Import de la config de slapd dans BCfg2
En passant, on passe au mode de rplication 'SyncRepl', qui permet une rplication from scratch sans dump de la base parente. darcs-hash:20080925004118-ffbb2-b6de13342ee17d92c37030f37b7e9c63a93cc628.gz
This commit is contained in:
Nicolas Dandrimont
parent
bfb6c05cfe
commit
df01def771
5 changed files with 547 additions and 2 deletions
48
Python/etc/default/slapd
Normal file
48
Python/etc/default/slapd
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
# -*- mode: python -*-
|
||||
|
||||
include("ip")
|
||||
|
||||
header('Fichier de configuration du démon slapd')
|
||||
|
||||
@Default location of the slapd.conf file
|
||||
@SLAPD_CONF=
|
||||
@
|
||||
@# System account to run the slapd server under. If empty the server
|
||||
@# will run as root.
|
||||
@SLAPD_USER=
|
||||
@
|
||||
@# System group to run the slapd server under. If empty the server will
|
||||
@# run in the primary group of its user.
|
||||
@SLAPD_GROUP=
|
||||
@
|
||||
@# Path to the pid file of the slapd server. If not set the init.d script
|
||||
@# will try to figure it out from $SLAPD_CONF (/etc/ldap/slapd.conf)
|
||||
@SLAPD_PIDFILE=
|
||||
@
|
||||
@# Configure if db_recover should be called before starting slapd
|
||||
@TRY_BDB_RECOVERY=yes
|
||||
@
|
||||
@# Configure if the slurpd daemon should be started. Possible values:
|
||||
@# - yes: Always start slurpd
|
||||
@# - no: Never start slurpd
|
||||
@# - auto: Start slurpd if a replica option is found in slapd.conf (default)
|
||||
@SLURPD_START=no
|
||||
@
|
||||
@# slapd normally serves ldap only on all TCP-ports 389. slapd can also
|
||||
@# service requests on TCP-port 636 (ldaps) and requests via unix
|
||||
@# sockets.
|
||||
@# Example usage:
|
||||
@SOCKET_PATH="/var/run/slapd/ldapi"
|
||||
|
||||
slapd_services = ["ldap://127.0.0.1/", "ldapi:///"]
|
||||
slapd_services += ["ldap://%s/" % admip()]
|
||||
|
||||
if has("sable"):
|
||||
slapd_services += ["ldaps://%s/" % pubip()]
|
||||
|
||||
print 'SLAPD_SERVICES="%s"' % ' '.join(slapd_services)
|
||||
@
|
||||
@# Additional options to pass to slapd and slurpd
|
||||
@SLAPD_OPTIONS=""
|
||||
@SLURPD_OPTIONS=""
|
||||
@
|
||||
167
Python/etc/ldap/slapd.conf
Normal file
167
Python/etc/ldap/slapd.conf
Normal file
|
|
@ -0,0 +1,167 @@
|
|||
# -*- mode: python; coding: utf-8 -*-
|
||||
|
||||
include("ip")
|
||||
|
||||
header("Serveur LDAP")
|
||||
|
||||
@#######################################################################
|
||||
@# Directives globales:
|
||||
@
|
||||
@# On permet le binding en version 2 pour login_ldap sur ragnarok
|
||||
@allow bind_v2
|
||||
@
|
||||
@# Définition des schémas et objectClasses
|
||||
@include /etc/ldap/schema/core.schema
|
||||
@include /etc/ldap/schema/cosine.schema
|
||||
@include /etc/ldap/schema/nis.schema
|
||||
@include /etc/ldap/schema/inetorgperson.schema
|
||||
@include /etc/ldap/schema/amavis.schema
|
||||
@include /etc/ldap/schema/crans.schema
|
||||
@
|
||||
@# Vérification de conformance au schéma pour les objets
|
||||
@schemacheck on
|
||||
@
|
||||
@# Emplacement du pidfile
|
||||
@pidfile /var/run/slapd/slapd.pid
|
||||
@
|
||||
@# Arguments passés au serveur
|
||||
@argsfile /var/run/slapd/slapd.args
|
||||
@
|
||||
@# Niveau de journalisation
|
||||
@loglevel 0
|
||||
@
|
||||
@# Stockage des modules
|
||||
@modulepath /usr/lib/ldap
|
||||
@moduleload back_bdb
|
||||
@
|
||||
@# Limitation du nombre de réponses
|
||||
@sizelimit 1000000000
|
||||
@
|
||||
@# Méthode pour crypter les mots de passe
|
||||
@password-hash {SSHA}
|
||||
@
|
||||
|
||||
if has("sable"):
|
||||
@# Configuration TLS pour la connexion à partir de ragnarok (login-ldap)
|
||||
@TLSCipherSuite HIGH:MEDIUM:+SSLv3
|
||||
@TLSCertificateFile /etc/ssl/certs/sable_server.pem
|
||||
@TLSCertificateKeyFile /etc/ssl/private/sable_privatekey.pem
|
||||
@TLSCACertificateFile /etc/ssl/certs/root.pem
|
||||
@TLSVerifyClient never
|
||||
|
||||
@#######################################################################
|
||||
@# Directives de configuration pour le backend bdb
|
||||
@backend bdb
|
||||
@
|
||||
