slapd.conf - configuration file for slapd, the stand-alone
LDAP daemon
SYNOPSIS
/etc/openldap/slapd.conf
DESCRIPTION
The file /etc/openldap/slapd.conf contains configuration
information for the slapd(8) daemon. This configuration
file is also used by the slurpd(8) replication daemon and
by the SLAPD tools slapadd(8), slapcat(8), and slapin
dex(8).
The slapd.conf file consists of a series of global config
uration options that apply to slapd as a whole (including
all backends), followed by zero or more database backend
definitions that contain information specific to a backend
instance.
The general format of slapd.conf is as follows:
# comment - these options apply to every database
<global configuration options>
# first database definition & configuration options
database <backend 1 type>
<configuration options specific to backend 1>
# subsequent database definitions & configuration options
...
As many backend-specific sections as desired may be
included. Global options can be overridden in a backend
(for options that appear more than once, the last appear
ance in the slapd.conf file is used). Blank lines and
comment lines beginning with a `#' character are ignored.
If a line begins with white space, it is considered a con
tinuation of the previous line.
Arguments on configuration lines are separated by white
space. If an argument contains white space, the argument
should be enclosed in double quotes. If an argument con
tains a double quote (`"') or a backslash character (`\'),
the character should be preceded by a backslash character.
The specific configuration options available are discussed
below in the Global Configuration Options, General Backend
Options, LDBM Backend-Specific Options, Shell Backend-Spe
cific Options, and Password Backend-Specific Options sec
tions. Refer to the "OpenLDAP Administrator's Guide" for
more details on the slapd configuration file.
GLOBAL CONFIGURATION OPTIONS
Options described in this section apply to all backends,
unless specifically overridden in a backend definition.
in brackets <>.
access to <what> [ by <who> <access> <control> ]+
Grant access (specified by <access>) to a set of
entries and/or attributes (specified by <what>) by
one or more requestors (specified by <who>). See
the "OpenLDAP's Administrator's Guide" for details.
allow <features>
Specify a set of features (separated by white
space) to allow (default none). tls_2_anon allows
Start TLS to force session to anonymous status (see
also disallow tls_authc).
argsfile <filename>
The ( absolute ) name of a file that will hold the
slapd server's command line options if started
without the debugging command line option.
attributetype ( <oid> [NAME <name>] [OBSOLETE]
[DESC <description>] [SUP <oid>] [EQUALITY <oid>]
[ORDERING <oid>] [SUBSTR <oid>] [SYNTAX <oidlen>]
[SINGLE-VALUE] [COLLECTIVE] [NO-USER-MODIFICATION]
[USAGE <attributeUsage>] )
Specify an attribute type using the LDAPv3 syntax
defined in RFC 2252. The slapd parser extends the
RFC 2252 definition by allowing string forms as
well as numeric OIDs to be used for the attribute
OID and attribute syntax OID. (See the
objectidentifier description.) Currently the syntax
name parser is case-sensitive. The known syntax
names are:
AttributeTypeDescription Audio
Binary BitString Certificate
CertificateList CertificatePair DN
DeliveryMethod DirectoryString
DITContentRuleDescription
DITStructureRuleDescription
EnhancedGuide
FacsimileTelephoneNumber
GeneralizedTime Guide IA5String
Integer MatchingRuleDescription
MatchingRuleUseDescription
MailPreference NameAndOptionalUUID
NameFormDescription NumericString
ObjectClassDescription OID
OtherMailbox OctetString
PostalAddress ProtocolInformation
PresentationAddress PrintableString
SupportedAlgorithm TelephoneNumber
TeletexTerminalIdentifier
TelexNumber UTCTime
LDAPSyntaxDescription
Bootparameter
concurrency <integer>
Specify a desired level of concurrency. Provided
to the underlying thread system as a hint. The
default is not to provide any hint.
defaultaccess { none | auth | compare | search | read |
write }
Specify the default access level to grant
requestors when no access directives were provided
for the database. The default behavior is to grant
'read' access. It is recommended that access
directives be used instead.
defaultsearchbase <dn>
Specify a default search base to use when client
submits a non-base search request with an empty
base DN.
disallow <features>
Specify a set of features (separated by white
space) to disallow (default none). bind_v2
disables acceptance of LDAPv2 bind requests.
bind_anon disables acceptance of anonymous bind
requests. bind_anon_cred disables anonymous bind
creditials are not empty (e.g. when DN is empty).
