Configuring Splat

splat.conf

Splat is configured by a configuration file usually named splat.conf. See the example config below (this config file is also included with the Splat source), and the splat.conf man page.

Example 1.1. Example splat.conf

<LDAP>
    # The LDAP Server configuration.
    # URI of the server(s)
    URI         ldaps://ldap1.example.com
    # The default search base for the server
    BaseDN      dc=example,dc=com
    # The distinguished name to use to bind to the LDAP directory
    # Both the BindDN and Password may be omitted, in which
    # case an anonymous bind is made.
    BindDN      cn=Manager,dc=example,dc=com
    # The password (may be in LDAP MD5/SHA1 form, generate using slappasswd)
    Password    {SSHA}0JjiKIXNxsrjzSRnFDDuJEM1wQLIMvv/
</LDAP>

<Logging>
    # Logging configuration
    <syslog>
        Level info
        Facility daemon
        Address /var/run/log
    </syslog>
#    <logfile>
        # Log debug messages to stdout
#        Level debug
#        Path STDOUT
#    </logfile>
</Logging>

<Service UserSSH>
    # The helper module
    Helper          splat.helpers.sshPublicKeys
    # The frequency at which the daemon will poll LDAP
    Frequency       10m

    # Helper-specific options. These are passed directly
    # to the helper plugin.	
    <Option home>
    	# Only write keys to home directories in /home
    	Value /home
    </Option>
    <Option minuid>
        # Do not write keys for users with a UID less than minuid
    	Value 1000
    </Option>
    <Option mingid>
        # Do not write keys for users with a GID less than mingid
    	Value 1000
    </Option>

    # The base DN to use when searching for entries.
    # Defaults to the LDAP BaseDN.
    SearchBase      ou=People,dc=example,dc=com
    # The filer to use when searching for entries
    SearchFilter    (&(objectClass=sshAccount)(accountStatus=active))

    # Group-specific options.

    # Require that entries match one of the specified groups
    RequireGroup    yes

    # Only the first matching group is used, and groups are evaluated in the
    # order specified.
    <Group Administrators>
        # The base DN to use when searching for groups
        # Defaults to the LDAP BaseDN
        SearchBase       ou=Groups,dc=example,dc=com
        # The filter to use when searching for groups
        SearchFilter     (&(objectClass=groupOfUniqueNames)(cn=administrators))
    </Group>

    <Group Developers>
        # The base DN to use when searching for groups
        # Defaults to the LDAP BaseDN
        SearchBase       ou=Groups,dc=example,dc=com
        # The filter to use when searching for groups
        SearchFilter     (&(objectClass=groupOfUniqueNames)(cn=developers))

        # Limit developers to using svn, rooted in /export/svn/repos
        <Option command>
            Value    /usr/local/bin/svnserve -t -r /export/svn/repos
        </Option>
    </Group>
</Service>

<Service MailForward>
    # The helper module
    Helper          splat.helpers.mailForwardingAddress
    # The frequency at which the daemon will poll LDAP
    Frequency       10m

    # Helper-specific options. These are passed directly
    # to the helper plugin.	
    <Option home>
    	# Only write keys to home directories in /home
    	Value /home
    </Option>
    <Option minuid>
        # Do not write keys for users with a UID less than minuid
    	Value 1000
    </Option>
    <Option mingid>
        # Do not write keys for users with a GID less than mingid
    	Value 1000
    </Option>

    # The base DN to use when searching for entries.
    # Defaults to the LDAP BaseDN.
    SearchBase      ou=People,dc=example,dc=com
    # The filer to use when searching for entries
    SearchFilter    (&(objectClass=posixAccount)(accountStatus=active))
</Service>

<Service HomeDirectory>
    # The helper module
    Helper          splat.helpers.homeDirectory
    # The frequency at which the daemon will poll LDAP
    Frequency       10m

    # Helper-specific options. These are passed directly
    # to the helper plugin.	
    <Option home>
    	# Only create home directories in /home
    	Value /home
    </Option>
    <Option minuid>
        # Do not create directories for users with a UID less than minuid
    	Value 1000
    </Option>
    <Option mingid>
        # Do not create directories for users with a GID less than mingid
    	Value 1000
    </Option>
    <Option skeldir>
        # Skeletal home directory
        Value /usr/share/skel
    </Option>
    <Option postcreate>
        # Script to execute post-homedir creation. Will be given the user's
        # uid, gid, and home directory as arguments
        Value /usr/local/libexec/splat-home-postcreate.sh
    </Option>

    # The base DN to use when searching for entries.
    # Defaults to the LDAP BaseDN.
    SearchBase      ou=People,dc=example,dc=com
    # The filer to use when searching for entries
    SearchFilter    (&(objectClass=posixAccount)(accountStatus=active))
</Service>

<Service purgeUser>
    # The helper module
    Helper          splat.helpers.purgeUser
    # The frequency at which the daemon will poll LDAP
    Frequency       10m

    # Helper-specific options. These are passed directly
    # to the helper plugin.	
    <Option home>
    	# Only purge/archive users with home directories in home
    	Value /home
    </Option>
    <Option minuid>
        # Do not purge users with a UID less than minuid
    	Value 1000
    </Option>
    <Option mingid>
        # Do not purge users with a GID less than mingid
    	Value 1000
    </Option>
    <Option archivehomedir>
        # Archive home directory before purging? Defaults to true.
        Value true
    </Option>
    <Option purgehomedir>
        # Actually purge home directory? Defaults to true.
        Value true
    </Option>
    <Option purgehomearchive>
        # Eventually purge archive made of home directory, too? 
        # Defaults to true.
        Value true
    </Option>
    <Option archivedest>
        # Where to place archives of home directories, if 
        # they are created. Defaults to /home.
        Value /home
    </Option>
    <Option purgearchivewait>
        # Number of days to wait after pendingPurge time before 
        # purging home archive, if purgehomearchive is set to 
        # true. Defaults to 14.
        Value 14
    </Option>

    # The base DN to use when searching for entries.
    # Defaults to the LDAP BaseDN.
    SearchBase      ou=People,dc=example,dc=com
    # The filer to use when searching for entries
    SearchFilter    (&(objectClass=purgeableAccount)(accountStatus=disabled))
</Service>