Differential D10600 Diff 52206 head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml

Changeset View

Standalone View

head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml

Show First 20 Lines • Show All 994 Lines • ▼ Show 20 Lines	<filename>/etc/rc.conf</filename>:</para>
<para>Then &man.autofs.5; can be started by running:</para>		<para>Then &man.autofs.5; can be started by running:</para>

<screen>&prompt.root; <userinput>service automount start</userinput>		<screen>&prompt.root; <userinput>service automount start</userinput>
&prompt.root; <userinput>service automountd start</userinput>		&prompt.root; <userinput>service automountd start</userinput>
&prompt.root; <userinput>service autounmountd start</userinput></screen>		&prompt.root; <userinput>service autounmountd start</userinput></screen>

<para>The &man.autofs.5; map format is the same as in other		<para>The &man.autofs.5; map format is the same as in other
operating systems. Information about this format from other		operating systems. Information about this format from other
sources can be useful, like the <link		sources can be useful, like the <link
xlink:href="http://web.archive.org/web/20160813071113/http://images.apple.com/business/docs/Autofs.pdf">Mac		xlink:href="http://web.archive.org/web/20160813071113/http://images.apple.com/business/docs/Autofs.pdf">Mac
OS X document</link>.</para>		OS X document</link>.</para>

<para>Consult the &man.automount.8;, &man.automountd.8;,		<para>Consult the &man.automount.8;, &man.automountd.8;,
&man.autounmountd.8;, and &man.auto.master.5; manual pages for		&man.autounmountd.8;, and &man.auto.master.5; manual pages for
more information.</para>		more information.</para>
</sect2>		</sect2>
</sect1>		</sect1>
▲ Show 20 Lines • Show All 1,231 Lines • ▼ Show 20 Lines	# [...more groups to follow]</programlisting>
(<acronym>LDAP</acronym>)</title>		(<acronym>LDAP</acronym>)</title>

<authorgroup>		<authorgroup>
<author>		<author>
<personname>		<personname>
<firstname>Tom</firstname>		<firstname>Tom</firstname>
<surname>Rhodes</surname>		<surname>Rhodes</surname>
</personname>		</personname>
<contrib>Written by </contrib>		<contrib>Originally contributed by </contrib>
</author>		</author>
</authorgroup>		</authorgroup>
		<authorgroup>
		<author>
		<personname>
		<firstname>Rocky</firstname>
		<surname>Hotas</surname>
		</personname>
		<contrib>Updates by </contrib>
		</author>
		</authorgroup>
</info>		</info>

<indexterm><primary>LDAP</primary></indexterm>		<indexterm><primary>LDAP</primary></indexterm>

<para>The Lightweight Directory Access Protocol		<para>The Lightweight Directory Access Protocol
(<acronym>LDAP</acronym>) is an application layer protocol used		(<acronym>LDAP</acronym>) is an application layer protocol used
to access, modify, and authenticate objects using a distributed		to access, modify, and authenticate objects using a distributed
directory information service. Think of it as a phone or record		directory information service. Think of it as a phone or record
▲ Show 20 Lines • Show All 73 Lines • ▼ Show 20 Lines	terminology can be found at <uri
</sect2>		</sect2>

<sect2 xml:id="ldap-config">		<sect2 xml:id="ldap-config">
<title>Configuring an <acronym>LDAP</acronym> Server</title>		<title>Configuring an <acronym>LDAP</acronym> Server</title>

<indexterm><primary>LDAP Server</primary></indexterm>		<indexterm><primary>LDAP Server</primary></indexterm>

<para>&os; does not provide a built-in <acronym>LDAP</acronym>		<para>&os; does not provide a built-in <acronym>LDAP</acronym>
server. Begin the configuration by installing the <package		server. Begin the configuration by installing <package
role="port">net/openldap24-server</package> package or port.		role="port">net/openldap-server</package> package or
Since the port has many configurable options, it is		port:</para>
recommended that the default options are reviewed to see if
the package is sufficient, and to instead compile the port if
any options should be changed. In most cases, the defaults
are fine. However, if SQL support is needed, this option must
be enabled and the port compiled using the instructions in
<xref linkend="ports-using"/>.</para>

