Configuring Splat

splat.conf

Splat is configured by a configuration file usually named splat.conf. See the example config below (this config file is also included with the Splat source), and the splat.conf man page.

Example 1.1. Example splat.conf

            <LDAP>
    # The LDAP Server configuration.
    # URI of the server(s)
    URI         ldaps://ldap1.example.com
    # The default search base for the server
    BaseDN      dc=example,dc=com
    # The distinguished name to use to bind to the LDAP directory
    # Both the BindDN and Password may be omitted, in which
    # case an anonymous bind is made.
    BindDN      cn=Manager,dc=example,dc=com
    # The password (may be in LDAP MD5/SHA1 form, generate using slappasswd)
    Password    {SSHA}0JjiKIXNxsrjzSRnFDDuJEM1wQLIMvv/
</LDAP>

<Logging>
    # Log messages at level INFO or higher
    Level info
    
    # Log to syslog
    <syslog>
        Facility daemon
        Address /var/run/log
    </syslog>

#    # Log messages to stdout
#    <logfile>
#        Path STDOUT
#    </logfile>
</Logging>

<Service UserSSH>
    # The helper module
    Helper          splat.helpers.sshPublicKeys
    # The frequency at which the daemon will poll LDAP
    Frequency       10m

    # Helper-specific options. These are passed directly
    # to the helper plugin.	
    <Option home>
    	# Only write keys to home directories in /home
    	Value /home
    </Option>
    <Option minuid>
        # Do not write keys for users with a UID less than minuid
    	Value 1000
    </Option>
    <Option mingid>
        # Do not write keys for users with a GID less than mingid
    	Value 1000
    </Option>

    # The base DN to use when searching for entries.
    # Defaults to the LDAP BaseDN.
    SearchBase      ou=People,dc=example,dc=com
    # The filer to use when searching for entries
    SearchFilter    (&(objectClass=sshAccount)(accountStatus=active))

    # Group-specific options.

    # Require that entries match one of the specified groups
    RequireGroup    yes

    # Only the first matching group is used, and groups are evaluated in the
    # order specified. Groups must store member DNs, which groupOfUniqueNames 
    # and groupOfNames object classes do. The posixGroup object class cannot be
    # used because it stores member UIDs only.
    <Group Administrators>
        # The base DN to use when searching for groups
        # Defaults to the LDAP BaseDN
        SearchBase       ou=Groups,dc=example,dc=com
        # The filter to use when searching for groups
        SearchFilter     (&(objectClass=groupOfUniqueNames)(cn=administrators))
        # LDAP attribute used to store member DNs. Defaults to uniqueMember. 
        MemberAttribute  uniqueMember
    </Group>

    <Group Developers>
        # The base DN to use when searching for groups
        # Defaults to the LDAP BaseDN
        SearchBase       ou=Groups,dc=example,dc=com
        # The filter to use when searching for groups
        SearchFilter     (&(objectClass=groupOfUniqueNames)(cn=developers))

        # Limit developers to using svn, rooted in /export/svn/repos
        <Option command>
            Value    /usr/local/bin/svnserve -t -r /export/svn/repos
        </Option>
    </Group>
</Service>

<Service MailForward>
    # The helper module
    Helper          splat.helpers.mailForwardingAddress
    # The frequency at which the daemon will poll LDAP
    Frequency       10m

    # Helper-specific options. These are passed directly
    # to the helper plugin.	
    <Option home>
    	# Only write keys to home directories in /home
    	Value /home
    </Option>
    <Option minuid>
        # Do not write keys for users with a UID less than minuid
    	Value 1000
    </Option>
    <Option mingid>
        # Do not write keys for users with a GID less than mingid
    	Value 1000
    </Option>

    # The base DN to use when searching for entries.
    # Defaults to the LDAP BaseDN.
    SearchBase      ou=People,dc=example,dc=com
    # The filer to use when searching for entries
    SearchFilter    (&(objectClass=posixAccount)(accountStatus=active))
</Service>

<Service HomeDirectory>
    # The helper module
    Helper          splat.helpers.homeDirectory
    # The frequency at which the daemon will poll LDAP
    Frequency       10m

