on the line. Note that leading white space is removed from the beginning
of lines even when the continuation character is used.
- U\bUR\bRI\bI _\bl_\bd_\ba_\bp_\b[_\bs_\b]_\b:_\b/_\b/_\b[_\bh_\bo_\bs_\bt_\bn_\ba_\bm_\be_\b[_\b:_\bp_\bo_\br_\bt_\b]_\b] _\b._\b._\b.
- Specifies a white space-delimited list of one or more URIs
- describing the LDAP server(s) to connect to. The _\bp_\br_\bo_\bt_\bo_\bc_\bo_\bl may be
- either _\bl_\bd_\ba_\bp _\bl_\bd_\ba_\bp_\bs, the latter being for servers that support TLS
- (SSL) encryption. If no _\bp_\bo_\br_\bt is specified, the default is port 389
- for ldap:// or port 636 for ldaps://. If no _\bh_\bo_\bs_\bt_\bn_\ba_\bm_\be is specified,
- s\bsu\bud\bdo\bo will connect to _\bl_\bo_\bc_\ba_\bl_\bh_\bo_\bs_\bt. Multiple U\bUR\bRI\bI lines are treated
- identically to a U\bUR\bRI\bI line containing multiple entries. Only
- systems using the OpenSSL libraries support the mixing of ldap://
- and ldaps:// URIs. Both the Netscape-derived and Tivoli LDAP
- libraries used on most commercial versions of Unix are only capable
- of supporting one or the other.
-
- H\bHO\bOS\bST\bT _\bn_\ba_\bm_\be_\b[_\b:_\bp_\bo_\br_\bt_\b] _\b._\b._\b.
- If no U\bUR\bRI\bI is specified, the H\bHO\bOS\bST\bT parameter specifies a white space-
- delimited list of LDAP servers to connect to. Each host may
- include an optional _\bp_\bo_\br_\bt separated by a colon (`:'). The H\bHO\bOS\bST\bT
- parameter is deprecated in favor of the U\bUR\bRI\bI specification and is
- included for backwards compatibility.
-
- P\bPO\bOR\bRT\bT _\bp_\bo_\br_\bt_\b__\bn_\bu_\bm_\bb_\be_\br
- If no U\bUR\bRI\bI is specified, the P\bPO\bOR\bRT\bT parameter specifies the default
- port to connect to on the LDAP server if a H\bHO\bOS\bST\bT parameter does not
- specify the port itself. If no P\bPO\bOR\bRT\bT parameter is used, the default
- is port 389 for LDAP and port 636 for LDAP over TLS (SSL). The
- P\bPO\bOR\bRT\bT parameter is deprecated in favor of the U\bUR\bRI\bI specification and
- is included for backwards compatibility.
-
B\bBI\bIN\bND\bD_\b_T\bTI\bIM\bME\bEL\bLI\bIM\bMI\bIT\bT _\bs_\be_\bc_\bo_\bn_\bd_\bs
The B\bBI\bIN\bND\bD_\b_T\bTI\bIM\bME\bEL\bLI\bIM\bMI\bIT\bT parameter specifies the amount of time, in
seconds, to wait while trying to connect to an LDAP server. If
multiple U\bUR\bRI\bIs or H\bHO\bOS\bST\bTs are specified, this is the amount of time to
wait before trying the next one in the list.
- N\bNE\bET\bTW\bWO\bOR\bRK\bK_\b_T\bTI\bIM\bME\bEO\bOU\bUT\bT _\bs_\be_\bc_\bo_\bn_\bd_\bs
- An alias for B\bBI\bIN\bND\bD_\b_T\bTI\bIM\bME\bEL\bLI\bIM\bMI\bIT\bT for OpenLDAP compatibility.
-
- T\bTI\bIM\bME\bEL\bLI\bIM\bMI\bIT\bT _\bs_\be_\bc_\bo_\bn_\bd_\bs
- The T\bTI\bIM\bME\bEL\bLI\bIM\bMI\bIT\bT parameter specifies the amount of time, in seconds,
- to wait for a response to an LDAP query.
-
- T\bTI\bIM\bME\bEO\bOU\bUT\bT _\bs_\be_\bc_\bo_\bn_\bd_\bs
- The T\bTI\bIM\bME\bEO\bOU\bUT\bT parameter specifies the amount of time, in seconds, to
- wait for a response from the various LDAP APIs.
-
- S\bSU\bUD\bDO\bOE\bER\bRS\bS_\b_B\bBA\bAS\bSE\bE _\bb_\ba_\bs_\be
- The base DN to use when performing s\bsu\bud\bdo\bo LDAP queries. Typically
- this is of the form ou=SUDOers,dc=example,dc=com for the domain
- example.com. Multiple S\bSU\bUD\bDO\bOE\bER\bRS\bS_\b_B\bBA\bAS\bSE\bE lines may be specified, in
- which case they are queried in the order specified.
-
- S\bSU\bUD\bDO\bOE\bER\bRS\bS_\b_S\bSE\bEA\bAR\bRC\bCH\bH_\b_F\bFI\bIL\bLT\bTE\bER\bR _\bl_\bd_\ba_\bp_\b__\bf_\bi_\bl_\bt_\be_\br
- An LDAP filter which is used to restrict the set of records
- returned when performing a s\bsu\bud\bdo\bo LDAP query. Typically, this is of
- the form attribute=value or
- (&(attribute=value)(attribute2=value2)). The default search filter
- is: objectClass=sudoRole. If _\bl_\bd_\ba_\bp_\b__\bf_\bi_\bl_\bt_\be_\br is omitted, no search
- filter will be used.
-
- S\bSU\bUD\bDO\bOE\bER\bRS\bS_\b_T\bTI\bIM\bME\bED\bD _\bo_\bn_\b/_\bt_\br_\bu_\be_\b/_\by_\be_\bs_\b/_\bo_\bf_\bf_\b/_\bf_\ba_\bl_\bs_\be_\b/_\bn_\bo
- Whether or not to evaluate the sudoNotBefore and sudoNotAfter
- attributes that implement time-dependent sudoers entries.
-
- S\bSU\bUD\bDO\bOE\bER\bRS\bS_\b_D\bDE\bEB\bBU\bUG\bG _\bd_\be_\bb_\bu_\bg_\b__\bl_\be_\bv_\be_\bl
- This sets the debug level for s\bsu\bud\bdo\bo LDAP queries. Debugging
- information is printed to the standard error. A value of 1 results
- in a moderate amount of debugging information. A value of 2 shows
- the results of the matches themselves. This parameter should not
- be set in a production environment as the extra information is
- likely to confuse users.
-
- The S\bSU\bUD\bDO\bOE\bER\bRS\bS_\b_D\bDE\bEB\bBU\bUG\bG parameter is deprecated and will be removed in a
- future release. The same information is now logged via the s\bsu\bud\bdo\bo
- debugging framework using the ``ldap'' subsystem at priorities _\bd_\bi_\ba_\bg
- and _\bi_\bn_\bf_\bo for _\bd_\be_\bb_\bu_\bg_\b__\bl_\be_\bv_\be_\bl values 1 and 2 respectively. See the
- sudo.conf(4) manual for details on how to configure s\bsu\bud\bdo\bo debugging.
