Specifies the source to use to retrieve NSS data from.
Valid Options: ldap
Specifies the cache method to use to store the data, which will be
queried by the NSS itself.
Valid options: files Store in a plain text file, similar in format to /etc/passwd. If the files-module option files_cache_filename_suffix is also set to cache then not only will the files be created with a .cache suffix, but also an index file will be written alongside, for use with the nss-cache NSS module. (See https://github.com/google/libnss-cache.)
nssdb Store in a Berkeley DB file, for use with the nss_db NSS module. Please note that this option is deprecated in favour of cache
Specifies the names of the maps that will be queried and cached by
Valid options: passwd group shadow netgroup automount sshkey
Specifies the directory where update and modify timestamps are stored.
These options configure the behaviour of the ldap source.
ldap_uri The LDAP URI to connect to.
ldap_base The base to perform LDAP searches under.
ldap_filter The search filter to use when querying.
ldap_scope The search scope to use. Defaults to one
ldap_bind_dn The bind DN to use when connecting to LDAP. Emtpy string is an anonymous bind. Defaults to the empty string.
ldap_bind_password The bind password to use when connecting to LDAP. Empty string is used for anonymous binds. Defaults to the empty string.
ldap_timelimit Timelimit in seconds for search results to return. -1 means no limit. Defaults to -1.
ldap_retry_max Number of retries on soft failures before giving up. Defaults to 3.
ldap_retry_delay Delay in seconds between retries. Defaults to 5.
ldap_tls_require_cert Sets expectations for SSL certificates, using TLS. One of never, hard, demand, allow, or try. See ldap.conf(5) for more information.
ldap_tls_cacertdir Directory for trusted CA certificates. Defaults to /usr/share/ssl
ldap_tls_cacertfile Filename containing trusted CA certificates. Defaults to /usr/share/ssl/cert.pem
ldap_uidattr The uid-like attribute in your directory. Defaults to uid.
ldap_uidregex A Python regex to extract uid components from the uid-like attribute. All matching groups are concatenated without spaces. For example: (.*)@example.com would return a uid to the left of the @example.com domain. Default is no regex.
ldap_groupregex A Python regex to extract group member components from the member or memberOf attributes. All matching groups are concatenated without spaces. For example: (.*)@example.com would return a member without the the @example.com domain. Default is no regex.
ldap_rfc2307bis Default uses rfc2307 schema. If rfc2307bis (groups stored as a list of DNs in member attr), set this to 1.
ldap_debug Sets the debug level for the underlying C library. Defaults to no logging.
These options configure the behaviour of the nssdb cache.
nssdb_dir Directory to store the Berkeley DB databases. Defaults to the current directory. Note that nss_db hardcodes the path to /var/db/nsscache on Debian systems, and /var/db on Red Hat systems.
nssdb_makedb Path to the makedb(1) command, which is used by the nssdb cache code to ensure that the Berkeley DB version created by the module matches that expected by the nss_db NSS module.
These optiosn configure the behaviour of the files cache.
files_dir Directory location to store the plain text files in. Defaults to the current directory.
files_cache_filename_suffix A suffix appended to the cache filename to differentiate it from, say, system NSS databases. Defaults to .cache.
files_local_automount_master A yes/no field only used for automount maps. A yes value will cause nsscache to update the auto.master file with the master map from the source. A no value will cause nsscache to leave auto.master alone, allowing the system to manage this file in other ways. When set to no, nsscache will only update other automount maps defined both locally and in the source. Defaults to yes.
A typical example might look like this:
source = ldap
cache = nssdb
maps = passwd, group, shadow
ldap_uri = ldap://ldap.example.com
ldap_base = ou=People,dc=example,dc=com
ldap_filter = (objectclass=posixAccount)
nssdb_dir = /var/db/nsscache
ldap_base = ou=Group,dc=example,dc=com
ldap_filter = (objectclass=posixGroup)
ldap_filter = (objectclass=posixAccount)
And a complementary /etc/nsswitch.conf might look like this:
passwd: files db
group: files db
shadow: files db
/etc/nsscache.conf The system-wide nsscache configuration file
The system name service switch configuration file ldap.conf(5) Details on LDAP configuration options exposed by the LDAP client libraries.
Written by Jamie Wilkinson (email@example.com) and Vasilios Hoffman (firstname.lastname@example.org).
The source code lives at https://github.com/google/nsscache
Copyright © 2007 Google, Inc.
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|nsscache 0.32||NSSCACHE.CONF (5)||2016-01-17|