732 lines
20 KiB
HTML
732 lines
20 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of LDAP.CONF</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>LDAP.CONF</H1>
|
|
Section: File Formats (5)<BR>Updated: 2020/01/30<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
|
|
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
ldap.conf, .ldaprc - LDAP configuration file/environment variables
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
/etc/ldap/ldap.conf, ldaprc, .ldaprc, $LDAP<option-name>
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
If the environment variable <B>LDAPNOINIT</B> is defined, all
|
|
defaulting is disabled.
|
|
<P>
|
|
|
|
The
|
|
<I>ldap.conf</I>
|
|
|
|
configuration file is used to set system-wide defaults to be applied when
|
|
running
|
|
<I>ldap</I>
|
|
|
|
clients.
|
|
<P>
|
|
|
|
Users may create an optional configuration file,
|
|
<I>ldaprc</I>
|
|
|
|
or
|
|
<I>.ldaprc</I>,
|
|
|
|
in their home directory which will be used to override the system-wide
|
|
defaults file.
|
|
The file
|
|
<I>ldaprc</I>
|
|
|
|
in the current working directory is also used.
|
|
<P>
|
|
|
|
<P>
|
|
|
|
Additional configuration files can be specified using
|
|
the <B>LDAPCONF</B> and <B>LDAPRC</B> environment variables.
|
|
<B>LDAPCONF</B> may be set to the path of a configuration file. This
|
|
path can be absolute or relative to the current working directory.
|
|
The <B>LDAPRC</B>, if defined, should be the basename of a file
|
|
in the current working directory or in the user's home directory.
|
|
<P>
|
|
|
|
Environmental variables may also be used to augment the file based defaults.
|
|
The name of the variable is the option name with an added prefix of <B>LDAP</B>.
|
|
For example, to define <B>BASE</B> via the environment, set the variable
|
|
<B>LDAPBASE</B> to the desired value.
|
|
<P>
|
|
|
|
Some options are user-only. Such options are ignored if present
|
|
in the
|
|
<I>ldap.conf</I>
|
|
|
|
(or file specified by
|
|
<B>LDAPCONF</B>).
|
|
|
|
<P>
|
|
|
|
Thus the following files and variables are read, in order:
|
|
<PRE>
|
|
variable $LDAPNOINIT, and if that is not set:
|
|
system file /etc/ldap/ldap.conf,
|
|
user files $HOME/ldaprc, $HOME/.ldaprc, ./ldaprc,
|
|
system file $LDAPCONF,
|
|
user files $HOME/$LDAPRC, $HOME/.$LDAPRC, ./$LDAPRC,
|
|
variables $LDAP<uppercase option name>.
|
|
</PRE>
|
|
|
|
Settings late in the list override earlier ones.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>SYNTAX</H2>
|
|
|
|
The configuration options are case-insensitive;
|
|
their value, on a case by case basis, may be case-sensitive.
|
|
<P>
|
|
|
|
Blank lines are ignored.
|
|
<BR>
|
|
|
|
Lines beginning with a hash mark (`#') are comments, and ignored.
|
|
<P>
|
|
|
|
Valid lines are made of an option's name (a sequence of non-blanks,
|
|
conventionally written in uppercase, although not required),
|
|
followed by a value.
|
|
The value starts with the first non-blank character after
|
|
the option's name, and terminates at the end of the line,
|
|
or at the last sequence of blanks before the end of the line.
|
|
The tokenization of the value, if any, is delegated to the handler(s)
|
|
for that option, if any. Quoting values that contain blanks
|
|
may be incorrect, as the quotes would become part of the value.
|
|
For example,
|
|
<P>
|
|
<PRE>
|
|
# Wrong - erroneous quotes:
|
|
URI "ldap:// ldaps://"
|
|
|
|
# Right - space-separated list of URIs, without quotes:
|
|
URI ldap:// ldaps://
|
|
|
|
# Right - DN syntax needs quoting for Example, Inc:
|
|
BASE ou=IT staff,o="Example, Inc",c=US
|
|
# or:
|
|
BASE ou=IT staff,o=Example\2C Inc,c=US
|
|
|
|
# Wrong - comment on same line as option:
|
|
DEREF never # Never follow aliases
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
A line cannot be longer than LINE_MAX, which should be more than 2000 bytes
|
|
on all platforms.