-
B\bBI\bIN\bND\bDD\bDN\bN _\bD_\bN
The B\bBI\bIN\bND\bDD\bDN\bN parameter specifies the identity, in the form of a
Distinguished Name (DN), to use when performing LDAP operations.
character (`#') and the escaping of special characters with a
backslash (`\') is not supported.
+ D\bDE\bER\bRE\bEF\bF _\bn_\be_\bv_\be_\br_\b/_\bs_\be_\ba_\br_\bc_\bh_\bi_\bn_\bg_\b/_\bf_\bi_\bn_\bd_\bi_\bn_\bg_\b/_\ba_\bl_\bw_\ba_\by_\bs
+ How alias dereferencing is to be performed when searching. See the
+ ldap.conf(1m) manual for a full description of this option.
+
+ H\bHO\bOS\bST\bT _\bn_\ba_\bm_\be_\b[_\b:_\bp_\bo_\br_\bt_\b] _\b._\b._\b.
+ If no U\bUR\bRI\bI is specified (see below), the H\bHO\bOS\bST\bT parameter specifies a
+ white space-delimited list of LDAP servers to connect to. Each
+ host may include an optional _\bp_\bo_\br_\bt separated by a colon (`:'). The
+ H\bHO\bOS\bST\bT parameter is deprecated in favor of the U\bUR\bRI\bI specification and
+ is included for backwards compatibility only.
+
+ K\bKR\bRB\bB5\b5_\b_C\bCC\bCN\bNA\bAM\bME\bE _\bf_\bi_\bl_\be _\bn_\ba_\bm_\be
+ The path to the Kerberos 5 credential cache to use when
+ authenticating with the remote server. This option is only
+ relevant when using SASL authentication (see below).
+
+ L\bLD\bDA\bAP\bP_\b_V\bVE\bER\bRS\bSI\bIO\bON\bN _\bn_\bu_\bm_\bb_\be_\br
+ The version of the LDAP protocol to use when connecting to the
+ server. The default value is protocol version 3.
+
+ N\bNE\bET\bTW\bWO\bOR\bRK\bK_\b_T\bTI\bIM\bME\bEO\bOU\bUT\bT _\bs_\be_\bc_\bo_\bn_\bd_\bs
+ An alias for B\bBI\bIN\bND\bD_\b_T\bTI\bIM\bME\bEL\bLI\bIM\bMI\bIT\bT provided for OpenLDAP compatibility.
+
+ P\bPO\bOR\bRT\bT _\bp_\bo_\br_\bt_\b__\bn_\bu_\bm_\bb_\be_\br
+ If no U\bUR\bRI\bI is specified, the P\bPO\bOR\bRT\bT parameter specifies the default
+ port to connect to on the LDAP server if a H\bHO\bOS\bST\bT parameter does not
+ specify the port itself. If no P\bPO\bOR\bRT\bT parameter is used, the default
+ is port 389 for LDAP and port 636 for LDAP over TLS (SSL). The
+ P\bPO\bOR\bRT\bT parameter is deprecated in favor of the U\bUR\bRI\bI specification and
+ is included for backwards compatibility only.
+
R\bRO\bOO\bOT\bTB\bBI\bIN\bND\bDD\bDN\bN _\bD_\bN
The R\bRO\bOO\bOT\bTB\bBI\bIN\bND\bDD\bDN\bN parameter specifies the identity, in the form of a
Distinguished Name (DN), to use when performing privileged LDAP
_\b/_\be_\bt_\bc_\b/_\bl_\bd_\ba_\bp_\b._\bs_\be_\bc_\br_\be_\bt. If no R\bRO\bOO\bOT\bTB\bBI\bIN\bND\bDD\bDN\bN is specified, the B\bBI\bIN\bND\bDD\bDN\bN
identity is used (if any).
- L\bLD\bDA\bAP\bP_\b_V\bVE\bER\bRS\bSI\bIO\bON\bN _\bn_\bu_\bm_\bb_\be_\br
- The version of the LDAP protocol to use when connecting to the
- server. The default value is protocol version 3.
+ R\bRO\bOO\bOT\bTU\bUS\bSE\bE_\b_S\bSA\bAS\bSL\bL _\bo_\bn_\b/_\bt_\br_\bu_\be_\b/_\by_\be_\bs_\b/_\bo_\bf_\bf_\b/_\bf_\ba_\bl_\bs_\be_\b/_\bn_\bo
+ Enable R\bRO\bOO\bOT\bTU\bUS\bSE\bE_\b_S\bSA\bAS\bSL\bL to enable SASL authentication when connecting
+ to an LDAP server from a privileged process, such as s\bsu\bud\bdo\bo.
+
+ S\bSA\bAS\bSL\bL_\b_A\bAU\bUT\bTH\bH_\b_I\bID\bD _\bi_\bd_\be_\bn_\bt_\bi_\bt_\by
+ The SASL user name to use when connecting to the LDAP server. By
+ default, s\bsu\bud\bdo\bo will use an anonymous connection. This option is
+ only relevant when using SASL authentication.
+
+ S\bSA\bAS\bSL\bL_\b_S\bSE\bEC\bCP\bPR\bRO\bOP\bPS\bS _\bn_\bo_\bn_\be_\b/_\bp_\br_\bo_\bp_\be_\br_\bt_\bi_\be_\bs
+ SASL security properties or _\bn_\bo_\bn_\be for no properties. See the SASL
+ programmer's manual for details. This option is only relevant when
+ using SASL authentication.
S\bSS\bSL\bL _\bo_\bn_\b/_\bt_\br_\bu_\be_\b/_\by_\be_\bs_\b/_\bo_\bf_\bf_\b/_\bf_\ba_\bl_\bs_\be_\b/_\bn_\bo
If the S\bSS\bSL\bL parameter is set to on, true or yes, TLS (SSL)
_\bs_\bt_\ba_\br_\bt_\b__\bt_\bl_\bs extension, such as the OpenLDAP and Tivoli Directory
servers.
- T\bTL\bLS\bS_\b_C\bCH\bHE\bEC\bCK\bKP\bPE\bEE\bER\bR _\bo_\bn_\b/_\bt_\br_\bu_\be_\b/_\by_\be_\bs_\b/_\bo_\bf_\bf_\b/_\bf_\ba_\bl_\bs_\be_\b/_\bn_\bo
- If enabled, T\bTL\bLS\bS_\b_C\bCH\bHE\bEC\bCK\bKP\bPE\bEE\bER\bR will cause the LDAP server's TLS
- certificated to be verified. If the server's TLS certificate
- cannot be verified (usually because it is signed by an unknown
- certificate authority), s\bsu\bud\bdo\bo will be unable to connect to it. If
- T\bTL\bLS\bS_\b_C\bCH\bHE\bEC\bCK\bKP\bPE\bEE\bER\bR is disabled, no check is made. Note that disabling
- the check creates an opportunity for man-in-the-middle attacks
- since the server's identity will not be authenticated. If
- possible, the CA's certificate should be installed locally so it
- can be verified. This option is not supported by the Tivoli
- Directory Server LDAP libraries.