<para>Next, create the directories to hold the data and to store		<screen>&prompt.root; <userinput>pkg install openldap-server</userinput></screen>
the certificates:</para>

<screen>&prompt.root; <userinput>mkdir /var/db/openldap-data</userinput>		<para>There is a large set of default options enabled in the
&prompt.root; <userinput>mkdir /usr/local/etc/openldap/private</userinput></screen>		<link xlink:href="&url.articles.linux-users;/software.html">
		package</link>. Review them by running
		<command>pkg info openldap-server</command>. If they are not
		sufficient (for example if SQL support is needed), please
		consider recompiling the port using the appropriate <link
		xlink:href="&url.books.handbook;/ports-using.html">framework</link>.</para>

<para>Copy over the database configuration file:</para>		<para>The installation creates the directory
		<filename>/var/db/openldap-data</filename> to hold the data.
		The directory to store the certificates must be
		created:</para>

<screen>&prompt.root; <userinput>cp /usr/local/etc/openldap/DB_CONFIG.example /var/db/openldap-data/DB_CONFIG</userinput></screen>		<screen>&prompt.root; <userinput>mkdir /usr/local/etc/openldap/private</userinput></screen>

<para>The next phase is to configure the certificate authority.		<para>The next phase is to configure the Certificate Authority.
The following commands must be executed from		The following commands must be executed from
<filename>/usr/local/etc/openldap/private</filename>. This is		<filename>/usr/local/etc/openldap/private</filename>. This is
important as the file permissions need to be restrictive and		important as the file permissions need to be restrictive and
users should not have access to these files. To create the		users should not have access to these files. More detailed
certificate authority, start with this command and follow the		information about certificates and their parameters can be
		found in <xref linkend="openssl"/>. To create the
		Certificate Authority, start with this command and follow the
prompts:</para>		prompts:</para>

<screen>&prompt.root; <userinput>openssl req -days <replaceable>365</replaceable> -nodes -new -x509 -keyout ca.key -out ../ca.crt</userinput></screen>		<screen>&prompt.root; <userinput>openssl req -days <replaceable>365</replaceable> -nodes -new -x509 -keyout ca.key -out ../ca.crt</userinput></screen>

<para>The entries for the prompts may be generic		<para>The entries for the prompts may be generic
<emphasis>except</emphasis> for the		<emphasis>except</emphasis> for the
<literal>Common Name</literal>. This entry must be		<literal>Common Name</literal>. This entry must be
<emphasis>different</emphasis> than the system hostname. If		<emphasis>different</emphasis> than the system hostname. If
this will be a self signed certificate, prefix the hostname		this will be a self signed certificate, prefix the hostname
with <literal>CA</literal> for certificate authority.</para>		with <literal>CA</literal> for Certificate Authority.</para>

<para>The next task is to create a certificate signing request		<para>The next task is to create a certificate signing request
and a private key. Input this command and follow the		and a private key. Input this command and follow the
prompts:</para>		prompts:</para>

<screen>&prompt.root; <userinput>openssl req -days <replaceable>365</replaceable> -nodes -new -keyout server.key -out server.csr</userinput></screen>		<screen>&prompt.root; <userinput>openssl req -days <replaceable>365</replaceable> -nodes -new -keyout server.key -out server.csr</userinput></screen>

<para>During the certificate generation process, be sure to		<para>During the certificate generation process, be sure to
correctly set the <literal>Common Name</literal> attribute.		correctly set the <literal>Common Name</literal> attribute.
Once complete, sign the key:</para>		The Certificate Signing Request must be signed with the
		Certificate Authority in order to be used as a valid
		certificate:</para>

<screen>&prompt.root; <userinput>openssl x509 -req -days <replaceable>365</replaceable> -in server.csr -out ../server.crt -CA ../ca.crt -CAkey ca.key -CAcreateserial</userinput></screen>		<screen>&prompt.root; <userinput>openssl x509 -req -days <replaceable>365</replaceable> -in server.csr -out ../server.crt -CA ../ca.crt -CAkey ca.key -CAcreateserial</userinput></screen>