bind_anon_dn disables anonymous bind when DN is not
empty. bind_simple disables simple (bind)
authentication. bind_krbv4 disables Kerberos V4
(bind) authentication. tls_authc disables StartTLS
if authenticated (see also allow tls_2_anon).
idletimeout <integer>
Specify the number of seconds to wait before
forcibly closing an idle client connections. A
idletimeout of 0 disables this feature. The
default is 0.
include <filename>
Read additional configuration information from the
given file before continuing with the next line of
the current file.
loglevel <integer>
Specify the level at which debugging statements and
operation statistics should be syslogged (currently
logged to the syslogd(8) LOG_LOCAL4 facility). Log
levels are additive, and available levels are:
1 trace function calls
2 debug packet handling
4 heavy trace debugging
8 connection management
32 search filter processing
64 configuration file processing
128 access control list processing
256 stats log
connections/operations/results
512 stats log entries sent
1024 print communication with shell
backends
2048 entry parsing
objectclass ( <oid> [NAME <name>] [DESC <description]
[OBSOLETE] [SUP <oids>] [{ ABSTRACT | STRUCTURAL |
AUXILIARY }] [MUST <oids>] [MAY <oids>] )
Specify an objectclass using the LDAPv3 syntax
defined in RFC 2252. The slapd parser extends the
RFC 2252 definition by allowing string forms as
well as numeric OIDs to be used for the object
class OID. (See the objectidentifier description.)
Object classes are "STRUCTURAL" by default.
objectidentifier <name> { <oid> | <name>[:<suffix>] }
Define a string name that equates to the given OID.
The string can be used in place of the numeric OID
in objectclass and attribute definitions. The name
can also be used with a suffix of the form ":xx" in
which case the value "oid.xx" will be used.
password-hash <hash>
The <hash> to use for userPassword generation. One
of {SSHA}, {SHA}, {SMD5}, {MD5}, and {CRYPT}. The
default is {SSHA}.
pidfile <filename>
The ( absolute ) name of a file that will hold the
slapd server's process ID ( see getpid(2) ) if
started without the debugging command line option.
referral <url>
Specify the referral to pass back when slapd(8)
cannot find a local database to handle a request.
If specified multiple times, each url is provided.
require <conditions>
Specify a set of conditions (separated by white
space) to require (default none). The directive
may be specified globally and/or per-database.
bind requires bind operation prior to directory
operations. LDAPv3 requires session to be using
LDAP version 3. authc requires authentication
prior to directory operations. SASL requires SASL
authentication prior to directory operations.
strong requires strong authentication prior to
directory operations. Currently SASL and strong
require no conditions (useful for clearly globally
set conditions within a particular database).
sasl-host <fqdn>
Used to specify the fully qualified domain name
used for SASL processing.
sasl-realm <realm>
Specify SASL realm. Default is empty.
sasl-secprops <properties>
Used to specify Cyrus SASL security properties.
The none flag (without any other properities)
causes the flag properites default,
"noanonymous,noplain", to be cleared. The noplain
flag disables mechanisms susceptible to simple
passive attacks. The noactive flag disables
mechanisms susceptible to active attacks. The
nodict flag disables mechanisms susceptible to
passive dictionary attacks. The noanonyous flag
disables mechanisms which support anonymous login.
The forwardsec flag require forward secrecy between
sessions. The passcred require mechanisms which
pass client credentials (and allow mechanisms which
can pass credentials to do so). The
minssf=<factor> property specifies the minimum
acceptable security strength factor as an integer
approximate to effective key length used for
encryption. 0 (zero) implies no protection, 1
implies integrity protection only, 56 allows DES or
other weak ciphers, 112 allows triple DES and other
strong ciphers, 128 allows RC4, Blowfish and other
modern strong ciphers. The default is 0. The
maxssf=<factor> property specifies the maximum
acceptable security strength factor as an integer
(see minssf description). The default is INT_MAX.
The maxbufsize=<size> property specifies the
maximum security layer receive buffer size allowed.
