Configuring Splat

splat.conf

Splat is configured by a configuration file usually named splat.conf. See the example config below (this config file is also included with the Splat source), and the splat.conf man page.

Example 1.1. Example splat.conf

<LDAP>
    # The LDAP Server configuration.
    # URI of the server(s)
    URI         ldaps://ldap1.example.com
    # The default search base for the server
    BaseDN      dc=example,dc=com
    # The distinguished name to use to bind to the LDAP directory
    # Both the BindDN and Password may be omitted, in which
    # case an anonymous bind is made.
    BindDN      cn=Manager,dc=example,dc=com
    # The password (may be in LDAP MD5/SHA1 form, generate using slappasswd)
    Password    {SSHA}0JjiKIXNxsrjzSRnFDDuJEM1wQLIMvv/
</LDAP>

<Logging>
    # Logging configuration
    <syslog>
        Level info
        Facility daemon
        Address /var/run/log
    </syslog>
#    <logfile>
        # Log debug messages to stdout
#        Level debug
#        Path STDOUT
#    </logfile>
</Logging>

<Service UserSSH>
    # The helper module
    Helper          splat.helpers.sshPublicKeys
    # The frequency at which the daemon will poll LDAP
    Frequency       10m

    # Helper-specific options. These are passed directly
    # to the helper plugin.	
    <Option home>
    	# Only write keys to home directories in /home
    	Value /home
    </Option>
    <Option minuid>
        # Do not write keys for users with a UID less than minuid
    	Value 1000
    </Option>
    <Option mingid>
        # Do not write keys for users with a GID less than mingid
    	Value 1000
    </Option>

    # The base DN to use when searching for entries.
    # Defaults to the LDAP BaseDN.
    SearchBase      ou=People,dc=example,dc=com
    # The filer to use when searching for entries
    SearchFilter    (objectClass=sshAccount)

    # Group-specific options.

    # Require that entries match one of the specified groups
    RequireGroup    yes

    # Only the first matching group is used, and groups are evaluated in the
    # order specified.
    <Group Administrators>
        # The base DN to use when searching for groups
        # Defaults to the LDAP BaseDN
        SearchBase       ou=Groups,dc=example,dc=com
        # The filter to use when searching for groups
        SearchFilter     (&(objectClass=groupOfUniqueNames)(cn=administrators))
    </Group>

    <Group Developers>
        # The base DN to use when searching for groups
        # Defaults to the LDAP BaseDN
        SearchBase       ou=Groups,dc=example,dc=com
        # The filter to use when searching for groups
        SearchFilter     (&(objectClass=groupOfUniqueNames)(cn=developers))

        # Limit developers to using svn, rooted in /export/svn/repos
        <Option command>
            Value    /usr/local/bin/svnserve -t -r /export/svn/repos
        </Option>
    </Group>
</Service>

<Service MailForward>
    # The helper module
    Helper          splat.helpers.mailForwardingAddress
    # The frequency at which the daemon will poll LDAP
    Frequency       10m

    # Helper-specific options. These are passed directly
    # to the helper plugin.	
    <Option home>
    	# Only write keys to home directories in /home
    	Value /home
    </Option>
    <Option minuid>
        # Do not write keys for users with a UID less than minuid
    	Value 1000
    </Option>
    <Option mingid>
        # Do not write keys for users with a GID less than mingid
    	Value 1000
    </Option>

    # The base DN to use when searching for entries.
    # Defaults to the LDAP BaseDN.
    SearchBase      ou=People,dc=example,dc=com
    # The filer to use when searching for entries
    SearchFilter    (objectClass=posixAccount)
</Service>

<Service HomeDirectory>
    # The helper module
    Helper          splat.helpers.homeDirectory
    # The frequency at which the daemon will poll LDAP
    Frequency       10m

    # Helper-specific options. These are passed directly
    # to the helper plugin.	
    <Option home>
    	# Only create home directories in /home
    	Value /home
    </Option>
    <Option minuid>
        # Do not create directories for users with a UID less than minuid
    	Value 1000
    </Option>
    <Option mingid>
        # Do not create directories for users with a GID less than mingid
    	Value 1000
    </Option>
    <Option skeldir>
        # Skeletal home directory
        Value /usr/share/skel
    </Option>
    <Option postcreate>
        # Script to execute post-homedir creation. Will be given the user's
        # uid, gid, and home directory as arguments
        Value /usr/local/libexec/splat-home-postcreate.sh
    </Option>

    # The base DN to use when searching for entries.
    # Defaults to the LDAP BaseDN.
    SearchBase      ou=People,dc=example,dc=com
    # The filer to use when searching for entries
    SearchFilter    (objectClass=posixAccount)
</Service>