mirror of
https://git.openldap.org/openldap/openldap.git
synced 2024-12-21 03:10:25 +08:00
146 lines
4.8 KiB
Groff
146 lines
4.8 KiB
Groff
.TH LDAP.CONF 5 "20 August 2000" "OpenLDAP LDVERSION"
|
|
.\" $OpenLDAP$
|
|
.\" Copyright 1998-2002 The OpenLDAP Foundation All Rights Reserved.
|
|
.\" Copying restrictions apply. See COPYRIGHT/LICENSE.
|
|
.UC 6
|
|
.SH NAME
|
|
ldap.conf, .ldaprc \- ldap configuration file
|
|
.SH SYNOPSIS
|
|
ETCDIR/ldap.conf
|
|
\fP.ldaprc\fP
|
|
.SH DESCRIPTION
|
|
The
|
|
.I ldap.conf
|
|
configuration file is used to set system-wide defaults to be applied when
|
|
running
|
|
.I ldap
|
|
clients. If the environment variable \fBLDAPNOINIT\fP is defined, all
|
|
defaulting is disabled.
|
|
.LP
|
|
Each user may specify an optional configuration file,
|
|
.IR .ldaprc ,
|
|
in his/her home directory which will be used to override the system-wide
|
|
defaults file.
|
|
.LP
|
|
Additional configuration files can be specified using
|
|
the \fBLDAPCONF\fP and \fBLDAPRC\fP environment variables.
|
|
\fBLDAPCONF\fP may be set the path of a configuration file. This
|
|
path can be absolute or relative to current working directory.
|
|
The \fBLDAPRC\fP, if defined, should be a basename of a file
|
|
in the current working directory or in the user's home directory.
|
|
.LP
|
|
Environmental variables may also be used to augment the file based defaults.
|
|
The name of the option is the as listed but with a prefix of \fBLDAP\fP.
|
|
For example, to define \fBBASE\fP via the environment, define the variable
|
|
\fBLDAPBASE\fP to desired value.
|
|
.LP
|
|
Some options are user\-only. Such options are ignored if present
|
|
in the
|
|
.IR ldap.conf
|
|
(or file specified by
|
|
.BR LDAPCONF ).
|
|
.SH OPTIONS
|
|
The different configuration options are:
|
|
.TP 1i
|
|
\fBBASE <base>\fP
|
|
Used to specify the default base DN to use when performing ldap operations.
|
|
The base must be specified as a Distinguished Name in LDAP format.
|
|
.TP 1i
|
|
\fBBINDDN <dn>\fP
|
|
Used to specify the default bind DN to use when performing ldap operations.
|
|
The bind DN must be specified as a Distinguished Name in LDAP format.
|
|
This is a user\-only option.
|
|
.TP 1i
|
|
\fBHOST <name[:port] ...>\fP
|
|
Used to specify the name(s) of an LDAP server(s) to which
|
|
.I ldap
|
|
library should connect to. Each server's name can be specified as a
|
|
domain-style name or an IP address and optionally followed a ':' and
|
|
the port number the ldap server is listening on. A space separated
|
|
listed of host may be provided.
|
|
.TP 1i
|
|
\fBPORT <port>\fP
|
|
Used to specify the port used with connecting to LDAP servers(s).
|
|
The port may be specified as a number.
|
|
.TP 1i
|
|
\fBSASL_SECPROPS <properties>\fP
|
|
Used to specify Cyrus SASL security properties.
|
|
The
|
|
.B none
|
|
flag (without any other properities) causes the flag properites
|
|
defaults ("noanonymous,noplain") to be cleared.
|
|
The
|
|
.B noplain
|
|
flag disables mechanisms susceptible to simple passive attacks.
|
|
The
|
|
.B noactive
|
|
flag disables mechanisms susceptible to active attacks.
|
|
The
|
|
.B nodict
|
|
flag disables mechanisms susceptible to passive dictionary attacks.
|
|
The
|
|
.B noanonyous
|
|
flag disables mechanisms which support anonymous login.
|
|
The
|
|
.B forwardsec
|
|
flag require forward secrecy between sessions.
|
|
The
|
|
.B passcred
|
|
require mechanisms which pass client credentials (and allow
|
|
mechanisms which can pass credentials to do so).
|
|
The
|
|
.B minssf=<factor>
|
|
property specifies the minimum acceptable
|
|
.I security strength factor
|
|
as an integer approximate to effective key length used for
|
|
encryption. 0 (zero) implies no protection, 1 implies integrity
|
|
protection only, 56 allows DES or other weak ciphers, 112
|
|
allows triple DES and other strong ciphers, 128 allows RC4,
|
|
Blowfish and other modern strong ciphers. The default is 0.
|
|
The
|
|
.B maxssf=<factor>
|
|
property specifies the maximum acceptable
|
|
.I security strength factor
|
|
as an integer (see minssf description). The default is INT_MAX.
|
|
The
|
|
.B maxbufsize=<factor>
|
|
property specifies the maximum security layer receive buffer
|
|
size allowed. 0 disables security layers. The default is 65536.
|
|
.TP 1i
|
|
\fBSIZELIMIT <integer>\fP
|
|
Used to specify a size limit to use when performing searches. The
|
|
number should be an non-negative integer. \fISIZELIMIT\fP of zero (0)
|
|
specifies unlimited search size.
|
|
.TP 1i
|
|
\fBTIMELIMIT <integer>\fP
|
|
Used to specify a time limit to use when performing searches. The
|
|
number should be an non-negative integer. \fITIMELIMIT\fP of zero (0)
|
|
specifies unlimited search time to be used.
|
|
.TP 1i
|
|
\fBDEREF <never|searching|finding|always>\fP
|
|
Specify how aliases dereferencing is done. \fIDEREF\fP should
|
|
be set to one of
|
|
.B never,
|
|
.B always,
|
|
.B search,
|
|
or
|
|
.B find
|
|
to specify that aliases are never dereferenced, always dereferenced,
|
|
dereferenced when searching, or dereferenced only when locating the
|
|
base object for the search. The default is to never dereference aliases.
|
|
.SH FILES
|
|
.I ETCDIR/ldap.conf
|
|
.LP
|
|
.I $HOME/.ldaprc
|
|
.LP
|
|
.I $CWD/.ldaprc
|
|
.SH "SEE ALSO"
|
|
ldap(3)
|
|
.SH AUTHOR
|
|
Kurt Zeilenga, The OpenLDAP Project
|
|
.SH ACKNOWLEDGEMENTS
|
|
.B OpenLDAP
|
|
is developed and maintained by The OpenLDAP Project (http://www.openldap.org/).
|
|
.B OpenLDAP
|
|
is derived from University of Michigan LDAP 3.3 Release.
|