0 disables security layers. The default is 65536.
schemacheck { on | off }
Turn schema checking on or off. The default is on.
security <factors>
Specify a set of factors (separated by white space)
to require. An integer value is associated with
each factor and is roughly equivalent of the
encryption key length to require. A value of 112
is equivalent to 3DES, 128 to Blowfish, etc.. The
directive may be specified globally and/or per-
database. ssf=<n> specifies the overall security
strength factor. transport=<n> specifies the
transport security strength factor. tls=<n>
sasl=<n> specifies the SASL security strength
factor. update_ssf=<n> specifies the overall
security strength factor to require for directory
updates. update_transport=<n> specifies the
transport security strength factor to require for
directory updates. update_tls=<n> specifies the
TLS security strength factor to require for
directory updates. update_sasl=<n> specifies the
SASL security strength factor to require for
directory updates. Note that the transport factor
is measure of security provided by the underlying
transport, e.g. ldapi:// (and eventually IPSEC).
It is not normally used.
sizelimit <integer>
Specify the maximum number of entries to return
from a search operation. The default size limit is
500.
srvtab <filename>
Specify the srvtab file in which the kerberos keys
necessary for authenticating clients using kerberos
can be found. This option is only meaningful if you
are using Kerberos authentication.
schemacheck { on | off }
Turn schema checking on or off. The default is on.
sizelimit <integer>
Specify the maximum number of entries to return
from a search operation. The default size limit is
500.
srvtab <filename>
Specify the srvtab file in which the kerberos keys
necessary for authenticating clients using kerberos
can be found. This option is only meaningful if you
are using Kerberos authentication.
threads <integer>
Specify the maximum size of the primary thread
pool. The default is 32.
timelimit <integer>
Specify the maximum number of seconds (in real
time) slapd will spend answering a search request.
The default time limit is 3600.
TLS OPTIONS
If slapd is build with support for Transport Layer
Security, there are more options you can specify.
Permits configuring what ciphers will be accepted
and the preference order. <cipher-suite-spec>
should be a cipher specification for OpenSSL.
Example:
TLSCipherSuite HIGH:MEDIUM:+SSLv2
To check what ciphers a given spec selects, use:
openssl ciphers -v <cipher-suite-spec>
TLSCertificateFile <filename>
Specifies the file that contains the slapd server
certificate.
TLSCertificateKeyFile <filename>
Specifies the file that contains the slapd server
private key that matches the certificate stored in
the TLSCertificateFile file. Currently, the
private key must not be protected with a password,
so it is of critical importance that it is
protected carefully.
TLSRandFile <filename>
Specifies the file to obtain random bits from when
/dev/[u]random is not available. Generally set to
the name of the EGD/PRNGD socket. The environment
variable RANDFILE can also be used to specify the
filename.
GENERAL BACKEND OPTIONS
Options in this section only apply to the configuration
file section for the backend in which they are defined.
They are supported by every type of backend.
database <databasetype>
Mark the beginning of a new database instance
definition. <databasetype> should be one of ldbm,
shell, or passwd depending on which backend will
serve the database.
lastmod on | off
Controls whether slapd will automatically maintain
the modifiersName, modifyTimestamp, creatorsName,
and createTimestamp attributes for entries. By
default, lastmod is on.
readonly on | off
This option puts the database into "read-only"
mode. Any attempts to modify the database will
return an "unwilling to perform" error. By
default, readonly is off.
bindmethod=simple|sasl [binddn=<simple DN>]
[credentials=<simple password>] [saslmech=<SASL
mech>] [secopts=<options>] [realm=<realm>]
[authcId=<authentication ID>]
[authcId=<authentication ID>]
Specify a replication site for this database.
Refer to the "OpenLDAP Administrator's Guide" for
detailed information on setting up a replicated
slapd directory service. A bindmethod of simple
requires the options binddn and credentials and
should only be used when adequate security services
(e.g TLS or IPSEC) are in place. A bindmethod of
sasl requires the option saslmech. If the
mechanism will use Kerberos, a kerberos instance
should be given in authcId.
replogfile <filename>
Specify the name of the replication log file to log
changes to. The replication log is typically
written by slapd(8) and read by slurpd(8). See
slapd.replog(5) for more information. The
specified file should be located in a directory
with limited read/write/execute access as the
replication logs may contain sensitive information.
rootdn <dn>
Specify the distinguished name that is not subject
to access control or administrative limit
restrictions for operations on this database. This
DN may or may not be associated with an entry. An
empty root DN (the default) specifies no root
access is to be granted. It is recommended that
the rootdn only be specified when needed (such as
when initially populating a database). If the
rootdn is within a namingContext (suffix) of the
database, a simple bind password may also be
provided using the rootpw directive.
