############################################################################ # See slapd.conf(5) for details on configuration options. # This file SHOULD NOT be world readable. # # Important note: # You surely have to adjust some settings to meet your (security) # requirements. # At least you should replace suffix "dc=example,dc=com" by # something meaningful for your setup. # If you plan to use OpenLDAP server as backend for Samba and/or Kerberos # KDC then you MUST add decent ACLs for protecting user credentials! # # Read the man pages before changing something! # # You can debug the config by running (as root while slapd stopped): # /usr/sbin/slapd -f /etc/openldap/slapd.conf -u ldap -g ldap -h "ldapi:/// ldap://127.0.0.1" -d 65535 ############################################################################ #--------------------------------------------------------------------------- # slapd global parameters #--------------------------------------------------------------------------- # serverID must be unique across all provider replicas # for using multi-master replication (MMR) serverID 99 # only alter this when you know what you're doing #threads 4 # Run-time files pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args # for more debugging set: #loglevel config stats stats2 loglevel stats #--------------------------------------------------------------------------- # Load runtime loadable modules #--------------------------------------------------------------------------- # Load additional backend modules installed by package 'openldap2' # The following backends are statically built-in and therefore don't have # to be loaded here: # config, ldif, monitor, bdb, hdb, ldap, mdb, relay #moduleload back_bdb #moduleload back_hdb moduleload back_mdb #moduleload back_meta #moduleload back_sock # Load additional overlay modules installed by package 'openldap2' # The following overlay are statically built-in and therefore don't have # to be loaded here: # ppolicy, syncprov #moduleload accesslog #moduleload constraint #moduleload dds #moduleload deref #moduleload dynlist #moduleload memberof moduleload refint #moduleload sssvlv #moduleload translucent moduleload unique #moduleload valsort # Load additional overlay modules installed by package 'openldap2-contrib' #moduleload allowed #moduleload lastbind #moduleload noopsrch #moduleload pw-pbkdf2 #moduleload pw-sha2 #moduleload smbk5pwd #--------------------------------------------------------------------------- # Include schema files #--------------------------------------------------------------------------- # Schema files installed by package 'openldap2' include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/ppolicy.schema #include /etc/openldap/schema/yast.schema # Schema file installed by package 'dhcp-server' #include /etc/openldap/schema/dhcp.schema # Schema file installed by package 'samba' #include /etc/openldap/schema/samba3.schema # Schema file installed by package 'krb5-plugin-kdb-ldap' #include /usr/share/doc/packages/krb5/kerberos.schema #--------------------------------------------------------------------------- # Transport Layer Security (TLS) configuration #--------------------------------------------------------------------------- # require at least TLS 1.0 and highly secure ciphers #TLSProtocolMin 3.1 #TLSCipherSuite HIGH:!SSLv3:!SSLv2:!ADH # TLS certificate and key files #TLSCACertificateFile /etc/ssl/ca-bundle.pem #TLSCertificateFile /etc/openldap/ssl.crt/server.crt #TLSCertificateKeyFile /etc/openldap/ssl.key/server.key # For enabling Perfect Forward Secrecy (PFS), see dhparam(1) #TLSDHParamFile /etc/openldap/ssl.key/dhparam #--------------------------------------------------------------------------- # Password hashing #--------------------------------------------------------------------------- #password-hash {CRYPT} # Parameters for {CRYPT} scheme: SHA-512, 72 bits) of salt, 5000 iterations #password-crypt-salt-format "$6$%.12s" #--------------------------------------------------------------------------- # Security requirements #--------------------------------------------------------------------------- #disallow bind_anon #require bind LDAPv3 strong # SSF value for ldapi:// localSSF 256 # minimum required SSF value (security strength factor) # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 #security ssf=128 update_ssf=256 simple_bind=128 security ssf=0 #--------------------------------------------------------------------------- # Global access control (ACLs) #--------------------------------------------------------------------------- # Root DSE: allow anyone to read it access to dn.base="" by * read # Sub schema sub entry: allow anyone to read it access to dn.base="cn=Subschema" by * read #--------------------------------------------------------------------------- # Authz-DN mappings #--------------------------------------------------------------------------- # If connected via IPC socket (ldapi:///) and SASL/EXTERNAL was used # System user root is mapped to the rootdn in database dc=example,dc=com # which has also read access on config and monitor databases authz-regexp "gidNumber=0\\+uidNumber=0,cn=peercred,cn=external,cn=auth" "cn=root,dc=example,dc=com" # Map local system user to LDAP entry # if connected via IPC socket (ldapi:///) and SASL/EXTERNAL was used authz-regexp "gidnumber=([0-9]+)\\+uidnumber=([0-9]+),cn=peercred,cn=external,cn=auth" "ldap:///dc=example,dc=com??sub?