|
|
There is no mechanism to split a long line on multiple lines, either for
|
|
beautification or to overcome the above limit.
|
|
<A NAME="lbAF"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
The different configuration options are:
|
|
<DL COMPACT>
|
|
<DT id="1"><B>URI <ldap[si]://[name[:port]] ...></B>
|
|
|
|
<DD>
|
|
Specifies the URI(s) of an LDAP server(s) to which the
|
|
<I>LDAP </I>
|
|
|
|
library should connect. The URI scheme may be any of
|
|
<B>ldap</B>,
|
|
|
|
<B>ldaps </B>
|
|
|
|
or
|
|
<B>ldapi</B>,
|
|
|
|
which refer to LDAP over TCP, LDAP over SSL (TLS) and LDAP
|
|
over IPC (UNIX domain sockets), respectively.
|
|
Each server's name can be specified as a
|
|
domain-style name or an IP address literal. Optionally, the
|
|
server's name can followed by a ':' and the port number the LDAP
|
|
server is listening on. If no port number is provided, the default
|
|
port for the scheme is used (389 for <A HREF="ldap://,">ldap://,</A> 636 for <A HREF="ldaps://).">ldaps://).</A>
|
|
For LDAP over IPC,
|
|
<B>name </B>
|
|
|
|
is the name of the socket, and no
|
|
<B>port</B>
|
|
|
|
is required, nor allowed; note that directory separators must be
|
|
URL-encoded, like any other characters that are special to URLs;
|
|
so the socket
|
|
<P>
|
|
<TT> </TT>/usr/local/var/ldapi<BR>
|
|
<P>
|
|
must be specified as
|
|
<P>
|
|
<TT> </TT><A HREF="ldapi://%2Fusr%2Flocal%2Fvar%2Fldapi">ldapi://%2Fusr%2Flocal%2Fvar%2Fldapi</A><BR>
|
|
<P>
|
|
A space separated list of URIs may be provided.
|
|
<DT id="2"><B>BASE <base></B>
|
|
|
|
<DD>
|
|
Specifies the default base DN to use when performing ldap operations.
|
|
The base must be specified as a Distinguished Name in LDAP format.
|
|
<DT id="3"><B>BINDDN <dn></B>
|
|
|
|
<DD>
|
|
Specifies the default bind DN to use when performing ldap operations.
|
|
The bind DN must be specified as a Distinguished Name in LDAP format.
|
|
<B>This is a user-only option.</B>
|
|
|
|
<DT id="4"><B>DEREF <when></B>
|
|
|
|
<DD>
|
|
Specifies how alias dereferencing is done when performing a search. The
|
|
<B><when></B>
|
|
|
|
can be specified as one of the following keywords:
|
|
<DL COMPACT><DT id="5"><DD>
|
|
<DL COMPACT>
|
|
<DT id="6"><B>never</B>
|
|
|
|
<DD>
|
|
Aliases are never dereferenced. This is the default.
|
|
<DT id="7"><B>searching</B>
|
|
|
|
<DD>
|
|
Aliases are dereferenced in subordinates of the base object, but
|
|
not in locating the base object of the search.
|
|
<DT id="8"><B>finding</B>
|
|
|
|
<DD>
|
|
Aliases are only dereferenced when locating the base object of the search.
|
|
<DT id="9"><B>always</B>
|
|
|
|
<DD>
|
|
Aliases are dereferenced both in searching and in locating the base object
|
|
of the search.
