dn: cn=configobjectClass: olcGlobalcn: configolcArgsFile: /var/run/openldap/slapd.argsolcPidFile: /var/run/openldap/slapd.pid## TLS settings#olcTLSCACertificatePath: /etc/openldap/certsolcTLSCertificateFile: "OpenLDAP Server"olcTLSCertificateKeyFile: /etc/openldap/certs/passwordstructuralObjectClass: olcGlobalentryUUID: 0ca4a796-53e8-1034-90ac-5fa43e938d62creatorsName: cn=configcreateTimestamp: 20161217040752ZentryCSN: 20161217040752.632838Z#000000#000#000000modifiersName: cn=configmodifyTimestamp: 20161217040752Z## Do not enable referrals until AFTER you have a working directory# service AND an understanding of referrals.##olcReferral: ldap://root.openldap.org## Sample security restrictions# Require integrity protection (prevent hijacking)# Require 112-bit (3DES or better) encryption for updates# Require 64-bit encryption for simple bind##olcSecurity: ssf=1 update_ssf=112 simple_bind=64## Load dynamic backend modules:# - modulepath is architecture dependent value (32/64-bit system)# - back_sql.la backend requires openldap-servers-sql package# - dyngroup.la and dynlist.la cannot be used at the same time#dn: cn=module,cn=configobjectClass: olcModuleListcn: module#olcModulepath: /usr/lib/openldapolcModulepath: /usr/lib64/openldap#olcModuleload: accesslog.la#olcModuleload: auditlog.la#olcModuleload: back_dn***v.la#olcModuleload: back_ldap.laolcModuleload: back_mdb.la#olcModuleload: back_meta.la#olcModuleload: back_null.la#olcModuleload: back_passwd.la#olcModuleload: back_relay.la#olcModuleload: back_shell.la#olcModuleload: back_sock.la#olcModuleload: collect.la#olcModuleload: constraint.la#olcModuleload: dds.la#olcModuleload: deref.la#olcModuleload: dyngroup.la#olcModuleload: dynlist.la#olcModuleload: memberof.la#olcModuleload: pcache.la#olcModuleload: ppolicy.la#olcModuleload: refint.la#olcModuleload: retcode.la#olcModuleload: rwm.la#olcModuleload: seqmod.la#olcModuleload: smbk5pwd.la#olcModuleload: sssvlv.la#olcModuleload: syncprov.la#olcModuleload: translucent.la#olcModuleload: unique.la#olcModuleload: valsort.la## Schema settings#dn: cn=schema,cn=configobjectClass: olcSchemaConfigcn: schemainclude: file:///etc/openldap/schema/core.ldifinclude: file:///etc/openldap/schema/cosine.ldifinclude: file:///etc/openldap/schema/nis.ldifinclude: file:///etc/openldap/schema/inetorgperson.ldifinclude: file:///etc/openldap/schema/openldap.ldifinclude: file:///etc/openldap/schema/corba.ldifinclude: file:///etc/openldap/schema/duaconf.ldifinclude: file:///etc/openldap/schema/dyngroup.ldif## Frontend settings#dn: olcDatabase=frontend,cn=configobjectClass: olcDatabaseConfigobjectClass: olcFrontendConfigolcDatabase: frontendolcAccess: to * by * readolcSizelimit: size.soft=10000 size.hard=1000000olcTimelimit: time.soft=300 time.hard=3600## Sample global access control policy:# Root DSE: allow anyone to read it# Subschema (sub)entry DSE: allow anyone to read it# Other DSEs:# Allow self write access# Allow authenticated users read access# Allow anonymous users to authenticate##olcAccess: to dn.base="" by * read#olcAccess: to dn.base="cn=Subschema" by * read#olcAccess: to *# by self write# by users read# by anonymous auth## if no access controls are present, the default policy# allows anyone and everyone to read anything but restricts# updates to rootdn. (e.g., "access to * by * read")## rootdn can always read and write EVERYTHING!### Configuration database#dn: olcDatabase=config,cn=configobjectClass: olcDatabaseConfigolcDatabase: configolcRootDN: cn=Manager,cn=configolcRootPW: {SSHA}la/7FNIvnUbtQmjUNf6NvnrDZAntJBKx# generate a password by running slappasswdolcMonitoring: FALSEolcAccess: to * by * none#olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c# n=auth" manage by * none## Server status monitoring#dn: olcDatabase=monitor,cn=configobjectClass: olcDatabaseConfigolcDatabase: monitorolcAddContentAcl: FALSEolcLastMod: TRUEolcMaxDerefDepth: 15olcReadOnly: FALSEolcSyncUseSubentry: FALSEolcMonitoring: FALSEolcAccess: to dn.subtree="cn=monitor" by dn.base="cn=Manager,cn=config" read by dn.base="cn=Manager,dc=test,dc=com" read by * none#olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c# n=auth" read by dn.base="cn=Manager,dc=my-domain,dc=com" read by * none## Backend database definitions#dn: olcDatabase=mdb,cn=configobjectClass: olcDatabaseConfigobjectClass: olcMdbConfigolcDatabase: mdbolcMonitoring: TRUEolcDbMaxSize: 42949672960olcSuffix: dc=test,dc=comolcDbDirectory: /var/lib/ldapolcRootDN: cn=Manager,dc=test,dc=com# generate a password by running slappasswdolcRootPW: {SSHA}AAek63z+Bzz9rG/djlyIm0pKsrxHpeMholcDbIndex: uid pres,eqolcDbIndex: cn,sn pres,eq,approx,subolcDbIndex: mail pres,eq,subolcDbIndex: objectClass pres,eqolcDbIndex: loginShell pres,eq#olcDbIndex: objectClass eq,pres#olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub# Tuning, not sure what these do maybe test them#olcDbConfig: set_cachesize 0 2097152 0#olcDbConfig: set_lk_max_objects 1500#olcDbConfig: set_lk_max_locks 1500#olcDbConfig: set_lk_max_lockers 1500#olcLastMod: TRUE#olcMonitoring: TRUE#olcDbCheckpoint: 512 30olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=test,dc=com" write by * noneolcAccess: to attrs=shadowLastChange by self write by * readolcAccess: to * by dn.base="cn=Manager,dc=test,dc=com" write by * read ##olcRootPW 的值是由slappasswd -s "密码生成" 生成后的密码替换配置文件中的值，即可