LDAP Explained

Rev 3 10/28/04

LDAP Explained

Presented by: Todd Lyons

todd at mrball dot net

Introduction

Details/Analogies

LDAP aware apps

Real-world system

Directory Management Tools

Reference Materials

Q&A

Installation Locations

In an RPM install, configs are in /etc/openldap, binaries are in /usr/sbin, and data and indexes are in /var/lib/ldap.

In a Gentoo install, configs are in /etc/openldap, binaries are in /usr/sbin, and data and indexes are in /var/lib/openldap-data.

In a source install, everything is usually under /usr/local/*.

Why Am I Here?

You already know what a directory is.

You use some of them daily:

Phone Book

TV Guide

What is a Directory?

A Directory is a specialized database.

You already know what a directory is.

You use some of them daily:

Phone Book

TV Guide

/usr/sbin/httpd

/etc/fstab

/lib/modules/2.6.8/kernel/drivers/char/drm/fglrx.ko

What is LDAP?

Lightweight Directory Access Protocol

Simplied X.500 (DAP)

Redundant operations dropped

Most data elements are text

Data elements are encoded by a few simple algorithms

Runs directly over TCP

Terminology

Attribute: A description of a part of something. Arranged in a name/value pair.

Object: A collection of attributes for one entity.

Objectclass: A group of attributes, some will be required, some will be optional.

Schema: Defines attributes and objectclasses.

DN: Distinguished Name, the full path. * Discussed in later analogy.

RDN: Relative Distinguished Name. Example: the current subdirectory. * Discussed in later analogy.

Base DN: Basename. Example: path to current subdirectory. * Discussed in later analogy.

http://www.linuxfocus.org/English/July2000/article159.shtml

http://www.linuxfocus.org/common/images/article159/ldapDirectory2.png

# base <dc=ivenue,dc=net> with scope sub

# filter: (sendmailMTAKey=cannonball@misterball.com)

# requesting: ALL

#

# cannonball@misterball.com, virtuser, ivenue.net

dn: sendmailMTAKey=cannonball@misterball.com,sendmailMTAMapName=virtuser,

dc=ivenue,dc=net

objectClass: sendmailMTA

objectClass: sendmailMTAMap

objectClass: sendmailMTAMapObject

sendmailMTACluster: Production

description: misterball.com

description: customerNumber->58144

sendmailMTAMapName: virtuser

sendmailMTAKey: cannonball@misterball.com

sendmailMTAMapValue: cannonball.misterball.com@smtp.ivenue.com

Command:

ldapsearch -x -D 'cn=sendmail,dc=ivenue,dc=net' -b 'dc=ivenue,dc=net' -w password -h ldap1 "(sendmailMTAKey=cannonball@misterball.com)"

# base <dc=ivenue,dc=net> with scope sub

# filter: (sendmailMTAKey=cannonball@misterball.com)

# requesting: ALL

#

# cannonball@misterball.com, virtuser, ivenue.net

dn: sendmailMTAKey=cannonball@misterball.com,sendmailMTAMapName=virtuser,

dc=ivenue,dc=net

objectClass: sendmailMTA

objectClass: sendmailMTAMap

objectClass: sendmailMTAMapObject

sendmailMTACluster: Production

description: misterball.com

description: customerNumber->58144

sendmailMTAMapName: virtuser

sendmailMTAKey: cannonball@misterball.com

sendmailMTAMapValue: cannonball.misterball.com@smtp.ivenue.com

Command:

ldapsearch -x -D 'cn=sendmail,dc=ivenue,dc=net' -b 'dc=ivenue,dc=net' -w password -h ldap1 "(sendmailMTAKey=cannonball@misterball.com)"

DN

# base <dc=ivenue,dc=net> with scope sub

# filter: (sendmailMTAKey=cannonball@misterball.com)

# requesting: ALL

#

# cannonball@misterball.com, virtuser, ivenue.net

dn: sendmailMTAKey=cannonball@misterball.com,sendmailMTAMapName=virtuser,

dc=ivenue,dc=net

objectClass: sendmailMTA

objectClass: sendmailMTAMap

objectClass: sendmailMTAMapObject

sendmailMTACluster: Production

description: misterball.com

description: customerNumber->58144

sendmailMTAMapName: virtuser

sendmailMTAKey: cannonball@misterball.com

sendmailMTAMapValue: cannonball.misterball.com@smtp.ivenue.com

Command:

ldapsearch -x -D 'cn=sendmail,dc=ivenue,dc=net' -b 'dc=ivenue,dc=net' -w password -h ldap1 "(sendmailMTAKey=cannonball@misterball.com)"

