Jakub Hrozek wrote:
-----BEGIN PGP SIGNED MESSAGE-----
On 05/28/2010 04:35 AM, David O'Brien wrote:
> I'd like to get my example config (below) in sync with latest
> recommendations and what the man page has to say. In the process we
> might even find some things that need review or update.
> 1. I've already changed enumerate to false
Sorry to nitpick, but maybe we should be consistent about using TRUE vs.
true and false vs. FALSE in the examples.
I asked the same question in IRC a little while back but no-one replied
- I think it was the wrong time of day :-) I think somebody else
raised the question of using zero and non-zero for FALSE and TRUE. I
agree, we should choose a style and stick to it. I vote for TRUE/FALSE
> 2. I'm curious about tls_reqcert: I know there are several options
> (never, allow, try, etc.), but wonder if in this particular config
> demand (hard) is required due to the encrypted channel requirements of
> authentication against an LDAP server. Educate me?
Setting tls_reqcert to hard is not required for authentication. We only
require that the ldap authentication must be done over a secure channel.
When setting up this encrypted channel, the server may be asked to
present itself with its certificate, the client can then checks the
certificate to verify the authenticity of the server. The
ldap_tls_reqcert option specifies whether to request the server
certificate and what checks to perform.
ok, wires crossed there. tls_reqcert is for checking the validity of the
server, nothing to do with setting up the encrypted channel.
> 3. ldap_tls_cacert value: the man page says the default is use OpenLDAP
> defaults, typically in /etc/openldap/ldap.conf. Should I update my
> example with the default value?
I personally don't have a strong preference.. The current example points
to Mozilla CA cert bundle which might be OK for deployments that have
commercial certificates from companies like VeriSign. Not sure how
representative this example is in real world..but I suspect many
deployments will just use their own internal CA or even self-signed
I might update this to something like </path/to/preferred/certificate>
or something similar.
> Again, any suggestions on a better example very welcome.
I wonder if the example config should list "ldap_search_base" instead of
"ldap_user_search_base". If we are going to include
ldap_user_search_base, I think we should also include
I wondered about that too, especially given that ldap_user_search_base
uses the value of ldap_search_base as its default. How about I just list
"ldap_search_base" instead of "ldap_user_search_base" (same value)?
Thanks for your help.
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane
"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.