From 8daa83a594a2e98f39d764422bfbdbc62c9efd44 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 19:20:00 +0200 Subject: Adding upstream version 2:4.20.0+dfsg. Signed-off-by: Daniel Baumann --- .../smbdotconf/ldap/clientldapsaslwrapping.xml | 41 ++++++++++ docs-xml/smbdotconf/ldap/ldapadmindn.xml | 20 +++++ docs-xml/smbdotconf/ldap/ldapconnectiontimeout.xml | 21 +++++ docs-xml/smbdotconf/ldap/ldapdeletedn.xml | 13 ++++ docs-xml/smbdotconf/ldap/ldapderef.xml | 23 ++++++ docs-xml/smbdotconf/ldap/ldapfollowreferral.xml | 23 ++++++ docs-xml/smbdotconf/ldap/ldapgroupsuffix.xml | 16 ++++ docs-xml/smbdotconf/ldap/ldapidmapsuffix.xml | 15 ++++ docs-xml/smbdotconf/ldap/ldapmachinesuffix.xml | 17 ++++ docs-xml/smbdotconf/ldap/ldapmaxanonrequest.xml | 18 +++++ docs-xml/smbdotconf/ldap/ldapmaxauthrequest.xml | 18 +++++ docs-xml/smbdotconf/ldap/ldapmaxsearchrequest.xml | 18 +++++ docs-xml/smbdotconf/ldap/ldappagesize.xml | 17 ++++ docs-xml/smbdotconf/ldap/ldappasswdsync.xml | 38 +++++++++ docs-xml/smbdotconf/ldap/ldapreplicationsleep.xml | 24 ++++++ docs-xml/smbdotconf/ldap/ldapsameditposix.xml | 91 ++++++++++++++++++++++ docs-xml/smbdotconf/ldap/ldapsamtrusted.xml | 29 +++++++ .../ldap/ldapserverrequirestrongauth.xml | 26 +++++++ docs-xml/smbdotconf/ldap/ldapssl.xml | 42 ++++++++++ docs-xml/smbdotconf/ldap/ldapsuffix.xml | 17 ++++ docs-xml/smbdotconf/ldap/ldaptimeout.xml | 11 +++ docs-xml/smbdotconf/ldap/ldapusersuffix.xml | 16 ++++ 22 files changed, 554 insertions(+) create mode 100644 docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapadmindn.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapconnectiontimeout.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapdeletedn.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapderef.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapfollowreferral.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapgroupsuffix.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapidmapsuffix.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapmachinesuffix.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapmaxanonrequest.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapmaxauthrequest.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapmaxsearchrequest.xml create mode 100644 docs-xml/smbdotconf/ldap/ldappagesize.xml create mode 100644 docs-xml/smbdotconf/ldap/ldappasswdsync.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapreplicationsleep.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapsameditposix.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapsamtrusted.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapserverrequirestrongauth.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapssl.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapsuffix.xml create mode 100644 docs-xml/smbdotconf/ldap/ldaptimeout.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapusersuffix.xml (limited to 'docs-xml/smbdotconf/ldap') diff --git a/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml b/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml new file mode 100644 index 0000000..21bd209 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml @@ -0,0 +1,41 @@ + + + + The defines whether + ldap traffic will be signed or signed and encrypted (sealed). + Possible values are plain, sign + and seal. + + + + The values sign and seal are + only available if Samba has been compiled against a modern + OpenLDAP version (2.3.x or higher). + + + + This option is needed firstly to secure the privacy of + administrative connections from samba-tool, + including in particular new or reset passwords for users. For + this reason the default is seal. + + Additionally, winbindd and the + net tool can use LDAP to communicate with + Domain Controllers, so this option also controls the level of + privacy for those connections. All supported AD DC versions + will enforce the usage of at least signed LDAP connections by + default, so a value of at least sign is + required in practice. + + + + The default value is seal. That implies synchronizing the time + with the KDC in the case of using Kerberos. + + +seal + diff --git a/docs-xml/smbdotconf/ldap/ldapadmindn.xml b/docs-xml/smbdotconf/ldap/ldapadmindn.xml new file mode 100644 index 0000000..1f3d20f --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapadmindn.xml @@ -0,0 +1,20 @@ + + + + + The defines the Distinguished Name (DN) name used by Samba to contact + the ldap server when retrieving user account information. The is used + in conjunction with the admin dn password stored in the private/secrets.tdb + file. See the smbpasswd 8 + man page for more information on how to accomplish this. + + + + The requires a fully specified DN. The is not appended to the . + + + diff --git a/docs-xml/smbdotconf/ldap/ldapconnectiontimeout.xml b/docs-xml/smbdotconf/ldap/ldapconnectiontimeout.xml new file mode 100644 index 0000000..b176897 