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="10"><DT><B>HOST <name[:port] ...></B>
|
|
|
|
<DD>
|
|
<DD>
|
|
Specifies the name(s) of an LDAP server(s) to which the
|
|
<I>LDAP </I>
|
|
|
|
library should connect. Each server's name can be specified as a
|
|
domain-style name or an IP address and optionally followed by a ':' and
|
|
the port number the ldap server is listening on. A space separated
|
|
list of hosts may be provided.
|
|
<B>HOST</B>
|
|
|
|
is deprecated in favor of
|
|
<B>URI</B>.
|
|
|
|
<DT id="11"><B>NETWORK_TIMEOUT <integer></B>
|
|
|
|
<DD>
|
|
Specifies the timeout (in seconds) after which the <A HREF="/cgi-bin/man/man2html?2+poll">poll</A>(2)/<A HREF="/cgi-bin/man/man2html?2+select">select</A>(2)
|
|
following a <A HREF="/cgi-bin/man/man2html?2+connect">connect</A>(2) returns in case of no activity.
|
|
<DT id="12"><B>PORT <port></B>
|
|
|
|
<DD>
|
|
Specifies the default port used when connecting to LDAP servers(s).
|
|
The port may be specified as a number.
|
|
<B>PORT</B>
|
|
|
|
is deprecated in favor of
|
|
<B>URI.</B>
|
|
|
|
<DT id="13"><B>REFERRALS <on/true/yes/off/false/no></B>
|
|
|
|
<DD>
|
|
Specifies if the client should automatically follow referrals returned
|
|
by LDAP servers.
|
|
The default is on.
|
|
Note that the command line tools
|
|
<B><A HREF="/cgi-bin/man/man2html?1+ldapsearch">ldapsearch</A></B>(1)
|
|
|
|
&co always override this option.
|
|
|
|
|
|
|
|
|
|
<DT id="14"><B>SIZELIMIT <integer></B>
|
|
|
|
<DD>
|
|
Specifies a size limit (number of entries) to use when performing searches.
|
|
The number should be a non-negative integer. <I>SIZELIMIT</I> of zero (0)
|
|
specifies a request for unlimited search size. Please note that the server
|
|
may still apply any server-side limit on the amount of entries that can be
|
|
returned by a search operation.
|
|
<DT id="15"><B>TIMELIMIT <integer></B>
|
|
|
|
<DD>
|
|
Specifies a time limit (in seconds) to use when performing searches.
|
|
The number should be a non-negative integer. <I>TIMELIMIT</I> of zero (0)
|
|
specifies unlimited search time to be used. Please note that the server
|
|
may still apply any server-side limit on the duration of a search operation.
|
|
<DT id="16"><B>VERSION {2|3}</B>
|
|
|
|
<DD>
|
|
Specifies what version of the LDAP protocol should be used.
|
|
<DT id="17"><B>TIMEOUT <integer></B>
|
|
|
|
<DD>
|
|
Specifies a timeout (in seconds) after which calls to synchronous LDAP
|
|
APIs will abort if no response is received. Also used for any
|
|
<B><A HREF="/cgi-bin/man/man2html?3+ldap_result">ldap_result</A></B>(3)
|
|
|
|
calls where a NULL timeout parameter is supplied.
|
|
</DL>
|
|
<A NAME="lbAG"> </A>
|
|
<H2>SASL OPTIONS</H2>
|
|
|
|
If OpenLDAP is built with Simple Authentication and Security Layer support,
|
|
there are more options you can specify.
|
|
<DL COMPACT>
|
|
<DT id="18"><B>SASL_MECH <mechanism></B>
|
|
|
|
<DD>
|
|
Specifies the SASL mechanism to use.
|
|
<DT id="19"><B>SASL_REALM <realm></B>
|
|
|
|
<DD>
|
|
Specifies the SASL realm.
|
|
<DT id="20"><B>SASL_AUTHCID <authcid></B>
|
|
|
|
<DD>
|
|
Specifies the authentication identity.
|
|
<B>This is a user-only option.</B>
|
|
|
|
<DT id="21"><B>SASL_AUTHZID <authcid></B>
|
|
|
|
<DD>
|
|
Specifies the proxy authorization identity.
