From: Todd C. Miller Date: Tue, 27 Jan 2015 16:29:02 +0000 (-0700) Subject: Sort ldap.conf options. X-Git-Tag: SUDO_1_8_12^2~42 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4ae3ab43c0a7e1ae98af1d9d54b027d7eb57564e;p=sudo Sort ldap.conf options. --- diff --git a/doc/sudoers.ldap.cat b/doc/sudoers.ldap.cat index aeebce5df..13e821162 100644 --- a/doc/sudoers.ldap.cat +++ b/doc/sudoers.ldap.cat @@ -291,83 +291,12 @@ DDEESSCCRRIIPPTTIIOONN on the line. Note that leading white space is removed from the beginning of lines even when the continuation character is used. - UURRII _l_d_a_p_[_s_]_:_/_/_[_h_o_s_t_n_a_m_e_[_:_p_o_r_t_]_] _._._. - Specifies a white space-delimited list of one or more URIs - describing the LDAP server(s) to connect to. The _p_r_o_t_o_c_o_l may be - either _l_d_a_p _l_d_a_p_s, the latter being for servers that support TLS - (SSL) encryption. If no _p_o_r_t is specified, the default is port 389 - for ldap:// or port 636 for ldaps://. If no _h_o_s_t_n_a_m_e is specified, - ssuuddoo will connect to _l_o_c_a_l_h_o_s_t. Multiple UURRII lines are treated - identically to a UURRII line containing multiple entries. Only - systems using the OpenSSL libraries support the mixing of ldap:// - and ldaps:// URIs. Both the Netscape-derived and Tivoli LDAP - libraries used on most commercial versions of Unix are only capable - of supporting one or the other. - - HHOOSSTT _n_a_m_e_[_:_p_o_r_t_] _._._. - If no UURRII is specified, the HHOOSSTT parameter specifies a white space- - delimited list of LDAP servers to connect to. Each host may - include an optional _p_o_r_t separated by a colon (`:'). The HHOOSSTT - parameter is deprecated in favor of the UURRII specification and is - included for backwards compatibility. - - PPOORRTT _p_o_r_t___n_u_m_b_e_r - If no UURRII is specified, the PPOORRTT parameter specifies the default - port to connect to on the LDAP server if a HHOOSSTT parameter does not - specify the port itself. If no PPOORRTT parameter is used, the default - is port 389 for LDAP and port 636 for LDAP over TLS (SSL). The - PPOORRTT parameter is deprecated in favor of the UURRII specification and - is included for backwards compatibility. - BBIINNDD__TTIIMMEELLIIMMIITT _s_e_c_o_n_d_s The BBIINNDD__TTIIMMEELLIIMMIITT parameter specifies the amount of time, in seconds, to wait while trying to connect to an LDAP server. If multiple UURRIIs or HHOOSSTTs are specified, this is the amount of time to wait before trying the next one in the list. - NNEETTWWOORRKK__TTIIMMEEOOUUTT _s_e_c_o_n_d_s - An alias for BBIINNDD__TTIIMMEELLIIMMIITT for OpenLDAP compatibility. - - TTIIMMEELLIIMMIITT _s_e_c_o_n_d_s - The TTIIMMEELLIIMMIITT parameter specifies the amount of time, in seconds, - to wait for a response to an LDAP query. - - TTIIMMEEOOUUTT _s_e_c_o_n_d_s - The TTIIMMEEOOUUTT parameter specifies the amount of time, in seconds, to - wait for a response from the various LDAP APIs. - - SSUUDDOOEERRSS__BBAASSEE _b_a_s_e - The base DN to use when performing ssuuddoo LDAP queries. Typically - this is of the form ou=SUDOers,dc=example,dc=com for the domain - example.com. Multiple SSUUDDOOEERRSS__BBAASSEE lines may be specified, in - which case they are queried in the order specified. - - SSUUDDOOEERRSS__SSEEAARRCCHH__FFIILLTTEERR _l_d_a_p___f_i_l_t_e_r - An LDAP filter which is used to restrict the set of records - returned when performing a ssuuddoo LDAP query. Typically, this is of - the form attribute=value or - (&(attribute=value)(attribute2=value2)). The default search filter - is: objectClass=sudoRole. If _l_d_a_p___f_i_l_t_e_r is omitted, no search - filter will be used. - - SSUUDDOOEERRSS__TTIIMMEEDD _o_n_/_t_r_u_e_/_y_e_s_/_o_f_f_/_f_a_l_s_e_/_n_o - Whether or not to evaluate the sudoNotBefore and sudoNotAfter - attributes that implement time-dependent sudoers entries. - - SSUUDDOOEERRSS__DDEEBBUUGG _d_e_b_u_g___l_e_v_e_l - This sets the debug level for ssuuddoo LDAP queries. Debugging - information is printed to the standard error. A value of 1 results - in a moderate amount of debugging information. A value of 2 shows - the results of the matches themselves. This parameter should not - be set in a production environment as the extra information is - likely to confuse users. - - The SSUUDDOOEERRSS__DDEEBBUUGG parameter is deprecated and will be removed in a - future release. The same information is now logged via the ssuuddoo - debugging framework using the ``ldap'' subsystem at priorities _d_i_a_g - and _i_n_f_o for _d_e_b_u_g___l_e_v_e_l values 1 and 2 respectively. See the - sudo.conf(4) manual for details on how to configure ssuuddoo debugging. - BBIINNDDDDNN _D_N The BBIINNDDDDNN parameter specifies the identity, in the form of a Distinguished Name (DN), to use when performing LDAP operations. @@ -388,6 +317,37 @@ DDEESSCCRRIIPPTTIIOONN character (`#') and the escaping of special characters with a backslash (`\') is not supported. + DDEERREEFF _n_e_v_e_r_/_s_e_a_r_c_h_i_n_g_/_f_i_n_d_i_n_g_/_a_l_w_a_y_s + How alias dereferencing is to be performed when searching. See the + ldap.conf(1m) manual for a full description of this option. + + HHOOSSTT _n_a_m_e_[_:_p_o_r_t_] _._._. + If no UURRII is specified (see below), the HHOOSSTT parameter specifies a + white space-delimited list of LDAP servers to connect to. Each + host may include an optional _p_o_r_t separated by a colon (`:'). The + HHOOSSTT