+ S\bSU\bUD\bDO\bOE\bER\bRS\bS_\b_B\bBA\bAS\bSE\bE _\bb_\ba_\bs_\be
+ The base DN to use when performing s\bsu\bud\bdo\bo LDAP queries. Typically
+ this is of the form ou=SUDOers,dc=example,dc=com for the domain
+ example.com. Multiple S\bSU\bUD\bDO\bOE\bER\bRS\bS_\b_B\bBA\bAS\bSE\bE lines may be specified, in
+ which case they are queried in the order specified.
+
+ S\bSU\bUD\bDO\bOE\bER\bRS\bS_\b_D\bDE\bEB\bBU\bUG\bG _\bd_\be_\bb_\bu_\bg_\b__\bl_\be_\bv_\be_\bl
+ This sets the debug level for s\bsu\bud\bdo\bo LDAP queries. Debugging
+ information is printed to the standard error. A value of 1 results
+ in a moderate amount of debugging information. A value of 2 shows
+ the results of the matches themselves. This parameter should not
+ be set in a production environment as the extra information is
+ likely to confuse users.
+
+ The S\bSU\bUD\bDO\bOE\bER\bRS\bS_\b_D\bDE\bEB\bBU\bUG\bG parameter is deprecated and will be removed in a
+ future release. The same information is now logged via the s\bsu\bud\bdo\bo
+ debugging framework using the ``ldap'' subsystem at priorities _\bd_\bi_\ba_\bg
+ and _\bi_\bn_\bf_\bo for _\bd_\be_\bb_\bu_\bg_\b__\bl_\be_\bv_\be_\bl values 1 and 2 respectively. See the
+ sudo.conf(4) manual for details on how to configure s\bsu\bud\bdo\bo debugging.
+
+ S\bSU\bUD\bDO\bOE\bER\bRS\bS_\b_S\bSE\bEA\bAR\bRC\bCH\bH_\b_F\bFI\bIL\bLT\bTE\bER\bR _\bl_\bd_\ba_\bp_\b__\bf_\bi_\bl_\bt_\be_\br
+ An LDAP filter which is used to restrict the set of records
+ returned when performing a s\bsu\bud\bdo\bo LDAP query. Typically, this is of
+ the form attribute=value or
+ (&(attribute=value)(attribute2=value2)). The default search filter
+ is: objectClass=sudoRole. If _\bl_\bd_\ba_\bp_\b__\bf_\bi_\bl_\bt_\be_\br is omitted, no search
+ filter will be used.
+
+ S\bSU\bUD\bDO\bOE\bER\bRS\bS_\b_T\bTI\bIM\bME\bED\bD _\bo_\bn_\b/_\bt_\br_\bu_\be_\b/_\by_\be_\bs_\b/_\bo_\bf_\bf_\b/_\bf_\ba_\bl_\bs_\be_\b/_\bn_\bo
+ Whether or not to evaluate the sudoNotBefore and sudoNotAfter
+ attributes that implement time-dependent sudoers entries.
+
+ T\bTI\bIM\bME\bEL\bLI\bIM\bMI\bIT\bT _\bs_\be_\bc_\bo_\bn_\bd_\bs
+ The T\bTI\bIM\bME\bEL\bLI\bIM\bMI\bIT\bT parameter specifies the amount of time, in seconds,
+ to wait for a response to an LDAP query.
+
+ T\bTI\bIM\bME\bEO\bOU\bUT\bT _\bs_\be_\bc_\bo_\bn_\bd_\bs
+ The T\bTI\bIM\bME\bEO\bOU\bUT\bT parameter specifies the amount of time, in seconds, to
+ wait for a response from the various LDAP APIs.
T\bTL\bLS\bS_\b_C\bCA\bAC\bCE\bER\bRT\bT _\bf_\bi_\bl_\be _\bn_\ba_\bm_\be
An alias for T\bTL\bLS\bS_\b_C\bCA\bAC\bCE\bER\bRT\bTF\bFI\bIL\bLE\bE for OpenLDAP compatibility.
When using Netscape-derived libraries, this file may also
contain Certificate Authority certificates.
+ T\bTL\bLS\bS_\b_C\bCH\bHE\bEC\bCK\bKP\bPE\bEE\bER\bR _\bo_\bn_\b/_\bt_\br_\bu_\be_\b/_\by_\be_\bs_\b/_\bo_\bf_\bf_\b/_\bf_\ba_\bl_\bs_\be_\b/_\bn_\bo
+ If enabled, T\bTL\bLS\bS_\b_C\bCH\bHE\bEC\bCK\bKP\bPE\bEE\bER\bR will cause the LDAP server's TLS
+ certificated to be verified. If the server's TLS certificate
+ cannot be verified (usually because it is signed by an unknown
+ certificate authority), s\bsu\bud\bdo\bo will be unable to connect to it. If
+ T\bTL\bLS\bS_\b_C\bCH\bHE\bEC\bCK\bKP\bPE\bEE\bER\bR is disabled, no check is made. Note that disabling
+ the check creates an opportunity for man-in-the-middle attacks
+ since the server's identity will not be authenticated. If
+ possible, the CA's certificate should be installed locally so it
+ can be verified. This option is not supported by the Tivoli
+ Directory Server LDAP libraries.
+
T\bTL\bLS\bS_\b_K\bKE\bEY\bY _\bf_\bi_\bl_\be _\bn_\ba_\bm_\be
The path to a file containing the private key which matches the
certificate specified by T\bTL\bLS\bS_\b_C\bCE\bER\bRT\bT. The private key must not be
When using Tivoli LDAP libraries, this file may also contain
Certificate Authority and client certificates and may be encrypted.
+ T\bTL\bLS\bS_\b_C\bCI\bIP\bPH\bHE\bER\bRS\bS _\bc_\bi_\bp_\bh_\be_\br _\bl_\bi_\bs_\bt
+ The T\bTL\bLS\bS_\b_C\bCI\bIP\bPH\bHE\bER\bRS\bS parameter allows the administer to restrict which
+ encryption algorithms may be used for TLS (SSL) connections. See
+ the OpenLDAP or Tivoli Directory Server manual for a list of valid
+ ciphers. This option is not supported by Netscape-derived
+ libraries.
+
T\bTL\bLS\bS_\b_K\bKE\bEY\bYP\bPW\bW _\bs_\be_\bc_\br_\be_\bt
The T\bTL\bLS\bS_\b_K\bKE\bEY\bYP\bPW\bW contains the password used to decrypt the key
database on clients using the Tivoli Directory Server LDAP library.
conjunction with _\bp_\br_\bn_\bg_\bd or _\be_\bg_\bd. This option is only supported by
the OpenLDAP libraries.
- T\bTL\bLS\bS_\b_C\bCI\bIP\bPH\bHE\bER\bRS\bS _\bc_\bi_\bp_\bh_\be_\br _\bl_\bi_\bs_\bt
- The T\bTL\bLS\bS_\b_C\bCI\bIP\bPH\bHE\bER\bRS\bS parameter allows the administer to restrict which
- encryption algorithms may be used for TLS (SSL) connections. See
- the OpenLDAP or Tivoli Directory Server manual for a list of valid
- ciphers. This option is not supported by Netscape-derived
- libraries.
+ U\bUR\bRI\bI _\bl_\bd_\ba_\bp_\b[_\bs_\b]_\b:_\b/_\b/_\b[_\bh_\bo_\bs_\bt_\bn_\ba_\bm_\be_\b[_\b:_\bp_\bo_\br_\bt_\b]_\b] _\b._\b._\b.
