Configuring Splat
Prev | Chapter 1. Installing and Using Splat | Next

## Configuring Splat

### splat.conf

Splat is configured by a configuration file usually named `splat.conf`. See the example config below (this config file is also included with the Splat source), and the splat.conf man page.

Example 1.1. Example splat.conf

                <LDAP>
        # The LDAP Server configuration.
        # URI of the server(s)
        URI         ldaps://ldap1.example.com
        # The default search base for the server
        BaseDN      dc=example,dc=com
        # The distinguished name to use to bind to the LDAP directory
        # Both the BindDN and Password may be omitted, in which
        # case an anonymous bind is made.
        BindDN      cn=Manager,dc=example,dc=com
        # The password (may be in LDAP MD5/SHA1 form, generate using slappasswd)
        Password    {SSHA}0JjiKIXNxsrjzSRnFDDuJEM1wQLIMvv/
    </LDAP>

    <Logging>
        # Log messages at level INFO or higher
        Level info

        # Log to syslog
        <syslog>
            Facility daemon
            Address /var/run/log
        </syslog>

    #    # Log messages to stdout
    #    <logfile>
    #        Path STDOUT
    #    </logfile>
    </Logging>

    <Service UserSSH>
        # The helper module
        Helper          splat.helpers.sshPublicKeys
        # The frequency at which the daemon will poll LDAP
        Frequency       10m

        # Helper-specific options. These are passed directly
        # to the helper plugin.
        <Option home>
        	# Only write keys to home directories in /home
        	Value /home
        </Option>
        <Option minuid>
            # Do not write keys for users with a UID less than minuid
        	Value 1000
        </Option>
        <Option mingid>
            # Do not write keys for users with a GID less than mingid
        	Value 1000
        </Option>

        # The base DN to use when searching for entries.
        # Defaults to the LDAP BaseDN.
        SearchBase      ou=People,dc=example,dc=com
        # The filer to use when searching for entries
        SearchFilter    (&(objectClass=sshAccount)(accountStatus=active))

        # Group-specific options.

        # Require that entries match one of the specified groups
        RequireGroup    yes

        # Only the first matching group is used, and groups are evaluated in the
        # order specified. Groups must store member DNs, which groupOfUniqueNames
        # and groupOfNames object classes do. The posixGroup object class cannot be
        # used because it stores member UIDs only.
        <Group Administrators>
            # The base DN to use when searching for groups
            # Defaults to the LDAP BaseDN
            SearchBase       ou=Groups,dc=example,dc=com
            # The filter to use when searching for groups
            SearchFilter     (&(objectClass=groupOfUniqueNames)(cn=administrators))
            # LDAP attribute used to store member DNs. Defaults to uniqueMember.
            MemberAttribute  uniqueMember
        </Group>

        <Group Developers>
            # The base DN to use when searching for groups
            # Defaults to the LDAP BaseDN
            SearchBase       ou=Groups,dc=example,dc=com
            # The filter to use when searching for groups
            SearchFilter     (&(objectClass=groupOfUniqueNames)(cn=developers))

            # Limit developers to using svn, rooted in /export/svn/repos
            <Option command>
                Value    /usr/local/bin/svnserve -t -r /export/svn/repos
            </Option>
        </Group>
    </Service>

    <Service MailForward>
        # The helper module
        Helper          splat.helpers.mailForwardingAddress
        # The frequency at which the daemon will poll LDAP
        Frequency       10m

        # Helper-specific options. These are passed directly
        # to the helper plugin.
        <Option home>
        	# Only write keys to home directories in /home
        	Value /home
        </Option>
        <Option minuid>
            # Do not write keys for users with a UID less than minuid
        	Value 1000
        </Option>
        <Option mingid>
            # Do not write keys for users with a GID less than mingid
        	Value 1000
        </Option>

        # The base DN to use when searching for entries.
        # Defaults to the LDAP BaseDN.
        SearchBase      ou=People,dc=example,dc=com
        # The filer to use when searching for entries
        SearchFilter    (&(objectClass=posixAccount)(accountStatus=active))
    </Service>

    <Service HomeDirectory>
        # The helper module
        Helper          splat.helpers.homeDirectory
        # The frequency at which the daemon will poll LDAP
        Frequency       10m

