diff options
Diffstat (limited to '')
| -rw-r--r-- | debian/slapd.conf | 133 | ||||
| -rw-r--r-- | debian/slapd.config | 169 |
2 files changed, 302 insertions, 0 deletions
diff --git a/debian/slapd.conf b/debian/slapd.conf new file mode 100644 index 0000000..260a190 --- /dev/null +++ b/debian/slapd.conf @@ -0,0 +1,133 @@ +# This is the main slapd configuration file. See slapd.conf(5) for more +# info on the configuration options. + +####################################################################### +# Global Directives: + +# Schema and objectClass definitions +include /etc/ldap/schema/core.schema +include /etc/ldap/schema/cosine.schema +include /etc/ldap/schema/nis.schema +include /etc/ldap/schema/inetorgperson.schema + +# Where the pid file is put. The init.d script +# will not stop the server if you change this. +pidfile /var/run/slapd/slapd.pid + +# List of arguments that were passed to the server +argsfile /var/run/slapd/slapd.args + +# Read slapd.conf(5) for possible values +loglevel none + +# Where the dynamically loaded modules are stored +modulepath /usr/lib/ldap +moduleload back_@BACKEND@ + +# The maximum number of entries that is returned for a search operation +sizelimit 500 + +# The tool-threads parameter sets the actual amount of cpu's that is used +# for indexing. +tool-threads 1 + +####################################################################### +# Specific Backend Directives for @BACKEND@: +# Backend specific directives apply to this backend until another +# 'backend' directive occurs +backend @BACKEND@ + +####################################################################### +# Specific Backend Directives for 'other': +# Backend specific directives apply to this backend until another +# 'backend' directive occurs +#backend <other> + +####################################################################### +# Specific Directives for database #1, of type @BACKEND@: +# Database specific directives apply to this databasse until another +# 'database' directive occurs +database @BACKEND@ + +# The base of your directory in database #1 +suffix "@SUFFIX@" + +# rootdn directive for specifying a superuser on the database. This is needed +# for syncrepl. +# rootdn "cn=admin,@SUFFIX@" + +# Where the database file are physically stored for database #1 +directory "/var/lib/ldap" + +# The dbconfig settings are used to generate a DB_CONFIG file the first +# time slapd starts. They do NOT override existing an existing DB_CONFIG +# file. You should therefore change these settings in DB_CONFIG directly +# or remove DB_CONFIG and restart slapd for changes to take effect. + +# For the Debian package we use 2MB as default but be sure to update this +# value if you have plenty of RAM +dbconfig set_cachesize 0 2097152 0 + +# Sven Hartge reported that he had to set this value incredibly high +# to get slapd running at all. See http://bugs.debian.org/303057 for more +# information. + +# Number of objects that can be locked at the same time. +dbconfig set_lk_max_objects 1500 +# Number of locks (both requested and granted) +dbconfig set_lk_max_locks 1500 +# Number of lockers +dbconfig set_lk_max_lockers 1500 + +# Indexing options for database #1 +index objectClass eq + +# Save the time that the entry gets modified, for database #1 +lastmod on + +# Checkpoint the BerkeleyDB database periodically in case of system +# failure and to speed slapd shutdown. +checkpoint 512 30 + +# The userPassword by default can be changed +# by the entry owning it if they are authenticated. +# Others should not be able to see it, except the +# admin entry below +# These access lines apply to database #1 only +access to attrs=userPassword,shadowLastChange + by dn="@ADMIN@" write + by anonymous auth + by self write + by * none + +# Ensure read access to the base for things like +# supportedSASLMechanisms. Without this you may +# have problems with SASL not knowing what +# mechanisms are available and the like. +# Note that this is covered by the 'access to *' +# ACL below too but if you change that as people +# are wont to do you'll still need this if you +# want SASL (and possible other things) to work +# happily. +access to dn.base="" by * read + +# The admin dn has full write access, everyone else +# can read everything. +access to * + by dn="@ADMIN@" write + by * read + +# For Netscape Roaming support, each user gets a roaming +# profile for which they have write access to +#access to dn=".