File _service:obs_scm:utsudo-ldap.conf of Package utsudo

## BINDDN DN
##  The BINDDN parameter specifies the identity, in the form of a Dis‐
##  tinguished Name (DN), to use when performing LDAP operations.  If
##  not specified, LDAP operations are performed with an anonymous
##  identity.  By default, most LDAP servers will allow anonymous
##  access.
##
#binddn uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com

## BINDPW secret
##  The BINDPW parameter specifies the password to use when performing
##  LDAP operations.  This is typically used in conjunction with the
##  BINDDN parameter.
##
#bindpw secret

## SSL start_tls
##  If the SSL parameter is set to start_tls, the LDAP server connec‐
##  tion is initiated normally and TLS encryption is begun before the
##  bind credentials are sent.  This has the advantage of not requiring
##  a dedicated port for encrypted communications.  This parameter is
##  only supported by LDAP servers that honor the start_tls extension,
##  such as the OpenLDAP and Tivoli Directory servers.
##
#ssl start_tls

## TLS_CACERTFILE file name
##  The path to a certificate authority bundle which contains the cer‐
##  tificates for all the Certificate Authorities the client knows to
##  be valid, e.g. /etc/ssl/ca-bundle.pem.  This option is only sup‐
##  ported by the OpenLDAP libraries.  Netscape-derived LDAP libraries
##  use the same certificate database for CA and client certificates
##  (see TLS_CERT).
##
#tls_cacertfile /path/to/CA.crt

## TLS_CHECKPEER on/true/yes/off/false/no
##  If enabled, TLS_CHECKPEER will cause the LDAP server's TLS certifi‐
##  cated to be verified.  If the server's TLS certificate cannot be
##  verified (usually because it is signed by an unknown certificate
##  authority), sudo will be unable to connect to it.  If TLS_CHECKPEER
##  is disabled, no check is made.  Note that disabling the check cre‐
##  ates an opportunity for man-in-the-middle attacks since the
##  server's identity will not be authenticated.  If possible, the CA's
##  certificate should be installed locally so it can be verified.
##  This option is not supported by the Tivoli Directory Server LDAP
##  libraries.
#tls_checkpeer yes

##
## URI ldap[s]://[hostname[:port]] ...
##  Specifies a whitespace-delimited list of one or more
##  URIs describing the LDAP server(s) to connect to. 
##
#uri ldap://ldapserver

##
## SUDOERS_BASE base
##  The base DN to use when performing sudo LDAP queries.
##  Multiple SUDOERS_BASE lines may be specified, in which
##  case they are queried in the order specified.
##
#sudoers_base ou=SUDOers,dc=example,dc=com

##
## BIND_TIMELIMIT seconds
##  The BIND_TIMELIMIT parameter specifies the amount of
##  time to wait while trying to connect to an LDAP server.
##
#bind_timelimit 30

##
## TIMELIMIT seconds
##  The TIMELIMIT parameter specifies the amount of time
##  to wait for a response to an LDAP query.
##
#timelimit 30

##
## SUDOERS_DEBUG debug_level
##  This sets the debug level for sudo LDAP queries. Debugging
##  information is printed to the standard error. A value of 1
##  results in a moderate amount of debugging information.
##  A value of 2 shows the results of the matches themselves.
##
#sudoers_debug 1