|
|
<B>This is a user-only option.</B>
|
|
|
|
<DT id="22"><B>SASL_SECPROPS <properties></B>
|
|
|
|
<DD>
|
|
Specifies Cyrus SASL security properties. The
|
|
<B><properties></B>
|
|
|
|
can be specified as a comma-separated list of the following:
|
|
<DL COMPACT><DT id="23"><DD>
|
|
<DL COMPACT>
|
|
<DT id="24"><B>none</B>
|
|
|
|
<DD>
|
|
(without any other properties) causes the properties
|
|
defaults ("noanonymous,noplain") to be cleared.
|
|
<DT id="25"><B>noplain</B>
|
|
|
|
<DD>
|
|
disables mechanisms susceptible to simple passive attacks.
|
|
<DT id="26"><B>noactive</B>
|
|
|
|
<DD>
|
|
disables mechanisms susceptible to active attacks.
|
|
<DT id="27"><B>nodict</B>
|
|
|
|
<DD>
|
|
disables mechanisms susceptible to passive dictionary attacks.
|
|
<DT id="28"><B>noanonymous</B>
|
|
|
|
<DD>
|
|
disables mechanisms which support anonymous login.
|
|
<DT id="29"><B>forwardsec</B>
|
|
|
|
<DD>
|
|
requires forward secrecy between sessions.
|
|
<DT id="30"><B>passcred</B>
|
|
|
|
<DD>
|
|
requires mechanisms which pass client credentials (and allows
|
|
mechanisms which can pass credentials to do so).
|
|
<DT id="31"><B>minssf=<factor> </B>
|
|
|
|
<DD>
|
|
specifies the minimum acceptable
|
|
<I>security strength factor</I>
|
|
|
|
as an integer approximating the effective key length used for
|
|
encryption. 0 (zero) implies no protection, 1 implies integrity
|
|
protection only, 56 allows DES or other weak ciphers, 112
|
|
allows triple DES and other strong ciphers, 128 allows RC4,
|
|
Blowfish and other modern strong ciphers. The default is 0.
|
|
<DT id="32"><B>maxssf=<factor> </B>
|
|
|
|
<DD>
|
|
specifies the maximum acceptable
|
|
<I>security strength factor</I>
|
|
|
|
as an integer (see
|
|
<B>minssf</B>
|
|
|
|
description). The default is
|
|
<B>INT_MAX</B>.
|
|
|
|
<DT id="33"><B>maxbufsize=<factor> </B>
|
|
|
|
<DD>
|
|
specifies the maximum security layer receive buffer
|
|
size allowed. 0 disables security layers. The default is 65536.
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="34"><B>SASL_NOCANON <on/true/yes/off/false/no></B>
|
|
|
|
<DD>
|
|
Do not perform reverse DNS lookups to canonicalize SASL host names. The default is off.
|
|
</DL>
|
|
<A NAME="lbAH"> </A>
|
|
<H2>GSSAPI OPTIONS</H2>
|
|
|
|
If OpenLDAP is built with Generic Security Services Application Programming Interface support,
|
|
there are more options you can specify.
|
|
<DL COMPACT>
|
|
<DT id="35"><B>GSSAPI_SIGN <on/true/yes/off/false/no></B>
|
|
|
|
<DD>
|
|
Specifies if GSSAPI signing (GSS_C_INTEG_FLAG) should be used.
|
|
The default is off.
|
|
<DT id="36"><B>GSSAPI_ENCRYPT <on/true/yes/off/false/no></B>
|
|
|
|
<DD>
|
|
Specifies if GSSAPI encryption (GSS_C_INTEG_FLAG and GSS_C_CONF_FLAG)
|
|
should be used. The default is off.
|
|
<DT id="37"><B>GSSAPI_ALLOW_REMOTE_PRINCIPAL <on/true/yes/off/false/no></B>
|
|
|
|
<DD>
|
|
Specifies if GSSAPI based authentication should try to form the
|
|
target principal name out of the ldapServiceName or dnsHostName
|
|
attribute of the targets RootDSE entry. The default is off.
