config is in nslcd 0.8.4.
This file is a maintainer script. It is executed when installing (*inst) or removing (*rm) the package.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 | #!/bin/sh
set -e
CONFFILE="/etc/nslcd.conf"
OCONFFILE="/etc/nss-ldapd.conf"
# fall back to old configfile if new one isn't present but old one is
[ ! -f "$CONFFILE" ] && [ -f "$OCONFFILE" ] && CONFFILE="$OCONFFILE"
# source debconf library.
. /usr/share/debconf/confmodule
db_version 2.0
db_capb backup
#
# This is the fist part of the script. In this part an attempt
# is made to get or guess the current configuration. This information
# is used later on to prompt the user and to provide a sensible
# default.
#
# read a configuration value from the specified file
# (it takes care in not overwriting a previously written value)
read_config()
{
debconf_param="$1"
cfg_param="$2"
# overwrite debconf value if different from config file
db_get "$debconf_param"
debconf_value="$RET"
cfgfile_value=`sed -n 's/^'"$cfg_param"'[[:space:]]*\([^[:space:]].*[^[:space:]]\)[[:space:]]*$/\1/ip' "$cfgfile" | tail -n 1`
[ -n "$cfgfile_value" ] && [ "$debconf_value" != "$cfgfile_value" ] && db_set "$debconf_param" "$cfgfile_value"
# we're done
return 0
}
# figure out the system's domain name
get_domain()
{
domain=`hostname --domain` || true
[ -z "$domain" ] && domain=`hostname --nis | grep '\.'` || true
[ -z "$domain" ] && domain=`hostname --fqdn | sed -n 's/^[^.]*\.//p'` || true
[ -z "$domain" ] && domain=`sed -n 's/^ *\(domain\|search\) *\([^ ]*\) *$/\2/p' /etc/resolv.conf | head -n 1` || true
echo "$domain"
}
# find a LDAP server URI by trying DNS and normal hostname lookups
guess_ldap_uri()
{
# see if ldap server exists on localhost and is listening on ldapi://
if [ -e /var/run/slapd/ldapi ]
then
echo "ldapi:///"
return
fi
# try to lookup _ldap._tcp SRV records
if [ -n "$domain" ]
then
server=`host -N 2 -t SRV _ldap._tcp.$domain 2> /dev/null | grep -v NXDOMAIN | awk '{print $NF}' | head -1 | sed 's/\.$//'` || true
if [ -n "$server" ]
then
echo "ldap://$server/"
return
fi
fi
# fall back to name lookups
if [ -z "$ldap_uri" ]
then
# try unqualified hostname lookup
server=`getent hosts ldap` || true
[ -z "$server" ] && server=`getent hosts dirhost` || true
# try qualified hostname
if [ -n "$domain" ] && [ -z "$server" ]
then
server=`getent hosts ldap."$domain"` || true
[ -z "$server" ] && server=`getent hosts dirhost."$domain"` || true
fi
# turn into URI with IP address
if [ -n "$server" ]
then
# extract IP address from host entry and quote IPv6 address
ip=`echo $server | sed 's/[[:space:]].*//;s/^\(.*:.*\)$/[\1]/'`
echo "ldap://$ip/"
fi
fi
}
# guess the LDAP search base by performing LDAP searches on the
# found server
query_search_base()
{
ldap_uri="$1"
# first try the default naming context
context=`ldapsearch -LLL -H "$ldap_uri" -x -b '' -s base defaultNamingContext 2>/dev/null | sed -n 's/^defaultNamingContext: //pi'` || true
if [ -n "$context" ]
then
echo "$context"
return
fi
# go over naming contexts, pick the first one with posixAccount or
# posixGroup objects in it
for context in `ldapsearch -LLL -H "$ldap_uri" -x -b '' -s base namingContexts 2>/dev/null | sed -n 's/^namingContexts: //pi'`
do
# search the context
found=`ldapsearch -LLL -H "$ldap_uri" -x -b "$context" -s sub -z 1 '(|(objectClass=posixAccount)(objectclass=posixGroup))' dn 2>/dev/null` || true
if [ -n "$found" ]
then
echo $context
return
fi
done
}
