82 lines
2.5 KiB
XML
82 lines
2.5 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
|
|
<appendix>
|
|
<title>Typical OpenLDAP settings</title>
|
|
|
|
<para>Some basic hints to configure the OpenLDAP server:</para>
|
|
|
|
<para><emphasis id="size_limit_exceeded" role="bold">Size
|
|
limit:</emphasis></para>
|
|
|
|
<para>You will get a message like "LDAP sizelimit exceeded, not all
|
|
entries are shown." when you hit the LDAP search limit.</para>
|
|
|
|
<para>OpenLDAP allows by default 500 return values per search, if you have
|
|
more users/groups/hosts please change this:</para>
|
|
|
|
<para>slapd.conf:</para>
|
|
|
|
<para>e.g. "sizelimit 10000" or "sizelimit -1" for unlimited return
|
|
values</para>
|
|
|
|
<para>slapd.d:</para>
|
|
|
|
<para>e.g. "olcSizeLimit: 10000" or "olcSizeLimit: -1" for unlimited
|
|
return values in /etc/ldap/slapd.d/cn=config.ldif</para>
|
|
|
|
<literallayout>
|
|
</literallayout>
|
|
|
|
<para><emphasis id="a_openldap_unique" role="bold">Unique
|
|
attributes:</emphasis></para>
|
|
|
|
<para>There are cases where you do not want that same attribute values
|
|
exist multiple times in your database. A good example are UID/GID
|
|
numbers.</para>
|
|
|
|
<para>OpenLDAP provides the <ulink
|
|
url="http://www.openldap.org/doc/admin24/overlays.html">attribute
|
|
uniqueness overlay</ulink> for this task.</para>
|
|
|
|
<para>Example to force unique UID numbers:</para>
|
|
|
|
<para>In
|
|
<emphasis>/etc/ldap/slapd.d/cn=config/cn=module{0}.ldif</emphasis> add
|
|
"olcModuleLoad: {3}unique" (replace "3" with the highest existing number
|
|
plus one).</para>
|
|
|
|
<para>Now in /etc/ldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif add e.g.
|
|
"olcUniqueURI: ldap:///?uidNumber?sub"</para>
|
|
|
|
<literallayout>
|
|
</literallayout>
|
|
|
|
<para id="indices"><emphasis role="bold">Indices:</emphasis></para>
|
|
|
|
<para>Indices will improve the performance when searching for entries in
|
|
the LDAP directory. The following indices are recommended:</para>
|
|
|
|
<simplelist>
|
|
<member>index objectClass eq</member>
|
|
|
|
<member>index default sub</member>
|
|
|
|
<member>index uidNumber eq</member>
|
|
|
|
<member>index gidNumber eq</member>
|
|
|
|
<member>index memberUid eq</member>
|
|
|
|
<member>index cn,sn,uid,displayName pres,sub,eq</member>
|
|
|
|
<member># Samba 3.x</member>
|
|
|
|
<member>index sambaSID eq</member>
|
|
|
|
<member>index sambaPrimaryGroupSID eq</member>
|
|
|
|
<member>index sambaDomainName eq</member>
|
|
</simplelist>
|
|
</appendix>
|