<para>The final part of the certificate generation process is to		<para>The final part of the certificate generation process is to
generate and sign the client certificates:</para>		generate and sign the client certificates:</para>

<screen>&prompt.root; <userinput>openssl req -days <replaceable>365</replaceable> -nodes -new -keyout client.key -out client.csr</userinput>		<screen>&prompt.root; <userinput>openssl req -days <replaceable>365</replaceable> -nodes -new -keyout client.key -out client.csr</userinput>
&prompt.root; <userinput>openssl x509 -req -days 3650 -in client.csr -out ../client.crt -CA ../ca.crt -CAkey ca.key</userinput></screen>		&prompt.root; <userinput>openssl x509 -req -days 3650 -in client.csr -out ../client.crt -CA ../ca.crt -CAkey ca.key</userinput></screen>

<para>Remember to use the same <literal>Common Name</literal>		<para>Remember to use the same <literal>Common Name</literal>
attribute when prompted. When finished, ensure that a total		attribute when prompted. When finished, ensure that a total
of eight (8) new files have been generated through the		of eight (8) new files have been generated through the
proceeding commands. If so, the next step is to edit		proceeding commands.</para>
<filename>/usr/local/etc/openldap/slapd.conf</filename> and
add the following options:</para>

<programlisting>TLSCipherSuite HIGH:MEDIUM:+SSLv3		<para>The daemon running the OpenLDAP server is
TLSCertificateFile /usr/local/etc/openldap/server.crt		<filename>slapd</filename>. Its configuration is performed
TLSCertificateKeyFile /usr/local/etc/openldap/private/server.key		through <filename>slapd.ldif</filename>: the old
TLSCACertificateFile /usr/local/etc/openldap/ca.crt</programlisting>		<filename>slapd.conf</filename> has been deprecated by
		OpenLDAP.</para>

<para>Then, edit		<para><link
<filename>/usr/local/etc/openldap/ldap.conf</filename> and add		xlink:href="http://www.openldap.org/doc/admin24/slapdconf2.html">Configuration
the following lines:</para>		examples</link> for <filename>slapd.ldif</filename> are
		available and can also be found in
		<filename>/usr/local/etc/openldap/slapd.ldif.sample</filename>.
		Options are documented in slapd-config(5). Each section
		of <filename>slapd.ldif</filename>, like all the other LDAP
		attribute sets, is uniquely identified through a DN. Be sure
		that no blank lines are left between the
		<literal>dn:</literal> statement and the desired end of the
		section. In the following example, TLS will be used to
		implement a secure channel. The first section represents the
		global configuration:</para>

<programlisting>TLS_CACERT /usr/local/etc/openldap/ca.crt		<programlisting>#
TLS_CIPHER_SUITE HIGH:MEDIUM:+SSLv3</programlisting>		# See slapd-config(5) for details on configuration options.
		# This file should NOT be world readable.
		#
		dn: cn=config
		objectClass: olcGlobal
		cn: config
		#
		#
		# Define global ACLs to disable default read access.
		#
		olcArgsFile: /var/run/openldap/slapd.args
		olcPidFile: /var/run/openldap/slapd.pid
		olcTLSCertificateFile: /usr/local/etc/openldap/server.crt
		olcTLSCertificateKeyFile: /usr/local/etc/openldap/private/server.key
		olcTLSCACertificateFile: /usr/local/etc/openldap/ca.crt
		#olcTLSCipherSuite: HIGH
		olcTLSProtocolMin: 3.1
		olcTLSVerifyClient: never</programlisting>

<para>While editing this file, uncomment the following entries		<para>The Certificate Authority, server certificate and server
and set them to the desired values: <option>BASE</option>,		private key files must be specified here. It is recommended
<option>URI</option>, <option>SIZELIMIT</option> and		to let the clients choose the security cipher and omit option
<option>TIMELIMIT</option>. Set the <option>URI</option> to		<literal>olcTLSCipherSuite</literal> (incompatible with TLS
contain <option>ldap://</option> and		clients other than <filename>openssl</filename>). Option
<option>ldaps://</option>. Then, add two entries pointing to		<literal>olcTLSProtocolMin</literal> lets the server require a
the certificate authority. When finished, the entries should		minimum security level: it is recommended. While
look similar to the following:</para>		verification is mandatory for the server, it is not for the
		client: <literal>olcTLSVerifyClient: never</literal>.</para>

<programlisting>BASE dc=example,dc=com		<para>The second section is about the backend modules and can be
URI ldap:// ldaps://		configured as follows:</para>

SIZELIMIT 12		<programlisting>#
TIMELIMIT 15		# Load dynamic backend modules:
		#
		dn: cn=module,cn=config
		objectClass: olcModuleList
		cn: module
		olcModulepath: /usr/local/libexec/openldap
		olcModuleload: back_mdb.la
		#olcModuleload: back_bdb.la
		#olcModuleload: back_hdb.la
		#olcModuleload: back_ldap.la
		#olcModuleload: back_passwd.la
		#olcModuleload: back_shell.la</programlisting>

TLS_CACERT /usr/local/etc/openldap/ca.crt		<para>The third section is devoted to load the needed
TLS_CIPHER_SUITE HIGH:MEDIUM:+SSLv3</programlisting>		<literal>ldif</literal> schemas to be used by the databases:
		they are essential.</para>

<para>The default password for the server should then be		<programlisting>dn: cn=schema,cn=config
changed:</para>		objectClass: olcSchemaConfig
		cn: schema

<screen>&prompt.root; <userinput>slappasswd -h "{SHA}" >> /usr/local/etc/openldap/slapd.conf</userinput></screen>		include: file:///usr/local/etc/openldap/schema/core.ldif
		include: file:///usr/local/etc/openldap/schema/cosine.ldif
		include: file:///usr/local/etc/openldap/schema/inetorgperson.ldif
		include: file:///usr/local/etc/openldap/schema/nis.ldif</programlisting>

<para>This command will prompt for the password and, if the		<para>Next, the frontend configuration section:</para>
process does not fail, a password hash will be added to the
end of <filename>slapd.conf</filename>. Several hashing
formats are supported. Refer to the manual page for
<command>slappasswd</command> for more information.</para>

<para>Next, edit		<programlisting># Frontend settings
<filename>/usr/local/etc/openldap/slapd.conf</filename> and		#
add the following lines:</para>		dn: olcDatabase={-1}frontend,cn=config
		objectClass: olcDatabaseConfig
		objectClass: olcFrontendConfig
		olcDatabase: {-1}frontend
		olcAccess: to * by * read
		#
		# Sample global access control policy:
		# Root DSE: allow anyone to read it
		# Subschema (sub)entry DSE: allow anyone to read it
		# Other DSEs:
		# Allow self write access
		# Allow authenticated users read access
		# Allow anonymous users to authenticate
		#
		#olcAccess: to dn.base="" by * read
		#olcAccess: to dn.base="cn=Subschema" by * read
		#olcAccess: to *
		# by self write
		# by users read
		# by anonymous auth
		#
		# if no access controls are present, the default policy
		# allows anyone and everyone to read anything but restricts
		# updates to rootdn. (e.g., "access to * by * read")
		#
		# rootdn can always read and write EVERYTHING!
		#
		olcPasswordHash: {SSHA}
		# {SSHA} is already the default for olcPasswordHash</programlisting>

<programlisting>password-hash {sha}		<para>Another section is devoted to the <emphasis>configuration
allow bind_v2</programlisting>		backend</emphasis>, the only way to later access the
		OpenLDAP server configuration is as a global
		super-user.</para>