# check the system (non-LDAP configuration files) for some
# reasonable defaults
parsesys()
{
# guess domain based on system information
domain=`get_domain`
# guess ldap server URI
db_get nslcd/ldap-uris
if [ -z "$RET" ]
then
ldap_uri=`guess_ldap_uri "$domain"`
[ -n "$ldap_uri" ] && db_set nslcd/ldap-uris "$ldap_uri"
else
# only get first URI from any stored (preseeded) value
ldap_uri=`echo "$RET" | sed -n 's/[[:space:]].*//'`
fi
# guess search base
db_get nslcd/ldap-base
if [ -z "$RET" ]
then
# try to find the search base from the found URI
[ -n "$ldap_uri" ] && search_base=`query_search_base "$ldap_uri"`
# try to use the domain name to build the default base
if [ -z "$search_base" ] && [ -n "$domain" ]
then
search_base=`echo "$domain" | sed 's/^/dc=/;s/\./,dc=/g'`
fi
[ -n "$search_base" ] && db_set nslcd/ldap-base "$search_base"
fi
# we're done
return 0
}
# parse a LDAP-like configuration file
parsecfg()
{
cfgfile="$1"
# check existance
[ -f "$cfgfile" ] || return 0
# find uri/host/port combo
db_get nslcd/ldap-uris
if [ -z "$RET" ]
then
uris=`sed -n 's/^uri[[:space:]]*//ip' "$cfgfile" | tr '\n' ' '`
if [ -z "$uris" ]
then
hosts=`sed -n 's/^host[[:space:]]*//ip' "$cfgfile"`
port=`sed -n 's/^port[[:space:]]*//ip' "$cfgfile" | tail -n 1`
for host in $hosts
do
if [ -z "$port" ] || (echo "$host" | grep -q ':' )
then
uris="$uris ldap://$host/"
else
uris="$uris ldap://$host:$port/"
fi
done
fi
[ -n "$uris" ] && db_set nslcd/ldap-uris "$uris"
fi
# read simple options
read_config nslcd/ldap-base base
read_config nslcd/ldap-binddn binddn
read_config nslcd/ldap-bindpw bindpw
read_config nslcd/ldap-sasl-mech sasl_mech
read_config nslcd/ldap-sasl-realm sasl_realm
read_config nslcd/ldap-sasl-authcid sasl_authcid
read_config nslcd/ldap-sasl-authzid sasl_authzid
read_config nslcd/ldap-sasl-secprops sasl_secprops
read_config nslcd/ldap-sasl-krb5-ccname krb5_ccname
# check ssl option
db_get nslcd/ldap-starttls
if [ -z "$RET" ]
then
if grep -qi '^ssl[[:space:]]*start_*tls' "$cfgfile"
then
db_set nslcd/ldap-starttls "true"
elif grep -qi '^ssl[[:space:]]' "$cfgfile"
then
db_set nslcd/ldap-starttls "false"
fi
fi
# check reqcert option
db_get nslcd/ldap-reqcert
if [ -z "$RET" ]
then
reqcert=`sed -n 's/^tls_\(reqcert\|checkpeer\)[[:space:]]*\([^[:space:]]*\)[[:space:]]*$/\2/ip' "$cfgfile" | tail -n 1`
# normalise value
reqcert=`echo "$reqcert" | tr 'A-Z' 'a-z' | sed 's/^no$/never/;s/^yes$/demand/'`
[ -n "$reqcert" ] && db_set nslcd/ldap-reqcert "$reqcert"
fi
# we're done
return 0
}
# fill our defaults with the current configuration if available
# and fall back to guessing the config from some other system files
if [ -f "$CONFFILE" ]
then
# parse current configuration
parsecfg "$CONFFILE"
else
# first match wins
parsecfg /etc/libnss-ldap.conf
parsecfg /etc/pam_ldap.conf
parsecfg /etc/ldap/ldap.conf
parsecfg /etc/ldap.conf
parsesys
# fallback default values
db_get nslcd/ldap-uris
[ -z "$RET" ] && db_set nslcd/ldap-uris "ldap://127.0.0.1/"
db_get nslcd/ldap-base
[ -z "$RET" ] && db_set nslcd/ldap-base "dc=example,dc=net"
fi
# fallback for starttls option
db_get nslcd/ldap-starttls
[ -z "$RET" ] && db_set nslcd/ldap-starttls "false"
# deduce auth-type from available information
db_get nslcd/ldap-auth-type
if [ -z "$RET" ]
then
db_get nslcd/ldap-sasl-mech
sasl_mech="$RET"
db_get nslcd/ldap-binddn
binddn="$RET"
if [ -n "$sasl_mech" ]
then
db_set nslcd/ldap-auth-type "SASL"
elif [ -n "$binddn" ]
then
db_set nslcd/ldap-auth-type "simple"
else
db_set nslcd/ldap-auth-type "none"
