title: A sample slapd.conf link: https://onemoretech.wordpress.com/2004/08/02/a-sample-slapdconf/ author: lembobro description: post_id: 765 created: 2004/08/02 10:58:00 created_gmt: 2004/08/02 10:58:00 comment_status: open post_name: a-sample-slapdconf status: publish post_type: post

A sample slapd.conf

This is a sample slapd.conf for those who might be interested in a bdb back-end, monitor, some basic access controls and indexes (Note: the stock stylesheet that I use on this site cuts off some of the line ends unless you maximize your browser):

`

include  /usr/local/etc/openldap/schema/core.schema
include  /usr/local/etc/openldap/schema/cosine.schema
include  /usr/local/etc/openldap/schema/inetorgperson.schema
include  /usr/local/etc/openldap/schema/nis.schema
include  /usr/local/etc/openldap/schema/samba.schema
# Define global ACLs to disable default read access.
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org
pidfile  /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
# Load dynamic backend modules:
# modulepath /usr/local/libexec/openldap
# moduleload back_bdb.la
# moduleload back_ldap.la
# moduleload back_ldbm.la
# moduleload back_passwd.la
# moduleload back_shell.la
# Sample security restrictions# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
# Sample access control policy:# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:#  Allow self write access
#  Allow authenticated users read access
#  Allow anonymous users to authenticate
# Directives needed to implement policy:
## if no access controls are present, the default policy is:
# Allow read by all
# rootdn can always write!
# Custom access controls - created 12/31/03 by P Lembo
# Read access to root dse by all
access to dn=”"
by * read
# Access by all to schema
access to dn.base=”cn=subschema”
by * read
# Access to monitor by all
access to dn.base=”cn=monitor”
by * read
# Limited access to password
access to attr=userpassword
by group/groupofuniquenames/uniquemember=”cn=Administrators,
dc=company,dc=com” write
by self write
by users auth
 by anonymous auth
# Limited access to Posix account attributes
access to attr=uidnumber,gidnumber,homedirectory,loginshell,gecos
by group/groupofuniquenames/uniquemember=”cn=Administrators,
dc=company,dc=com” write
by self read
# Limited access to Samba account attributes
access to attr=lmpassword,ntpassword,pwdlastset,acctflags,logontime,
logofftime,kickofftime,pwdcanchange,pwdmustchange,smbhome,homedrive,
profilepath,userworkstations,primarygroupid,rid
     by group/groupofuniquenames/uniquemember=”cn=Administrators,
dc=company,dc=com” write
     by self read
# User access to organizational attributes
access to attr=o,ou,c,description,uniquemember
     by group/groupofuniquenames/uniquemember=”cn=Administrators,
dc=company,dc=com” write
     by users read
# Access to public attributes by all
    access to attr=uid,c,title
    by group/groupofuniquenames/uniquemember=”cn=Administrators,
dc=company,dc=com” write
    by users read
    by anonymous read
# Self write access to public attributes
access to attr=cn,displayname,sn,givenname,mail,telephonenumber,
facsimiletelephonenumber
    by group/groupofuniquenames/uniquemember=”cn=Administrators,
dc=company,dc=com” write
    by self write
     by users read
    by anonymous read
# Self write and limited access to private attributes
access to attr=homephone
     by group/groupofuniquenames/uniquemember=”cn=Administrators,
dc=company,dc=com” write
    by self write
    by users read
# Self write and read access to all other attributes
access to *
     by group/groupofuniquenames/uniquemember=”cn=Administrators,
dc=company,dc=com” write
    by self write
    by users read
    by anonymous read
    password-hash {SHA}
    allow bind_v2
    sizelimit   200
    timelimit   120
# TLS/SSL directives
TLSCertificateFile /usr/local/etc/openldap/newcert.pem
TLSCertificateKeyFile /usr/local/etc/openldap/newkey.pem
TLSCACertificateFile /usr/local/etc/openldap/newca.pem
##########################################
 # ldbm database definitions
##########################################
 # Monitor backend
database        monitor
# User database
database bdb
suffix  “dc=company,dc=com”
rootdn  “cn=Manager,dc=company,dc=com”
# Cleartext passwords, especially for the rootdn, should
# be avoided.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw  {SHA}xxxxxxxxxxxxxxxxxxxxxxxx
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/db/openldap-data
# Cache directives
cachesize    2000
idlcachesize 4000
# Indices to maintain
index objectclass eq
index cn  eq,pres,sub
index sn  eq,pres,sub
index givenname eq,pres,sub
index mail  eq,pres,sub
index c  eq,pres
index uid  eq,pres
index displayname  eq,pres,sub
index uidnumber  eq
index gidnumber  eq
index memberuid  eq
# Samba v2 schema attribs
index rid  eq
# Samba v3 schema attributes
# index sambasid eq
# index sambaprimarygroupsid eq
# index sambadomainname eq

`

Copyright 2004-2019 Phil Lembo