Base DN

# base <dc=ivenue,dc=net> with scope sub

# filter: (sendmailMTAKey=cannonball@misterball.com)

# requesting: ALL

#

# cannonball@misterball.com, virtuser, ivenue.net

dn: sendmailMTAKey=cannonball@misterball.com,sendmailMTAMapName=virtuser,

dc=ivenue,dc=net

objectClass: sendmailMTA

objectClass: sendmailMTAMap

objectClass: sendmailMTAMapObject

sendmailMTACluster: Production

description: misterball.com

description: customerNumber->58144

sendmailMTAMapName: virtuser

sendmailMTAKey: cannonball@misterball.com

sendmailMTAMapValue: cannonball.misterball.com@smtp.ivenue.com

Command:

ldapsearch -x -D 'cn=sendmail,dc=ivenue,dc=net' -b 'dc=ivenue,dc=net' -w password -h ldap1 "(sendmailMTAKey=cannonball@misterball.com)"

Attributes

# base <dc=ivenue,dc=net> with scope sub

# filter: (sendmailMTAKey=cannonball@misterball.com)

# requesting: ALL

#

# cannonball@misterball.com, virtuser, ivenue.net

dn: sendmailMTAKey=cannonball@misterball.com,sendmailMTAMapName=virtuser,

dc=ivenue,dc=net

objectClass: sendmailMTA

objectClass: sendmailMTAMap

objectClass: sendmailMTAMapObject

sendmailMTACluster: Production

description: misterball.com

description: customerNumber->58144

sendmailMTAMapName: virtuser

sendmailMTAKey: cannonball@misterball.com

sendmailMTAMapValue: cannonball.misterball.com@smtp.ivenue.com

Command:

ldapsearch -x -D 'cn=sendmail,dc=ivenue,dc=net' -b 'dc=ivenue,dc=net' -w password -h ldap1 "(sendmailMTAKey=cannonball@misterball.com)"

Objectclasses

# base <dc=ivenue,dc=net> with scope sub

# filter: (uid=cannonball@misterball.com)

# requesting: ALL

#

# cannonball.misterball.com, users, ivenue.net

dn: uid=cannonball.misterball.com,ou=users,dc=ivenue,dc=net

loginShell: /sbin/nologin

gidNumber: 1000

uidNumber: 1008

shadowMax: 99999

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

objectClass: account

objectClass: CourierMailAccount

uid: cannonball@misterball.com

uid: cannonball.misterball.com

gecos:: IA==

shadowLastChange: 11740

cn:: IA==

homeDirectory: /netapp1/mail/maildirs/m/i/s/cannonball.misterball.com

description: customerNumber->58144

shadowWarning: 7

userPassword:: cGFzc3dvcmQ=

mail: cannonball@misterball.com

quota: 10000000S

Command:

ldapsearch -x -D 'cn=sendmail,dc=ivenue,dc=net' -b 'dc=ivenue,dc=net' -w password -h ldap1 "(uid=cannonball@misterball.com)"

# base <dc=ivenue,dc=net> with scope sub

# filter: (uid=cannonball@misterball.com)

# requesting: ALL

#

# cannonball.misterball.com, users, ivenue.net

dn: uid=cannonball.misterball.com,ou=users,dc=ivenue,dc=net

loginShell: /sbin/nologin

gidNumber: 1000

uidNumber: 1008

shadowMax: 99999

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

objectClass: account

objectClass: CourierMailAccount

uid: cannonball@misterball.com

uid: cannonball.misterball.com

gecos:: IA==

shadowLastChange: 11740

cn:: IA==

homeDirectory: /netapp1/mail/maildirs/m/i/s/cannonball.misterball.com

description: customerNumber->58144

shadowWarning: 7

userPassword:: cGFzc3dvcmQ=

mail: cannonball@misterball.com

quota: 10000000S

Multivalued Attribute

Command:

ldapsearch -x -D 'cn=sendmail,dc=ivenue,dc=net' -b 'dc=ivenue,dc=net' -w password -h ldap1 "(uid=cannonball@misterball.com)"

# base <dc=ivenue,dc=net> with scope sub

# filter: (uid=cannonball@misterball.com)

# requesting: ALL

#

# cannonball.misterball.com, users, ivenue.net

dn: uid=cannonball.misterball.com,ou=users,dc=ivenue,dc=net

loginShell: /sbin/nologin

gidNumber: 1000

uidNumber: 1008

shadowMax: 99999

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

objectClass: account

objectClass: CourierMailAccount

uid: cannonball@misterball.com

uid: cannonball.misterball.com

gecos:: IA==

shadowLastChange: 11740

cn:: IA==

homeDirectory: /netapp1/mail/maildirs/m/i/s/cannonball.misterball.com

description: customerNumber->58144

shadowWarning: 7

userPassword:: cGFzc3dvcmQ=

mail: cannonball@misterball.com

quota: 10000000S

Base64 Encoded Password Attribute

Command:

ldapsearch -x -D 'cn=sendmail,dc=ivenue,dc=net' -b 'dc=ivenue,dc=net' -w password -h ldap1 "(uid=cannonball@misterball.com)"