|
|
</DL>
|
|
<A NAME="lbAI"> </A>
|
|
<H2>TLS OPTIONS</H2>
|
|
|
|
If OpenLDAP is built with Transport Layer Security support, there
|
|
are more options you can specify. These options are used when an
|
|
<B>ldaps:// URI</B>
|
|
|
|
is selected (by default or otherwise) or when the application
|
|
negotiates TLS by issuing the LDAP StartTLS operation.
|
|
<DL COMPACT>
|
|
<DT id="38"><B>TLS_CACERT <filename></B>
|
|
|
|
<DD>
|
|
Specifies the file that contains certificates for all of the Certificate
|
|
Authorities the client will recognize.
|
|
<DT id="39"><B>TLS_CACERTDIR <path></B>
|
|
|
|
<DD>
|
|
Specifies the path of a directory that contains Certificate Authority
|
|
certificates in separate individual files. The
|
|
<B>TLS_CACERT</B>
|
|
|
|
is always used before
|
|
<B>TLS_CACERTDIR.</B>
|
|
|
|
This parameter is ignored with GnuTLS. On Debian openldap is linked against GnuTLS.
|
|
<P>
|
|
When using Mozilla NSS, <path> may contain a Mozilla NSS cert/key
|
|
database. If <path> contains a Mozilla NSS cert/key database and
|
|
CA cert files, OpenLDAP will use the cert/key database and will
|
|
ignore the CA cert files.
|
|
<DT id="40"><B>TLS_CERT <filename></B>
|
|
|
|
<DD>
|
|
Specifies the file that contains the client certificate.
|
|
<B>This is a user-only option.</B>
|
|
|
|
<P>
|
|
When using Mozilla NSS, if using a cert/key database (specified with
|
|
TLS_CACERTDIR), TLS_CERT specifies the name of the certificate to use:
|
|
<PRE>
|
|
TLS_CERT Certificate for Sam Carter
|
|
</PRE>
|
|
|
|
If using a token other than the internal built in token, specify the
|
|
token name first, followed by a colon:
|
|
<PRE>
|
|
TLS_CERT my hardware device:Certificate for Sam Carter
|
|
</PRE>
|
|
|
|
Use certutil -L to list the certificates by name:
|
|
<PRE>
|
|
certutil -d /path/to/certdbdir -L
|
|
</PRE>
|
|
|
|
<DT id="41"><B>TLS_KEY <filename></B>
|
|
|
|
<DD>
|
|
Specifies the file that contains the private key that matches the certificate
|
|
stored in the
|
|
<B>TLS_CERT</B>
|
|
|
|
file. Currently, the private key must not be protected with a password, so
|
|
it is of critical importance that the key file is protected carefully.
|
|
<B>This is a user-only option.</B>
|
|
|
|
<P>
|
|
When using Mozilla NSS, TLS_KEY specifies the name of a file that contains
|
|
the password for the key for the certificate specified with TLS_CERT. The
|
|
modutil command can be used to turn off password protection for the cert/key
|
|
database. For example, if TLS_CACERTDIR specifies /home/scarter/.moznss as
|
|
the location of the cert/key database, use modutil to change the password
|
|
to the empty string:
|
|
<PRE>
|
|
modutil -dbdir ~/.moznss -changepw 'NSS Certificate DB'
|
|
</PRE>
|
|
|
|
You must have the old password, if any. Ignore the WARNING about the running
|
|
browser. Press 'Enter' for the new password.
|
|
<P>
|
|
<DT id="42"><B>TLS_CIPHER_SUITE <cipher-suite-spec></B>
|
|
|
|
<DD>
|
|
Specifies acceptable cipher suite and preference order.
|
|
<cipher-suite-spec> should be a cipher specification for
|
|
the TLS library in use (OpenSSL, GnuTLS, or Mozilla NSS).