    # Helper-specific options. These are passed directly
    # to the helper plugin.	
    <Option home>
    	# Only create home directories in /home
    	Value /home
    </Option>
    <Option minuid>
        # Do not create directories for users with a UID less than minuid
    	Value 1000
    </Option>
    <Option mingid>
        # Do not create directories for users with a GID less than mingid
    	Value 1000
    </Option>
    <Option skeldir>
        # Skeletal home directory to copy files from. By default, created 
        # home directories are empty.
        Value /usr/share/skel
    </Option>
    <Option postcreate>
        # Script to execute post-homedir creation. Will be given the user's
        # uid, gid, and home directory as arguments
        Value /usr/local/libexec/splat-home-postcreate.sh
    </Option>

    # The base DN to use when searching for entries.
    # Defaults to the LDAP BaseDN.
    SearchBase      ou=People,dc=example,dc=com
    # The filer to use when searching for entries
    SearchFilter    (&(objectClass=posixAccount)(accountStatus=active))
</Service>

<Service purgeUser>
    # The helper module
    Helper          splat.helpers.purgeUser
    # The frequency at which the daemon will poll LDAP
    Frequency       10m

    # Helper-specific options. These are passed directly
    # to the helper plugin.	
    <Option home>
    	# Only purge/archive users with home directories in home
    	Value /home
    </Option>
    <Option minuid>
        # Do not purge users with a UID less than minuid
    	Value 1000
    </Option>
    <Option mingid>
        # Do not purge users with a GID less than mingid
    	Value 1000
    </Option>
    <Option archivehomedir>
        # Archive home directory before purging? Defaults to true.
        Value true
    </Option>
    <Option purgehomedir>
        # Actually purge home directory? Defaults to true.
        Value true
    </Option>
    <Option purgehomearchive>
        # Eventually purge archive made of home directory, too? 
        # Defaults to true.
        Value true
    </Option>
    <Option archivedest>
        # Where to place archives of home directories, if 
        # they are created. Defaults to /home.
        Value /home
    </Option>
    <Option purgearchivewait>
        # Number of days to wait after pendingPurge time before 
        # purging home archive, if purgehomearchive is set to 
        # true. Defaults to 14.
        Value 14
    </Option>

    # The base DN to use when searching for entries.
    # Defaults to the LDAP BaseDN.
    SearchBase      ou=People,dc=example,dc=com
    # The filer to use when searching for entries
    SearchFilter    (&(objectClass=purgeableAccount)(accountStatus=disabled))
</Service>

<Service OpenNMS>
    # The helper module
    Helper          splat.helpers.opennms
    # The frequency at which the daemon will poll LDAP
    Frequency       60m

    # Helper-specific options. These are passed directly
    # to the helper plugin.     
    <Option usersFile>
        Value /usr/local/opennms/etc/users.xml
    </Option>
    <Option groupsFile>
        Value /usr/local/opennms/etc/groups.xml
    </Option>
    <Option userNameAttribute>
        Value uid
    </Option>
    <Option fullNameAttribute>
        Value cn
    </Option>
    <Option emailAttribute>
        Value mail
    </Option>
    <Option xmppAddressAttribute>
        Value mail
    </Option>
    <Option commentsAttribute>
        Value title
    </Option>
    <Option opennmsGroup>
        Value Users
    </Option>

    # The base DN to use when searching for entries.
    # Defaults to the LDAP BaseDN.
    SearchBase      ou=People,dc=example,dc=com
    # The filer to use when searching for entries
    SearchFilter    (&(objectClass=sshAccount)(accountStatus=active))

    # Group-specific options.

    # Require that entries match one of the specified groups
    RequireGroup    no

    # Only the first matching group is used, and groups are evaluated in the
    # order specified.
    <Group Administrators>
        # The base DN to use when searching for groups
        # Defaults to the LDAP BaseDN
        SearchBase       ou=Groups,dc=example,dc=com
        # The filter to use when searching for groups
        SearchFilter     (&(objectClass=groupOfUniqueNames)(cn=administrators))
        <Option opennmsGroup>
            Value Administrators
        </Option>
    </Group>
</Service>