ldap 初始化配置

Posted 2020-10-17

dn: cn=config

objectClass: olcGlobal

cn: config

olcArgsFile: /var/run/openldap/slapd.args

olcPidFile: /var/run/openldap/slapd.pid

#

# TLS settings

#

olcTLSCACertificatePath: /etc/openldap/certs

olcTLSCertificateFile: "OpenLDAP Server"

olcTLSCertificateKeyFile: /etc/openldap/certs/password

structuralObjectClass: olcGlobal

entryUUID: 0ca4a796-53e8-1034-90ac-5fa43e938d62

creatorsName: cn=config

createTimestamp: 20161217040752Z

entryCSN: 20161217040752.632838Z#000000#000#000000

modifiersName: cn=config

modifyTimestamp: 20161217040752Z

#

# Do not enable referrals until AFTER you have a working directory

# service AND an understanding of referrals.

#

#olcReferral: ldap://root.openldap.org

#

# Sample security restrictions

#    Require integrity protection (prevent hijacking)

#    Require 112-bit (3DES or better) encryption for updates

#    Require 64-bit encryption for simple bind

#

#olcSecurity: ssf=1 update_ssf=112 simple_bind=64

#

# Load dynamic backend modules:

# - modulepath is architecture dependent value (32/64-bit system)

# - back_sql.la backend requires openldap-servers-sql package

# - dyngroup.la and dynlist.la cannot be used at the same time

#

dn: cn=module,cn=config

objectClass: olcModuleList

cn: module

#olcModulepath:    /usr/lib/openldap

olcModulepath:    /usr/lib64/openldap

#olcModuleload: accesslog.la

#olcModuleload: auditlog.la

#olcModuleload: back_dnssrv.la

#olcModuleload: back_ldap.la

olcModuleload: back_mdb.la

#olcModuleload: back_meta.la

#olcModuleload: back_null.la

#olcModuleload: back_passwd.la

#olcModuleload: back_relay.la

#olcModuleload: back_shell.la

#olcModuleload: back_sock.la

#olcModuleload: collect.la

#olcModuleload: constraint.la

#olcModuleload: dds.la

#olcModuleload: deref.la

#olcModuleload: dyngroup.la

#olcModuleload: dynlist.la

#olcModuleload: memberof.la

#olcModuleload: pcache.la

#olcModuleload: ppolicy.la

#olcModuleload: refint.la

#olcModuleload: retcode.la

#olcModuleload: rwm.la

#olcModuleload: seqmod.la

#olcModuleload: smbk5pwd.la

#olcModuleload: sssvlv.la

#olcModuleload: syncprov.la

#olcModuleload: translucent.la

#olcModuleload: unique.la

#olcModuleload: valsort.la

#

# Schema settings

#

dn: cn=schema,cn=config

objectClass: olcSchemaConfig

cn: schema

include: file:///etc/openldap/schema/core.ldif

include: file:///etc/openldap/schema/cosine.ldif

include: file:///etc/openldap/schema/nis.ldif

include: file:///etc/openldap/schema/inetorgperson.ldif

include: file:///etc/openldap/schema/openldap.ldif

include: file:///etc/openldap/schema/corba.ldif

include: file:///etc/openldap/schema/duaconf.ldif

include: file:///etc/openldap/schema/dyngroup.ldif

#

# Frontend settings

#

dn: olcDatabase=frontend,cn=config

objectClass: olcDatabaseConfig

objectClass: olcFrontendConfig

olcDatabase: frontend

olcAccess: to * by * read

olcSizelimit: size.soft=10000 size.hard=1000000

olcTimelimit: time.soft=300 time.hard=3600

#

# Sample global access control policy:

#    Root DSE: allow anyone to read it

#    Subschema (sub)entry DSE: allow anyone to read it

#    Other DSEs:

#        Allow self write access

#        Allow authenticated users read access

#        Allow anonymous users to authenticate

#

#olcAccess: to dn.base="" by * read

#olcAccess: to dn.base="cn=Subschema" by * read

#olcAccess: to *

#    by self write

#    by users read

#    by anonymous auth

#

# if no access controls are present, the default policy

# allows anyone and everyone to read anything but restricts

# updates to rootdn.  (e.g., "access to * by * read")

#

# rootdn can always read and write EVERYTHING!

#

#

# Configuration database

#

dn: olcDatabase=config,cn=config

objectClass: olcDatabaseConfig

olcDatabase: config

olcRootDN: cn=Manager,cn=config

olcRootPW: {SSHA}la/7FNIvnUbtQmjUNf6NvnrDZAntJBKx  #密码由slappasswd -s '密码' 命令生成

# generate a password by running slappasswd

olcMonitoring: FALSE

olcAccess: to * by * none

#olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c

# n=auth" manage by * none

#

# Server status monitoring

#

dn: olcDatabase=monitor,cn=config

objectClass: olcDatabaseConfig

olcDatabase: monitor

olcAddContentAcl: FALSE

olcLastMod: TRUE

olcMaxDerefDepth: 15

olcReadOnly: FALSE

olcSyncUseSubentry: FALSE

olcMonitoring: FALSE

olcAccess: to dn.subtree="cn=monitor"

  by dn.base="cn=Manager,cn=config" read

  by dn.base="cn=Manager,dc=test,dc=com" read

  by * none

#olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c

# n=auth" read by dn.base="cn=Manager,dc=my-domain,dc=com" read by * none

#

# Backend database definitions

#

dn: olcDatabase=mdb,cn=config

objectClass: olcDatabaseConfig

objectClass: olcMdbConfig

olcDatabase: mdb

olcMonitoring: TRUE

olcDbMaxSize: 42949672960

olcSuffix: dc=test,dc=com

olcDbDirectory:    /var/lib/ldap

olcRootDN: cn=Manager,dc=test,dc=com

# generate a password by running slappasswd

olcRootPW: {SSHA}AAek63z+Bzz9rG/djlyIm0pKsrxHpeMh #密码由slappasswd命令生成

olcDbIndex: uid pres,eq

olcDbIndex: cn,sn pres,eq,approx,sub

olcDbIndex: mail pres,eq,sub

olcDbIndex: objectClass pres,eq

olcDbIndex: loginShell pres,eq

#olcDbIndex: objectClass eq,pres

#olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub

# Tuning, not sure what these do maybe test them

#olcDbConfig: set_cachesize 0 2097152 0

#olcDbConfig: set_lk_max_objects 1500

#olcDbConfig: set_lk_max_locks 1500

#olcDbConfig: set_lk_max_lockers 1500

#olcLastMod: TRUE

#olcMonitoring: TRUE

#olcDbCheckpoint: 512 30

olcAccess: to attrs=userPassword

   by self write

   by anonymous auth

   by dn.base="cn=Manager,dc=test,dc=com" write

   by * none

olcAccess: to attrs=shadowLastChange

   by self write

   by * read

olcAccess: to *

   by dn.base="cn=Manager,dc=test,dc=com" write

   by * read