+ Specifies a white space-delimited list of one or more URIs
+ describing the LDAP server(s) to connect to. The _\bp_\br_\bo_\bt_\bo_\bc_\bo_\bl may be
+ either _\bl_\bd_\ba_\bp _\bl_\bd_\ba_\bp_\bs, the latter being for servers that support TLS
+ (SSL) encryption. If no _\bp_\bo_\br_\bt is specified, the default is port 389
+ for ldap:// or port 636 for ldaps://. If no _\bh_\bo_\bs_\bt_\bn_\ba_\bm_\be is specified,
+ s\bsu\bud\bdo\bo will connect to _\bl_\bo_\bc_\ba_\bl_\bh_\bo_\bs_\bt. Multiple U\bUR\bRI\bI lines are treated
+ identically to a U\bUR\bRI\bI line containing multiple entries. Only
+ systems using the OpenSSL libraries support the mixing of ldap://
+ and ldaps:// URIs. Both the Netscape-derived and Tivoli LDAP
+ libraries used on most commercial versions of Unix are only capable
+ of supporting one or the other.
U\bUS\bSE\bE_\b_S\bSA\bAS\bSL\bL _\bo_\bn_\b/_\bt_\br_\bu_\be_\b/_\by_\be_\bs_\b/_\bo_\bf_\bf_\b/_\bf_\ba_\bl_\bs_\be_\b/_\bn_\bo
Enable U\bUS\bSE\bE_\b_S\bSA\bAS\bSL\bL for LDAP servers that support SASL authentication.
- S\bSA\bAS\bSL\bL_\b_A\bAU\bUT\bTH\bH_\b_I\bID\bD _\bi_\bd_\be_\bn_\bt_\bi_\bt_\by
- The SASL user name to use when connecting to the LDAP server. By
- default, s\bsu\bud\bdo\bo will use an anonymous connection.
-
- R\bRO\bOO\bOT\bTU\bUS\bSE\bE_\b_S\bSA\bAS\bSL\bL _\bo_\bn_\b/_\bt_\br_\bu_\be_\b/_\by_\be_\bs_\b/_\bo_\bf_\bf_\b/_\bf_\ba_\bl_\bs_\be_\b/_\bn_\bo
- Enable R\bRO\bOO\bOT\bTU\bUS\bSE\bE_\b_S\bSA\bAS\bSL\bL to enable SASL authentication when connecting
- to an LDAP server from a privileged process, such as s\bsu\bud\bdo\bo.
-
R\bRO\bOO\bOT\bTS\bSA\bAS\bSL\bL_\b_A\bAU\bUT\bTH\bH_\b_I\bID\bD _\bi_\bd_\be_\bn_\bt_\bi_\bt_\by
The SASL user name to use when R\bRO\bOO\bOT\bTU\bUS\bSE\bE_\b_S\bSA\bAS\bSL\bL is enabled.
- S\bSA\bAS\bSL\bL_\b_S\bSE\bEC\bCP\bPR\bRO\bOP\bPS\bS _\bn_\bo_\bn_\be_\b/_\bp_\br_\bo_\bp_\be_\br_\bt_\bi_\be_\bs
- SASL security properties or _\bn_\bo_\bn_\be for no properties. See the SASL
- programmer's manual for details.
-
- K\bKR\bRB\bB5\b5_\b_C\bCC\bCN\bNA\bAM\bME\bE _\bf_\bi_\bl_\be _\bn_\ba_\bm_\be
- The path to the Kerberos 5 credential cache to use when
- authenticating with the remote server.
-
- D\bDE\bER\bRE\bEF\bF _\bn_\be_\bv_\be_\br_\b/_\bs_\be_\ba_\br_\bc_\bh_\bi_\bn_\bg_\b/_\bf_\bi_\bn_\bd_\bi_\bn_\bg_\b/_\ba_\bl_\bw_\ba_\by_\bs
- How alias dereferencing is to be performed when searching. See the
- ldap.conf(1m) manual for a full description of this option.
-
See the _\bl_\bd_\ba_\bp_\b._\bc_\bo_\bn_\bf entry in the _\bE_\bX_\bA_\bM_\bP_\bL_\bE_\bS section.
C\bCo\bon\bnf\bfi\big\bgu\bur\bri\bin\bng\bg n\bns\bss\bsw\bwi\bit\btc\bch\bh.\b.c\bco\bon\bnf\bf
file distributed with s\bsu\bud\bdo\bo or http://www.sudo.ws/license.html for
complete details.
-Sudo 1.8.12 December 4, 2014 Sudo 1.8.12
+Sudo 1.8.12 January 26, 2015 Sudo 1.8.12
.\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER!
.\" IT IS GENERATED AUTOMATICALLY FROM sudoers.ldap.mdoc.in
.\"
-.\" Copyright (c) 2003-2014 Todd C. Miller <Todd.Miller@courtesan.com>
+.\" Copyright (c) 2003-2015 Todd C. Miller <Todd.Miller@courtesan.com>
.\"
.\" Permission to use, copy, modify, and distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.TH "SUDOERS.LDAP" "8" "December 4, 2014" "Sudo @PACKAGE_VERSION@" "System Manager's Manual"
+.TH "SUDOERS.LDAP" "8" "January 26, 2015" "Sudo @PACKAGE_VERSION@" "System Manager's Manual"
.nh
.if n .ad l
.SH "NAME"
Note that leading white space is removed from the beginning of lines
even when the continuation character is used.
.TP 6n
-\fBURI\fR \fIldap[s]://[hostname[:port]] ...\fR
-Specifies a white space-delimited list of one or more URIs describing
-the LDAP server(s) to connect to.
-The
-\fIprotocol\fR
-may be either
-\fIldap\fR
-\fIldaps\fR,
-the latter being for servers that support TLS (SSL) encryption.
-If no
-\fIport\fR
-is specified, the default is port 389 for
-\fRldap://\fR
-or port 636 for
-\fRldaps://\fR.
-If no
-\fIhostname\fR
-is specified,
-\fBsudo\fR
-will connect to
-\fIlocalhost\fR.
-Multiple
-\fBURI\fR
-lines are treated identically to a
-\fBURI\fR
-line containing multiple entries.
-Only systems using the OpenSSL libraries support the mixing of
-\fRldap://\fR
-and
-\fRldaps://\fR
-URIs.
-Both the Netscape-derived and Tivoli LDAP libraries used on most commercial
-versions of Unix are only capable of supporting one or the other.
-.TP 6n
-\fBHOST\fR \fIname[:port] ...\fR
-If no
-\fBURI\fR
-is specified, the
-\fBHOST\fR
-parameter specifies a white space-delimited list of LDAP servers to connect to.
-Each host may include an optional
-\fIport\fR
-separated by a colon
-(\(oq:\&\(cq).
-The
-\fBHOST\fR
-parameter is deprecated in favor of the
-\fBURI\fR
-specification and is included for backwards compatibility.
-.TP 6n
-\fBPORT\fR \fIport_number\fR
-If no
-\fBURI\fR
-is specified, the
-\fBPORT\fR
-parameter specifies the default port to connect to on the LDAP server if a
-\fBHOST\fR
-parameter does not specify the port itself.