parameter is deprecated in favor of the UURRII specification and + is included for backwards compatibility only. + + KKRRBB55__CCCCNNAAMMEE _f_i_l_e _n_a_m_e + The path to the Kerberos 5 credential cache to use when + authenticating with the remote server. This option is only + relevant when using SASL authentication (see below). + + LLDDAAPP__VVEERRSSIIOONN _n_u_m_b_e_r + The version of the LDAP protocol to use when connecting to the + server. The default value is protocol version 3. + + NNEETTWWOORRKK__TTIIMMEEOOUUTT _s_e_c_o_n_d_s + An alias for BBIINNDD__TTIIMMEELLIIMMIITT provided for OpenLDAP compatibility. + + PPOORRTT _p_o_r_t___n_u_m_b_e_r + If no UURRII is specified, the PPOORRTT parameter specifies the default + port to connect to on the LDAP server if a HHOOSSTT parameter does not + specify the port itself. If no PPOORRTT parameter is used, the default + is port 389 for LDAP and port 636 for LDAP over TLS (SSL). The + PPOORRTT parameter is deprecated in favor of the UURRII specification and + is included for backwards compatibility only. + RROOOOTTBBIINNDDDDNN _D_N The RROOOOTTBBIINNDDDDNN parameter specifies the identity, in the form of a Distinguished Name (DN), to use when performing privileged LDAP @@ -397,9 +357,19 @@ DDEESSCCRRIIPPTTIIOONN _/_e_t_c_/_l_d_a_p_._s_e_c_r_e_t. If no RROOOOTTBBIINNDDDDNN is specified, the BBIINNDDDDNN identity is used (if any). - LLDDAAPP__VVEERRSSIIOONN _n_u_m_b_e_r - The version of the LDAP protocol to use when connecting to the - server. The default value is protocol version 3. + RROOOOTTUUSSEE__SSAASSLL _o_n_/_t_r_u_e_/_y_e_s_/_o_f_f_/_f_a_l_s_e_/_n_o + Enable RROOOOTTUUSSEE__SSAASSLL to enable SASL authentication when connecting + to an LDAP server from a privileged process, such as ssuuddoo. + + SSAASSLL__AAUUTTHH__IIDD _i_d_e_n_t_i_t_y + The SASL user name to use when connecting to the LDAP server. By + default, ssuuddoo will use an anonymous connection. This option is + only relevant when using SASL authentication. + + SSAASSLL__SSEECCPPRROOPPSS _n_o_n_e_/_p_r_o_p_e_r_t_i_e_s + SASL security properties or _n_o_n_e for no properties. See the SASL + programmer's manual for details. This option is only relevant when + using SASL authentication. SSSSLL _o_n_/_t_r_u_e_/_y_e_s_/_o_f_f_/_f_a_l_s_e_/_n_o If the SSSSLL parameter is set to on, true or yes, TLS (SSL) @@ -416,17 +386,45 @@ DDEESSCCRRIIPPTTIIOONN _s_t_a_r_t___t_l_s extension, such as the OpenLDAP and Tivoli Directory servers. - TTLLSS__CCHHEECCKKPPEEEERR _o_n_/_t_r_u_e_/_y_e_s_/_o_f_f_/_f_a_l_s_e_/_n_o - If enabled, TTLLSS__CCHHEECCKKPPEEEERR will cause the LDAP server's TLS - certificated to be verified. If the server's TLS certificate - cannot be verified (usually because it is signed by an unknown - certificate authority), ssuuddoo will be unable to connect to it. If - TTLLSS__CCHHEECCKKPPEEEERR is disabled, no check is made. Note that disabling - the check creates an opportunity for man-in-the-middle attacks - since the server's identity will not be authenticated. If - possible, the CA's certificate should be installed locally so it - can be verified. This option is not supported by the Tivoli - Directory Server LDAP libraries. + SSUUDDOOEERRSS__BBAASSEE _b_a_s_e + The base DN to use when performing ssuuddoo LDAP queries. Typically + this is of the form ou=SUDOers,dc=example,dc=com for the domain + example.com. Multiple SSUUDDOOEERRSS__BBAASSEE lines may be specified, in + which case they are queried in the order specified. + + SSUUDDOOEERRSS__DDEEBBUUGG _d_e_b_u_g___l_e_v_e_l + This sets the debug level for ssuuddoo LDAP queries. Debugging + information is printed to the standard error. A value of 1 results + in a moderate amount of debugging information. A value of 2 shows + the results of the matches themselves. This parameter should not + be set in a production environment as the extra information is + likely to confuse users. + + The SSUUDDOOEERRSS__DDEEBBUUGG parameter is deprecated and will be removed in a + future release. The same information is now logged via the ssuuddoo + debugging framework using the ``ldap'' subsystem at priorities _d_i_a_g + and _i_n_f_o for _d_e_b_u_g___l_e_v_e_l values 1 and 2 respectively. See the + sudo.conf(4) manual for details on how to configure ssuuddoo debugging. + + SSUUDDOOEERRSS__SSEEAARRCCHH__FFIILLTTEERR _l_d_a_p___f_i_l_t_e_r + An LDAP filter which is used to restrict the set of records + returned when performing a ssuuddoo LDAP query. Typically, this is of + the form attribute=value or + (&(attribute=value)(attribute2=value2)). The default search filter + is: objectClass=sudoRole. If _l_d_a_p___f_i_l_t_e_r is omitted, no search + filter will be used. + + SSUUDDOOEERRSS__TTIIMMEEDD _o_n_/_t_r_u_e_/_y_e_s_/_o_f_f_/_f_a_l_s_e_/_n_o + Whether or not to evaluate the sudoNotBefore and sudoNotAfter + attributes that implement time-dependent sudoers entries. + + TTIIMMEELLIIMMIITT _s_e_c_o_n_d_s + The TTIIMMEELLIIMMIITT parameter specifies the amount of time, in seconds, + to wait for a response to an LDAP query. + + TTIIMMEEOOUUTT _s_e_c_o_n_d_s + The TTIIMMEEOOUUTT parameter specifies the amount of time, in seconds, to + wait for a response from the various LDAP APIs. TTLLSS__CCAACCEERRTT _f_i_l_e _n_a_m_e An alias for TTLLSS__CCAACCEERRTTFFIILLEE for OpenLDAP compatibility. @@ -464,6 +462,18 @@ DDEESSCCRRIIPPTTIIOONN When using Netscape-derived libraries, this