olcGlobal - Security Attributes

Note: To change the UserDN or password for OLC (cn=config) use the olcDatabase={0}config entry

Showing: Entry Attribute Values
olcAuthzPolicy
olcConnMaxPendingAuth
olcLocalSSF
olcSaslHost
olcSaslSecProps
olcSockbufMaxIncomingAuth

TLS/SSL Attributes

TLS/SSL Server

Applicable when the server must respond to client requests for LDAPS service or StartTLS requests and during replication when acting as a provider to a consumer which requests TLS service. Note: The cn= part of the subject (or subjectAltName) in the server certificate must be the same as the URL used to connect to the server.

olcTLSCertificateFile:
olcTLSCertificateKeyFile:

The full path to a file containing the private key pair of the public key contained in the certificate file (olcTLSCertificatefile). This is an extremely sensitive file and should be secured with read only privileges (0400) for the user that LDAP (slapd) is running under (typically ldap). This file, in PEM format, (with a file name such as .pem or .key) must not be secured with a password.

TLS/SSL Client

olcTLSVerifyClient:

The value never indicates the server will not request a client certificate. If one is provided and the server cannot verify it the session proceeds as if the client certificate was not provided. The value allow indicates the the server will request a client certificate but if none is provided or the server cannot validate it the session proceeds normally. The value try indicates the server will request a client certificate and if none is provids the session continues. if a client certificate is provides but the server cannot verify it (the server has no root and intermediate certificates if required) then the session is terminated. The value of demand indicates the server will request a client certificate and if none is provided or the server is unable to validate the certificate (the server has no root and intermediate certificates if required) the session is terminated.

olcTLSCACertificateFile:
olcTLSCACertificatePath:

TLS/SSL CRL

olcTLSCRLCheck:
olcTLSCRLFile:

TLS/SSL General

olcTLSProtocolMin:

olcProtocolMin defines the minimum TLS version acceptable. The default value (0.0) indicates all versions are acceptable. Setting to, say 1.1 indicates that a connection attempt from a client using version 1.0 will be refused. (Current - 2017 - TLS protocol version is 1.2.)

olcTLSRandFile
olcTLSCipherSuite:
olcTLSDHParamFile: