forked from infra/ansible
180 lines
4.8 KiB
Django/Jinja
180 lines
4.8 KiB
Django/Jinja
#
|
|
# See slapd.conf(5) for details on configuration options.
|
|
# This file should NOT be world readable.
|
|
#
|
|
|
|
#######################################################################
|
|
# Schemas
|
|
#######################################################################
|
|
|
|
include /etc/ldap/schema/core.schema
|
|
include /etc/ldap/schema/cosine.schema
|
|
include /etc/ldap/schema/inetorgperson.schema
|
|
include /etc/ldap/schema/kitchen.schema
|
|
include /etc/ldap/schema/misc.schema
|
|
include /etc/ldap/schema/namedobject.schema
|
|
include /etc/ldap/schema/nis.schema
|
|
include /etc/ldap/schema/openssh-lpk.schema
|
|
include /etc/ldap/schema/radius.schema
|
|
include /etc/ldap/schema/samba.schema
|
|
|
|
|
|
#######################################################################
|
|
# Files, logging, modules
|
|
#######################################################################
|
|
|
|
pidfile /var/run/slapd/slapd.pid
|
|
argsfile /var/run/slapd/slapd.args
|
|
|
|
#loglevel stats sync
|
|
loglevel sync
|
|
|
|
# Load dynamic backend modules:
|
|
modulepath /usr/lib/ldap
|
|
moduleload back_mdb.la
|
|
moduleload ppolicy.la
|
|
{% if slapd_role == 'master' %}
|
|
moduleload syncprov.la
|
|
{% endif %}
|
|
|
|
# Sample security restrictions
|
|
# Require integrity protection (prevent hijacking)
|
|
# Require 112-bit (3DES or better) encryption for updates
|
|
# Require 63-bit encryption for simple bind
|
|
# security ssf=1 update_ssf=112 simple_bind=64
|
|
|
|
|
|
#######################################################################
|
|
# ACL
|
|
#######################################################################
|
|
|
|
access to dn.base=""
|
|
by * read
|
|
access to dn.base="cn=Subschema"
|
|
by * read
|
|
access to dn.one="ou=people,dc=binary-kitchen,dc=de" attrs=userPassword
|
|
by self write
|
|
by group="cn=admin,dc=binary-kitchen,dc=de" write
|
|
by anonymous auth
|
|
by * none
|
|
access to dn.one="ou=people,dc=binary-kitchen,dc=de" attrs=loginShell
|
|
by self write
|
|
by group="cn=admin,dc=binary-kitchen,dc=de" write
|
|
by users read
|
|
by * none
|
|
access to dn.sub="ou=people,dc=binary-kitchen,dc=de"
|
|
by group="cn=admin,dc=binary-kitchen,dc=de" write
|
|
by self read
|
|
by users read
|
|
by * none
|
|
access to dn.one="ou=groups,dc=binary-kitchen,dc=de" attrs=memberUid
|
|
by group="cn=admin,dc=binary-kitchen,dc=de" write
|
|
by self read
|
|
by users read
|
|
by * none
|
|
access to attrs=userPassword
|
|
by self write
|
|
by anonymous auth
|
|
by * none
|
|
access to attrs=loginShell
|
|
by self write
|
|
by users read
|
|
by * none
|
|
access to *
|
|
by self read
|
|
by users read
|
|
by * none
|
|
|
|
|
|
#######################################################################
|
|
# TLS
|
|
#######################################################################
|
|
|
|
TLSCertificateFile /etc/ldap/ssl/srv.crt
|
|
TLSCertificateKeyFile /etc/ldap/ssl/srv.key
|
|
TLSCACertificateFile /etc/ssl/certs/ca-certificates.crt
|
|
TLSCACertificatePath /etc/ssl/certs
|
|
TLSCipherSuite NORMAL
|
|
TLSVerifyClient never
|
|
|
|
|
|
#######################################################################
|
|
# MDB database definitions
|
|
#######################################################################
|
|
|
|
database mdb
|
|
suffix "{{ ldap_base }}"
|
|
# <kbyte> <min>
|
|
checkpoint 32 30
|
|
rootdn "cn=Manager,dc=binary-kitchen,dc=de"
|
|
rootpw {{ slapd_root_hash }}
|
|
# The database directory MUST exist prior to running slapd AND
|
|
# should only be accessible by the slapd and slap tools.
|
|
# Mode 700 recommended.
|
|
directory /var/lib/ldap
|
|
|
|
|
|
#######################################################################
|
|
# Indices
|
|
#######################################################################
|
|
|
|
index objectClass eq
|
|
|
|
# Replication related
|
|
index entryCSN eq
|
|
index entryUUID eq
|
|
|
|
# Posix Users/Groups
|
|
index cn eq
|
|
index gidNumber eq
|
|
index memberUid eq
|
|
index uid eq
|
|
index uidNumber eq
|
|
|
|
# Mail
|
|
index mail eq
|
|
index mailAlternateAddress eq
|
|
|
|
|
|
#######################################################################
|
|
# Password Policies
|
|
#######################################################################
|
|
|
|
overlay ppolicy
|
|
ppolicy_default "cn=pp-default,ou=policies,dc=binary-kitchen,dc=de"
|
|
|
|
|
|
{% if slapd_role == 'master' %}
|
|
#######################################################################
|
|
# Replication
|
|
#######################################################################
|
|
|
|
overlay syncprov
|
|
syncprov-checkpoint 10 1
|
|
syncprov-sessionlog 100
|
|
|
|
|
|
#######################################################################
|
|
# Samba Password Sync
|
|
#######################################################################
|
|
|
|
moduleload smbk5pwd.so
|
|
overlay smbk5pwd
|
|
smbk5pwd-enable samba
|
|
smbk5pwd-must-change 0
|
|
{% elif slapd_role == 'slave' %}
|
|
#######################################################################
|
|
# Replication Consumer
|
|
#######################################################################
|
|
|
|
syncrepl rid={{ slapd_replica_id }}
|
|
provider="ldaps://ldapm.binary.kitchen"
|
|
searchbase="{{ ldap_base }}"
|
|
type=refreshAndPersist
|
|
retry="5 10 30 +"
|
|
binddn="cn=Manager,dc=binary-kitchen,dc=de"
|
|
bindmethod=simple
|
|
credentials="{{ slapd_root_pass }}"
|
|
tls_reqcert=demand
|
|
{% endif %}
|