file may also contain Certificate Authority certificates. + TTLLSS__CCHHEECCKKPPEEEERR _o_n_/_t_r_u_e_/_y_e_s_/_o_f_f_/_f_a_l_s_e_/_n_o + If enabled, TTLLSS__CCHHEECCKKPPEEEERR will cause the LDAP server's TLS + certificated to be verified. If the server's TLS certificate + cannot be verified (usually because it is signed by an unknown + certificate authority), ssuuddoo will be unable to connect to it. If + TTLLSS__CCHHEECCKKPPEEEERR is disabled, no check is made. Note that disabling + the check creates an opportunity for man-in-the-middle attacks + since the server's identity will not be authenticated. If + possible, the CA's certificate should be installed locally so it + can be verified. This option is not supported by the Tivoli + Directory Server LDAP libraries. + TTLLSS__KKEEYY _f_i_l_e _n_a_m_e The path to a file containing the private key which matches the certificate specified by TTLLSS__CCEERRTT. The private key must not be @@ -481,6 +491,13 @@ DDEESSCCRRIIPPTTIIOONN When using Tivoli LDAP libraries, this file may also contain Certificate Authority and client certificates and may be encrypted. + TTLLSS__CCIIPPHHEERRSS _c_i_p_h_e_r _l_i_s_t + The TTLLSS__CCIIPPHHEERRSS parameter allows the administer to restrict which + encryption algorithms may be used for TLS (SSL) connections. See + the OpenLDAP or Tivoli Directory Server manual for a list of valid + ciphers. This option is not supported by Netscape-derived + libraries. + TTLLSS__KKEEYYPPWW _s_e_c_r_e_t The TTLLSS__KKEEYYPPWW contains the password used to decrypt the key database on clients using the Tivoli Directory Server LDAP library. @@ -512,39 +529,25 @@ DDEESSCCRRIIPPTTIIOONN conjunction with _p_r_n_g_d or _e_g_d. This option is only supported by the OpenLDAP libraries. - TTLLSS__CCIIPPHHEERRSS _c_i_p_h_e_r _l_i_s_t - The TTLLSS__CCIIPPHHEERRSS parameter allows the administer to restrict which - encryption algorithms may be used for TLS (SSL) connections. See - the OpenLDAP or Tivoli Directory Server manual for a list of valid - ciphers. This option is not supported by Netscape-derived - libraries. + UURRII _l_d_a_p_[_s_]_:_/_/_[_h_o_s_t_n_a_m_e_[_:_p_o_r_t_]_] _._._. + Specifies a white space-delimited list of one or more URIs + describing the LDAP server(s) to connect to. The _p_r_o_t_o_c_o_l may be + either _l_d_a_p _l_d_a_p_s, the latter being for servers that support TLS + (SSL) encryption. If no _p_o_r_t is specified, the default is port 389 + for ldap:// or port 636 for ldaps://. If no _h_o_s_t_n_a_m_e is specified, + ssuuddoo will connect to _l_o_c_a_l_h_o_s_t. Multiple UURRII lines are treated + identically to a UURRII line containing multiple entries. Only + systems using the OpenSSL libraries support the mixing of ldap:// + and ldaps:// URIs. Both the Netscape-derived and Tivoli LDAP + libraries used on most commercial versions of Unix are only capable + of supporting one or the other. UUSSEE__SSAASSLL _o_n_/_t_r_u_e_/_y_e_s_/_o_f_f_/_f_a_l_s_e_/_n_o Enable UUSSEE__SSAASSLL for LDAP servers that support SASL authentication. - SSAASSLL__AAUUTTHH__IIDD _i_d_e_n_t_i_t_y - The SASL user name to use when connecting to the LDAP server. By - default, ssuuddoo will use an anonymous connection. - - RROOOOTTUUSSEE__SSAASSLL _o_n_/_t_r_u_e_/_y_e_s_/_o_f_f_/_f_a_l_s_e_/_n_o - Enable RROOOOTTUUSSEE__SSAASSLL to enable SASL authentication when connecting - to an LDAP server from a privileged process, such as ssuuddoo. - RROOOOTTSSAASSLL__AAUUTTHH__IIDD _i_d_e_n_t_i_t_y The SASL user name to use when RROOOOTTUUSSEE__SSAASSLL is enabled. - SSAASSLL__SSEECCPPRROOPPSS _n_o_n_e_/_p_r_o_p_e_r_t_i_e_s - SASL security properties or _n_o_n_e for no properties. See the SASL - programmer's manual for details. - - KKRRBB55__CCCCNNAAMMEE _f_i_l_e _n_a_m_e - The path to the Kerberos 5 credential cache to use when - authenticating with the remote server. - - DDEERREEFF _n_e_v_e_r_/_s_e_a_r_c_h_i_n_g_/_f_i_n_d_i_n_g_/_a_l_w_a_y_s - How alias dereferencing is to be performed when searching. See the - ldap.conf(1m) manual for a full description of this option. - See the _l_d_a_p_._c_o_n_f entry in the _E_X_A_M_P_L_E_S section. CCoonnffiigguurriinngg nnsssswwiittcchh..ccoonnff @@ -835,4 +838,4 @@ DDIISSCCLLAAIIMMEERR file distributed with ssuuddoo or http://www.sudo.ws/license.html for complete details. -Sudo 1.8.12 December 4, 2014 Sudo 1.8.12 +Sudo 1.8.12 January 26, 2015 Sudo 1.8.12 diff --git a/doc/sudoers.ldap.man.in b/doc/sudoers.ldap.man.in index a51f53f42..8e7b842b7 100644 --- a/doc/sudoers.ldap.man.in +++ b/doc/sudoers.ldap.man.in @@ -1,7 +1,7 @@ .\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER! .\" IT IS GENERATED AUTOMATICALLY FROM sudoers.ldap.mdoc.in .\" -.\" Copyright (c) 2003-2014 Todd C. Miller +.\" Copyright (c) 2003-2015 Todd C. Miller .\" .\" Permission to use, copy, modify, and distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -16,7 +16,7 @@ .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.TH "SUDOERS.LDAP" "8" "December 4, 2014" "Sudo @PACKAGE_VERSION@" "System Manager's Manual" +.TH "SUDOERS.LDAP" "8" "January 26, 2015" "Sudo @PACKAGE_VERSION@" "System Manager's Manual" .nh .if n .ad l .SH "NAME" @@ -521,74 +521,6 @@ as the last character on the line. Note that leading white space is removed from the beginning of lines even when the continuation character is used. .TP 6n -\fBURI\fR \fIldap[s]://[hostname[:port]] ...\fR -Specifies a white space-delimited list of one or more URIs describing -the LDAP server(s) to connect to. -The -\fIprotocol\fR -may be either -\fIldap\fR -\fIldaps\fR, -the latter being for servers that support TLS (SSL) encryption. -If no -\fIport\fR -is specified, the default is port 389 for -\fRldap://\fR -or port 636 for -\fRldaps://\fR. -If no -\fIhostname\fR -is specified, -\fBsudo\fR -will connect to -\fIlocalhost\fR. -Multiple -\fBURI\fR -lines are treated identically to a -\fBURI\fR -line containing multiple entries. -Only systems using the OpenSSL libraries support the mixing of -\fRldap://\fR -and -\fRldaps://\fR -URIs. -Both the Netscape-derived and Tivoli LDAP libraries used on most commercial -versions of Unix are only capable of supporting one or the other. -.TP 6n -\fBHOST\fR \fIname[:port] ...\fR -If no -\fBURI\fR -is specified, the -\fBHOST\fR -parameter specifies a white space-delimited list of LDAP servers to connect to. -Each host may include an optional -\fIport\fR -separated by a colon -(\(oq:\&\(cq). -The -\fBHOST\fR -parameter is deprecated in favor of the -\fBURI\fR -specification and is included for backwards compatibility. -.TP 6n -\fBPORT\fR \fIport_number\fR -If no -\fBURI\fR -is specified, the -\fBPORT\fR -parameter specifies the default port to connect to on the LDAP server if a -\fBHOST\fR -parameter does not specify the port itself. -If no -\fBPORT\fR -parameter is used, the default is port 389 for LDAP and port 636 for LDAP -over TLS (SSL). -The -\fBPORT\fR -parameter is deprecated in favor of the -\fBURI\fR -specification and is included for backwards compatibility. -.TP 6n \fBBIND_TIMELIMIT\fR \fIseconds\fR The \fBBIND_TIMELIMIT\fR @@ -601,88 +533,6 @@ or are specified, this is the amount of time to wait before trying the next one in the list. .TP 6n -\fBNETWORK_TIMEOUT\fR \fIseconds\fR -An alias for -\fBBIND_TIMELIMIT\fR -for OpenLDAP compatibility. -.TP 6n -\fBTIMELIMIT\fR \fIseconds\fR -The -\fBTIMELIMIT\fR -parameter specifies the amount of time, in seconds, to wait for a -response to an LDAP query. -.TP 6n -\fBTIMEOUT\fR \fIseconds\fR -The -\fBTIMEOUT\fR -parameter specifies the amount of time, in seconds, to wait for a -response from the various LDAP APIs. -.TP 6n -\fBSUDOERS_BASE\fR \fIbase\fR -The base DN to use when performing -\fBsudo\fR -LDAP queries. -Typically this is of the form -\fRou=SUDOers,dc=example,dc=com\fR -for the domain -\fRexample.com\fR. -Multiple -\fBSUDOERS_BASE\fR -lines may be specified, in which case they are queried in the order specified. -.TP 6n -\fBSUDOERS_SEARCH_FILTER\fR \fIldap_filter\fR -An LDAP filter which is used to restrict the set of records returned -when performing a -\fBsudo\fR -LDAP query. -Typically, this is of the -form -\fRattribute=value\fR -or -\fR(&(attribute=value)(attribute2=value2))\fR. -The default search filter is: -\fRobjectClass=sudoRole\fR. -If -\fIldap_filter\fR -is omitted, no search filter will be used. -.TP 6n -\fBSUDOERS_TIMED\fR \fIon/true/yes/off/false/no\fR -Whether or not to evaluate the -\fRsudoNotBefore\fR -and -\fRsudoNotAfter\fR -attributes that implement time-dependent sudoers entries. -.TP 6n -\fBSUDOERS_DEBUG\fR \fIdebug_level\fR -This sets the debug level for -\fBsudo\fR -LDAP queries. -Debugging information is printed to the standard error. -A value of 1 results in a moderate amount of debugging information. -A value of 2 shows the results of the matches themselves. -This parameter should not be set in a production environment as the -extra information is likely to confuse users. -.sp -The -\fBSUDOERS_DEBUG\fR -parameter is deprecated and will be removed in a future release. -The same information is now logged via the -\fBsudo\fR -debugging framework using the -\(lqldap\(rq -subsystem at priorities -\fIdiag\fR -and -\fIinfo\fR -for -\fIdebug_level\fR -values 1 and 2 respectively. -See the -sudo.conf(@mansectform@) -manual for details on how to configure -\fBsudo\fR -debugging. -.TP 6n \fBBINDDN\fR \fIDN\fR The \fBBINDDN\fR @@ -720,6 +570,60 @@ and the escaping of special characters with a backslash is not supported. .RE .TP 6n +\fBDEREF\fR \fInever/searching/finding/always\fR +How alias dereferencing is to be performed when searching. +See the +ldap.conf(@mansectsu@) +manual for a full description of this option. +.TP 6n +\fBHOST\fR \fIname[:port] ...\fR +If no +\fBURI\fR +is specified (see below), the +\fBHOST\fR +parameter specifies a white space-delimited list of LDAP servers to connect to. +Each host may include an optional +\fIport\fR +separated by a colon +(\(oq:\&\(cq). +The +\fBHOST\fR +parameter is deprecated in favor of the +\fBURI\fR +specification and is included for backwards compatibility only. +.TP 6n +\fBKRB5_CCNAME\fR \fIfile name\fR +The path to the Kerberos 5 credential cache to use when authenticating +with the remote server. +This option is only relevant when using SASL authentication (see below). +.TP 6n +\fBLDAP_VERSION\fR \fInumber\fR +The version of the LDAP protocol to use when connecting to the server. +The default value is protocol version 3. +.TP 6n +\fBNETWORK_TIMEOUT\fR \fIseconds\fR +An alias for +\fBBIND_TIMELIMIT\fR +provided for OpenLDAP compatibility. +.TP 6n +\fBPORT\fR \fIport_number\fR +If no +\fBURI\fR +is specified, the +\fBPORT\fR +parameter specifies the default port to connect to on the LDAP server if a +\fBHOST\fR +parameter does not specify