nslcd.conf(5) System Manager's Manual nslcd.conf(5) (NAME) nslcd.conf - LDAP (DESCRIPTION) nss-pam-ldapd LDAP . ( NIS .) nslcd.conf nslcd ( nslcd(8)). NSS PAM LDAP . (OPTIONS) (RUNTIME OPTIONS) threads NUM LDAP . LDAP . . uid UID (UID) . . UID . LDAP . gid GID (GID) . . GID . LDAP . log SCHEME [LEVEL] . SCHEME none syslog . LEVEL . : crit error warning notice info debug. info . . . syslog info . (GENERAL CONNECTION OPTIONS) uri URI ... (URI) LDAP . URI ldap ldapi ldaps LDAP TCP IPC SSL ( LDAP ). DNS SRV DNS . DNS:DOMAIN . SRV URI ldaps:// DNSLDAPS . ldapi %2f ( ldapi://%2fvar%2frun%2fslapd%2fldapi/) . / URI . ( bind_timelimit ). LDAP IP LDAP . ldap_version VERSION LDAP . LDAP . binddn DN (DN) (bind) . . bindpw PASSWORD () . binddn . nslcd.conf . rootpwmoddn DN (DN) PAM . DN LDAP . rootpwmodpw PASSWORD () . rootpwmoddn . PAM . nslcd.conf . SASL (SASL AUTHENTICATION OPTIONS) sasl_mech MECHANISM SASL SASL . sasl_realm REALM SASL SASL . sasl_authcid AUTHCID SASL . sasl_authzid AUTHZID SASL . : dn: u: . sasl_secprops PROPERTIES Cyrus SASL . ldap.conf(5) . sasl_canonicalize yes|no LDAP . yes LDAP . LDAP . (KERBEROS AUTHENTICATION OPTIONS) krb5_ccname NAME GSS-API . / (SEARCH/MAPPING OPTIONS) base [MAP] DN (DN) . . MAP . MAP . DN DOMAIN DNS . "" ( base LDAP ). LDAP . LDAP nslcd . scope [MAP] sub[tree]|one[level]|base|children (subtree onelevel base children). subtree base children . deref never|searching|finding|always . . referrals yes|no . . filter MAP FILTER FILTER LDAP . objectClass ( (objectClass=posixAccount)). map MAP ATTRIBUTE NEWATTRIBUTE RFC 2307 . MAP . ATTRIBUTE RFC 2307 ( userPassword ipProtocolNumber macAddress ). NEWATTRIBUTE . NEWATTRIBUTE (") "EXPRESSION" . . group passwd shadow ( ). group userPassword . passwd : userPassword gidNumber gecos homeDirectory loginShell. shadow : userPassword shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag. uidNumber gidNumber passwd group objectSid SID SID ( objectSid:S-1-5-21-3623811015-3361044348-30300820). userPassword ("*") . / (TIMING/RECONNECT OPTIONS) bind_timelimit SECONDS ( ) . timelimit . LDAP . bind_timelimit . timelimit SECONDS ( ) LDAP . (0) . idle_timelimit SECONDS ( ) LDAP . . reconnect_sleeptime SECONDS LDAP . . reconnect_retrytime SECONDS LDAP . . . nslcd LDAP . NSS PAM nslcd nslcd . nslcd . SSL/TLS (SSL/TLS OPTIONS) ssl on|off|start_tls SSL/TLS ( ). start_tls LDAP SSL StartTLS . LDAP SSL StartTLS . tls_reqcert never|allow|try|demand|hard . ldap.conf(5) . tls_cacertdir tls_cacertfile . tls_cacertdir PATH X.509 . GnuTLS . OpenLDAP GnuTLS . tls_cacertfile PATH X.509 . tls_randfile PATH . GnuTLS . OpenLDAP GnuTLS . tls_ciphers CIPHERS TLS . TLS . tls_cert PATH TLS . tls_key PATH TLS . tls_reqsan never|allow|try|demand|hard (SAN) . ldap.conf(5) . tls_crlcheck none|peer|all (CRL) CA . ldap.conf(5) . tls_crlfile PATH (CRL) . ldap.conf(5) . (OTHER OPTIONS) pagesize NUMBER RFC2696 LDAP . (0) . LDAP ( ) . OpenLDAP sizelimit size.prtotal=unlimited . nss_initgroups_ignoreusers user1,user2,... LDAP . LDAP . . ALLLOCAL . nslcd LDAP . nss_min_uid UID LDAP . . nss_uid_offset NUMBER LDAP . objectSid . nss_min_uid . nss_gid_offset NUMBER LDAP . objectSid . nss_nested_groups yes|no member . . . nss_getgrent_skipmembers yes|no . . . . . nss_disable_enumeration yes|no / (getpwent() getgrent() setspent()) . / . LDAP / . / / . . validnames REGEX . LDAP . POSIX . (/) 'i' . : /^[a-z0-9._@$()]([a-z0-9._@$() \\~-]*[a-z0-9._@$()~-])?$/i ignorecase yes|no group netgroup passwd protocols rpc services shadow . yes nscd . LDAP . pam_authc_ppolicy yes|no LDAP . . pam_authc_search FILTER nslcd LDAP BIND ( ) BIND . DN . . pam_authz_search . BASE DN . NONE BIND . LDAP BIND ( ). pam_authz_search FILTER . . : $username $service $ruser $rhost $tty $hostname $fqdn $domain $dn $uid. . authorizedService ( pam_check_service_attr pam_ldap PADL ): (&(objectClass=posixAccount)(uid=$username)(|(authorizedService=$service)(!(authorizedService=*)))) pam_check_host_attr : (&(objectClass=posixAccount)(uid=$username)(|(host=$hostname)(host=$fqdn)(host=\\*))) . pam_password_prohibit_message "MESSAGE" pam_ldap . . reconnect_invalidate DB,DB,... nslcd LDAP . DB nsswitch nscd . DB nfsidmap nfsidmap . ( ) LDAP . cache CACHE TIME [TIME] . TIME . TIME . . s m h d . 0 off . dn2uid DN member . 15m . (SUPPORTED MAPS) . MAP . alias[es] (). NSS /etc/aliases . ether[s] ( ). group (Posix). host[s] . netgroup . network[s] . passwd (Posix). protocol[s] ( /etc/protocols). rpc (RPC). service[s] . shadow (shadow) . (ATTRIBUTE MAPPING EXPRESSIONS) . . (POSIX) . . : "${attr}" ( "$attr") "${attr:-word}" ( ) word "${attr:+word}" ( ) word "${attr:offset:length}" length ( ) offset ( ) length offset "${attr#word}" word "${attr##word}" word ( pynslcd) "${attr%word}" word ( pynslcd) "${attr%%word}" word ( pynslcd) nslcd # ? . pynslcd . (") ($) (\) (\) () . LDAP . : map shadow shadowFlag "${shadowFlag:-0}" shadowFlag 0 map passd homeDirectory "${homeDirectory:-/home/$uid}" uid homeDirectory map shadow shadowExpire "${isDisabled:+100}" isDisabled map shadow userPassword "${userPassword#{crypt\}}" {crypt} userPassword (FILES) /etc/nslcd.conf /etc/nsswitch.conf (Name Service Switch) (SEE ALSO) nslcd(8), nsswitch.conf(5) (AUTHORS) Arthur de Jong nss_ldap(5) .PADL Software Pty Ltd . Version 0.9.13 Feb 2025 nslcd.conf(5)