# base <dc=ivenue,dc=net> with scope sub

# filter: (uid=cannonball@misterball.com)

# requesting: ALL

#

# cannonball.misterball.com, users, ivenue.net

dn: uid=cannonball.misterball.com,ou=users,dc=ivenue,dc=net

loginShell: /sbin/nologin

gidNumber: 1000

uidNumber: 1008

shadowMax: 99999

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

objectClass: account

objectClass: CourierMailAccount

uid: cannonball@misterball.com

uid: cannonball.misterball.com

gecos:: IA==

shadowLastChange: 11740

cn:: IA==

homeDirectory: /netapp1/mail/maildirs/m/i/s/cannonball.misterball.com

description: customerNumber->58144

shadowWarning: 7

userPassword:: cGFzc3dvcmQ=

mail: cannonball@misterball.com

quota: 10000000S

Base64 Encoded Password Attribute

[todd@tlyons ~]$ echo “cGFzc3dvcmQ=” \

> | mimencode -u; echo

password

[todd@tlyons ~]$

Command:

ldapsearch -x -D 'cn=sendmail,dc=ivenue,dc=net' -b 'dc=ivenue,dc=net' -w password -h ldap1 "(uid=cannonball@misterball.com)"

# cannonball.misterball.com, users, ivenue.net

dn: uid=cannonball.misterball.com,ou=users,dc=ivenue,dc=net

loginShell: /sbin/nologin

gidNumber: 1000

uidNumber: 1008

shadowMax: 99999

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

objectClass: account

objectClass: CourierMailAccount

uid: cannonball@misterball.com

uid: cannonball.misterball.com

gecos:: IA==

shadowLastChange: 11740

cn:: IA==

homeDirectory: /netapp1/mail/maildirs/m/i/s/cannonball.misterball.com

description: customerNumber->58144

shadowWarning: 7

userPassword:: cGFzc3dvcmQ=

mail: cannonball@misterball.com

quota: 10000000S

# search result

search: 2

result: 0 Success

access to attr=userPassword

by dn="cn=master,dc=ivenue,dc=net" write

by dn="cn=courier,dc=ivenue,dc=net" read

by dn="cn=sendmail,dc=ivenue,dc=net" read

by dn="cn=pam,dc=ivenue,dc=net" read

by self write

by * auth

access to *

by dn="cn=master,dc=ivenue,dc=net" write

by * read

Password Attribute

Command:

ldapsearch -x -D 'cn=sendmail,dc=ivenue,dc=net' -b 'dc=ivenue,dc=net' -w password -h ldap1 "(uid=cannonball@misterball.com)"

Command:

ldapsearch -x -b 'dc=ivenue,dc=net' -w password -h ldap2 "(uid=cannonball@misterball.com)"

# cannonball.misterball.com, users, ivenue.net

dn: uid=cannonball.misterball.com,ou=users,dc=ivenue,dc=net

loginShell: /sbin/nologin

gidNumber: 1000

uidNumber: 1008

shadowMax: 99999

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

objectClass: account

objectClass: CourierMailAccount

uid: cannonball@misterball.com

uid: cannonball.misterball.com

gecos:: IA==

shadowLastChange: 11740

cn:: IA==

homeDirectory: /netapp1/mail/maildirs/m/i/s/cannonball.misterball.com

description: customerNumber->58144

shadowWarning: 7

mail: cannonball@misterball.com

quota: 10000000S

# search result

search: 2

result: 0 Success

access to attr=userPassword

by dn="cn=master,dc=ivenue,dc=net" write

by dn="cn=courier,dc=ivenue,dc=net" read

by dn="cn=sendmail,dc=ivenue,dc=net" read

by dn="cn=pam,dc=ivenue,dc=net" read

by self write

by * auth

access to *

by dn="cn=master,dc=ivenue,dc=net" write

by * read

Password Attribute not accessible by this user (anonymous).

