRYPT}
  59
  60 # Search base
  61 defaultsearchbase       dc=gonicus,dc=de
  62
  63
  64 # Where clients are refered to if no
  65 # match is found locally
  66 #referral       ldap://some.other.ldap.server
  67
  68 ## TLS setup, needs certificates
  69 #TLSCipherSuite HIGH:MEDIUM:+SSLv2
  70 #TLSCertificateFile /etc/ssl/certs/slapd.pem
  71 #TLSCertificateKeyFile /etc/ssl/certs/slapd.pem
  72
  73 ## SASL setup
  74 #sasl-authz-policy
  75 #sasl-host      gosa.gonicus.local
  76 #sasl-realm     GONICUS.LOCAL
  77 #sasl-regexp    cn=(.*),ou=(.*) cn=$1,ou=$2,ou=People,dc=gonicus,dc=de
  78 #sasl-secprops  noanonymous
  79
  80 ## Kerberos setup
  81 #srvtab         /etc/krb5.keytab.ldap
  82
  83 # Where the pid file is put. The init.d script
  84 # will not stop the server if you change this.
  85 pidfile         /var/run/slapd.pid
  86
  87 # List of arguments that were passed to the server
  88 argsfile        /var/run/slapd.args
  89
  90 # Read slapd.conf(5) for possible values
  91 loglevel        1024
  92
  93 # Where the dynamically loaded modules are stored
  94 modulepath      /usr/lib/ldap
  95 moduleload      back_bdb
  96 moduleload      back_monitor
  97 #moduleload      back_shell
  98
  99 # Some tuning parameters
 100 #threads                64
 101 #concurrency            32
 102 #conn_max_pending       100
 103 #conn_max_pending_auth  250
 104 #reverse-lookup         off
 105 #sizelimit              1000
 106 #timelimit              30
 107 #idletimeout            30
 108
 109 # Limits
 110 #limits anonymous       size.soft=500 time.soft=5
 111 #limits user            size=none time.soft=30
 112
 113 access to dn.base=""
 114         by * read
 115 access to dn.base="cn=Subschema"
 116         by * read
 117
 118 access to dn.subtree=cn=Monitor
 119         by * read
 120
 121 # Access to schema information
 122 #access to dn.subtree=""
 123 #        by * read
 124
 125 # The userPassword/shadow Emtries by default can be
 126 # changed by the entry owning it if they are authenticated.
 127 # Others should not be able to see it, except the admin
 128 # entry below
 129 access to attrs=userPassword,userPKCS12,sambaPwdLastSet,sambaPwdMustChange,sambaPwdCanChange,shadowMax,shadowExpire
 130         by dn="cn=ldapadmin,dc=gonicus,dc=de" write
 131         by dn.regex="uid=[^/]+/admin\+(realm=GONICUS.LOCAL)?" write
 132         by anonymous auth
 133         by self write
 134         by * none
 135 access to attrs=shadowLastChange
 136         by self write
 137         by * read
 138
 139 # Deny access to imap/fax/kerberos admin passwords stored
 140 # in ldap tree
 141 access to attrs=goImapPassword
 142         by dn="cn=ldapadmin,dc=gonicus,dc=de" write
 143         by dn.regex="uid=[^/]+/admin\+(realm=GONICUS.LOCAL)?" write
 144         by * none
 145 access to attrs=goKrbPassword
 146         by dn="cn=ldapadmin,dc=gonicus,dc=de" write
 147         by dn.regex="uid=[^/]+/admin\+(realm=GONICUS.LOCAL)?" write
 148         by * none
 149 access to attrs=goFaxPassword
 150         by dn="cn=ldapadmin,dc=gonicus,dc=de" write
 151         by dn.regex="uid=[^/]+/admin\+(realm=GONICUS.LOCAL)?" write
 152         by * none
 153
 154 # Let servers write last user attribute
 155 access to attrs=gotoLastUser
 156         by * write
 157
 158 # Samba passwords by default can be changed
 159 # by the entry owning it if they are authenticated.