-If no
-\fBPORT\fR
-parameter is used, the default is port 389 for LDAP and port 636 for LDAP
-over TLS (SSL).
-The
-\fBPORT\fR
-parameter is deprecated in favor of the
-\fBURI\fR
-specification and is included for backwards compatibility.
-.TP 6n
\fBBIND_TIMELIMIT\fR \fIseconds\fR
The
\fBBIND_TIMELIMIT\fR
are specified, this is the amount of time to wait before trying
the next one in the list.
.TP 6n
-\fBNETWORK_TIMEOUT\fR \fIseconds\fR
-An alias for
-\fBBIND_TIMELIMIT\fR
-for OpenLDAP compatibility.
-.TP 6n
-\fBTIMELIMIT\fR \fIseconds\fR
-The
-\fBTIMELIMIT\fR
-parameter specifies the amount of time, in seconds, to wait for a
-response to an LDAP query.
-.TP 6n
-\fBTIMEOUT\fR \fIseconds\fR
-The
-\fBTIMEOUT\fR
-parameter specifies the amount of time, in seconds, to wait for a
-response from the various LDAP APIs.
-.TP 6n
-\fBSUDOERS_BASE\fR \fIbase\fR
-The base DN to use when performing
-\fBsudo\fR
-LDAP queries.
-Typically this is of the form
-\fRou=SUDOers,dc=example,dc=com\fR
-for the domain
-\fRexample.com\fR.
-Multiple
-\fBSUDOERS_BASE\fR
-lines may be specified, in which case they are queried in the order specified.
-.TP 6n
-\fBSUDOERS_SEARCH_FILTER\fR \fIldap_filter\fR
-An LDAP filter which is used to restrict the set of records returned
-when performing a
-\fBsudo\fR
-LDAP query.
-Typically, this is of the
-form
-\fRattribute=value\fR
-or
-\fR(&(attribute=value)(attribute2=value2))\fR.
-The default search filter is:
-\fRobjectClass=sudoRole\fR.
-If
-\fIldap_filter\fR
-is omitted, no search filter will be used.
-.TP 6n
-\fBSUDOERS_TIMED\fR \fIon/true/yes/off/false/no\fR
-Whether or not to evaluate the
-\fRsudoNotBefore\fR
-and
-\fRsudoNotAfter\fR
-attributes that implement time-dependent sudoers entries.
-.TP 6n
-\fBSUDOERS_DEBUG\fR \fIdebug_level\fR
-This sets the debug level for
-\fBsudo\fR
-LDAP queries.
-Debugging information is printed to the standard error.
-A value of 1 results in a moderate amount of debugging information.
-A value of 2 shows the results of the matches themselves.
-This parameter should not be set in a production environment as the
-extra information is likely to confuse users.
-.sp
-The
-\fBSUDOERS_DEBUG\fR
-parameter is deprecated and will be removed in a future release.
-The same information is now logged via the
-\fBsudo\fR
-debugging framework using the
-\(lqldap\(rq
-subsystem at priorities
-\fIdiag\fR
-and
-\fIinfo\fR
-for
-\fIdebug_level\fR
-values 1 and 2 respectively.
-See the
-sudo.conf(@mansectform@)
-manual for details on how to configure
-\fBsudo\fR
-debugging.
-.TP 6n
\fBBINDDN\fR \fIDN\fR
The
\fBBINDDN\fR
is not supported.
.RE
.TP 6n
+\fBDEREF\fR \fInever/searching/finding/always\fR
+How alias dereferencing is to be performed when searching.
+See the
+ldap.conf(@mansectsu@)
+manual for a full description of this option.
+.TP 6n
+\fBHOST\fR \fIname[:port] ...\fR
+If no
+\fBURI\fR
+is specified (see below), the
+\fBHOST\fR
+parameter specifies a white space-delimited list of LDAP servers to connect to.
+Each host may include an optional
+\fIport\fR
+separated by a colon
+(\(oq:\&\(cq).
+The
+\fBHOST\fR
+parameter is deprecated in favor of the
+\fBURI\fR
+specification and is included for backwards compatibility only.
+.TP 6n
+\fBKRB5_CCNAME\fR \fIfile name\fR
+The path to the Kerberos 5 credential cache to use when authenticating
+with the remote server.
+This option is only relevant when using SASL authentication (see below).
+.TP 6n
+\fBLDAP_VERSION\fR \fInumber\fR
+The version of the LDAP protocol to use when connecting to the server.
+The default value is protocol version 3.
+.TP 6n
+\fBNETWORK_TIMEOUT\fR \fIseconds\fR
+An alias for
+\fBBIND_TIMELIMIT\fR
+provided for OpenLDAP compatibility.
+.TP 6n
+\fBPORT\fR \fIport_number\fR
+If no
+\fBURI\fR
+is specified, the
+\fBPORT\fR
+parameter specifies the default port to connect to on the LDAP server if a
+\fBHOST\fR
+parameter does not specify the port itself.
+If no
+\fBPORT\fR
+parameter is used, the default is port 389 for LDAP and port 636 for LDAP
+over TLS (SSL).
+The
+\fBPORT\fR
+parameter is deprecated in favor of the
+\fBURI\fR
+specification and is included for backwards compatibility only.
+.TP 6n
\fBROOTBINDDN\fR \fIDN\fR
The
\fBROOTBINDDN\fR
\fBBINDDN\fR
identity is used (if any).
.TP 6n
-\fBLDAP_VERSION\fR \fInumber\fR
-The version of the LDAP protocol to use when connecting to the server.
-The default value is protocol version 3.
+\fBROOTUSE_SASL\fR \fIon/true/yes/off/false/no\fR
+Enable
+\fBROOTUSE_SASL\fR
+to enable SASL authentication when connecting
+to an LDAP server from a privileged process, such as
+\fBsudo\fR.
+.TP 6n
+\fBSASL_AUTH_ID\fR \fIidentity\fR
+The SASL user name to use when connecting to the LDAP server.
+By default,
+\fBsudo\fR
+will use an anonymous connection.
+This option is only relevant when using SASL authentication.
+.TP 6n
+\fBSASL_SECPROPS\fR \fInone/properties\fR
+SASL security properties or
+\fInone\fR
+for no properties.
+See the SASL programmer's manual for details.
+This option is only relevant when using SASL authentication.
.TP 6n
\fBSSL\fR \fIon/true/yes/off/false/no\fR
If the
\fIstart_tls\fR
extension, such as the OpenLDAP and Tivoli Directory servers.
.TP 6n
-\fBTLS_CHECKPEER\fR \fIon/true/yes/off/false/no\fR
-If enabled,
-\fBTLS_CHECKPEER\fR
-will cause the LDAP server's TLS certificated to be verified.
-If the server's TLS certificate cannot be verified (usually because it
-is signed by an unknown certificate authority),
+\fBSUDOERS_BASE\fR \fIbase\fR
+The base DN to use when performing
\fBsudo\fR
-will be unable to connect to it.
+LDAP queries.
+Typically this is of the form
+\fRou=SUDOers,dc=example,dc=com\fR
+for the domain
+\fRexample.com\fR.
+Multiple
+\fBSUDOERS_BASE\fR
+lines may be specified, in which case they are queried in the order specified.