<para>The <option>suffix</option> in this file must be updated		<programlisting>dn: olcDatabase={0}config,cn=config
to match the <option>BASE</option> used in		objectClass: olcDatabaseConfig
<filename>/usr/local/etc/openldap/ldap.conf</filename> and		olcDatabase: {0}config
<option>rootdn</option> should also be set. A recommended		olcAccess: to * by * none
value for <option>rootdn</option> is something like		olcRootPW: {SSHA}iae+lrQZILpiUdf16Z9KmDmSwT77Dj4U</programlisting>
<option>cn=Manager</option>. Before saving this file, place
the <option>rootpw</option> in front of the password output
from <command>slappasswd</command> and delete the old
<option>rootpw</option>. The end result should
look similar to this:</para>

<programlisting>TLSCipherSuite HIGH:MEDIUM:+SSLv3		<para>The default administrator username is
TLSCertificateFile /usr/local/etc/openldap/server.crt		<literal>cn=config</literal>. Type
TLSCertificateKeyFile /usr/local/etc/openldap/private/server.key		<filename>slappasswd</filename> in a shell, choose a password
TLSCACertificateFile /usr/local/etc/openldap/ca.crt		and use its hash in <literal>olcRootPW</literal>. If this
rootpw {SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g=</programlisting>		option is not specified now, before
		<filename>slapd.ldif</filename> is imported, no one will be
		later able to modify the
		<emphasis>global configuration</emphasis> section.</para>

<para>Finally, enable the <application>OpenLDAP</application>		<para>The last section is about the database backend:</para>
service in <filename>/etc/rc.conf</filename> and set the
<acronym>URI</acronym>:</para>

<programlisting>slapd_enable="YES"		<programlisting>#######################################################################
slapd_flags="-4 -h ldaps:///"</programlisting>		# LMDB database definitions
		#######################################################################
		#
		dn: olcDatabase=mdb,cn=config
		objectClass: olcDatabaseConfig
		objectClass: olcMdbConfig
		olcDatabase: mdb
		olcDbMaxSize: 1073741824
		olcSuffix: dc=domain,dc=example
		olcRootDN: cn=mdbadmin,dc=domain,dc=example
		# Cleartext passwords, especially for the rootdn, should
		# be avoided. See slappasswd(8) and slapd-config(5) for details.
		# Use of strong authentication encouraged.
		olcRootPW: {SSHA}X2wHvIWDk6G76CQyCMS1vDCvtICWgn0+
		# The database directory MUST exist prior to running slapd AND
		# should only be accessible by the slapd and slap tools.
		# Mode 700 recommended.
		olcDbDirectory: /var/db/openldap-data
		# Indices to maintain
		olcDbIndex: objectClass eq</programlisting>

<para>At this point the server can be started and tested:</para>		<para>This database hosts the <emphasis>actual
		contents</emphasis> of the <acronym>LDAP</acronym>
		directory. Types other than <literal>mdb</literal> are
		available. Its super-user, not to be confused with the global
		one, is configured here: a (possibly custom) username in
		<literal>olcRootDN</literal> and the password hash in
		<literal>olcRootPW</literal>; <filename>slappasswd</filename>
		can be used as before.</para>

<screen>&prompt.root; <userinput>service slapd start</userinput></screen>		<para>This <link
		xlink:href="http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=tree;f=tests/data/regressions/its8444;h=8a5e808e63b0de3d2bdaf2cf34fecca8577ca7fd;hb=HEAD">repository</link>
		contains four examples of <filename>slapd.ldif</filename>. To
		convert an existing <filename>slapd.conf</filename> into
		<filename>slapd.ldif</filename>, refer to <link
		xlink:href="http://www.openldap.org/doc/admin24/slapdconf2.html">this
		page</link> (please note that this may introduce some
		unuseful options).</para>

<para>If everything is configured correctly, a search of the		<para>When the configuration is completed,
directory should show a successful connection with a single		<filename>slapd.ldif</filename> must be placed in an empty
response as in this example:</para>		directory. It is recommended to create it as:</para>

<screen>&prompt.root; <userinput>ldapsearch -Z</userinput>		<screen>&prompt.root; <userinput>mkdir /usr/local/etc/openldap/slapd.d/</userinput></screen>

		<para>Import the configuration database:</para>

		<screen>&prompt.root; <userinput>/usr/local/sbin/slapadd -n0 -F /usr/local/etc/openldap/slapd.d/ -l /usr/local/etc/openldap/slapd.ldif</userinput></screen>