 160 # Others should not be able to see it, except the
 161 # admin entry below
 162 access to attrs=sambaLmPassword,sambaNtPassword
 163         by dn="cn=ldapadmin,dc=gonicus,dc=de" write
 164         by dn.regex="uid=[^/]+/admin\+(realm=GONICUS.LOCAL)?" write
 165         by anonymous auth
 166         by self write
 167         by * none
 168
 169 # Enable write create access for the terminal admin
 170 access to dn="ou=incoming,dc=gonicus,dc=de"
 171         by dn="cn=terminal-admin,dc=gonicus,dc=de" write
 172         by dn="cn=ldapadmin,dc=gonicus,dc=de" write
 173         by dn.regex="uid=[^/]+/admin\+(realm=GONICUS.LOCAL)?" write
 174         by * none
 175
 176 access to dn.sub="ou=incoming,dc=gonicus,dc=de"
 177         by dn="cn=terminal-admin,dc=gonicus,dc=de" write
 178         by dn="cn=ldapadmin,dc=gonicus,dc=de" write
 179         by dn.regex="uid=[^/]+/admin\+(realm=GONICUS.LOCAL)?" write
 180         by * none
 181
 182 # What trees should be readable, depends on your policy. Either
 183 # use this entry and specify what should be readable, or leave
 184 # the access to * => by * read below untouched
 185 #access to dn="ou=(people|groups)"
 186 #       by * read
 187
 188 # The admin dn has full write access
 189 access to *
 190         by dn="cn=ldapadmin,dc=gonicus,dc=de" =wrscx
 191         by dn.regex="uid=[^/]+/admin\+(realm=GONICUS.LOCAL)?" =wrscx
 192         by * read
 193 #       by peername="ip=127\.0\.0\.1" read
 194 #       by * none
 195
 196 #######################################################################
 197 # database definitions
 198 #######################################################################
 199
 200 # Monitor backend
 201 database        monitor
 202
 203 # The backend type, ldbm, is the default standard
 204 database        bdb
 205 cachesize       5000
 206 mode            0600
 207
 208 # The base of your directory
 209 suffix          "dc=gonicus,dc=de"
 210 checkpoint      512 720
 211
 212 # Sample password is "tester", generate a new one using the mkpasswd
 213 # utility and put the string after {crypt}
 214 rootdn  "cn=ldapadmin,dc=gonicus,dc=de"
 215 rootpw  {crypt}OuorOLd3VqvC2
 216
 217 # Indexing
 218 index   default                                                 sub
 219 index   uid,mail                                                eq
 220 index   gosaMailAlternateAddress,gosaMailForwardingAddress      eq
 221 index   cn,sn,givenName,ou                                      pres,eq,sub
 222 index   objectClass                                             pres,eq
 223 index   uidNumber,gidNumber,memberuid,macAddress                eq
 224 index   gosaSubtreeACL,gosaObject,gosaUser                      pres,eq
 225
 226 # Indexing for Kolab
 227 #index  alias                                                   eq,sub
 228 #index  kolabDeleteFlag                                         eq
 229 #index  kolabHomeServer                                         eq
 230 #index  member                                                  pres,eq
 231
 232 # Indexing for Samba 3
 233 index   sambaSID                                                eq
 234 index   sambaPrimaryGroupSID                                    eq
 235 index   sambaDomainName                                         eq
 236
 237 # Indexing for DNS/DHCP
 238 #index  zoneName                                                eq
 239 #index  relativeDomainName                                      eq
 240 #index   dhcpHWAddress                                          eq
 241 #index   dhcpClassData                                          eq
 242 #index   dhcpPrimaryDN                                          eq
 243 #index   dhcpSecondaryDN                                                eq
 244
 245 # Where the database file are physically stored
 246 directory       "/var/lib/ldap"
 247
 248 # Log modifications and write entryUUID
 249 lastmod on
 250
 251
 252 # Example replication using admin account. This will require taking the
 253 # out put of this database using slapcat(8C), and then importing that into
 254 # the replica using slapadd(8C).
 255
 256 # Replication setup
 257 #replogfile /var/log/ldap-replicalog
 258 #replica host=ldap-2.gonicus.local
 259 #       binddn="cn=replicator,dc=gonicus,dc=de" bindmethod=simple credentials=secret
 260
 261 # Dummy database for config replication
 262 #database        shell
 263 #suffix          "dc=gonicus,dc=shell"
 264 #search          /etc/ldap/shell/process.pl
 265 #add             /etc/ldap/shell/process.pl
 266
 267 # End of ldapd configuration file
 268