*,ou=Roaming,o=morsnet" +# by dn="@ADMIN@" write +# by dnattr=owner write + +####################################################################### +# Specific Directives for database #2, of type 'other' (can be @BACKEND@ too): +# Database specific directives apply to this databasse until another +# 'database' directive occurs +#database <other> + +# The base of your directory for database #2 +#suffix "dc=debian,dc=org" diff --git a/debian/slapd.config b/debian/slapd.config new file mode 100644 index 0000000..8225b77 --- /dev/null +++ b/debian/slapd.config @@ -0,0 +1,169 @@ +#! /bin/sh + +set -e + +# Load debconf +. /usr/share/debconf/confmodule + +# This will be replaced with debian/slapd.scripts-common which includes +# various helper functions and $OLD_VERSION and $SLAPD_CONF +#SCRIPTSCOMMON# + +# Check if the user wants to configure slapd manually +want_manual_configuration() { + db_input medium slapd/no_configuration || true + db_go || true + db_get slapd/no_configuration + no_configuration="$RET" + + if [ "$no_configuration" = "true" ]; then + return 0 + fi + return 1 +} + +# Make sure the values entered make sense +validate_initial_config() { + local invalid + invalid="" + + # Make sure the domain name is valid + # The regexp doesn't work for UTF-8 domain names, but for that to + # work, we would also need to Base64 encode it in the LDIF; since + # we're not doing it at the moment, this should be fine for now + db_get slapd/domain + if [ -z "$RET" ] || ! echo "$RET" | grep -q '^[a-zA-Z0-9.-]*$'; then + db_fset slapd/domain seen false + invalid=true + fi + + # Suffix and Organization may not be empty + db_get shared/organization + if [ -z "$RET" ]; then + db_fset shared/organization seen false + invalid=true + fi + + # Make sure the passwords match + local pass1 pass2 + db_get slapd/password1 + pass1="$RET" + db_get slapd/password2 + pass2="$RET" + + if [ "$pass1" != "$pass2" ]; then + db_fset slapd/password1 seen false + db_fset slapd/password2 seen false + invalid=true + fi + + # Tell the user + if [ "$invalid" ]; then + db_fset slapd/invalid_config seen false + db_input critical slapd/invalid_config || true + db_go || true + db_get slapd/invalid_config + if [ "$RET" != "true" ]; then + db_set slapd/no_configuration true + invalid= + fi + fi + + if [ "$invalid" ]; then + return 1 + else + return 0 + fi +} + +# Query the information we need to create an initial directory +query_initial_config() { + while true; do + db_input medium slapd/domain || true + db_input medium shared/organization || true + db_input high slapd/password1 || true + db_input high slapd/password2 || true + db_input low slapd/backend || true + db_input low slapd/purge_database || true + # XXX - should be done more general, but for now this should do + # the trick + if [ -e "/var/lib/ldap" ] && ! is_empty_dir /var/lib/ldap; then + db_input low slapd/move_old_database || true + fi + db_go || true + + if validate_initial_config; then + break + fi + done +} + +# ----- Configuration of LDIF dumping and reloading--------------------- {{{ +# +# Dumping the database can have negative effects on the system we are +# running on. If there is a lot of data dumping it might fill a partition +# for example. Therefore we must give the user exact control over what we +# are doing. + +configure_dumping() { # {{{ +# Ask the user for the configuration of the dumping component +# Usage: configure_dumping + + # Look if the user wants to migrate to the BDB backend + if ! database_dumping_enabled; then + return 0 + fi + + # Configure if and where to dump the LDAP databases + db_input medium slapd/dump_database || true + db_go || true + db_get slapd/dump_database + + # Abort if the user does not want dumping + if [ "$RET" = never ]; then + return 0 + fi + + db_input medium slapd/dump_database_destdir || true + db_go || true + + # If the user entered the empty value, go back to the default + db_get slapd/dump_database_destdir + if [ "$RET" = "" ]; then + db_reset slapd/dump_database_destdir + fi +} + +# }}} +# }}} + +warn_about_selfwrite_acl() { # {{{ +# Warn about databases having an acl beginning with "to * by self +# write", installed by default in previous versions of slapd.init.ldif +# but having possible security implications. + if [ -d "$SLAPD_CONF" ]; then + if grep -q '^olcAccess: {[0-9]*}to \* by self write' \ + "$SLAPD_CONF"/cn\=config/olcDatabase*.ldif 2>/dev/null; then + db_input high slapd/unsafe_selfwrite_acl || true + fi + fi +} +# }}} + +# Create an initial directory on fresh install +if is_initial_configuration "$@"; then + if ! want_manual_configuration; then + set_defaults_for_unseen_entries + query_initial_config + fi +fi + +# Configure the dumping component if we are upgrading some older version. +if [ "$1" = configure ] && [ -n "$2" ]; then + configure_dumping + warn_about_selfwrite_acl +fi + +db_go || true + +exit 0 |