--=-NIKZplg5L6FNssI2Xw1S Content-Type: text/plain Content-Transfer-Encoding: 7bit

It has worked (in 2.4.18, 2.4.19, 2.4.20) with the same configs.

Pavel

--=-NIKZplg5L6FNssI2Xw1S Content-Disposition: attachment; filename="slapd.conf" Content-Type: text/plain; name="slapd.conf"; charset="UTF-8" Content-Transfer-Encoding: 7bit

# # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. #

include /etc/openldap24/schema/corba.schema include /etc/openldap24/schema/core.schema include /etc/openldap24/schema/cosine.schema include /etc/openldap24/schema/duaconf.schema include /etc/openldap24/schema/dyngroup.schema include /etc/openldap24/schema/inetorgperson.schema include /etc/openldap24/schema/java.schema include /etc/openldap24/schema/misc.schema include /etc/openldap24/schema/nis.schema include /etc/openldap24/schema/openldap.schema include /etc/openldap24/schema/ppolicy.schema include /etc/openldap24/schema/collective.schema include /etc/openldap24/schema/samba.schema

# Allow LDAPv2 client connections. This is NOT the default. allow bind_v2

# Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org

pidfile /var/run/openldap24/slapd.pid argsfile /var/run/openldap24/slapd.args

# Load dynamic backend modules: # modulepath /usr/lib/openldap24 # or /usr/lib64/openldap24 # moduleload accesslog.la # moduleload auditlog.la # moduleload back_sql.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la

# The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt TLSCACertificateFile /etc/pki/tls/cacert.pem # TLSCertificateFile /etc/pki/tls/certs/slapd.pem TLSCertificateFile /etc/pki/tls/certs/ldap3.ldapnet.tmapy.cz-cert.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem TLSCertificateKeyFile /etc/pki/tls/private/ldap3.ldapnet.tmapy.cz-key.pem

# Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING!

# Define global ACLs to disable default read access and provide default # behaviour for samba/pam use include /etc/openldap24/slapd.access.conf

# Provide write access to replicators, and cover access to any other # attributes (default anonymous read access may be undesirable) access to dn.subtree="dc=tmapy,dc=cz" by group="cn=Replicator,ou=Group,dc=tmapy,dc=cz" write by users read by anonymous read

# loglevel <integer> # Specify the level at which debugging statements and # operation statistics should be syslogged (currently # 1 trace function calls # 2 debug packet handling # 4 heavy trace debugging # 8 connection management # 16 print out packets sent and received # 32 search filter processing # 64 configuration file processing # 128 access control list processing # 256 stats log # connections/operations/results # 512 stats log entries sent # 1024 print communication with shell # backends # 2048 entry parsing

# 1 + 2 + 8 + 16 + 32 + 64 + 128 + 256 # loglevel 507

# 16 + 256 # loglevel 272

# 8 + 16 + 128 + 256 # loglevel 408

# 16 + 128 + 256 # loglevel 400

# 2 + 8 + 64 + 256 # loglevel 330

# 8 + 128 # loglevel 136

# 128 + 256 # loglevel 384

# loglevel 128

loglevel 0

####################################################################### # ldbm and/or bdb database definitions #######################################################################

database bdb suffix "dc=tmapy,dc=cz" checkpoint 1024 15 rootdn "cn=Manager,dc=tmapy,dc=cz" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret rootpw heslo # rootpw {crypt}ijFYNcSNctBYg

# The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap24/tmapy.cz

# Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq

# Replicas of this database #replogfile /var/lib/ldap24/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com@EXAMPLE.COM

# # enable monitoring # database monitor # # # allow onlu rootdn to read the monitor # access to * # by dn.exact="cn=Manager,dc=tmapy,dc=cz" read # by * none

# syncrepl directives ServerID 11

syncrepl rid=001 provider=ldap://ldap1.ldapnet.tmapy.cz:389 starttls=yes bindmethod=simple binddn="cn=Manager,dc=tmapy,dc=cz" credentials=heslo searchbase="dc=tmapy,dc=cz" schemachecking=on type=refreshAndPersist retry="5 5 300 5" timeout=1

--=-NIKZplg5L6FNssI2Xw1S Content-Disposition: attachment; filename="slapd.access.conf" Content-Type: text/plain; name="slapd.access.conf"; charset="UTF-8" Content-Transfer-Encoding: 7bit

# This configuration file contains default ACLs that attempt to cater # to most setups, specifically unix authentication, samba-s ldapsam backend # and allowing users to have a shared address book # If these ACLs don-t meet your needs, please do not modify the file in-place, # but rather make a copy, and change the include directive in slapd.conf # This file is *not* marked as noreplace, so it will be replaced during an # upgrade, this is done so that we can ensure that the ACLs are in sync with # the schema files they require.