|
|
Example:
|
|
<DL COMPACT><DT id="43"><DD>
|
|
<DL COMPACT><DT id="44"><DD>
|
|
<DL COMPACT>
|
|
<DT id="45"><I>OpenSSL:</I>
|
|
|
|
<DD>
|
|
TLS_CIPHER_SUITE HIGH:MEDIUM:+SSLv2
|
|
<DT id="46"><I>GnuTLS:</I>
|
|
|
|
<DD>
|
|
TLS_CIPHER_SUITE SECURE256:!AES-128-CBC
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
To check what ciphers a given spec selects in OpenSSL, use:
|
|
<P>
|
|
<PRE>
|
|
openssl ciphers -v <cipher-suite-spec>
|
|
</PRE>
|
|
|
|
<P>
|
|
With GnuTLS the available specs can be found in the manual page of
|
|
<B><A HREF="/cgi-bin/man/man2html?1+gnutls-cli">gnutls-cli</A></B>(1)
|
|
|
|
(see the description of the
|
|
option
|
|
<B>--priority</B>).
|
|
|
|
<P>
|
|
In older versions of GnuTLS, where gnutls-cli does not support the option
|
|
--priority, you can obtain the --- more limited --- list of ciphers by calling:
|
|
<P>
|
|
<PRE>
|
|
gnutls-cli -l
|
|
</PRE>
|
|
|
|
<P>
|
|
When using Mozilla NSS, the OpenSSL cipher suite specifications are used and
|
|
translated into the format used internally by Mozilla NSS. There isn't an easy
|
|
way to list the cipher suites from the command line. The authoritative list
|
|
is in the source code for Mozilla NSS in the file sslinfo.c in the structure
|
|
<PRE>
|
|
static const SSLCipherSuiteInfo suiteInfo[]
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<DT id="47"><B>TLS_PROTOCOL_MIN <major>[.<minor>]</B>
|
|
|
|
<DD>
|
|
Specifies minimum SSL/TLS protocol version that will be negotiated.
|
|
If the server doesn't support at least that version,
|
|
the SSL handshake will fail.
|
|
To require TLS 1.x or higher, set this option to 3.(x+1),
|
|
e.g.,
|
|
<P>
|
|
<PRE>
|
|
TLS_PROTOCOL_MIN 3.2
|
|
</PRE>
|
|
|
|
<P>
|
|
would require TLS 1.1.
|
|
Specifying a minimum that is higher than that supported by the
|
|
OpenLDAP implementation will result in it requiring the
|
|
highest level that it does support.
|
|
This parameter is ignored with GnuTLS.
|
|
<DT id="48"><B>TLS_RANDFILE <filename></B>
|
|
|
|
<DD>
|
|
Specifies the file to obtain random bits from when /dev/[u]random is
|
|
not available. Generally set to the name of the EGD/PRNGD socket.
|
|
The environment variable RANDFILE can also be used to specify the filename.
|
|
This parameter is ignored with GnuTLS and Mozilla NSS. On Debian openldap is linked against GnuTLS.
|
|
<DT id="49"><B>TLS_REQCERT <level></B>
|
|
|
|
<DD>
|
|
Specifies what checks to perform on server certificates in a TLS session,
|
|
if any. The
|
|
<B><level></B>
|
|
|
|
can be specified as one of the following keywords:
|
|
<DL COMPACT><DT id="50"><DD>
|
|
<DL COMPACT>
|
|
<DT id="51"><B>never</B>
|
|
|
|
<DD>
|
|
The client will not request or check any server certificate.
|
|
<DT id="52"><B>allow</B>
|
|
|
|
<DD>
|
|
The server certificate is requested. If no certificate is provided,
|
|
the session proceeds normally. If a bad certificate is provided, it will
|
|
be ignored and the session proceeds normally.
|
|
<DT id="53"><B>try</B>
|
|
|
|
<DD>
|
|
The server certificate is requested. If no certificate is provided,
|
|
the session proceeds normally. If a bad certificate is provided,
|
|
the session is immediately terminated.
|
|
<DT id="54"><B>demand | hard</B>
|
|
|
|
<DD>
|
|
These keywords are equivalent. The server certificate is requested. If no
|
|
certificate is provided, or a bad certificate is provided, the session
|
|
is immediately terminated. This is the default setting.