the port itself. +If no +\fBPORT\fR +parameter is used, the default is port 389 for LDAP and port 636 for LDAP +over TLS (SSL). +The +\fBPORT\fR +parameter is deprecated in favor of the +\fBURI\fR +specification and is included for backwards compatibility only. +.TP 6n \fBROOTBINDDN\fR \fIDN\fR The \fBROOTBINDDN\fR @@ -740,9 +644,26 @@ is specified, the \fBBINDDN\fR identity is used (if any). .TP 6n -\fBLDAP_VERSION\fR \fInumber\fR -The version of the LDAP protocol to use when connecting to the server. -The default value is protocol version 3. +\fBROOTUSE_SASL\fR \fIon/true/yes/off/false/no\fR +Enable +\fBROOTUSE_SASL\fR +to enable SASL authentication when connecting +to an LDAP server from a privileged process, such as +\fBsudo\fR. +.TP 6n +\fBSASL_AUTH_ID\fR \fIidentity\fR +The SASL user name to use when connecting to the LDAP server. +By default, +\fBsudo\fR +will use an anonymous connection. +This option is only relevant when using SASL authentication. +.TP 6n +\fBSASL_SECPROPS\fR \fInone/properties\fR +SASL security properties or +\fInone\fR +for no properties. +See the SASL programmer's manual for details. +This option is only relevant when using SASL authentication. .TP 6n \fBSSL\fR \fIon/true/yes/off/false/no\fR If the @@ -768,22 +689,82 @@ This parameter is only supported by LDAP servers that honor the \fIstart_tls\fR extension, such as the OpenLDAP and Tivoli Directory servers. .TP 6n -\fBTLS_CHECKPEER\fR \fIon/true/yes/off/false/no\fR -If enabled, -\fBTLS_CHECKPEER\fR -will cause the LDAP server's TLS certificated to be verified. -If the server's TLS certificate cannot be verified (usually because it -is signed by an unknown certificate authority), +\fBSUDOERS_BASE\fR \fIbase\fR +The base DN to use when performing \fBsudo\fR -will be unable to connect to it. +LDAP queries. +Typically this is of the form +\fRou=SUDOers,dc=example,dc=com\fR +for the domain +\fRexample.com\fR. +Multiple +\fBSUDOERS_BASE\fR +lines may be specified, in which case they are queried in the order specified. +.TP 6n +\fBSUDOERS_DEBUG\fR \fIdebug_level\fR +This sets the debug level for +\fBsudo\fR +LDAP queries. +Debugging information is printed to the standard error. +A value of 1 results in a moderate amount of debugging information. +A value of 2 shows the results of the matches themselves. +This parameter should not be set in a production environment as the +extra information is likely to confuse users. +.sp +The +\fBSUDOERS_DEBUG\fR +parameter is deprecated and will be removed in a future release. +The same information is now logged via the +\fBsudo\fR +debugging framework using the +\(lqldap\(rq +subsystem at priorities +\fIdiag\fR +and +\fIinfo\fR +for +\fIdebug_level\fR +values 1 and 2 respectively. +See the +sudo.conf(@mansectform@) +manual for details on how to configure +\fBsudo\fR +debugging. +.TP 6n +\fBSUDOERS_SEARCH_FILTER\fR \fIldap_filter\fR +An LDAP filter which is used to restrict the set of records returned +when performing a +\fBsudo\fR +LDAP query. +Typically, this is of the +form +\fRattribute=value\fR +or +\fR(&(attribute=value)(attribute2=value2))\fR. +The default search filter is: +\fRobjectClass=sudoRole\fR. If -\fBTLS_CHECKPEER\fR -is disabled, no check is made. -Note that disabling the check creates an opportunity for man-in-the-middle -attacks since the server's identity will not be authenticated. -If possible, the CA's certificate should be installed locally so it can -be verified. -This option is not supported by the Tivoli Directory Server LDAP libraries. +\fIldap_filter\fR +is omitted, no search filter will be used. +.TP 6n +\fBSUDOERS_TIMED\fR \fIon/true/yes/off/false/no\fR +Whether or not to evaluate the +\fRsudoNotBefore\fR +and +\fRsudoNotAfter\fR +attributes that implement time-dependent sudoers entries. +.TP 6n +\fBTIMELIMIT\fR \fIseconds\fR +The +\fBTIMELIMIT\fR +parameter specifies the amount of time, in seconds, to wait for a +response to an LDAP query. +.TP 6n +\fBTIMEOUT\fR \fIseconds\fR +The +\fBTIMEOUT\fR +parameter specifies the amount of time, in seconds, to wait for a +response from the various LDAP APIs. .TP 6n \fBTLS_CACERT\fR \fIfile name\fR An alias for @@ -838,6 +819,23 @@ Certificate Authority certificates. .RE .PD .TP 6n +\fBTLS_CHECKPEER\fR \fIon/true/yes/off/false/no\fR +If enabled, +\fBTLS_CHECKPEER\fR +will cause the LDAP server's TLS certificated to be verified. +If the server's TLS certificate cannot be verified (usually because it +is signed by an unknown certificate authority), +\fBsudo\fR +will be unable to connect to it. +If +\fBTLS_CHECKPEER\fR +is disabled, no check is made. +Note that disabling the check creates an opportunity for man-in-the-middle +attacks since the server's identity will not be authenticated. +If possible, the CA's certificate should be installed locally so it can +be verified. +This option is not supported by the Tivoli Directory Server LDAP libraries. +.TP 6n \fBTLS_KEY\fR \fIfile name\fR The path to a file containing the private key which matches the certificate specified by @@ -864,6 +862,15 @@ Certificate Authority and client certificates and may be encrypted. .RE .PD .TP 6n +\fBTLS_CIPHERS\fR \fIcipher list\fR +The +\fBTLS_CIPHERS\fR +parameter allows the administer to restrict which encryption algorithms +may be used for TLS (SSL) connections. +See the OpenLDAP or Tivoli Directory Server manual for a list of valid +ciphers. +This option is not supported by Netscape-derived libraries. +.TP 6n \fBTLS_KEYPW\fR \fIsecret\fR The \fBTLS_KEYPW\fR @@ -933,53 +940,49 @@ or \fIegd\fR. This option is only supported by the OpenLDAP libraries. .TP 6n -\fBTLS_CIPHERS\fR \fIcipher list\fR +\fBURI\fR \fIldap[s]://[hostname[:port]] ...