Attachment 252566 Details for Bug 444620

ldap.conf config file

ldap.conf (text/plain), 6.00 KB, created by Alexander Fleischer on 2008-11-17 08:20:21 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Alexander Fleischer

Created: 2008-11-17 08:20:21 UTC

Size: 6.00 KB

patch

obsolete

>#
># This is the configuration file for the LDAP nameservice
># switch library, the LDAP PAM module and the shadow package.
>#
>
># Your LDAP server. Must be resolvable without using LDAP.
>host	10.0.0.1 
>#141.24.205.205
>
># The distinguished name of the search base.
>base	dc=example,dc=com
># The LDAP version to use (defaults to 3
># if supported by client library)
>ldap_version	3
>
># The distinguished name to bind to the server with.
># Optional: default is to bind anonymously.
>binddn cn=ldapleser,cn=users,,dc=example,dc=com
>
># The credentials to bind with. 
># Optional: default is no credential.
>bindpw geheim
>
># The distinguished name to bind to the server with
># if the effective user ID is root. Password is
># stored in /etc/ldap.secret (mode 600)
>#rootbinddn cn=Manager,dc=example,dc=com
>
># The port.
># Optional: default is 389.
>#port 389
>
># The search scope.
>scope sub
>#scope one
>#scope base
>
># Search timelimit
>#timelimit 30
>
># Bind timelimit
>#bind_timelimit 30
>
># Idle timelimit; client will close connections
># (nss_ldap only) if the server has not been contacted
># for the number of seconds specified below.
>#idle_timelimit 3600
>
># Filter to AND with uid=%s
>#pam_filter objectclass=account
>
># The user ID attribute (defaults to uid)
>#pam_login_attribute uid
>
># Search the root DSE for the password policy (works
># with Netscape Directory Server)
>#pam_lookup_policy yes
>
># Check the 'host' attribute for access control
># Default is no; if set to yes, and user has no
># value for the host attribute, and pam_ldap is
># configured for account management (authorization)
># then the user will not be allowed to login.
>#pam_check_host_attr yes
>
># Group to enforce membership of
>#pam_groupdn cn=PAM,ou=Groups,dc=padl,dc=com
>
># Group member attribute
>pam_member_attribute member
>
># Specify a minium or maximum UID number allowed
>#pam_min_uid 0
>#pam_max_uid 0
>
># Template login attribute, default template user
># (can be overriden by value of former attribute
># in user's entry)
>#pam_login_attribute userPrincipalName
>#pam_template_login_attribute uid
>#pam_template_login nobody
>
># Do not hash the password at all; presume
># the directory server will do it, if
># necessary. This is the default.
>#pam_password clear
>
># Hash password locally; required for University of
># Michigan LDAP server, and works with Netscape
># Directory Server if you're using the UNIX-Crypt
># hash mechanism and not using the NT Synchronization
># service. 
>#pam_password	crypt
>
># Remove old password first, then update in
># cleartext. Necessary for use with Novell
># Directory Services (NDS)
>#pam_password nds
>
># Update Active Directory password, by
># creating Unicode password and updating
># unicodePwd attribute.
>#pam_password ad
>
># Use the OpenLDAP password change
># extended operation to update the password.
>#pam_password exop
>
># Redirect users to a URL or somesuch on password
># changes.
>#pam_password_prohibit_message Please visit http://internal to change your password.
>
># RFC2307bis naming contexts
># Syntax:
># nss_base_XXX		base?scope?filter
># where scope is {base,one,sub}
># and filter is a filter to be &'d with the
># default filter.
># You can omit the suffix eg:
># nss_base_passwd	ou=People,
># to append the default base DN but this
># may incur a small performance impact.
>#nss_base_passwd	ou=People,dc=padl,dc=com?one
>#nss_base_shadow	ou=People,dc=padl,dc=com?one
>#nss_base_group		ou=Group,dc=padl,dc=com?one
>#nss_base_hosts		ou=Hosts,dc=padl,dc=com?one
>#nss_base_services	ou=Services,dc=padl,dc=com?one
>#nss_base_networks	ou=Networks,dc=padl,dc=com?one
>#nss_base_protocols	ou=Protocols,dc=padl,dc=com?one
>#nss_base_rpc		ou=Rpc,dc=padl,dc=com?one
>#nss_base_ethers	ou=Ethers,dc=padl,dc=com?one
>#nss_base_netmasks	ou=Networks,dc=padl,dc=com?ne
>#nss_base_bootparams	ou=Ethers,dc=padl,dc=com?one
>#nss_base_aliases	ou=Aliases,dc=padl,dc=com?one
>#nss_base_netgroup	ou=Netgroup,dc=padl,dc=com?one
>
># attribute/objectclass mapping
># Syntax:
>#nss_map_attribute	rfc2307attribute	mapped_attribute
>#nss_map_objectclass	rfc2307objectclass	mapped_objectclass
>
># configure --enable-nds is no longer supported.
># For NDS now do:
>#nss_map_attribute uniqueMember member
>
># configure --enable-mssfu-schema is no longer supported.
># For MSSFU now do:
>nss_map_objectclass posixAccount User
>nss_map_attribute uid sAMAccountName
>nss_map_attribute uidNumber UidNumber
>nss_map_attribute loginShell LoginShell
>nss_map_attribute uniqueMember Member
>#nss_map_attribute userPassword msSFUPassword
>nss_map_attribute homeDirectory msSFUHomeDirectory
>nss_map_objectclass posixGroup Group
>pam_login_attribute sAMAccountName
>pam_filter objectclass=User
>pam_password ad
>
># configure --enable-authpassword is no longer supported
># For authPassword support, now do:
>#nss_map_attribute userPassword authPassword
>#pam_password nds
>
># For IBM SecureWay support, do:
>#nss_map_objectclass posixAccount aixAccount
>#nss_map_attribute uid userName
>#nss_map_attribute gidNumber gid
>#nss_map_attribute uidNumber uid
>#nss_map_attribute userPassword passwordChar
>#nss_map_objectclass posixGroup aixAccessGroup
>#nss_map_attribute cn groupName
>#nss_map_attribute uniqueMember member
>#pam_login_attribute userName
>#pam_filter objectclass=aixAccount
>#pam_password clear
>
># Netscape SDK LDAPS
>#ssl on
>
># Netscape SDK SSL options
>#sslpath /etc/ssl/certs/cert7.db
>
># OpenLDAP SSL mechanism
># start_tls mechanism uses the normal LDAP port, LDAPS typically 636
>#ssl	start_tls
>#pam_filter	objectclass=posixAccount
>#nss_base_passwd	dc=theoinf,dc=tu-ilmenau,dc=de
>#nss_base_shadow	dc=theoinf,dc=tu-ilmenau,dc=de
>#nss_base_group	dc=theoinf,dc=tu-ilmenau,dc=de
>#ssl on
>
># OpenLDAP SSL options
># Require and verify server certificate (yes/no)
># Default is "no"
>tls_checkpeer no
>
># CA certificates for server certificate verification
># At least one of these are required if tls_checkpeer is "yes"
>#tls_cacertfile /etc/ssl/ca.cert
>#tls_cacertdir /etc/ssl/certs
>
># SSL cipher suite
># See man ciphers for syntax
>#tls_ciphers TLSv1
>
># Client certificate and key
># Use these, if your server requires client authentication.
>#tls_cert
>#tls_key
>
>referrals Off
>
>#Don't try forever if the LDAP server is not reacheable
>bind_policy soft

Actions: View

Attachments on bug 444620: 252566