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="55"><B>TLS_CRLCHECK <level></B>
|
|
|
|
<DD>
|
|
Specifies if the Certificate Revocation List (CRL) of the CA should be
|
|
used to verify if the server certificates have not been revoked. This
|
|
requires
|
|
<B>TLS_CACERTDIR</B>
|
|
|
|
parameter to be set. This parameter is ignored with GnuTLS and Mozilla NSS. On Debian openldap is linked against GnuTLS.
|
|
<B><level></B>
|
|
|
|
can be specified as one of the following keywords:
|
|
<DL COMPACT><DT id="56"><DD>
|
|
<DL COMPACT>
|
|
<DT id="57"><B>none</B>
|
|
|
|
<DD>
|
|
No CRL checks are performed
|
|
<DT id="58"><B>peer</B>
|
|
|
|
<DD>
|
|
Check the CRL of the peer certificate
|
|
<DT id="59"><B>all</B>
|
|
|
|
<DD>
|
|
Check the CRL for a whole certificate chain
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="60"><B>TLS_CRLFILE <filename></B>
|
|
|
|
<DD>
|
|
Specifies the file containing a Certificate Revocation List to be used
|
|
to verify if the server certificates have not been revoked. This
|
|
parameter is only supported with GnuTLS and Mozilla NSS.
|
|
</DL>
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>ENVIRONMENT VARIABLES</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="61">LDAPNOINIT<DD>
|
|
disable all defaulting
|
|
<DT id="62">LDAPCONF<DD>
|
|
path of a configuration file
|
|
<DT id="63">LDAPRC<DD>
|
|
basename of ldaprc file in $HOME or $CWD
|
|
<DT id="64">LDAP<option-name><DD>
|
|
Set <option-name> as from ldap.conf
|
|
</DL>
|
|
<A NAME="lbAK"> </A>
|
|
<H2>FILES</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="65"><I>/etc/ldap/ldap.conf</I>
|
|
|
|
<DD>
|
|
system-wide ldap configuration file
|
|
<DT id="66"><I>$HOME/ldaprc, $HOME/.ldaprc</I>
|
|
|
|
<DD>
|
|
user ldap configuration file
|
|
<DT id="67"><I>$CWD/ldaprc</I>
|
|
|
|
<DD>
|
|
local ldap configuration file
|
|
</DL>
|
|
<A NAME="lbAL"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+ldap">ldap</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+ldap_set_option">ldap_set_option</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+ldap_result">ldap_result</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+openssl">openssl</A></B>(1),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+sasl">sasl</A></B>(3)
|
|
|
|
<A NAME="lbAM"> </A>
|
|
<H2>AUTHOR</H2>
|
|
|
|
Kurt Zeilenga, The OpenLDAP Project
|
|
<A NAME="lbAN"> </A>
|
|
<H2>ACKNOWLEDGEMENTS</H2>
|
|
|
|
|
|
|
|
<B>OpenLDAP Software</B>
|
|
|
|
is developed and maintained by The OpenLDAP Project <<A HREF="http://www.openldap.org/">http://www.openldap.org/</A>>.
|
|
<B>OpenLDAP Software</B>
|
|
|
|
is derived from the University of Michigan LDAP 3.3 Release.
|
|
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="68"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="69"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="70"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="71"><A HREF="#lbAE">SYNTAX</A><DD>
|
|
<DT id="72"><A HREF="#lbAF">OPTIONS</A><DD>
|
|
<DT id="73"><A HREF="#lbAG">SASL OPTIONS</A><DD>
|
|
<DT id="74"><A HREF="#lbAH">GSSAPI OPTIONS</A><DD>
|
|
<DT id="75"><A HREF="#lbAI">TLS OPTIONS</A><DD>
|
|
<DT id="76"><A HREF="#lbAJ">ENVIRONMENT VARIABLES</A><DD>
|
|
<DT id="77"><A HREF="#lbAK">FILES</A><DD>
|
|
<DT id="78"><A HREF="#lbAL">SEE ALSO</A><DD>
|
|
<DT id="79"><A HREF="#lbAM">AUTHOR</A><DD>
|
|
<DT id="80"><A HREF="#lbAN">ACKNOWLEDGEMENTS</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:03 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|