		<para>Start the <filename>slapd</filename> daemon:</para>

		<screen>&prompt.root; <userinput>/usr/local/libexec/slapd -F /usr/local/etc/openldap/slapd.d/</userinput></screen>

		<para>Option <literal>-d</literal> can be used for debugging,
		as specified in slapd(8). To verify that the server is
		running and working:</para>

		<screen>&prompt.root; <userinput>ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts</userinput>
# extended LDIF		# extended LDIF
#		#
# LDAPv3		# LDAPv3
# base <dc=example,dc=com> (default) with scope subtree		# base <> with scope baseObject
# filter: (objectclass=*)		# filter: (objectclass=*)
# requesting: ALL		# requesting: namingContexts
#		#

		#
		dn:
		namingContexts: dc=domain,dc=example

# search result		# search result
search: 3		search: 2
result: 32 No such object		result: 0 Success

# numResponses: 1</screen>		# numResponses: 2
		# numEntries: 1</screen>

<note>		<para>The server must still be trusted. If that has never been
<para>If the command fails and the configuration looks		done before, follow these instructions. Install the OpenSSL
correct, stop the <command>slapd</command> service and		package or port:</para>
restart it with debugging options:</para>

<screen>&prompt.root; <userinput>service slapd stop</userinput>		<screen>&prompt.root; <userinput>pkg install openssl</userinput></screen>
&prompt.root; <userinput>/usr/local/libexec/slapd -d -1</userinput></screen>
</note>

<para>Once the service is responding, the directory can be		<para>From the directory where <filename>ca.crt</filename> is
populated using <command>ldapadd</command>. In this example,		stored (in this example,
a file containing this list of users is first created. Each		<filename>/usr/local/etc/openldap</filename>), run:</para>
user should use the following format:</para>

<programlisting>dn: dc=<replaceable>example</replaceable>,dc=<replaceable>com</replaceable>		<screen>&prompt.root; <userinput>c_rehash .</userinput></screen>
objectclass: dcObject
objectclass: organization
o: <replaceable>Example</replaceable>
dc: <replaceable>Example</replaceable>

dn: cn=<replaceable>Manager</replaceable>,dc=<replaceable>example</replaceable>,dc=<replaceable>com</replaceable>		<para>Both the CA and the server certificate are now correctly
objectclass: organizationalRole		recognized in their respective roles. To verify this, run
cn: <replaceable>Manager</replaceable></programlisting>		this command from the <filename>server.crt</filename>
		directory:</para>

<para>To import this file, specify the file name. The following		<screen>&prompt.root; <userinput>openssl verify -verbose -CApath . server.crt</userinput></screen>
command will prompt for the password specified earlier and the
output should look something like this:</para>

<screen>&prompt.root; <userinput>ldapadd -Z -D "cn=<replaceable>Manager</replaceable>,dc=<replaceable>example</replaceable>,dc=<replaceable>com</replaceable>" -W -f <replaceable>import.ldif</replaceable></userinput>		<para>If <filename>slapd</filename> was running, restart it. As
Enter LDAP Password:		stated in <filename>/usr/local/etc/rc.d/slapd</filename>, to
adding new entry "dc=example,dc=com"		properly run <filename>slapd</filename> at boot the
		following lines must be added to
		<filename>/etc/rc.conf</filename>:</para>

adding new entry "cn=Manager,dc=example,dc=com"</screen>		<programlisting>lapd_enable="YES"
		slapd_flags='-h "ldapi://%2fvar%2frun%2fopenldap%2fldapi/
		ldap://0.0.0.0/"'
		slapd_sockets="/var/run/openldap/ldapi"
		slapd_cn_config="YES"</programlisting>

<para>Verify the data was added by issuing a search on the		<para><filename>slapd</filename> does not provide debugging at
server using <command>ldapsearch</command>:</para>		boot. Check <filename>/var/log/debug.log</filename>,
		<filename>dmesg -a</filename> and
		<filename>/var/log/messages</filename> for this
		purpose.</para>

