freeipa/install/share/bootstrap-template.ldif

486 lines
10 KiB
Plaintext
Raw Normal View History

dn: cn=accounts,$SUFFIX
changetype: add
0000-12-31 18:09:24 -05:50
objectClass: top
objectClass: nsContainer
cn: accounts
0000-12-31 18:09:24 -05:50
dn: cn=users,cn=accounts,$SUFFIX
changetype: add
0000-12-31 18:09:24 -05:50
objectClass: top
objectClass: nsContainer
cn: users
0000-12-31 18:09:24 -05:50
dn: cn=groups,cn=accounts,$SUFFIX
changetype: add
0000-12-31 18:09:24 -05:50
objectClass: top
objectClass: nsContainer
cn: groups
0000-12-31 18:09:24 -05:50
dn: cn=services,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: services
0000-12-31 18:09:24 -05:50
2007-11-30 15:58:02 -06:00
dn: cn=computers,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: computers
dn: cn=hostgroups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: hostgroups
dn: cn=alt,$SUFFIX
changetype: add
objectClass: nsContainer
cn: alt
dn: cn=ng,cn=alt,$SUFFIX
changetype: add
objectClass: nsContainer
cn: ng
dn: cn=automount,$SUFFIX
changetype: add
objectClass: nsContainer
cn: automount
dn: cn=default,cn=automount,$SUFFIX
changetype: add
objectClass: nsContainer
cn: default
dn: automountmapname=auto.master,cn=default,cn=automount,$SUFFIX
changetype: add
objectClass: automountMap
automountMapName: auto.master
dn: automountmapname=auto.direct,cn=default,cn=automount,$SUFFIX
changetype: add
objectClass: automountMap
automountMapName: auto.direct
dn: description=/- auto.direct,automountmapname=auto.master,cn=default,cn=automount,$SUFFIX
changetype: add
objectClass: automount
automountKey: /-
automountInformation: auto.direct
description: /- auto.direct
dn: cn=hbac,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbac
dn: cn=hbacservices,cn=hbac,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbacservices
dn: cn=hbacservicegroups,cn=hbac,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbacservicegroups
dn: cn=sudo,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudo
dn: cn=sudocmds,cn=sudo,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudocmds
dn: cn=sudocmdgroups,cn=sudo,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudocmdgroups
dn: cn=sudorules,cn=sudo,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudorules
dn: cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: etc
dn: cn=locations,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: locations
dn: cn=sysaccounts,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: sysaccounts
dn: cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: ipa
dn: cn=masters,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: masters
dn: cn=replicas,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: replicas
dn: cn=dna,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: dna
dn: cn=posix-ids,cn=dna,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: posix-ids
Use certmonger to renew CA subsystem certificates Certificate renewal can be done only one one CA as the certificates need to be shared amongst them. certmonger has been trained to communicate directly with dogtag to perform the renewals. The initial CA installation is the defacto certificate renewal master. A copy of the certificate is stored in the IPA LDAP tree in cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX, the rdn being the nickname of the certificate, when a certificate is renewed. Only the most current certificate is stored. It is valid to have no certificates there, it means that no renewals have taken place. The clones are configured with a new certmonger CA type that polls this location in the IPA tree looking for an updated certificate. If one is not found then certmonger is put into the CA_WORKING state and will poll every 8 hours until an updated certificate is available. The RA agent certificate, ipaCert in /etc/httpd/alias, is a special case. When this certificate is updated we also need to update its entry in the dogtag tree, adding the updated certificate and telling dogtag which certificate to use. This is the certificate that lets IPA issue certificates. On upgrades we check to see if the certificate tracking is already in place. If not then we need to determine if this is the master that will do the renewals or not. This decision is made based on whether it was the first master installed. It is concievable that this master is no longer available meaning that none are actually tracking renewal. We will need to document this. https://fedorahosted.org/freeipa/ticket/2803
2012-07-11 14:51:01 -05:00
dn: cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: ca_renewal
dn: cn=certificates,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: certificates
dn: cn=custodia,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: custodia
dn: cn=dogtag,cn=custodia,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: dogtag
dn: cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: s4u2proxy
dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: ipaKrb5DelegationACL
objectClass: groupOfPrincipals
objectClass: top
cn: ipa-http-delegation
memberPrincipal: HTTP/$HOST@$REALM
ipaAllowedTarget: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
ipaAllowedTarget: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: groupOfPrincipals
objectClass: top
cn: ipa-ldap-delegation-targets
memberPrincipal: ldap/$HOST@$REALM
dn: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: groupOfPrincipals
objectClass: top
cn: ipa-cifs-delegation-targets
dn: uid=admin,cn=users,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: person
objectClass: posixaccount
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: inetuser
objectClass: ipaobject
objectClass: ipasshuser
uid: admin
krbPrincipalName: admin@$REALM
cn: Administrator
sn: Administrator
uidNumber: $IDSTART
gidNumber: $IDSTART
