bionic (5) nsscache.conf.5.gz

Provided by: nsscache_0.34-2ubuntu1_all bug

NAME

       nsscache.conf - NSS local cache synchroniser configuration file

SYNOPSIS

       /etc/nsscache.conf

DESCRIPTION

       nsscache synchronises a local NSS cache, and other databases, against a remote data source. This approach
       allows the administrator to separate the network from  the  NSS  lookup  codepath,  improving  speed  and
       reliability of name services.

       The  nsscache  configuration file comprises of one DEFAULT section, followed by zero or more map-specific
       configuration sections.  The file format is similar to that of ".ini" files.

       The DEFAULT section must provide at least one source keyword, specifying the  data  source  to  use,  one
       cache  keyword,  specifying  the  means in which the cache data will be stored locally, one maps keyword,
       specifying which NSS maps should be cached, and one timestamp_dir keyword, specifying the location of the
       timestamps used for incremental updates.

       Additional  global defaults, such as LDAP search parameters, or the filesystem location of the cache, may
       also be included in the DEFAULT section.

       Additional sections may be included that allow per-map overrides to configuration options.  For  example,
       one  might  specify  their  global  LDAP search base as ou=People but want to override that for the group
       mapping as ou=Groups

       Apart from the source, cache, and maps configuration options, all options are prefixed by the name of the
       module that they configure.

       A complete list of configuration options follows.

DEFAULT-only OPTIONS

       source Specifies the source to use to retrieve NSS data from.

              Valid Options: ldap

       cache  Specifies the cache method to use to store the data, which will be queried by the NSS itself.

              Valid  options: files Store in a plain text file, similar in format to /etc/passwd.  If the files-
              module option files_cache_filename_suffix is also set to cache then not only  will  the  files  be
              created  with  a .cache suffix, but also an index file will be written alongside, for use with the
              nss-cache NSS module.  (See https://github.com/google/libnss-cache.)

              nssdb Store in a Berkeley DB file, for use with the nss_db NSS  module.   Please  note  that  this
              option is deprecated in favour of cache

       maps   Specifies the names of the maps that will be queried and cached by nsscache

              Valid options: passwd group shadow netgroup automount sshkey

       timestamp_dir
              Specifies the directory where update and modify timestamps are stored.

ldap SOURCE OPTIONS

       These options configure the behaviour of the ldap source.

       ldap_uri
              The LDAP URI to connect to.

       ldap_base
              The base to perform LDAP searches under.

       ldap_filter
              The search filter to use when querying.

       ldap_scope
              The search scope to use.  Defaults to one

              Valid options: sub[tree] one[level] base

       ldap_bind_dn
              The  bind  DN to use when connecting to LDAP.  Empty string is an anonymous bind.  Defaults to the
              empty string.

       ldap_bind_password
              The bind password to use when connecting to LDAP.  Empty  string  is  used  for  anonymous  binds.
              Defaults to the empty string.

       ldap_timelimit
              Timelimit in seconds for search results to return.  -1 means no limit.  Defaults to -1.

       ldap_retry_max
              Number of retries on soft failures before giving up.  Defaults to 3.

       ldap_retry_delay
              Delay in seconds between retries.  Defaults to 5.

       ldap_tls_require_cert
              Sets  expectations for SSL certificates, using TLS.  One of 'never', 'hard', 'demand', 'allow', or
              'try'.  See ldap.conf(5) for more information.

       ldap_tls_cacertdir
              Directory for trusted CA certificates.  Defaults to /usr/share/ssl

       ldap_tls_cacertfile
              Filename containing trusted CA certificates.  Defaults to /usr/share/ssl/cert.pem

       ldap_tls_starttls
              Set to 1 to enable STARTTLS. Leave absent to disable.

       ldap_uidattr
              The uid-like attribute in your directory.  Defaults to uid.

       ldap_uidregex
              A Python regex to extract uid components from the uid-like attribute.   All  matching  groups  are
              concatenated  without  spaces.  For example:  '(.*)@example.com' would return a uid to the left of
              the @example.com domain.  Default is no regex.

       ldap_groupregex
              A Python regex to extract group member components from the member  or  memberOf  attributes.   All
              matching  groups are concatenated without spaces.  For example:  '(.*)@example.com' would return a
              member without the the @example.com domain.  Default is no regex.

       ldap_rfc2307bis
              Default uses rfc2307 schema. If rfc2307bis (groups stored as a list of DNs in 'member' attr),  set
              this to 1.

       ldap_debug
              Sets the debug level for the underlying C library.  Defaults to no logging.

nssdb CACHE OPTIONS

       These options configure the behaviour of the nssdb cache.

       nssdb_dir
              Directory  to  store  the  Berkeley  DB  databases.  Defaults to the current directory.  Note that
              nss_db hardcodes the path to /var/lib/misc on Debian systems, and /var/db on Red Hat systems.

       nssdb_makedb
              Path to the makedb(1) command, which is used by the nssdb cache code to ensure that  the  Berkeley
              DB version created by the module matches that expected by the nss_db NSS module.

files CACHE OPTIONS

       These optiosn configure the behaviour of the files cache.

       files_dir
              Directory location to store the plain text files in.  Defaults to the current directory.

       files_cache_filename_suffix
              A  suffix  appended  to  the  cache  filename to differentiate it from, say, system NSS databases.
              Defaults to '.cache'.

       files_local_automount_master
              A yes/no field only used for automount maps.  A 'yes' value will  cause  nsscache  to  update  the
              auto.master  file  with the master map from the source.  A 'no' value will cause nsscache to leave
              auto.master alone, allowing the system to manage this file in  other  ways.   When  set  to  'no',
              nsscache  will  only update other automount maps defined both locally and in the source.  Defaults
              to 'yes'.

EXAMPLE

       A typical example might look like this:

         [DEFAULT]
         source = ldap
         cache = nssdb
         maps = passwd, group, shadow
         ldap_uri = ldap://ldap.example.com
         ldap_base = ou=People,dc=example,dc=com
         ldap_filter = (objectclass=posixAccount)
         nssdb_dir = /var/lib/misc

         [group]
         ldap_base = ou=Group,dc=example,dc=com
         ldap_filter = (objectclass=posixGroup)

         [shadow]
         ldap_filter = (objectclass=posixAccount)

       And a complementary /etc/nsswitch.conf might look like this:

         passwd: files db
         group: files db
         shadow: files db

FILES

       /etc/nsscache.conf
              The system-wide nsscache configuration file

SEE ALSO

       nsscache(1)

       nsswitch.conf(5)
              The system name service switch configuration file

       ldap.conf(5)
              Details on LDAP configuration options exposed by the LDAP client libraries.

AUTHOR

       Written by Jamie Wilkinson (jaq@google.com) and Vasilios Hoffman (vasilios@google.com).

       The source code lives at https://github.com/google/nsscache

       Copyright © 2007 Google, Inc.
       This is free software; see the source for copying  conditions.   There  is  NO  warranty;  not  even  for
       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.