+.TP 6n
+\fBSUDOERS_DEBUG\fR \fIdebug_level\fR
+This sets the debug level for
+\fBsudo\fR
+LDAP queries.
+Debugging information is printed to the standard error.
+A value of 1 results in a moderate amount of debugging information.
+A value of 2 shows the results of the matches themselves.
+This parameter should not be set in a production environment as the
+extra information is likely to confuse users.
+.sp
+The
+\fBSUDOERS_DEBUG\fR
+parameter is deprecated and will be removed in a future release.
+The same information is now logged via the
+\fBsudo\fR
+debugging framework using the
+\(lqldap\(rq
+subsystem at priorities
+\fIdiag\fR
+and
+\fIinfo\fR
+for
+\fIdebug_level\fR
+values 1 and 2 respectively.
+See the
+sudo.conf(@mansectform@)
+manual for details on how to configure
+\fBsudo\fR
+debugging.
+.TP 6n
+\fBSUDOERS_SEARCH_FILTER\fR \fIldap_filter\fR
+An LDAP filter which is used to restrict the set of records returned
+when performing a
+\fBsudo\fR
+LDAP query.
+Typically, this is of the
+form
+\fRattribute=value\fR
+or
+\fR(&(attribute=value)(attribute2=value2))\fR.
+The default search filter is:
+\fRobjectClass=sudoRole\fR.
If
-\fBTLS_CHECKPEER\fR
-is disabled, no check is made.
-Note that disabling the check creates an opportunity for man-in-the-middle
-attacks since the server's identity will not be authenticated.
-If possible, the CA's certificate should be installed locally so it can
-be verified.
-This option is not supported by the Tivoli Directory Server LDAP libraries.
+\fIldap_filter\fR
+is omitted, no search filter will be used.
+.TP 6n
+\fBSUDOERS_TIMED\fR \fIon/true/yes/off/false/no\fR
+Whether or not to evaluate the
+\fRsudoNotBefore\fR
+and
+\fRsudoNotAfter\fR
+attributes that implement time-dependent sudoers entries.
+.TP 6n
+\fBTIMELIMIT\fR \fIseconds\fR
+The
+\fBTIMELIMIT\fR
+parameter specifies the amount of time, in seconds, to wait for a
+response to an LDAP query.
+.TP 6n
+\fBTIMEOUT\fR \fIseconds\fR
+The
+\fBTIMEOUT\fR
+parameter specifies the amount of time, in seconds, to wait for a
+response from the various LDAP APIs.
.TP 6n
\fBTLS_CACERT\fR \fIfile name\fR
An alias for
.RE
.PD
.TP 6n
+\fBTLS_CHECKPEER\fR \fIon/true/yes/off/false/no\fR
+If enabled,
+\fBTLS_CHECKPEER\fR
+will cause the LDAP server's TLS certificated to be verified.
+If the server's TLS certificate cannot be verified (usually because it
+is signed by an unknown certificate authority),
+\fBsudo\fR
+will be unable to connect to it.
+If
+\fBTLS_CHECKPEER\fR
+is disabled, no check is made.
+Note that disabling the check creates an opportunity for man-in-the-middle
+attacks since the server's identity will not be authenticated.
+If possible, the CA's certificate should be installed locally so it can
+be verified.
+This option is not supported by the Tivoli Directory Server LDAP libraries.
+.TP 6n
\fBTLS_KEY\fR \fIfile name\fR
The path to a file containing the private key which matches the
certificate specified by
.RE
.PD
.TP 6n
+\fBTLS_CIPHERS\fR \fIcipher list\fR
+The
+\fBTLS_CIPHERS\fR
+parameter allows the administer to restrict which encryption algorithms
+may be used for TLS (SSL) connections.
+See the OpenLDAP or Tivoli Directory Server manual for a list of valid
+ciphers.
+This option is not supported by Netscape-derived libraries.
+.TP 6n
\fBTLS_KEYPW\fR \fIsecret\fR
The
\fBTLS_KEYPW\fR
\fIegd\fR.
This option is only supported by the OpenLDAP libraries.
.TP 6n
-\fBTLS_CIPHERS\fR \fIcipher list\fR
+\fBURI\fR \fIldap[s]://[hostname[:port]] ...\fR
+Specifies a white space-delimited list of one or more URIs describing
+the LDAP server(s) to connect to.
The
-\fBTLS_CIPHERS\fR
-parameter allows the administer to restrict which encryption algorithms
-may be used for TLS (SSL) connections.
-See the OpenLDAP or Tivoli Directory Server manual for a list of valid
-ciphers.
-This option is not supported by Netscape-derived libraries.
+\fIprotocol\fR
+may be either
+\fIldap\fR
+\fIldaps\fR,
+the latter being for servers that support TLS (SSL) encryption.
+If no
+\fIport\fR
+is specified, the default is port 389 for
+\fRldap://\fR
+or port 636 for
+\fRldaps://\fR.
+If no
+\fIhostname\fR
+is specified,
+\fBsudo\fR
+will connect to
+\fIlocalhost\fR.
+Multiple
+\fBURI\fR
+lines are treated identically to a
+\fBURI\fR
+line containing multiple entries.
+Only systems using the OpenSSL libraries support the mixing of
+\fRldap://\fR
+and
+\fRldaps://\fR
+URIs.
+Both the Netscape-derived and Tivoli LDAP libraries used on most commercial
+versions of Unix are only capable of supporting one or the other.
.TP 6n
\fBUSE_SASL\fR \fIon/true/yes/off/false/no\fR
Enable
\fBUSE_SASL\fR
for LDAP servers that support SASL authentication.
.TP 6n
-\fBSASL_AUTH_ID\fR \fIidentity\fR
-The SASL user name to use when connecting to the LDAP server.
-By default,
-\fBsudo\fR
-will use an anonymous connection.
-.TP 6n
-\fBROOTUSE_SASL\fR \fIon/true/yes/off/false/no\fR
-Enable
-\fBROOTUSE_SASL\fR
-to enable SASL authentication when connecting
-to an LDAP server from a privileged process, such as
-\fBsudo\fR.
-.TP 6n
\fBROOTSASL_AUTH_ID\fR \fIidentity\fR
The SASL user name to use when
\fBROOTUSE_SASL\fR
is enabled.
-.TP 6n
-\fBSASL_SECPROPS\fR \fInone/properties\fR
-SASL security properties or
-\fInone\fR
-for no properties.
-See the SASL programmer's manual for details.
-.TP 6n
-\fBKRB5_CCNAME\fR \fIfile name\fR
-The path to the Kerberos 5 credential cache to use when authenticating
-with the remote server.
-.TP 6n
-\fBDEREF\fR \fInever/searching/finding/always\fR
-How alias dereferencing is to be performed when searching.
-See the
-ldap.conf(@mansectsu@)
-manual for a full description of this option.
.PP
See the
\fIldap.conf\fR
.\"
-.\" Copyright (c) 2003-2014 Todd C. Miller <Todd.Miller@courtesan.com>
+.\" Copyright (c) 2003-2015 Todd C. Miller <Todd.Miller@courtesan.com>
.\"
.\" Permission to use, copy, modify, and distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd December 4, 2014
+.Dd January 26, 2015
.Dt SUDOERS.LDAP @mansectsu@
.Os Sudo @PACKAGE_VERSION@
.Sh NAME
Note that leading white space is removed from the beginning of lines
even when the continuation character is used.