<screen>&prompt.user; <userinput>ldapsearch -Z</userinput>		<para>The following example adds the group
# extended LDIF		<literal>team</literal> and the user <literal>john</literal>
#		to the <systemitem
# LDAPv3		class="systemname">domain.example</systemitem>
# base <dc=example,dc=com> (default) with scope subtree		<acronym>LDAP</acronym> database, which is still empty.
# filter: (objectclass=*)		First, create the file
# requesting: ALL		<filename>domain.ldif</filename>:</para>
#

# example.com		<screen>&prompt.root; <userinput>cat domain.ldif</userinput>
dn: dc=example,dc=com		dn: dc=domain,dc=example
objectClass: dcObject		objectClass: dcObject
objectClass: organization		objectClass: organization
o: Example		o: domain.example
dc: Example		dc: domain

# Manager, example.com		dn: ou=groups,dc=domain,dc=example
dn: cn=Manager,dc=example,dc=com		objectClass: top
objectClass: organizationalRole		objectClass: organizationalunit
cn: Manager		ou: groups

# search result		dn: ou=users,dc=domain,dc=example
search: 3		objectClass: top
result: 0 Success		objectClass: organizationalunit
		ou: users

# numResponses: 3		dn: cn=team,ou=groups,dc=domain,dc=example
# numEntries: 2</screen>		objectClass: top
		objectClass: posixGroup
		cn: team
		gidNumber: 10001

<para>At this point, the server should be configured and		dn: uid=john,ou=users,dc=domain,dc=example
functioning properly.</para>		objectClass: top
		objectClass: account
		objectClass: posixAccount
		objectClass: shadowAccount
		cn: John McUser
		uid: john
		uidNumber: 10001
		gidNumber: 10001
		homeDirectory: /home/john/
		loginShell: /usr/bin/bash
		userPassword: secret</screen>

		<para>See the OpenLDAP documentation for more details. Use
		<filename>slappasswd</filename> to replace the plain text
		password <literal>secret</literal> with a hash in
		<literal>userPassword</literal>. The path specified as
		<literal>loginShell</literal> must exist in all the systems
		where <literal>john</literal> is allowed to login. Finally,
		use the <literal>mdb</literal> administrator to modify the
		database:</para>

		<screen>&prompt.root; <userinput>ldapadd -W -D "cn=mdbadmin,dc=domain,dc=example" -f domain.ldif</userinput></screen>

		<para>Modifications to the <emphasis>global
		configuration</emphasis> section can only be performed by
		the global super-user. For example, assume that the option
		<literal>olcTLSCipherSuite: HIGH:MEDIUM:SSLv3</literal> was
		initially specified and must now be deleted. First, create a
		file that contains the following:</para>

		<screen>&prompt.root; <userinput>cat <replaceable>global_mod</replaceable></userinput>
		dn: cn=config
		changetype: modify
		delete: olcTLSCipherSuite</screen>

		<para>Then, apply the modifications:</para>

		<screen>&prompt.root; <userinput>ldapmodify -f global_mod -x -D "cn=config" -W</userinput></screen>

		<para>When asked, provide the password chosen in the
		<emphasis>configuration backend</emphasis> section. The
		username is not required: here, <literal>cn=config</literal>
		represents the DN of the database section to be modified.
		Alternatively, use <literal>ldapmodify</literal> to delete a
		single line of the database, <literal>ldapdelete</literal> to
		delete a whole entry.</para>

		<para>If something goes wrong, or if the global super-user
		cannot access the configuration backend, it is possible to
		delete and re-write the whole configuration:</para>

		<screen>&prompt.root; <userinput>rm -rf /usr/local/etc/openldap/slapd.d/</userinput></screen>

		<para><filename>slapd.ldif</filename> can then be edited and
		imported again. Please, follow this procedure only when no
		other solution is available.</para>

		<para>This is the configuration of the server only. The same
		machine can also host an LDAP client, with its own separate
		configuration.</para>
</sect2>		</sect2>
</sect1>		</sect1>