homeDirectory: /home/admin
loginShell: /bin/bash
gecos: Administrator
nsAccountLock: FALSE
ipaUniqueID: autogenerate
dn: cn=admins,cn=groups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: groupofnames
objectClass: posixgroup
objectClass: ipausergroup
objectClass: ipaobject
2007-10-04 15:41:19 -05:00
cn: admins
description: Account administrators group
gidNumber: $IDSTART
member: uid=admin,cn=users,cn=accounts,$SUFFIX
nsAccountLock: FALSE
ipaUniqueID: autogenerate
dn: cn=ipausers,cn=groups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: groupofnames
objectClass: nestedgroup
objectClass: ipausergroup
objectClass: ipaobject
description: Default group for all users
cn: ipausers
ipaUniqueID: autogenerate
dn: cn=editors,cn=groups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: groupofnames
objectClass: posixgroup
objectClass: ipausergroup
objectClass: ipaobject
gidNumber: eval($IDSTART+2)
description: Limited admins who can edit other users
cn: editors
ipaUniqueID: autogenerate
dn: cn=ipaservers,cn=hostgroups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: groupOfNames
objectClass: nestedGroup
objectClass: ipaobject
objectClass: ipahostgroup
description: IPA server hosts
cn: ipaservers
ipaUniqueID: autogenerate
dn: cn=sshd,cn=hbacservices,cn=hbac,$SUFFIX
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: sshd
description: sshd
ipauniqueid:autogenerate
dn: cn=ftp,cn=hbacservices,cn=hbac,$SUFFIX
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: ftp
description: ftp
ipauniqueid:autogenerate
dn: cn=su,cn=hbacservices,cn=hbac,$SUFFIX
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: su
description: su
ipauniqueid:autogenerate
dn: cn=login,cn=hbacservices,cn=hbac,$SUFFIX
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: login
description: login
ipauniqueid:autogenerate
dn: cn=su-l,cn=hbacservices,cn=hbac,$SUFFIX
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: su-l
description: su with login shell
ipauniqueid:autogenerate
dn: cn=sudo,cn=hbacservices,cn=hbac,$SUFFIX
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: sudo
description: sudo
ipauniqueid:autogenerate
dn: cn=sudo-i,cn=hbacservices,cn=hbac,$SUFFIX
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: sudo-i
description: sudo-i
ipauniqueid:autogenerate
dn: cn=gdm,cn=hbacservices,cn=hbac,$SUFFIX
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: gdm
description: gdm
ipauniqueid:autogenerate
dn: cn=gdm-password,cn=hbacservices,cn=hbac,$SUFFIX
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: gdm-password
description: gdm-password
ipauniqueid:autogenerate
dn: cn=kdm,cn=hbacservices,cn=hbac,$SUFFIX
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: kdm
description: kdm
ipauniqueid:autogenerate
dn: cn=Sudo,cn=hbacservicegroups,cn=hbac,$SUFFIX
changetype: add
objectClass: ipaobject
objectClass: ipahbacservicegroup
objectClass: nestedGroup
objectClass: groupOfNames
objectClass: top
cn: Sudo
ipauniqueid:autogenerate
description: Default group of Sudo related services
member: cn=sudo,cn=hbacservices,cn=hbac,$SUFFIX
member: cn=sudo-i,cn=hbacservices,cn=hbac,$SUFFIX
0000-12-31 18:09:24 -05:50
dn: cn=ipaConfig,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
objectClass: ipaGuiConfig
objectClass: ipaConfigObject
ipaUserSearchFields: uid,givenname,sn,telephonenumber,ou,title
ipaGroupSearchFields: cn,description
ipaSearchTimeLimit: 2
2010-10-18 16:07:01 -05:00
ipaSearchRecordsLimit: 100
ipaHomesRootDir: /home
ipaDefaultLoginShell: /bin/sh
ipaDefaultPrimaryGroup: ipausers
ipaMaxUsernameLength: 32
ipaPwdExpAdvNotify: 4
ipaGroupObjectClasses: top
ipaGroupObjectClasses: groupofnames
ipaGroupObjectClasses: nestedgroup
ipaGroupObjectClasses: ipausergroup
ipaGroupObjectClasses: ipaobject
ipaUserObjectClasses: top
ipaUserObjectClasses: person
ipaUserObjectClasses: organizationalperson
ipaUserObjectClasses: inetorgperson
ipaUserObjectClasses: inetuser
ipaUserObjectClasses: posixaccount
ipaUserObjectClasses: krbprincipalaux
ipaUserObjectClasses: krbticketpolicyaux
ipaUserObjectClasses: ipaobject
ipaUserObjectClasses: ipasshuser
ipaDefaultEmailDomain: $DOMAIN
ipaMigrationEnabled: FALSE
ipaConfigString: AllowNThash
ipaConfigString: KDC:Disable Last Success
ipaSELinuxUserMapOrder: guest_u:s0$$xguest_u:s0$$user_u:s0$$staff_u:s0-s0:c0.c1023$$unconfined_u:s0-s0:c0.c1023
ipaSELinuxUserMapDefault: unconfined_u:s0-s0:c0.c1023
dn: cn=cosTemplates,cn=accounts,$SUFFIX
changetype: add
objectclass: top
objectclass: nsContainer
cn: cosTemplates
# templates for this cos definition are managed by the pwpolicy plugin
dn: cn=Password Policy,cn=accounts,$SUFFIX
changetype: add
description: Password Policy based on group membership
objectClass: top
objectClass: ldapsubentry
objectClass: cosSuperDefinition
objectClass: cosClassicDefinition
cosTemplateDn: cn=cosTemplates,cn=accounts,$SUFFIX
cosAttribute: krbPwdPolicyReference override
cosSpecifier: memberOf
dn: cn=selinux,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: selinux
dn: cn=usermap,cn=selinux,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: usermap
2012-06-12 04:58:41 -05:00
dn: cn=ranges,cn=etc,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: ranges
dn: cn=${REALM}_id_range,cn=ranges,cn=etc,$SUFFIX
2012-06-12 04:58:41 -05:00
changetype: add
objectClass: top
objectClass: ipaIDrange
objectClass: ipaDomainIDRange
cn: ${REALM}_id_range
2012-06-12 04:58:41 -05:00
ipaBaseID: $IDSTART
ipaIDRangeSize: $IDRANGE_SIZE
ipaRangeType: ipa-local
dn: cn=ca,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: ca
dn: cn=certprofiles,cn=ca,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: certprofiles
dn: cn=caacls,cn=ca,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: caacls
dn: cn=cas,cn=ca,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: cas