fi
fi
#
# This is the second part of the script. In this part the configurable
# settings will be presented to the user for approval. The postinst
# will finaly perform the actual modifications.
#
state="server"
while [ "$state" != "done" ]
do
case "$state" in
server)
# ask about server configuration
db_input high nslcd/ldap-uris || true
db_input high nslcd/ldap-base || true
# ask the questions, go to the next question or exit
state="authtype"
db_go || exit 1
# TODO: add error checking on options
;;
authtype)
# ask for authentication type
db_input medium nslcd/ldap-auth-type || true
# ask the question, go to the next question or back
state="authentication"
db_go || state="server"
;;
authentication)
# check which questions to ask, depending on the authentication type
db_get nslcd/ldap-auth-type
case "$RET" in
none)
# anonymous bind, nothing to ask (clear password)
db_set nslcd/ldap-bindpw ""
state="starttls"
;;
simple)
# ask for binddn and bindpw
db_input medium nslcd/ldap-binddn || true
db_input medium nslcd/ldap-bindpw || true
state="starttls"
;;
SASL)
# ask about SASL mechanism (other SASL questions depend on this)
db_input medium nslcd/ldap-sasl-mech || true
state="sasloptions"
;;
*)
exit 1
;;
esac
db_go || state="authtype"
;;
sasloptions)
# get SASL mech
db_get nslcd/ldap-sasl-mech
sasl_mech="$RET"
# ask SASL questions
db_input medium nslcd/ldap-sasl-realm || true
if [ "$sasl_mech" != "GSSAPI" ]
then
db_input medium nslcd/ldap-sasl-authcid || true
db_input medium nslcd/ldap-bindpw || true
fi
db_input medium nslcd/ldap-sasl-authzid || true
db_input medium nslcd/ldap-sasl-secprops || true
if [ "$sasl_mech" = "GSSAPI" ]
then
# have a default for ldap-sasl-krb5-ccname
db_get nslcd/ldap-sasl-krb5-ccname
[ -z "$RET" ] && db_set nslcd/ldap-sasl-krb5-ccname "/var/run/nslcd/nslcd.tkt"
db_input low nslcd/ldap-sasl-krb5-ccname || true
fi
# ask the question, go to the next question or back
state="starttls"
db_go || state="authentication"
;;
starttls)
# check if ldaps:// URL's are used
db_get nslcd/ldap-uris
uris="$RET"
if (echo "$uris" | grep -q 'ldaps://')
then
# ldaps: URI defined, don't ask about StartTLS
db_set nslcd/ldap-starttls "false"
else
# ask whether to use StartTLS
db_input medium nslcd/ldap-starttls || true
fi
# ask the question, go to the next question or back
# (we go back to authtype because the previous questions were optional)
state="reqcert"
db_go || state="authtype"
;;
reqcert)
# check if ldaps:// URL's are used
db_get nslcd/ldap-uris
uris="$RET"
# check if StartTLS is used
db_get nslcd/ldap-starttls
starttls="$RET"
if (echo "$uris" | grep -q 'ldaps://') || [ "$starttls" = "true" ]
then
# ask whether to do certificate validation
db_input high nslcd/ldap-reqcert || true
else
db_set nslcd/ldap-reqcert ""
fi
# ask the question, go to the next question or back
# (we go back to authtype because the previous questions were optional)
state="done"
db_go || state="authtype"
;;
esac
done
exit 0
|