<sect1 xml:id="network-dhcp">		<sect1 xml:id="network-dhcp">
<!--		<!--
<sect1info>		<sect1info>
<authorgroup>		<authorgroup>
<author>		<author>
▲ Show 20 Lines • Show All 230 Lines • ▼ Show 20 Lines	host fantasia {

<callout arearefs="subnet-mask">		<callout arearefs="subnet-mask">
<para>The subnet mask that will be provided to		<para>The subnet mask that will be provided to
clients.</para>		clients.</para>
</callout>		</callout>

<callout arearefs="default-lease-time">		<callout arearefs="default-lease-time">
<para>The default lease expiry time in seconds. A client		<para>The default lease expiry time in seconds. A client
can be configured to override this value. </para>		can be configured to override this value.</para>
</callout>		</callout>

<callout arearefs="max-lease-time">		<callout arearefs="max-lease-time">
<para>The maximum allowed length of time, in seconds, for a		<para>The maximum allowed length of time, in seconds, for a
lease. Should a client request a longer lease, a lease		lease. Should a client request a longer lease, a lease
will still be issued, but it will only be valid for		will still be issued, but it will only be valid for
<literal>max-lease-time</literal>.</para>		<literal>max-lease-time</literal>.</para>
</callout>		</callout>
▲ Show 20 Lines • Show All 1,261 Lines • ▼ Show 20 Lines	Starting smbd.</screen>
details.</para>		details.</para>

<para>This application reads <filename>/etc/ntp.conf</filename>		<para>This application reads <filename>/etc/ntp.conf</filename>
to determine which <acronym>NTP</acronym> servers to query.		to determine which <acronym>NTP</acronym> servers to query.
Here is a simple example of an		Here is a simple example of an
<filename>/etc/ntp.conf</filename>:</para>		<filename>/etc/ntp.conf</filename>:</para>

<example>		<example>
<title> Sample <filename>/etc/ntp.conf</filename></title>		<title>Sample <filename>/etc/ntp.conf</filename></title>

<programlisting>server ntplocal.example.com prefer		<programlisting>server ntplocal.example.com prefer
server timeserver.example.org		server timeserver.example.org
server ntp2a.example.net		server ntp2a.example.net

driftfile /var/db/ntp.drift</programlisting>		driftfile /var/db/ntp.drift</programlisting>
</example>		</example>

▲ Show 20 Lines • Show All 72 Lines • ▼ Show 20 Lines	driftfile /var/db/ntp.drift</programlisting>
connection to the Internet to function properly. However, if		connection to the Internet to function properly. However, if
a <acronym>PPP</acronym> connection is configured to dial out		a <acronym>PPP</acronym> connection is configured to dial out
on demand, <acronym>NTP</acronym> traffic should be prevented		on demand, <acronym>NTP</acronym> traffic should be prevented
from triggering a dial out or keeping the connection alive.		from triggering a dial out or keeping the connection alive.
This can be configured with <literal>filter</literal>		This can be configured with <literal>filter</literal>
directives in <filename>/etc/ppp/ppp.conf</filename>. For		directives in <filename>/etc/ppp/ppp.conf</filename>. For
example:</para>		example:</para>

<programlisting> set filter dial 0 deny udp src eq 123		<programlisting>set filter dial 0 deny udp src eq 123
# Prevent NTP traffic from initiating dial out		# Prevent NTP traffic from initiating dial out
set filter dial 1 permit 0 0		set filter dial 1 permit 0 0
set filter alive 0 deny udp src eq 123		set filter alive 0 deny udp src eq 123
# Prevent incoming NTP traffic from keeping the connection open		# Prevent incoming NTP traffic from keeping the connection open
set filter alive 1 deny udp dst eq 123		set filter alive 1 deny udp dst eq 123
# Prevent outgoing NTP traffic from keeping the connection open		# Prevent outgoing NTP traffic from keeping the connection open
set filter alive 2 permit 0/0 0/0</programlisting>		set filter alive 2 permit 0/0 0/0</programlisting>

▲ Show 20 Lines • Show All 338 Lines • Show Last 20 Lines