# The root DIT should be accessible to all clients access to dn.exact="" by * read

# So should the schema access to dn.subtree="cn=Subschema" by * read

# Generic ACLs # These ACLs should work well for any domain-based (ie dc=,dc=) suffix, # but need adjustment and testing for any other suffix # Note that these ACLs allow anonymous read access to most non-password # attributes, you may want to prevent leakage of this information by # removing the "by anonymous read" lines # Regex-based ACLs also impose a performance penalty, replace # for example dn.regex="^([^,]+,)?ou=People,(dc=[^,]+(,dc=[^,]+)*)$" with # dn.subtree="ou=People,dc=example,dc=com" and all $2-s with dc=example,dc=com # if you need the extra performance

# Protect passwords, using a regex so we can have generic accounts with # write access # Openldap will not authenticate against non-userPassword attributes # but we would have to duplicate most rules ... access to dn.regex="^([^,]*,)?ou=[^,]+,(dc=[^,]+(,dc=[^,]+)*)$" attrs=sambaLMPassword,sambaNTPassword,userPassword,sambaPasswordHistory,sambaPwdLastSet,shadowLastChange,shadowMax by self write by dn.exact,expand="uid=root,ou=People,$2" write by group.expand="cn=Domain Controllers,ou=Group,$2" write by group.expand="cn=Replicator,ou=Group,$2" write by anonymous auth by * none

# ACL allowing samba domain controllers to write their domain info access to dn.regex="^sambaDomainName=([^,]+),(dc=[^,]+(,dc=[^,]+)*)$" attrs=entry,children,sambaDomain,uidNumber,gidNumber by dn.exact,expand="uid=root,ou=People,$2" write by group.expand="cn=Domain Controllers,ou=Group,$2" write by group.expand="cn=Replicator,ou=Group,$2" write by users read by anonymous read

# ACL allowing samba domain controllers to add user accounts access to dn.regex="^([^,]+,)?ou=People,(dc=[^,]+(,dc=[^,]+)*)$" attrs=entry,children,posixAccount,sambaSamAccount by dn.exact,expand="uid=root,ou=People,$2" write by group.expand="cn=Domain Controllers,ou=Group,$2" write by group.expand="cn=Replicator,ou=Group,$2" write by users read by anonymous read

# allow users to modify their own "address book" entries: access to dn.regex="([^,]+,)?ou=People,(dc=[^,]+(,dc=[^,]+)*)$" attrs=inetOrgPerson,mail by self write by dn.exact,expand="uid=root,ou=People,$2" write by group.expand="cn=Domain Controllers,ou=Group,$2" write by group.expand="cn=Replicator,ou=Group,$2" write by users read by anonymous read

# Allow samba domain controllers to create groups and group mappings access to dn.regex="^([^,]+,)?ou=Group,(dc=[^,]+(,dc=[^,]+)*)$" attrs=entry,children,posixGroup,sambaGroupMapping by dn.exact,expand="uid=root,ou=People,$2" write by group.expand="cn=Domain Controllers,ou=Group,$2" write by group.expand="cn=Replicator,ou=Group,$2" write by users read by anonymous read

# Allow samba domain controllers to create machine accounts access to dn.regex="^([^,]+,)?ou=Hosts,(dc=[^,]+(,dc=[^,]+)*)$" attrs=entry,children,posixAccount,inetOrgperson,sambaSamAccount by dn.exact,expand="uid=root,ou=People,$2" write by group.expand="cn=Domain Controllers,ou=Group,$2" write by group.expand="cn=Replicator,ou=Group,$2" write by users read by anonymous read

# Allow samba to create idmap entries access to dn.regex="^([^,]+,)?ou=Idmap,(dc=[^,]+(,dc=[^,]+)*)$" attrs=entry,children,sambaIdmapEntry by dn.exact,expand="uid=root,ou=People,$2" write by group.expand="cn=Domain Controllers,ou=Group,$2" write by group.expand="cn=Replicator,ou=Group,$2" write by users read by anonymous read

# Allow users in the domain to add entries to the "global address book": # For use with Evolution, the attrs list could be modified to be: # attrs=children,entry,inetOrgPerson,evolutionperson,calEntry # if evolutionperson.schema and calendar.schema are available access to dn.regex="^([^,]+,)?ou=Contacts,(dc=[^,]+(,dc=[^,]+)*)$" attrs=children,entry,inetOrgPerson by dn.sub,expand="ou=People,$2" write by group.expand="cn=Replicator,ou=Group,$2" write by users read by anonymous read

--=-NIKZplg5L6FNssI2Xw1S--