.Bl -tag -width 4n
-.It Sy URI Ar ldap[s]://[hostname[:port]] ...
-Specifies a white space-delimited list of one or more URIs describing
-the LDAP server(s) to connect to.
-The
-.Em protocol
-may be either
-.Em ldap
-.Em ldaps ,
-the latter being for servers that support TLS (SSL) encryption.
-If no
-.Em port
-is specified, the default is port 389 for
-.Li ldap://
-or port 636 for
-.Li ldaps:// .
-If no
-.Em hostname
-is specified,
-.Nm sudo
-will connect to
-.Em localhost .
-Multiple
-.Sy URI
-lines are treated identically to a
-.Sy URI
-line containing multiple entries.
-Only systems using the OpenSSL libraries support the mixing of
-.Li ldap://
-and
-.Li ldaps://
-URIs.
-Both the Netscape-derived and Tivoli LDAP libraries used on most commercial
-versions of Unix are only capable of supporting one or the other.
-.It Sy HOST Ar name[:port] ...
-If no
-.Sy URI
-is specified, the
-.Sy HOST
-parameter specifies a white space-delimited list of LDAP servers to connect to.
-Each host may include an optional
-.Em port
-separated by a colon
-.Pq Ql :\& .
-The
-.Sy HOST
-parameter is deprecated in favor of the
-.Sy URI
-specification and is included for backwards compatibility.
-.It Sy PORT Ar port_number
-If no
-.Sy URI
-is specified, the
-.Sy PORT
-parameter specifies the default port to connect to on the LDAP server if a
-.Sy HOST
-parameter does not specify the port itself.
-If no
-.Sy PORT
-parameter is used, the default is port 389 for LDAP and port 636 for LDAP
-over TLS (SSL).
-The
-.Sy PORT
-parameter is deprecated in favor of the
-.Sy URI
-specification and is included for backwards compatibility.
.It Sy BIND_TIMELIMIT Ar seconds
The
.Sy BIND_TIMELIMIT
.Sy HOST Ns s
are specified, this is the amount of time to wait before trying
the next one in the list.
-.It Sy NETWORK_TIMEOUT Ar seconds
-An alias for
-.Sy BIND_TIMELIMIT
-for OpenLDAP compatibility.
-.It Sy TIMELIMIT Ar seconds
-The
-.Sy TIMELIMIT
-parameter specifies the amount of time, in seconds, to wait for a
-response to an LDAP query.
-.It Sy TIMEOUT Ar seconds
-The
-.Sy TIMEOUT
-parameter specifies the amount of time, in seconds, to wait for a
-response from the various LDAP APIs.
-.It Sy SUDOERS_BASE Ar base
-The base DN to use when performing
-.Nm sudo
-LDAP queries.
-Typically this is of the form
-.Li ou=SUDOers,dc=example,dc=com
-for the domain
-.Li example.com .
-Multiple
-.Sy SUDOERS_BASE
-lines may be specified, in which case they are queried in the order specified.
-.It Sy SUDOERS_SEARCH_FILTER Ar ldap_filter
-An LDAP filter which is used to restrict the set of records returned
-when performing a
-.Nm sudo
-LDAP query.
-Typically, this is of the
-form
-.Li attribute=value
-or
-.Li (&(attribute=value)(attribute2=value2)) .
-The default search filter is:
-.Li objectClass=sudoRole .
-If
-.Ar ldap_filter
-is omitted, no search filter will be used.
-.It Sy SUDOERS_TIMED Ar on/true/yes/off/false/no
-Whether or not to evaluate the
-.Li sudoNotBefore
-and
-.Li sudoNotAfter
-attributes that implement time-dependent sudoers entries.
-.It Sy SUDOERS_DEBUG Ar debug_level
-This sets the debug level for
-.Nm sudo
-LDAP queries.
-Debugging information is printed to the standard error.
-A value of 1 results in a moderate amount of debugging information.
-A value of 2 shows the results of the matches themselves.
-This parameter should not be set in a production environment as the
-extra information is likely to confuse users.
-.Pp
-The
-.Sy SUDOERS_DEBUG
-parameter is deprecated and will be removed in a future release.
-The same information is now logged via the
-.Nm sudo
-debugging framework using the
-.Dq ldap
-subsystem at priorities
-.Em diag
-and
-.Em info
-for
-.Em debug_level
-values 1 and 2 respectively.
-See the
-.Xr sudo.conf @mansectform@
-manual for details on how to configure
-.Nm sudo
-debugging.
.It Sy BINDDN Ar DN
The
.Sy BINDDN
and the escaping of special characters with a backslash
.Pq Ql \e
is not supported.
+.It Sy DEREF Ar never/searching/finding/always
+How alias dereferencing is to be performed when searching.
+See the
+.Xr ldap.conf @mansectsu@
+manual for a full description of this option.
+.It Sy HOST Ar name[:port] ...
+If no
+.Sy URI
+is specified (see below), the
+.Sy HOST
+parameter specifies a white space-delimited list of LDAP servers to connect to.
+Each host may include an optional
+.Em port
+separated by a colon
+.Pq Ql :\& .
+The
+.Sy HOST
+parameter is deprecated in favor of the
+.Sy URI
+specification and is included for backwards compatibility only.
+.It Sy KRB5_CCNAME Ar file name
+The path to the Kerberos 5 credential cache to use when authenticating
+with the remote server.
+This option is only relevant when using SASL authentication (see below).
+.It Sy LDAP_VERSION Ar number
+The version of the LDAP protocol to use when connecting to the server.
+The default value is protocol version 3.
+.It Sy NETWORK_TIMEOUT Ar seconds
+An alias for
+.Sy BIND_TIMELIMIT
+provided for OpenLDAP compatibility.
+.It Sy PORT Ar port_number
+If no
+.Sy URI
+is specified, the
+.Sy PORT
+parameter specifies the default port to connect to on the LDAP server if a
+.Sy HOST
+parameter does not specify the port itself.
+If no
+.Sy PORT
+parameter is used, the default is port 389 for LDAP and port 636 for LDAP
+over TLS (SSL).
+The
+.Sy PORT
+parameter is deprecated in favor of the
+.Sy URI
+specification and is included for backwards compatibility only.
.It Sy ROOTBINDDN Ar DN
The
.Sy ROOTBINDDN
is specified, the
.Sy BINDDN
identity is used (if any).
-.It Sy LDAP_VERSION Ar number
-The version of the LDAP protocol to use when connecting to the server.
-The default value is protocol version 3.
+.It Sy ROOTUSE_SASL Ar on/true/yes/off/false/no
+Enable
+.Sy ROOTUSE_SASL
+to enable SASL authentication when connecting
+to an LDAP server from a privileged process, such as
+.Nm sudo .
+.It Sy SASL_AUTH_ID Ar identity
+The SASL user name to use when connecting to the LDAP server.
+By default,
+.Nm sudo
+will use an anonymous connection.
+This option is only relevant when using SASL authentication.
+.It Sy SASL_SECPROPS Ar none/properties
+SASL security properties or
+.Em none
+for no properties.
+See the SASL programmer's manual for details.