@#######################################################################
|
||||
@# Configuration de la base de données principale
|
||||
@database bdb
|
||||
@
|
||||
@# Base de recherche principale
|
||||
@suffix "dc=crans,dc=org"
|
||||
@
|
||||
@# Répertoire de stockage de la base de données
|
||||
@directory "/var/lib/ldap"
|
||||
@
|
||||
@# Options d'indexation pour la base de données
|
||||
@index entryUUID,entryCSN eq
|
||||
@index objectClass,memberUid,uid,uidNumber eq
|
||||
@index cn,sn eq,approx,sub
|
||||
@index mailAlias,mail,canonicalAlias eq
|
||||
@index macAddress eq
|
||||
@index nom,host,hostAlias eq,approx,sub
|
||||
@index chbre eq,subinitial
|
||||
@index paiement,droits eq
|
||||
@
|
||||
@# Sauvegarde des timestamps de modifications des objets
|
||||
@lastmod on
|
||||
@
|
||||
|
||||
if has("db-main"):
|
||||
@# Overlay pour la synchronisation par syncprov
|
||||
@overlay syncprov
|
||||
@syncprov-checkpoint 100 10
|
||||
@syncprov-sessionlog 100
|
||||
|
||||
else:
|
||||
include("secrets")
|
||||
rid = admip()
|
||||
# L'identifiant du réplica est choisi comme étant la dernière partie de l'adresse ip
|
||||
rid = rid[rid.rfind(".")+1:]
|
||||
@# Réplication de la base
|
||||
@# LDAP a besoin de la déclaration du rootdn
|
||||
@rootdn="cn=damin,dc=crans,dc=org"
|
||||
@
|
||||
@# SyncRepl
|
||||
print "syncrepl rid=%s" % rid
|
||||
@ provider ldap://vert.adm.crans.org
|
||||
@ searchbase="dc=crans,dc=org"
|
||||
@ schemachecking=on
|
||||
@ type=refreshAndPersist
|
||||
print ' binddn="%s"' % secrets.ldap_replica_auth_dn
|
||||
@ bindmethod=simple
|
||||
print ' credentials=%s' % secrets.ldap_replica_password
|
||||
@ retry="30 20 300 3"
|
||||
@
|
||||
@# Redirection des requêtes en écriture, ...
|
||||
@updateref ldap://vert.adm.crans.org
|
||||
|
||||
@
|
||||
@# L'attribut userPassword doit pouvoir être écrit uniquement par
|
||||
@# soi-même, l'admin, les replicas. Dovecot peut le lire, et on peut
|
||||
@# s'authentifier avec anonymement
|
||||
@
|
||||
@access to attrs=userPassword
|
||||
@ by dn.regex="cn=admin,dc=crans,dc=org" write
|
||||
@ by dn.regex="cn=replica,dc=crans,dc=org" write
|
||||
@ by dn.regex="cn=dovecot,dc=crans,dc=org" read
|
||||
@ by anonymous auth
|
||||
@ by self write
|
||||
@ by * none
|
||||
@
|
||||
@# Permettre l'accès à la base pour des trucs comme
|
||||
@# "supportedSASLMechanisms", pour éviter des problèmes
|
||||
@# possibles si les méthodes SASL ne sont pas connues.
|
||||
@access to dn.base="" by * read
|
||||
@
|
||||
@# Pour postfix
|
||||
@access to dn.regex="^(a|c)id=[0-9]+,ou=data,dc=crans,dc=org$$"
|
||||
@ attrs=mailAlias,canonicalAlias,uid,mail,entry,objectClass,contourneGreylist,rewriteMailHeaders
|
||||
@ by dn.regex="cn=postfix,dc=crans,dc=org" read
|
||||
@ by * break
|
||||
@
|
||||
@# Pour intranet
|
||||
@access to dn.regex="^(a|c)id=[0-9]+,ou=data,dc=crans,dc=org$$"
|
||||
@ attrs=uid,entry,objectClass
|
||||
@ by dn.regex="cn=intranet,dc=crans,dc=org" read
|
||||
@ by * break
|
||||
@
|
||||
@# Pour dovecot
|
||||
@access to dn.regex="^(a|c)id=[0-9]+,ou=data,dc=crans,dc=org$$"
|
||||
@ attrs=uid,homeDirectory,uidNumber,gidNumber,userPassword,objectClass,entry
|
||||
@ by dn.regex="cn=dovecot,dc=crans,dc=org" read
|
||||
@ by * break
|
||||
@
|
||||
@# Informations accessibles à tous
|
||||
@access to dn.regex="^(a|c)id=[0-9]+,ou=data,dc=crans,dc=org$$"
|
||||
@ attrs=uid,homeDirectory,uidNumber,gidNumber,gecos,objectClass,entry
|
||||
@ by anonymous read
|
||||
@ by * break
|
||||
@
|
||||
@access to dn="ou=data,dc=crans,dc=org"
|
||||
@ by anonymous search
|
||||
@ by * break
|
||||
@
|
||||
@access to dn.subtree="ou=Group,dc=crans,dc=org"
|
||||
@ by anonymous read
|
||||
@ by * break
|
||||
@
|
||||
@# L'admin et la réplication peut tout lire
|
||||
@# can read everything.
|
||||
@access to *
|
||||
@ by dn.regex="cn=admin,dc=crans,dc=org" write
|
||||
@ by dn.regex="cn=replica,dc=crans,dc=org" write
|
||||
@ by sockname.regex="ldapi" read
|
||||
@ by dn.regex="cn=readonly,dc=crans,dc=org" read
|
||||
@ by self read
|
||||
@ by * none
|
||||
Loading…
Add table
Add a link
Reference in a new issue