ldap.conf, .ldaprc - ldap configuration file


SYNOPSIS

       /etc/openldap/ldap.conf


DESCRIPTION

       The  ldap.conf  configuration  file is used to set system-
       wide defaults to be applied when running ldap clients.  If
       the   environment  variable  LDAPNOINIT  is  defined,  all
       defaulting is disabled.

       Each user may  specify  an  optional  configuration  file,
       .ldaprc,  in  his/her home directory which will be used to
       override the system-wide defaults file.

       Additional configuration files can be specified using  the
       LDAPCONF  and  LDAPRC environment variables.  LDAPCONF may
       be set the path of a configuration file.  This path can be
       absolute  or  relative  to current working directory.  The
       LDAPRC, if defined, should be a basename of a file in  the
       current working directory or in the user's home directory.

       Environmental variables may also be used  to  augment  the
       file  based  defaults.   The  name of the option is the as
       listed but with a prefix of LDAP.  For example, to  define
       BASE  via the environment, define the variable LDAPBASE to
       desired value.

       Some options are user-only.  Such options are  ignored  if
       present  in the ldap.conf (or file specified by LDAPCONF).


OPTIONS

       The different configuration options are:

       BASE <base>
                 Used to specify the default base DN to use  when
                 performing  ldap  operations.   The base must be
                 specified as a Distinguished Name in  LDAP  for­
                 mat.

       BINDDN <dn>
                 Used  to specify the default bind DN to use when
                 performing ldap operations.  The bind DN must be
                 specified  as  a Distinguished Name in LDAP for­
                 mat.  This is a user-only option.

       HOST <name[:port] ...>
                 Used to specify the name(s) of an LDAP server(s)
                 to  which  ldap library should connect to.  Each
                 server's name can be specified as a domain-style
                 name  or an IP address and optionally followed a
                 ':' and the port number the ldap server is  lis­
                 tening on.  A space separated listed of host may


       PORT <port>
                 Used to specify the port used with connecting to
                 LDAP servers(s).  The port may be specified as a
                 number.

       SASL_SECPROPS <properties>
                 Used to specify Cyrus SASL security  properties.
                 The  none  flag  (without any other properities)
                 causes the flag properites  defaults  ("noanony­
                 mous,noplain")  to be cleared.  The noplain flag
                 disables mechanisms susceptible to  simple  pas­
                 sive attacks.  The noactive flag disables mecha­
                 nisms susceptible to active attacks.  The nodict
                 flag  disables mechanisms susceptible to passive
                 dictionary attacks.  The  noanonyous  flag  dis­
                 ables  mechanisms which support anonymous login.
                 The  forwardsec  flag  require  forward  secrecy
                 between  sessions.   The passcred require mecha­
                 nisms which pass client credentials  (and  allow
                 mechanisms which can pass credentials to do so).
                 The minssf=<factor> property specifies the mini­
                 mum  acceptable  security  strength factor as an
                 integer approximate to effective key length used
                 for encryption.  0 (zero) implies no protection,
                 1 implies integrity protection only,  56  allows
                 DES or other weak ciphers, 112 allows triple DES
                 and other strong ciphers, 128 allows RC4,  Blow­
                 fish  and  other  modern  strong  ciphers.   The
                 default  is  0.   The  maxssf=<factor>  property
                 specifies   the   maximum   acceptable  security
                 strength  factor  as  an  integer  (see   minssf
                 description).   The  default  is  INT_MAX.   The
                 maxbufsize=<factor> property specifies the maxi­
                 mum  security layer receive buffer size allowed.
                 0 disables  security  layers.   The  default  is
                 65536.

       SIZELIMIT <integer>
                 Used  to  specify  a size limit to use when per­
                 forming searches.  The number should be an  non-
                 negative  integer.  SIZELIMIT of zero (0) speci­
                 fies unlimited search size.

       TIMELIMIT <integer>
                 Used to specify a time limit to  use  when  per­
                 forming  searches.  The number should be an non-
                 negative integer.  TIMELIMIT of zero (0)  speci­
                 fies unlimited search time to be used.

       DEREF <never|searching|finding|always>
                 Specify   how  aliases  dereferencing  is  done.
                 DEREF should be set to  one  of  never,  always,

                 never dereferenced, always dereferenced,  deref­
                 erenced  when  searching,  or  dereferenced only
                 when locating the base object  for  the  search.
                 The default is to never dereference aliases.


FILES

       /etc/openldap/ldap.conf

       $HOME/.ldaprc

       $CWD/.ldaprc


SEE ALSO

       ldap(3)


AUTHOR

       Kurt Zeilenga, The OpenLDAP Project


ACKNOWLEDGEMENTS

       OpenLDAP  is developed and maintained by The OpenLDAP Pro­
       ject (http://www.openldap.org/).  OpenLDAP is derived from
       University of Michigan LDAP 3.3 Release.


Man(1) output converted with man2html