rootpw <password>
Specify a password (or hash of the password) for
the rootdn. If the rootdn is not within the
namingContext of the database, the provided
password is ignored. This option accepts all RFC
2307 userPassword formats known to the server (see
password-hash desription) as well as cleartext.
slappasswd(8) may be used to generate a hash of a
password. Cleartext and {CRYPT} passwords are not
recommended. If empty (the default),
authentication of the root DN is by other means
(e.g. SASL). Use of SASL is encouraged.
suffix <dn suffix>
Specify the DN suffix of queries that will be
lines can be given and at least one is required for
each database definition.
updatedn <dn>
This option is only applicable in a slave slapd.
It specifies the DN allowed to make changes to the
replica (typically, this is the DN slurpd(8) binds
as when making changes to the replica).
updateref <url>
Specify the referral to pass back when slapd(8) is
asked to modify a replicated local database. If
specified multiple times, each url is provided.
LDBM BACKEND-SPECIFIC OPTIONS
Options in this category only apply to the LDBM backend
database. That is, they must follow a "database ldbm" line
and come before any subsequent "database" lines. The LDBM
backend is a high-performance database that makes
extensive use of indexing and caching to speed data
access.
cachesize <integer>
Specify the size in entries of the in-memory cache
maintained by the LDBM backend database instance.
The default is 1000 entries.
dbcachesize <integer>
Specify the size in bytes of the in-memory cache
associated with each open index file. If not
supported by the underlying database method, this
option is ignored without comment. The default is
100000 bytes.
dbnolocking
Specify that no database locking should be
performed. Enabling this option may improve
performance at the expense of data security.
dbnosync Specify that on-disk database contents
should not be immediately synchronized with in
memory changes. Enabling this option may improve
performance at the expense of data security.
directory <directory>
Specify the directory where the LDBM files
containing this database and associated indexes
live. A separate directory must be specified for
each database. The default is //var/run/openldap-
ldbm.
index {<attrlist>|default} [pres,eq,approx,sub,<special>]
Specify the indexes to maintain for the given
attribute. If only an <attr> is given, the indices
special index parameters may be specified. The
index type sub can be decomposed into subinitial,
subany, and subfinal indices. The special type
lang may be specified to allow use of this index by
language subtypes. The special type autolang may
be specified to automatically maintain separate
indices for each language subtypes. The special
type subtypes may be specified to allow use of this
index by named subtypes. The special type
autosubtypes may be specified to automatically
maintain separate indices for each other subtypes.
mode <integer>
Specify the file protection mode that newly created
database index files should have. The default is
0600.
SHELL BACKEND-SPECIFIC OPTIONS
Options in this category only apply to the SHELL backend
database. That is, they must follow a "database shell"
line and come before any subsequent "database" lines. The
Shell backend executes external programs to implement
operations, and is designed to make it easy to tie an
existing database to the slapd front-end.
bind <pathname>
unbind <pathname>
search <pathname>
compare <pathname>
modify <pathname>
modrdn <pathname>
add <pathname>
delete <pathname>
abandon <pathname>
These options specify the pathname of the command
to execute in response to the given LDAP operation.
Note that you need only supply configuration lines for
those commands you want the backend to handle. Operations
for which a command is not supplied will be refused with
an "unwilling to perform" error.
PASSWORD BACKEND-SPECIFIC OPTIONS
Options in this category only apply to the PASSWD backend
database. That is, they must follow a "database passwd"
PASSWD database serves up the user account information
listed in the system passwd(5) file.
file <filename>
Specifies an alternate passwd file to use. The
default is /etc/passwd.
EXAMPLE
"OpenLDAP Administrator's Guide" contains an annotated
example of a configuration file.
FILES
/etc/openldap/slapd.conf
SEE ALSO
ldap(3), slapd.replog(5), locale(5), passwd(5), slapd(8),
slapadd(8), slapcat(8), slapindex(8), slappassword(8),
slurpd(8),
"OpenLDAP Administrator's Guide"
(http://www.OpenLDAP.org/doc/admin/)
ACKNOWLEDGEMENTS
OpenLDAP is developed and maintained by The OpenLDAP
Project (http://www.openldap.org/). OpenLDAP is derived
from University of Michigan LDAP 3.3 Release.
Man(1) output converted with
man2html