        # Helper-specific options. These are passed directly
        # to the helper plugin.
        <Option home>
        	# Only create home directories in /home
        	Value /home
        </Option>
        <Option minuid>
            # Do not create directories for users with a UID less than minuid
        	Value 1000
        </Option>
        <Option mingid>
            # Do not create directories for users with a GID less than mingid
        	Value 1000
        </Option>
        <Option skeldir>
            # Skeletal home directory to copy files from. By default, created
            # home directories are empty.
            Value /usr/share/skel
        </Option>
        <Option postcreate>
            # Script to execute post-homedir creation. Will be given the user's
            # uid, gid, and home directory as arguments
            Value /usr/local/libexec/splat-home-postcreate.sh
        </Option>

        # The base DN to use when searching for entries.
        # Defaults to the LDAP BaseDN.
        SearchBase      ou=People,dc=example,dc=com
        # The filer to use when searching for entries
        SearchFilter    (&(objectClass=posixAccount)(accountStatus=active))
    </Service>

    <Service purgeUser>
        # The helper module
        Helper          splat.helpers.purgeUser
        # The frequency at which the daemon will poll LDAP
        Frequency       10m

        # Helper-specific options. These are passed directly
        # to the helper plugin.
        <Option home>
        	# Only purge/archive users with home directories in home
        	Value /home
        </Option>
        <Option minuid>
            # Do not purge users with a UID less than minuid
        	Value 1000
        </Option>
        <Option mingid>
            # Do not purge users with a GID less than mingid
        	Value 1000
        </Option>
        <Option archivehomedir>
            # Archive home directory before purging? Defaults to true.
            Value true
        </Option>
        <Option purgehomedir>
            # Actually purge home directory? Defaults to true.
            Value true
        </Option>
        <Option purgehomearchive>
            # Eventually purge archive made of home directory, too?
            # Defaults to true.
            Value true
        </Option>
        <Option archivedest>
            # Where to place archives of home directories, if
            # they are created. Defaults to /home.
            Value /home
        </Option>
        <Option purgearchivewait>
            # Number of days to wait after pendingPurge time before
            # purging home archive, if purgehomearchive is set to
            # true. Defaults to 14.
            Value 14
        </Option>

        # The base DN to use when searching for entries.
        # Defaults to the LDAP BaseDN.
        SearchBase      ou=People,dc=example,dc=com
        # The filer to use when searching for entries
        SearchFilter    (&(objectClass=purgeableAccount)(accountStatus=disabled))
    </Service>

    <Service OpenNMS>
        # The helper module
        Helper          splat.helpers.opennms
        # The frequency at which the daemon will poll LDAP
        Frequency       60m

        # Helper-specific options. These are passed directly
        # to the helper plugin.
        <Option usersFile>
            Value /usr/local/opennms/etc/users.xml
        </Option>
        <Option groupsFile>
            Value /usr/local/opennms/etc/groups.xml
        </Option>
        <Option userNameAttribute>
            Value uid
        </Option>
        <Option fullNameAttribute>
            Value cn
        </Option>
        <Option emailAttribute>
            Value mail
        </Option>
        <Option xmppAddressAttribute>
            Value mail
        </Option>
        <Option commentsAttribute>
            Value title
        </Option>
        <Option opennmsGroup>
            Value Users
        </Option>

        # The base DN to use when searching for entries.
        # Defaults to the LDAP BaseDN.
        SearchBase      ou=People,dc=example,dc=com
        # The filer to use when searching for entries
        SearchFilter    (&(objectClass=sshAccount)(accountStatus=active))

        # Group-specific options.

        # Require that entries match one of the specified groups
        RequireGroup    no

        # Only the first matching group is used, and groups are evaluated in the
        # order specified.
        <Group Administrators>
            # The base DN to use when searching for groups
            # Defaults to the LDAP BaseDN
            SearchBase       ou=Groups,dc=example,dc=com
            # The filter to use when searching for groups
            SearchFilter     (&(objectClass=groupOfUniqueNames)(cn=administrators))
            <Option opennmsGroup>
                Value Administrators
            </Option>
        </Group>
    </Service>

Prev | Up | Next
Chapter 1. Installing and Using Splat | Home | Running Splat