\fR +Specifies a white space-delimited list of one or more URIs describing +the LDAP server(s) to connect to. The -\fBTLS_CIPHERS\fR -parameter allows the administer to restrict which encryption algorithms -may be used for TLS (SSL) connections. -See the OpenLDAP or Tivoli Directory Server manual for a list of valid -ciphers. -This option is not supported by Netscape-derived libraries. +\fIprotocol\fR +may be either +\fIldap\fR +\fIldaps\fR, +the latter being for servers that support TLS (SSL) encryption. +If no +\fIport\fR +is specified, the default is port 389 for +\fRldap://\fR +or port 636 for +\fRldaps://\fR. +If no +\fIhostname\fR +is specified, +\fBsudo\fR +will connect to +\fIlocalhost\fR. +Multiple +\fBURI\fR +lines are treated identically to a +\fBURI\fR +line containing multiple entries. +Only systems using the OpenSSL libraries support the mixing of +\fRldap://\fR +and +\fRldaps://\fR +URIs. +Both the Netscape-derived and Tivoli LDAP libraries used on most commercial +versions of Unix are only capable of supporting one or the other. .TP 6n \fBUSE_SASL\fR \fIon/true/yes/off/false/no\fR Enable \fBUSE_SASL\fR for LDAP servers that support SASL authentication. .TP 6n -\fBSASL_AUTH_ID\fR \fIidentity\fR -The SASL user name to use when connecting to the LDAP server. -By default, -\fBsudo\fR -will use an anonymous connection. -.TP 6n -\fBROOTUSE_SASL\fR \fIon/true/yes/off/false/no\fR -Enable -\fBROOTUSE_SASL\fR -to enable SASL authentication when connecting -to an LDAP server from a privileged process, such as -\fBsudo\fR. -.TP 6n \fBROOTSASL_AUTH_ID\fR \fIidentity\fR The SASL user name to use when \fBROOTUSE_SASL\fR is enabled. -.TP 6n -\fBSASL_SECPROPS\fR \fInone/properties\fR -SASL security properties or -\fInone\fR -for no properties. -See the SASL programmer's manual for details. -.TP 6n -\fBKRB5_CCNAME\fR \fIfile name\fR -The path to the Kerberos 5 credential cache to use when authenticating -with the remote server. -.TP 6n -\fBDEREF\fR \fInever/searching/finding/always\fR -How alias dereferencing is to be performed when searching. -See the -ldap.conf(@mansectsu@) -manual for a full description of this option. .PP See the \fIldap.conf\fR diff --git a/doc/sudoers.ldap.mdoc.in b/doc/sudoers.ldap.mdoc.in index 1a50f98a2..e2c0c90e4 100644 --- a/doc/sudoers.ldap.mdoc.in +++ b/doc/sudoers.ldap.mdoc.in @@ -1,5 +1,5 @@ .\" -.\" Copyright (c) 2003-2014 Todd C. Miller +.\" Copyright (c) 2003-2015 Todd C. Miller .\" .\" Permission to use, copy, modify, and distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd December 4, 2014 +.Dd January 26, 2015 .Dt SUDOERS.LDAP @mansectsu@ .Os Sudo @PACKAGE_VERSION@ .Sh NAME @@ -493,71 +493,6 @@ as the last character on the line. Note that leading white space is removed from the beginning of lines even when the continuation character is used. .Bl -tag -width 4n -.It Sy URI Ar ldap[s]://[hostname[:port]] ... -Specifies a white space-delimited list of one or more URIs describing -the LDAP server(s) to connect to. -The -.Em protocol -may be either -.Em ldap -.Em ldaps , -the latter being for servers that support TLS (SSL) encryption. -If no -.Em port -is specified, the default is port 389 for -.Li ldap:// -or port 636 for -.Li ldaps:// . -If no -.Em hostname -is specified, -.Nm sudo -will connect to -.Em localhost . -Multiple -.Sy URI -lines are treated identically to a -.Sy URI -line containing multiple entries. -Only systems using the OpenSSL libraries support the mixing of -.Li ldap:// -and -.Li ldaps:// -URIs. -Both the Netscape-derived and Tivoli LDAP libraries used on most commercial -versions of Unix are only capable of supporting one or the other. -.It Sy HOST Ar name[:port] ... -If no -.Sy URI -is specified, the -.Sy HOST -parameter specifies a white space-delimited list of LDAP servers to connect to. -Each host may include an optional -.Em port -separated by a colon -.Pq Ql :\& . -The -.Sy HOST -parameter is deprecated in favor of the -.Sy URI -specification and is included for backwards compatibility. -.It Sy PORT Ar port_number -If no -.Sy URI -is specified, the -.Sy PORT -parameter specifies the default port to connect to on the LDAP server if a -.Sy HOST -parameter does not specify the port itself. -If no -.Sy PORT -parameter is used, the default is port 389 for LDAP and port 636 for LDAP -over TLS (SSL). -The -.Sy PORT -parameter is deprecated in favor of the -.Sy URI -specification and is included for backwards compatibility. .It Sy BIND_TIMELIMIT Ar seconds The .Sy BIND_TIMELIMIT @@ -569,81 +504,6 @@ or .Sy HOST Ns s are specified, this is the amount of time to wait before trying the next one in the list. -.It Sy NETWORK_TIMEOUT Ar seconds -An alias for -.Sy BIND_TIMELIMIT -for OpenLDAP compatibility. -.It Sy TIMELIMIT Ar seconds -The -.Sy TIMELIMIT -parameter specifies the amount of time, in seconds, to wait for a -response to an LDAP query. -.It Sy TIMEOUT Ar seconds -The -.Sy TIMEOUT -parameter specifies the amount of time, in seconds, to wait for a -response from the various LDAP APIs. -.It Sy SUDOERS_BASE Ar base -The base DN to use when performing -.Nm sudo -LDAP queries. -Typically this is of the form -.Li ou=SUDOers,dc=example,dc=com -for the domain -.Li example.com . -Multiple -.Sy SUDOERS_BASE -lines may be specified, in which case they are queried in the order specified. -.It Sy SUDOERS_SEARCH_FILTER Ar ldap_filter -An LDAP filter which is used to restrict the set of records returned -when performing a -.Nm sudo -LDAP query. -Typically, this is of the -form -.Li attribute=value -or -.Li (&(attribute=value)(attribute2=value2)) . -The default search filter is: -.Li objectClass=sudoRole . -If -.Ar ldap_filter -is omitted, no search filter will be used. -.It Sy SUDOERS_TIMED Ar on/true/yes/off/false/no -Whether or not to evaluate the -.Li sudoNotBefore -and -.Li sudoNotAfter -attributes that implement time-dependent sudoers entries. -.It Sy SUDOERS_DEBUG Ar debug_level -This sets the debug level for -.Nm sudo -LDAP queries. -Debugging information is printed to the standard error. -A value of 1 results in a moderate amount of debugging information. -A value of 2 shows the results of the matches themselves. -This parameter should not be set in a production environment as the -extra information is likely to confuse users. -.Pp -The -.Sy SUDOERS_DEBUG -parameter is deprecated and will be removed in a future release. -The same information is now logged via the -.Nm sudo -debugging framework using the -.Dq ldap -subsystem at priorities -.Em diag -and -.Em info -for -.Em debug_level -values 1 and 2 respectively. -See the -.Xr sudo.conf @mansectform@ -manual for details on how to configure -.Nm sudo -debugging. .It Sy BINDDN Ar DN The .Sy BINDDN @@ -674,6 +534,54 @@ Plain text passwords may not include the comment character and the escaping of special characters with a backslash .Pq Ql \e is not supported. +.It Sy DEREF Ar never/searching/finding/always +How alias dereferencing is to be performed when searching. +See the +.Xr ldap.conf @mansectsu@ +manual for a full description of this option. +.It Sy HOST Ar name[:port] ... +If no +.Sy URI +is specified (see below), the +.Sy HOST +parameter specifies a white space-delimited list of LDAP servers to connect to. +Each host may include an optional +.Em port +separated by a colon +.Pq Ql :\& . +The +.Sy HOST +parameter is deprecated in favor of the +.Sy URI +specification and is included for backwards compatibility only. +.It Sy KRB5_CCNAME Ar file name +The path to the Kerberos 5 credential cache to use when authenticating +with the remote server. +This option is only relevant when using SASL authentication (see below). +.It Sy LDAP_VERSION Ar number +The version of the LDAP protocol to use when connecting to the server. +The default value is protocol version 3. +.It Sy NETWORK_TIMEOUT Ar seconds +An alias for +.Sy BIND_TIMELIMIT +provided for OpenLDAP compatibility. +.It Sy PORT Ar port_number +If no +.Sy URI +is specified, the +.Sy PORT +parameter specifies the default port to connect to on the LDAP server if a +.Sy HOST +parameter does not specify the port itself. +If no +.Sy PORT +parameter is used, the default is port 389 for LDAP and port 636 for LDAP +over TLS (SSL). +The +.Sy PORT +parameter is deprecated in favor of the +.Sy URI +specification and is included for backwards compatibility only. .It Sy ROOTBINDDN Ar DN The .Sy ROOTBINDDN @@ -693,9 +601,24 @@ If no is specified, the .Sy BINDDN identity is used (if any). -.It Sy LDAP_VERSION Ar number -The version of the LDAP protocol to use when connecting to the server. -The default value is protocol version 3. +.It Sy ROOTUSE_SASL Ar on/true/yes/off/false/no +Enable +.Sy ROOTUSE_SASL +to enable SASL authentication when connecting +to an LDAP server from a privileged process, such as +.Nm sudo . +.It Sy SASL_AUTH_ID Ar identity +The SASL user name to use when connecting to the LDAP server. +By default, +.Nm sudo +will use an anonymous connection. +This option is only relevant when using SASL authentication. +.It Sy SASL_SECPROPS Ar none/properties +SASL security properties or +.Em none +for no properties. +See the SASL programmer's manual for details. +This option is only relevant when using SASL authentication. .It Sy SSL Ar on/true/yes/off/false/no If the .Sy SSL @@ -718,22 +641,77 @@ communications. This parameter is only supported by LDAP servers that honor the .Em start_tls extension, such as the OpenLDAP and Tivoli Directory servers. -.It Sy TLS_CHECKPEER Ar on/true/yes/off/false/no -If enabled, -.Sy TLS_CHECKPEER -will cause the LDAP server's TLS certificated to be verified. -If the server's TLS certificate cannot be verified (usually because it -is signed by an unknown certificate authority), +.It Sy SUDOERS_BASE Ar base +The base DN to use when performing .Nm sudo -will be unable to connect to it. +LDAP queries. +Typically this is of the form +.Li ou=SUDOers,dc=example,dc=com +for the domain +.Li example.com . +Multiple +.Sy SUDOERS_BASE +lines may be specified, in which case they are queried in the order specified. +.It Sy SUDOERS_DEBUG Ar debug_level +This sets the debug level for +.Nm sudo +LDAP queries. +Debugging information is printed to the standard error. +A value of 1 results in a moderate amount of debugging information. +A value of 2 shows the results of the matches themselves. +This parameter should not be set in a production environment as the +extra information is likely to confuse users. +.Pp +The +.Sy SUDOERS_DEBUG +parameter is deprecated and