22f5af
## BINDDN DN
22f5af
##  The BINDDN parameter specifies the identity, in the form of a Dis‐
22f5af
##  tinguished Name (DN), to use when performing LDAP operations.  If
22f5af
##  not specified, LDAP operations are performed with an anonymous
22f5af
##  identity.  By default, most LDAP servers will allow anonymous
22f5af
##  access.
22f5af
##
22f5af
#binddn uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com
22f5af
22f5af
## BINDPW secret
22f5af
##  The BINDPW parameter specifies the password to use when performing
22f5af
##  LDAP operations.  This is typically used in conjunction with the
22f5af
##  BINDDN parameter.
22f5af
##
22f5af
#bindpw secret
22f5af
22f5af
## SSL start_tls
22f5af
##  If the SSL parameter is set to start_tls, the LDAP server connec‐
22f5af
##  tion is initiated normally and TLS encryption is begun before the
22f5af
##  bind credentials are sent.  This has the advantage of not requiring
22f5af
##  a dedicated port for encrypted communications.  This parameter is
22f5af
##  only supported by LDAP servers that honor the start_tls extension,
22f5af
##  such as the OpenLDAP and Tivoli Directory servers.
22f5af
##
22f5af
#ssl start_tls
22f5af
22f5af
## TLS_CACERTFILE file name
22f5af
##  The path to a certificate authority bundle which contains the cer‐
22f5af
##  tificates for all the Certificate Authorities the client knows to
22f5af
##  be valid, e.g. /etc/ssl/ca-bundle.pem.  This option is only sup‐
22f5af
##  ported by the OpenLDAP libraries.  Netscape-derived LDAP libraries
22f5af
##  use the same certificate database for CA and client certificates
22f5af
##  (see TLS_CERT).
22f5af
##
22f5af
#tls_cacertfile /path/to/CA.crt
22f5af
22f5af
## TLS_CHECKPEER on/true/yes/off/false/no
22f5af
##  If enabled, TLS_CHECKPEER will cause the LDAP server's TLS certifi‐
22f5af
##  cated to be verified.  If the server's TLS certificate cannot be
22f5af
##  verified (usually because it is signed by an unknown certificate
22f5af
##  authority), sudo will be unable to connect to it.  If TLS_CHECKPEER
22f5af
##  is disabled, no check is made.  Note that disabling the check cre‐
22f5af
##  ates an opportunity for man-in-the-middle attacks since the
22f5af
##  server's identity will not be authenticated.  If possible, the CA's
22f5af
##  certificate should be installed locally so it can be verified.
22f5af
##  This option is not supported by the Tivoli Directory Server LDAP
22f5af
##  libraries.
22f5af
#tls_checkpeer yes
22f5af
22f5af
##
22f5af
## URI ldap[s]://[hostname[:port]] ...
22f5af
##  Specifies a whitespace-delimited list of one or more
22f5af
##  URIs describing the LDAP server(s) to connect to. 
22f5af
##
22f5af
#uri ldap://ldapserver
22f5af
22f5af
##
22f5af
## SUDOERS_BASE base
22f5af
##  The base DN to use when performing sudo LDAP queries.
22f5af
##  Multiple SUDOERS_BASE lines may be specified, in which
22f5af
##  case they are queried in the order specified.
22f5af
##
22f5af
#sudoers_base ou=SUDOers,dc=example,dc=com
22f5af
22f5af
##
22f5af
## BIND_TIMELIMIT seconds
22f5af
##  The BIND_TIMELIMIT parameter specifies the amount of
22f5af
##  time to wait while trying to connect to an LDAP server.
22f5af
##
22f5af
#bind_timelimit 30
22f5af
22f5af
##
22f5af
## TIMELIMIT seconds
22f5af
##  The TIMELIMIT parameter specifies the amount of time
22f5af
##  to wait for a response to an LDAP query.
22f5af
##
22f5af
#timelimit 30
22f5af
22f5af
##
22f5af
## SUDOERS_DEBUG debug_level
22f5af
##  This sets the debug level for sudo LDAP queries. Debugging
22f5af
##  information is printed to the standard error. A value of 1
22f5af
##  results in a moderate amount of debugging information.
22f5af
##  A value of 2 shows the results of the matches themselves.
22f5af
##
22f5af
#sudoers_debug 1