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapconnectiontimeout.xml @@ -0,0 +1,21 @@ + + + + This parameter tells the LDAP library calls which timeout in seconds + they should honor during initial connection establishments to LDAP servers. + It is very useful in failover scenarios in particular. If one or more LDAP + servers are not reachable at all, we do not have to wait until TCP + timeouts are over. This feature must be supported by your LDAP library. + + + + This parameter is different from + which affects operations on LDAP servers using an existing connection + and not establishing an initial connection. + + +2 + diff --git a/docs-xml/smbdotconf/ldap/ldapdeletedn.xml b/docs-xml/smbdotconf/ldap/ldapdeletedn.xml new file mode 100644 index 0000000..47ffad8 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapdeletedn.xml @@ -0,0 +1,13 @@ + + + This parameter specifies whether a delete + operation in the ldapsam deletes the complete entry or only the attributes + specific to Samba. + + + +no + diff --git a/docs-xml/smbdotconf/ldap/ldapderef.xml b/docs-xml/smbdotconf/ldap/ldapderef.xml new file mode 100644 index 0000000..920d1ae --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapderef.xml @@ -0,0 +1,23 @@ + + + + + This option controls whether Samba should tell the LDAP library + to use a certain alias dereferencing method. The default is + auto, which means that the default setting of the + ldap client library will be kept. Other possible values are + never, finding, + searching and always. Grab + your LDAP manual for more information. + + + + +auto +searching + + diff --git a/docs-xml/smbdotconf/ldap/ldapfollowreferral.xml b/docs-xml/smbdotconf/ldap/ldapfollowreferral.xml new file mode 100644 index 0000000..3130a7b --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapfollowreferral.xml @@ -0,0 +1,23 @@ + + + + + This option controls whether to follow LDAP referrals or not when + searching for entries in the LDAP database. Possible values are + on to enable following referrals, + off to disable this, and + auto, to use the libldap default settings. + libldap's choice of following referrals or not is set in + /etc/openldap/ldap.conf with the REFERRALS parameter as documented in + ldap.conf(5). + + + +auto +off + + diff --git a/docs-xml/smbdotconf/ldap/ldapgroupsuffix.xml b/docs-xml/smbdotconf/ldap/ldapgroupsuffix.xml new file mode 100644 index 0000000..f11b5d5 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapgroupsuffix.xml @@ -0,0 +1,16 @@ + + + This parameter specifies the suffix that is + used for groups when these are added to the LDAP directory. + If this parameter is unset, the value of will be used instead. The suffix string is prepended to the + string so use a partial DN. + + + +ou=Groups + diff --git a/docs-xml/smbdotconf/ldap/ldapidmapsuffix.xml b/docs-xml/smbdotconf/ldap/ldapidmapsuffix.xml new file mode 100644 index 0000000..e20e962 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapidmapsuffix.xml @@ -0,0 +1,15 @@ + + + + This parameters specifies the suffix that is used when storing idmap mappings. If this parameter + is unset, the value of will be used instead. The suffix + string is prepended to the string so use a partial DN. + + + +ou=Idmap + diff --git a/docs-xml/smbdotconf/ldap/ldapmachinesuffix.xml b/docs-xml/smbdotconf/ldap/ldapmachinesuffix.xml new file mode 100644 index 0000000..d3310ed --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapmachinesuffix.xml @@ -0,0 +1,17 @@ + + + + + It specifies where machines should be added to the ldap tree. If this parameter is unset, the value of + will be used instead. The suffix string is prepended to the + string so use a partial DN. + + + + +ou=Computers + diff --git a/docs-xml/smbdotconf/ldap/ldapmaxanonrequest.xml b/docs-xml/smbdotconf/ldap/ldapmaxanonrequest.xml new file mode 100644 index 0000000..61bdcec --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapmaxanonrequest.xml @@ -0,0 +1,18 @@ + + + + This parameter specifies the maximum permitted size (in bytes) + for an LDAP request received on an anonymous connection. + + + + If the request size exceeds this limit the request will be + rejected. + + +256000 +500000 + diff --git a/docs-xml/smbdotconf/ldap/ldapmaxauthrequest.xml b/docs-xml/smbdotconf/ldap/ldapmaxauthrequest.xml new file mode 100644 index 0000000..c5934f7 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapmaxauthrequest.xml @@ -0,0 +1,18 @@ + + + + This parameter specifies the maximum permitted size (in bytes) + for an LDAP request received on an authenticated connection. + + + + If the request size exceeds this limit the request will be + rejected. + + +16777216 +4194304 + diff --git a/docs-xml/smbdotconf/ldap/ldapmaxsearchrequest.xml b/docs-xml/smbdotconf/ldap/ldapmaxsearchrequest.xml new file mode 100644 index 0000000..ebeb081 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapmaxsearchrequest.xml @@ -0,0 +1,18 @@ + + + + This parameter specifies the maximum permitted size (in bytes) + for an LDAP search request. + + + + If the request size exceeds this limit the request will be + rejected. + + +256000 +4194304 + diff --git a/docs-xml/smbdotconf/ldap/ldappagesize.xml b/docs-xml/smbdotconf/ldap/ldappagesize.xml new file mode 100644 index 0000000..577ea2a --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldappagesize.xml @@ -0,0 +1,17 @@ + + + + This parameter specifies the number of entries per page. + + + If the LDAP server supports paged results, clients can + request subsets of search results (pages) instead of the entire list. + This parameter specifies the size of these pages. + + +1000 +512 + diff --git a/docs-xml/smbdotconf/ldap/ldappasswdsync.xml b/docs-xml/smbdotconf/ldap/ldappasswdsync.xml new file mode 100644 index 0000000..42bc916 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldappasswdsync.xml @@ -0,0 +1,38 @@ + + +ldap password sync + + + This option is used to define whether or not Samba should sync the LDAP password with the NT + and LM hashes for normal accounts (NOT for workstation, server or domain trusts) on a password + change via SAMBA. + + + + The can be set to one of three values: + + + + + Yes = Try + to update the LDAP, NT and LM passwords and update the pwdLastSet time. + + + + No = Update NT and + LM passwords and update the pwdLastSet time. + + + + Only = Only update + the LDAP password and let the LDAP server do the rest. + + + + +no + diff --git a/docs-xml/smbdotconf/ldap/ldapreplicationsleep.xml b/docs-xml/smbdotconf/ldap/ldapreplicationsleep.xml new file mode 100644 index 0000000..059c77e --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapreplicationsleep.xml @@ -0,0 +1,24 @@ + + + + When Samba is asked to write to a read-only LDAP replica, we are redirected to talk to the read-write master server. + This server then replicates our changes back to the 'local' server, however the replication might take some seconds, + especially over slow links. Certain client activities, particularly domain joins, can become confused by the 'success' + that does not immediately change the LDAP back-end's data. + + + + This option simply causes Samba to wait a short time, to allow the LDAP server to catch up. If you have a particularly + high-latency network, you may wish to time the LDAP replication with a network sniffer, and increase this value accordingly. + Be aware that no checking is performed that the data has actually replicated. + + + + The value is specified in milliseconds, the maximum value is 5000 (5 seconds). + + +1000 + diff --git a/docs-xml/smbdotconf/ldap/ldapsameditposix.xml b/docs-xml/smbdotconf/ldap/ldapsameditposix.xml new file mode 100644 index 0000000..e7f36e6 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapsameditposix.xml @@ -0,0 +1,91 @@ + + + + + Editposix is an option that leverages ldapsam:trusted to make it simpler to manage a domain controller + eliminating the need to set up custom scripts to add and manage the posix users and groups. This option + will instead directly manipulate the ldap tree to create, remove and modify user and group entries. + This option also requires a running winbindd as it is used to allocate new uids/gids on user/group + creation. The allocation range must be therefore configured. + + + + To use this option, a basic ldap tree must be provided and the ldap suffix parameters must be properly + configured. On virgin servers the default users and groups (Administrator, Guest, Domain Users, + Domain Admins, Domain Guests) can be precreated with the command net sam + provision. To run this command the ldap server must be running, Winbindd must be running and + the smb.conf ldap options must be properly configured. + + The typical ldap setup used with the yes option + is usually sufficient to use yes as well. + + + + An example configuration can be the following: + + + encrypt passwords = true + passdb backend = ldapsam + + ldapsam:trusted=yes + ldapsam:editposix=yes + + ldap admin dn = cn=admin,dc=samba,dc=org + ldap delete dn = yes + ldap group suffix = ou=groups + ldap idmap suffix = ou=idmap + ldap machine suffix = ou=computers + ldap user suffix = ou=users + ldap suffix = dc=samba,dc=org + + idmap backend = ldap:"ldap://localhost" + + idmap uid = 5000-50000 + idmap gid = 5000-50000 + + + This configuration assumes a directory layout like described in the following ldif: + + + dn: dc=samba,dc=org + objectClass: top + objectClass: dcObject + objectClass: organization + o: samba.org + dc: samba + + dn: cn=admin,dc=samba,dc=org + objectClass: simpleSecurityObject + objectClass: organizationalRole + cn: admin + description: LDAP administrator + userPassword: secret + + dn: ou=users,dc=samba,dc=org + objectClass: top + objectClass: organizationalUnit + ou: users + + dn: ou=groups,dc=samba,dc=org + objectClass: top + objectClass: organizationalUnit + ou: groups + + dn: ou=idmap,dc=samba,dc=org + objectClass: top + objectClass: organizationalUnit + ou: idmap + + dn: ou=computers,dc=samba,dc=org + objectClass: top + objectClass: organizationalUnit + ou: computers + + + + +no + diff --git a/docs-xml/smbdotconf/ldap/ldapsamtrusted.xml b/docs-xml/smbdotconf/ldap/ldapsamtrusted.xml new file mode 100644 index 0000000..1d593e6 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapsamtrusted.xml @@ -0,0 +1,29 @@ + + + + + By default, Samba as a Domain Controller with an LDAP backend needs to use the Unix-style NSS subsystem to + access user and group information. Due to the way Unix stores user information in /etc/passwd and /etc/group + this inevitably leads to inefficiencies. One important question a user needs to know is the list of groups he + is member of. The plain UNIX model involves a complete enumeration of the file /etc/group and its NSS + counterparts in LDAP. UNIX has optimized functions to enumerate group membership. Sadly, other functions that + are used to deal with user and group attributes lack such optimization. + + + + To make Samba scale well in large environments, the yes + option assumes that the complete user and group database that is relevant to Samba is stored in LDAP with the + standard posixAccount/posixGroup attributes. It further assumes that the Samba auxiliary object classes are + stored together with the POSIX data in the same LDAP object. If these assumptions are met, + yes can be activated and Samba can bypass the + NSS system to query user group memberships. Optimized LDAP queries can greatly speed up domain logon and + administration tasks. Depending on the size of the LDAP database a factor of 100 or more for common queries + is easily achieved. + + + +no + diff --git a/docs-xml/smbdotconf/ldap/ldapserverrequirestrongauth.xml b/docs-xml/smbdotconf/ldap/ldapserverrequirestrongauth.xml new file mode 100644 index 0000000..02bdd81 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapserverrequirestrongauth.xml @@ -0,0 +1,26 @@ + + + + The defines whether + the ldap server requires ldap traffic to be signed or signed and encrypted (sealed). + Possible values are no, allow_sasl_over_tls + and yes. + + + A value of no allows simple and sasl binds over + all transports. + + A value of allow_sasl_over_tls allows simple and sasl binds + (without sign or seal) over TLS encrypted connections. Unencrypted connections only + allow sasl binds with sign or seal. + + A value of yes allows only simple binds + over TLS encrypted connections. Unencrypted connections only + allow sasl binds with sign or seal. + +yes + diff --git a/docs-xml/smbdotconf/ldap/ldapssl.xml b/docs-xml/smbdotconf/ldap/ldapssl.xml new file mode 100644 index 0000000..5fe67b1 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapssl.xml @@ -0,0 +1,42 @@ + + + This option is used to define whether or not Samba should + use SSL when connecting to the ldap server + This is NOT related to + Samba's previous SSL support which was enabled by specifying the + --with-ssl option to the + configure + script. + + LDAP connections should be secured where possible. This may be + done setting either this parameter to + start tls + or by specifying ldaps:// in + the URL argument of . + + The can be set to one of + two values: + + + Off = Never + use SSL when querying the directory. + + + + start tls = Use + the LDAPv3 StartTLS extended operation (RFC2830) for + communicating with the directory server. + + + + Please note that this parameter does only affect rpc + methods. + + + +start tls + diff --git a/docs-xml/smbdotconf/ldap/ldapsuffix.xml b/docs-xml/smbdotconf/ldap/ldapsuffix.xml new file mode 100644 index 0000000..aeff0dd --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapsuffix.xml @@ -0,0 +1,17 @@ + + + Specifies the base for all ldap suffixes and for storing the sambaDomain object. + + + The ldap suffix will be appended to the values specified for the , + , , and the + . Each of these should be given only a DN relative to the + . + + + +dc=samba,dc=org + diff --git a/docs-xml/smbdotconf/ldap/ldaptimeout.xml b/docs-xml/smbdotconf/ldap/ldaptimeout.xml new file mode 100644 index 0000000..f421eeb --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldaptimeout.xml @@ -0,0 +1,11 @@ + + + + This parameter defines the number of seconds that Samba should use as timeout for LDAP operations. + + +15 + diff --git a/docs-xml/smbdotconf/ldap/ldapusersuffix.xml b/docs-xml/smbdotconf/ldap/ldapusersuffix.xml new file mode 100644 index 0000000..c8455e4 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapusersuffix.xml @@ -0,0 +1,16 @@ + + + + This parameter specifies where users are added to the tree. If this parameter is unset, + the value of will be used instead. The suffix + string is prepended to the string so use a partial DN. + + + + +ou=people + -- cgit v1.2.3