will be removed in a future release. +The same information is now logged via the +.Nm sudo +debugging framework using the +.Dq ldap +subsystem at priorities +.Em diag +and +.Em info +for +.Em debug_level +values 1 and 2 respectively. +See the +.Xr sudo.conf @mansectform@ +manual for details on how to configure +.Nm sudo +debugging. +.It Sy SUDOERS_SEARCH_FILTER Ar ldap_filter +An LDAP filter which is used to restrict the set of records returned +when performing a +.Nm sudo +LDAP query. +Typically, this is of the +form +.Li attribute=value +or +.Li (&(attribute=value)(attribute2=value2)) . +The default search filter is: +.Li objectClass=sudoRole . If -.Sy TLS_CHECKPEER -is disabled, no check is made. -Note that disabling the check creates an opportunity for man-in-the-middle -attacks since the server's identity will not be authenticated. -If possible, the CA's certificate should be installed locally so it can -be verified. -This option is not supported by the Tivoli Directory Server LDAP libraries. +.Ar ldap_filter +is omitted, no search filter will be used. +.It Sy SUDOERS_TIMED Ar on/true/yes/off/false/no +Whether or not to evaluate the +.Li sudoNotBefore +and +.Li sudoNotAfter +attributes that implement time-dependent sudoers entries. +.It Sy TIMELIMIT Ar seconds +The +.Sy TIMELIMIT +parameter specifies the amount of time, in seconds, to wait for a +response to an LDAP query. +.It Sy TIMEOUT Ar seconds +The +.Sy TIMEOUT +parameter specifies the amount of time, in seconds, to wait for a +response from the various LDAP APIs. .It Sy TLS_CACERT Ar file name An alias for .Sy TLS_CACERTFILE @@ -774,6 +752,22 @@ contains both keys and certificates. When using Netscape-derived libraries, this file may also contain Certificate Authority certificates. .El +.It Sy TLS_CHECKPEER Ar on/true/yes/off/false/no +If enabled, +.Sy TLS_CHECKPEER +will cause the LDAP server's TLS certificated to be verified. +If the server's TLS certificate cannot be verified (usually because it +is signed by an unknown certificate authority), +.Nm sudo +will be unable to connect to it. +If +.Sy TLS_CHECKPEER +is disabled, no check is made. +Note that disabling the check creates an opportunity for man-in-the-middle +attacks since the server's identity will not be authenticated. +If possible, the CA's certificate should be installed locally so it can +be verified. +This option is not supported by the Tivoli Directory Server LDAP libraries. .It Sy TLS_KEY Ar file name The path to a file containing the private key which matches the certificate specified by @@ -790,6 +784,14 @@ The key type depends on the LDAP libraries used. .El When using Tivoli LDAP libraries, this file may also contain Certificate Authority and client certificates and may be encrypted. +.It Sy TLS_CIPHERS Ar cipher list +The +.Sy TLS_CIPHERS +parameter allows the administer to restrict which encryption algorithms +may be used for TLS (SSL) connections. +See the OpenLDAP or Tivoli Directory Server manual for a list of valid +ciphers. +This option is not supported by Netscape-derived libraries. .It Sy TLS_KEYPW Ar secret The .Sy TLS_KEYPW @@ -852,46 +854,47 @@ It is generally used in conjunction with or .Em egd . This option is only supported by the OpenLDAP libraries. -.It Sy TLS_CIPHERS Ar cipher list +.It Sy URI Ar ldap[s]://[hostname[:port]] ... +Specifies a white space-delimited list of one or more URIs describing +the LDAP server(s) to connect to. The -.Sy TLS_CIPHERS -parameter allows the administer to restrict which encryption algorithms -may be used for TLS (SSL) connections. -See the OpenLDAP or Tivoli Directory Server manual for a list of valid -ciphers. -This option is not supported by Netscape-derived libraries. +.Em protocol +may be either +.Em ldap +.Em ldaps , +the latter being for servers that support TLS (SSL) encryption. +If no +.Em port +is specified, the default is port 389 for +.Li ldap:// +or port 636 for +.Li ldaps:// . +If no +.Em hostname +is specified, +.Nm sudo +will connect to +.Em localhost . +Multiple +.Sy URI +lines are treated identically to a +.Sy URI +line containing multiple entries. +Only systems using the OpenSSL libraries support the mixing of +.Li ldap:// +and +.Li ldaps:// +URIs. +Both the Netscape-derived and Tivoli LDAP libraries used on most commercial +versions of Unix are only capable of supporting one or the other. .It Sy USE_SASL Ar on/true/yes/off/false/no Enable .Sy USE_SASL for LDAP servers that support SASL authentication. -.It Sy SASL_AUTH_ID Ar identity -The SASL user name to use when connecting to the LDAP server. -By default, -.Nm sudo -will use an anonymous connection. -.It Sy ROOTUSE_SASL Ar on/true/yes/off/false/no -Enable -.Sy ROOTUSE_SASL -to enable SASL authentication when connecting -to an LDAP server from a privileged process, such as -.Nm sudo . .It Sy ROOTSASL_AUTH_ID Ar identity The SASL user name to use when .Sy ROOTUSE_SASL is enabled. -.It Sy SASL_SECPROPS Ar none/properties -SASL security properties or -.Em none -for no properties. -See the SASL programmer's manual for details. -.It Sy KRB5_CCNAME Ar file name -The path to the Kerberos 5 credential cache to use when authenticating -with the remote server. -.It Sy DEREF Ar never/searching/finding/always -How alias dereferencing is to be performed when searching. -See the -.Xr ldap.conf @mansectsu@ -manual for a full description of this option. .El .Pp See the