Blame SOURCES/sudo-ldap.conf

1b092f
## BINDDN DN
1b092f
##  The BINDDN parameter specifies the identity, in the form of a Dis‐
1b092f
##  tinguished Name (DN), to use when performing LDAP operations.  If
1b092f
##  not specified, LDAP operations are performed with an anonymous
1b092f
##  identity.  By default, most LDAP servers will allow anonymous
1b092f
##  access.
1b092f
##
1b092f
#binddn uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com
1b092f
1b092f
## BINDPW secret
1b092f
##  The BINDPW parameter specifies the password to use when performing
1b092f
##  LDAP operations.  This is typically used in conjunction with the
1b092f
##  BINDDN parameter.
1b092f
##
1b092f
#bindpw secret
1b092f
1b092f
## SSL start_tls
1b092f
##  If the SSL parameter is set to start_tls, the LDAP server connec‐
1b092f
##  tion is initiated normally and TLS encryption is begun before the
1b092f
##  bind credentials are sent.  This has the advantage of not requiring
1b092f
##  a dedicated port for encrypted communications.  This parameter is
1b092f
##  only supported by LDAP servers that honor the start_tls extension,
1b092f
##  such as the OpenLDAP and Tivoli Directory servers.
1b092f
##
1b092f
#ssl start_tls
1b092f
1b092f
## TLS_CACERTFILE file name
1b092f
##  The path to a certificate authority bundle which contains the cer‐
1b092f
##  tificates for all the Certificate Authorities the client knows to
1b092f
##  be valid, e.g. /etc/ssl/ca-bundle.pem.  This option is only sup‐
1b092f
##  ported by the OpenLDAP libraries.  Netscape-derived LDAP libraries
1b092f
##  use the same certificate database for CA and client certificates
1b092f
##  (see TLS_CERT).
1b092f
##
1b092f
#tls_cacertfile /path/to/CA.crt
1b092f
1b092f
## TLS_CHECKPEER on/true/yes/off/false/no
1b092f
##  If enabled, TLS_CHECKPEER will cause the LDAP server's TLS certifi‐
1b092f
##  cated to be verified.  If the server's TLS certificate cannot be
1b092f
##  verified (usually because it is signed by an unknown certificate
1b092f
##  authority), sudo will be unable to connect to it.  If TLS_CHECKPEER
1b092f
##  is disabled, no check is made.  Note that disabling the check cre‐
1b092f
##  ates an opportunity for man-in-the-middle attacks since the
1b092f
##  server's identity will not be authenticated.  If possible, the CA's
1b092f
##  certificate should be installed locally so it can be verified.
1b092f
##  This option is not supported by the Tivoli Directory Server LDAP
1b092f
##  libraries.
1b092f
#tls_checkpeer yes
1b092f
1b092f
##
1b092f
## URI ldap[s]://[hostname[:port]] ...
1b092f
##  Specifies a whitespace-delimited list of one or more
1b092f
##  URIs describing the LDAP server(s) to connect to. 
1b092f
##
1b092f
#uri ldap://ldapserver
1b092f
1b092f
##
1b092f
## SUDOERS_BASE base
1b092f
##  The base DN to use when performing sudo LDAP queries.
1b092f
##  Multiple SUDOERS_BASE lines may be specified, in which
1b092f
##  case they are queried in the order specified.
1b092f
##
1b092f
#sudoers_base ou=SUDOers,dc=example,dc=com
1b092f
1b092f
##
1b092f
## BIND_TIMELIMIT seconds
1b092f
##  The BIND_TIMELIMIT parameter specifies the amount of
1b092f
##  time to wait while trying to connect to an LDAP server.
1b092f
##
1b092f
#bind_timelimit 30
1b092f
1b092f
##
1b092f
## TIMELIMIT seconds
1b092f
##  The TIMELIMIT parameter specifies the amount of time
1b092f
##  to wait for a response to an LDAP query.
1b092f
##
1b092f
#timelimit 30
1b092f
1b092f
##
1b092f
## SUDOERS_DEBUG debug_level
1b092f
##  This sets the debug level for sudo LDAP queries. Debugging
1b092f
##  information is printed to the standard error. A value of 1
1b092f
##  results in a moderate amount of debugging information.
1b092f
##  A value of 2 shows the results of the matches themselves.
1b092f
##
1b092f
#sudoers_debug 1