(&(objectClass=posixAccount)(uidNumber=$2)(gidNumber=$1))" # this maps the attribute uid to a LDAP entry # if one of the typical password-based SASL mechs was used authz-regexp "uid=([a-zA-Z0-9_-]+),cn=(DIGEST-MD5|CRAM-MD5|NTLM|PLAIN|LOGIN|SCRAM-SHA-1),cn=auth" "ldap:///dc=example,dc=com??sub?(uid=$1)" # this maps the attribute uid to a LDAP entry # if one of the Kerberos based SASL mechs was used #authz-regexp # "uid=([a-zA-Z0-9_-]+),cn=(GSSAPI|GS2-KRB5|GS2-IAKERB),cn=auth" # "ldap:///dc=example,dc=com??sub?(|(krbPrincipalName=$1)(krbPrincipalAlias=$1))" # Map client cert subject DN to LDAP entry if SASL/EXTERNAL was used #authz-regexp # "(.+)" # "ldap:///dc=example,dc=com??sub?(&(objectClass=pkiUser)(seeAlso=$1))" #=========================================================================== # Database specific configuration sections below # Required order of databases: # config (first), ...others..., monitor (last) #=========================================================================== #--------------------------------------------------------------------------- # cn=config // Configuration database (always first!) # see slapd-config(5) #--------------------------------------------------------------------------- database config # Cleartext passwords, especially for the rootdn, should # be avoid! See slappasswd(8) and slapd.conf(5) for details. # Best thing is not to set rootpw at all! # For local config access by root use LDAPI with SASL/EXTERNAL instead # (see above). #rootpw secret access to dn.subtree="cn=config" by dn.exact="cn=root,dc=example,dc=com" manage by group.base="cn=slapd admins,ou=groups,dc=example,dc=com" read by * none #--------------------------------------------------------------------------- # dc=example,dc=com // Example MDB database to be used by normal clients # see slapd-mdb(5) #--------------------------------------------------------------------------- database mdb suffix "dc=example,dc=com" # rootdn has to be set for overlays' internal operations rootdn "cn=root,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid! See slappasswd(8) and slapd.conf(5) for details. # Best thing is not to set rootpw at all! rootpw secret # The database directory MUST exist prior to running slapd and # SHOULD only be accessible by the slapd user 'ldap'. # mkdir /var/lib/ldap/example-db && chown ldap:ldap /var/lib/ldap/example-db && chmod 0700 /var/lib/ldap/example-db directory /var/lib/ldap/example-db # Permissions of database files created mode 0600 # extra information to be available in cn=monitor for this database monitoring on # Perform ACL checks on the content of a new entry being added add_content_acl on # backend-specific database parameters checkpoint 1024 5 # 100 MB (you can raise the limit later) maxsize 104857600 # Indices to maintain # # Whenever you change indexing configuration you have to re-run slapindex # while slapd being stopped! # Don't forget to fix ownership/permissions of newly generated index files # afterwards! # set always! index objectClass eq # for typical address book use index cn,sn,givenName,mail eq,sub # for user management index uid,uidNumber,gidNumber eq # for authz-regexp mapping of Kerberos principal name #index krbPrincipalName,krbPrincipalAlias eq # for authz-regexp mapping of client cert subject DNs #index seeAlso eq # for syncrepl index entryUUID,entryCSN eq # access control lists (ACLs) for dc=example,dc=com # see slapd.access(5) for details on access control lists (ACLs) # full read access also to 'userPassword' for group of replicas # and control is forwarded to subsequent ACLs access to dn.subtree=dc=example,dc=com by group.base="cn=slapd replicas,ou=groups,dc=example,dc=com" read by * break # write-only access to 'userPassword' for user, auth access else access to attrs=userPassword by self =w by * auth # 'userPKCS' must only be accessible by self access to attrs=userPKCS12 by self write by * none # No access to history of passwords #access to # attrs=pwdHistory # by * none # Catch-all ACL for the rest access to dn.subtree=dc=example,dc=com by group.base="cn=slapd admins,ou=groups,dc=example,dc=com" manage by self read by users read by * auth # see slapo-ppolicy(5) overlay ppolicy # Default password policy entry #ppolicy_default cn=ppolicy-default,ou=policies,dc=example,dc=com # Hash clear-text userPassword values sent in with add/modify operations #ppolicy_hash_cleartext # Return AccountLocked error code to client #ppolicy_use_lockout # see slapo-refint(5) overlay refint refint_attributes member seeAlso refint_nothing cn=dummy # Check sub-tree wide uniqueness of certain attributes # see slapo-unique(5) # you have to add eq-index for efficient uniqueness check! # Note that filter part is currently ignored because of OpenLDAP ITS#6825 overlay unique unique_uri "ldap:///dc=example,dc=com?uid,uidNumber,homeDirectory?sub" unique_uri "ldap:///ou=groups,dc=example,dc=com?cn,gidNumber?sub?(|(objectClass=groupOfNames)(objectClass=posixGroup))" #unique_uri "ldap:///dc=example,dc=com?krbPrincipalName,krbPrincipalAlias?sub" #unique_uri "ldap:///dc=example,dc=com?ipHostNumber?sub" #unique_uri "ldap:///dc=example,dc=com?employeeNumber?sub" #unique_uri "ldap:///dc=example,dc=com?uniqueIdentifier?sub" #overlay syncprov #mirrormode on #--------------------------------------------------------------------------- # cn=monitor // Monitoring database (always last!) # see slapd-monitor(5) #--------------------------------------------------------------------------- database monitor access to dn.subtree="cn=monitor" by dn.exact="cn=root,dc=example,dc=com" write by group.base="cn=slapd admins,ou=groups,dc=example,dc=com" write by users read