+This option is only relevant when using SASL authentication.
.It Sy SSL Ar on/true/yes/off/false/no
If the
.Sy SSL
This parameter is only supported by LDAP servers that honor the
.Em start_tls
extension, such as the OpenLDAP and Tivoli Directory servers.
-.It Sy TLS_CHECKPEER Ar on/true/yes/off/false/no
-If enabled,
-.Sy TLS_CHECKPEER
-will cause the LDAP server's TLS certificated to be verified.
-If the server's TLS certificate cannot be verified (usually because it
-is signed by an unknown certificate authority),
+.It Sy SUDOERS_BASE Ar base
+The base DN to use when performing
.Nm sudo
-will be unable to connect to it.
+LDAP queries.
+Typically this is of the form
+.Li ou=SUDOers,dc=example,dc=com
+for the domain
+.Li example.com .
+Multiple
+.Sy SUDOERS_BASE
+lines may be specified, in which case they are queried in the order specified.
+.It Sy SUDOERS_DEBUG Ar debug_level
+This sets the debug level for
+.Nm sudo
+LDAP queries.
+Debugging information is printed to the standard error.
+A value of 1 results in a moderate amount of debugging information.
+A value of 2 shows the results of the matches themselves.
+This parameter should not be set in a production environment as the
+extra information is likely to confuse users.
+.Pp
+The
+.Sy SUDOERS_DEBUG
+parameter is deprecated and will be removed in a future release.
+The same information is now logged via the
+.Nm sudo
+debugging framework using the
+.Dq ldap
+subsystem at priorities
+.Em diag
+and
+.Em info
+for
+.Em debug_level
+values 1 and 2 respectively.
+See the
+.Xr sudo.conf @mansectform@
+manual for details on how to configure
+.Nm sudo
+debugging.
+.It Sy SUDOERS_SEARCH_FILTER Ar ldap_filter
+An LDAP filter which is used to restrict the set of records returned
+when performing a
+.Nm sudo
+LDAP query.
+Typically, this is of the
+form
+.Li attribute=value
+or
+.Li (&(attribute=value)(attribute2=value2)) .
+The default search filter is:
+.Li objectClass=sudoRole .
If
-.Sy TLS_CHECKPEER
-is disabled, no check is made.
-Note that disabling the check creates an opportunity for man-in-the-middle
-attacks since the server's identity will not be authenticated.
-If possible, the CA's certificate should be installed locally so it can
-be verified.
-This option is not supported by the Tivoli Directory Server LDAP libraries.
+.Ar ldap_filter
+is omitted, no search filter will be used.
+.It Sy SUDOERS_TIMED Ar on/true/yes/off/false/no
+Whether or not to evaluate the
+.Li sudoNotBefore
+and
+.Li sudoNotAfter
+attributes that implement time-dependent sudoers entries.
+.It Sy TIMELIMIT Ar seconds
+The
+.Sy TIMELIMIT
+parameter specifies the amount of time, in seconds, to wait for a
+response to an LDAP query.
+.It Sy TIMEOUT Ar seconds
+The
+.Sy TIMEOUT
+parameter specifies the amount of time, in seconds, to wait for a
+response from the various LDAP APIs.
.It Sy TLS_CACERT Ar file name
An alias for
.Sy TLS_CACERTFILE
When using Netscape-derived libraries, this file may also contain
Certificate Authority certificates.
.El
+.It Sy TLS_CHECKPEER Ar on/true/yes/off/false/no
+If enabled,
+.Sy TLS_CHECKPEER
+will cause the LDAP server's TLS certificated to be verified.
+If the server's TLS certificate cannot be verified (usually because it
+is signed by an unknown certificate authority),
+.Nm sudo
+will be unable to connect to it.
+If
+.Sy TLS_CHECKPEER
+is disabled, no check is made.
+Note that disabling the check creates an opportunity for man-in-the-middle
+attacks since the server's identity will not be authenticated.
+If possible, the CA's certificate should be installed locally so it can
+be verified.
+This option is not supported by the Tivoli Directory Server LDAP libraries.
.It Sy TLS_KEY Ar file name
The path to a file containing the private key which matches the
certificate specified by
.El
When using Tivoli LDAP libraries, this file may also contain
Certificate Authority and client certificates and may be encrypted.
+.It Sy TLS_CIPHERS Ar cipher list
+The
+.Sy TLS_CIPHERS
+parameter allows the administer to restrict which encryption algorithms
+may be used for TLS (SSL) connections.
+See the OpenLDAP or Tivoli Directory Server manual for a list of valid
+ciphers.
+This option is not supported by Netscape-derived libraries.
.It Sy TLS_KEYPW Ar secret
The
.Sy TLS_KEYPW
or
.Em egd .
This option is only supported by the OpenLDAP libraries.
-.It Sy TLS_CIPHERS Ar cipher list
+.It Sy URI Ar ldap[s]://[hostname[:port]] ...
+Specifies a white space-delimited list of one or more URIs describing
+the LDAP server(s) to connect to.
The
-.Sy TLS_CIPHERS
-parameter allows the administer to restrict which encryption algorithms
-may be used for TLS (SSL) connections.
-See the OpenLDAP or Tivoli Directory Server manual for a list of valid
-ciphers.
-This option is not supported by Netscape-derived libraries.
+.Em protocol
+may be either
+.Em ldap
+.Em ldaps ,
+the latter being for servers that support TLS (SSL) encryption.
+If no
+.Em port
+is specified, the default is port 389 for
+.Li ldap://
+or port 636 for
+.Li ldaps:// .
+If no
+.Em hostname
+is specified,
+.Nm sudo
+will connect to
+.Em localhost .
+Multiple
+.Sy URI
+lines are treated identically to a
+.Sy URI
+line containing multiple entries.
+Only systems using the OpenSSL libraries support the mixing of
+.Li ldap://
+and
+.Li ldaps://
+URIs.
+Both the Netscape-derived and Tivoli LDAP libraries used on most commercial
+versions of Unix are only capable of supporting one or the other.
.It Sy USE_SASL Ar on/true/yes/off/false/no
Enable
.Sy USE_SASL
for LDAP servers that support SASL authentication.
-.It Sy SASL_AUTH_ID Ar identity
-The SASL user name to use when connecting to the LDAP server.
-By default,
-.Nm sudo
-will use an anonymous connection.
-.It Sy ROOTUSE_SASL Ar on/true/yes/off/false/no
-Enable
-.Sy ROOTUSE_SASL
-to enable SASL authentication when connecting
-to an LDAP server from a privileged process, such as
-.Nm sudo .
.It Sy ROOTSASL_AUTH_ID Ar identity
The SASL user name to use when
.Sy ROOTUSE_SASL
is enabled.
-.It Sy SASL_SECPROPS Ar none/properties
-SASL security properties or
-.Em none
-for no properties.
-See the SASL programmer's manual for details.
-.It Sy KRB5_CCNAME Ar file name
-The path to the Kerberos 5 credential cache to use when authenticating
-with the remote server.
-.It Sy DEREF Ar never/searching/finding/always
-How alias dereferencing is to be performed when searching.
-See the
-.Xr ldap.conf @mansectsu@
-manual for a full description of this option.
.El
.Pp
See the
projects / sudo / commitdiff