Include	/etc/openldap/schema/core.schema

include	/etc/openldap/schema/cosine.schema

include	/etc/openldap/schema/inetorgperson.schema

include	/etc/openldap/schema/nis.schema

include	/etc/openldap/schema/sendmail.schema

include	/etc/openldap/schema/courier.schema

pidfile	/var/run/openldap/slapd.pid

argsfile	/var/run/openldap/slapd.args

#######################################################################

# ACL's

#######################################################################

access to attr=userPassword

by dn="cn=master,dc=ivenue,dc=net" write

by dn="cn=courier,dc=ivenue,dc=net" read

by dn="cn=sendmail,dc=ivenue,dc=net" read

by dn="cn=pam,dc=ivenue,dc=net" read

by self write

by * auth

access to *

by dn="cn=master,dc=ivenue,dc=net" write

by * read

#######################################################################

# ldbm database definitions

#######################################################################

database ldbm

suffix "dc=ivenue,dc=net"

rootdn "cn=Manager,dc=ivenue,dc=net"

rootpw {crypt}6d1Y8zMFOZQ/6

directory /var/lib/openldap-data

# Indices to maintain

index objectClass,uid,uidNumber,gidNumber,memberUid eq

index cn,mail,surname,givenname eq,subinitial

index sendmailMTAKey,sendmailMTAMapName eq

index sendmailMTAHost,sendmailMTACluster eq

index sendmailMTAAliasGrouping,sendmailMTAClassName eq

#updatedn cn=Manager,dc=ivenue,dc=net BAD BAD BAD! NEVER NEVER NEVER!

updatedn cn=master,dc=ivenue,dc=net

/etc/openldap/slapd.conf

on Slave(s)

/etc/openldap/slapd.conf on Master

Standard replication, plain text, simple password:

replica uri=ldap://ldap1.ivenue.net:389

binddn="cn=master,dc=ivenue,dc=net"

bindmethod=simple credentials=password

replica uri=ldap://ldap2.ivenue.net:389

binddn="cn=master,dc=ivenue,dc=net"

bindmethod=simple credentials=password

replogfile /var/lib/openldap-slurp/replication.log

Using encryption (also requires settings of where to locate certificates, both on master and slave):

replica uri=ldap://ldap1.ivenue.net:389

binddn="cn=master,dc=ivenue,dc=net"

bindmethod=simple credentials=password

tls=yes

replogfile /var/lib/openldap-slurp/replication.log

Using GSSAPI/SASL (also requires settings of where to locate certificates, both on master and slave):

replica host=ldap-1.example.com:389 tls=yes

bindmethod=sasl saslmech=GSSAPI

authcId=host/ldap-master.example.com@EXAMPLE.COM

replogfile /var/lib/ldap/openldap-master-replog

LDAP Aware Applications

PAM

Courier-IMAP

Sendmail

Qmail

ProFTP

Apache

Samba

Address Books

Languages: perl, python, php, c, c++

PAM LDAP Config

smtp1 root # grep "^[^#]" /etc/ldap.conf

host 10.1.1.251

base dc=ivenue,dc=net

binddn cn=pam,dc=ivenue,dc=net

bindpw password

rootbinddn cn=pam,dc=ivenue,dc=net

scope sub

pam_filter objectclass=account

pam_login_attribute uid

pam_password clear

nss_base_passwd ou=users,dc=ivenue,dc=net?one

nss_base_shadow ou=users,dc=ivenue,dc=net?one

nss_base_group ou=group,dc=ivenue,dc=net?one

ssl no

pam_password MD5

PAM LDAP Config

smtp1 root # id cannonball@misterball.com

uid=1008(cannonball@misterball.com) gid=1000(mailusers) groups=1000(mailusers)

smtp1 root # getent passwd cannonball@misterball.com

cannonball@misterball.com:x:1008:1000: :/netapp1/mail/maildirs/m/i/s/cannonball.misterball.com:/sbin/nologin

smtp1 root # ldapsearch -x -D 'cn=sendmail,dc=ivenue,dc=net' -b 'dc=ivenue,dc=net' -w password -h ldap1 "(uid=cannonball@misterball.com)"

# base <dc=ivenue,dc=net> with scope sub

# filter: (uid=cannonball@misterball.com)

# requesting: ALL

#

# cannonball.misterball.com, users, ivenue.net

dn: uid=cannonball.misterball.com,ou=users,dc=ivenue,dc=net

loginShell: /sbin/nologin

gidNumber: 1000

uidNumber: 1008

shadowMax: 99999

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

objectClass: account

objectClass: CourierMailAccount

uid: cannonball@misterball.com

uid: cannonball.misterball.com

gecos:: IA==

shadowLastChange: 11740

cn:: IA==

homeDirectory: /netapp1/mail/maildirs/m/i/s/cannonball.misterball.com

description: customerNumber->58144

shadowWarning: 7

userPassword:: cGFzc3dvcmQ=

mail: cannonball@misterball.com

quota: 10000000S

# numResponses: 2

# numEntries: 1

Sendmail LDAP Config

define(`ALIAS_FILE', `ldap:')dnl

define(confLDAP_DEFAULT_SPEC, `-h ldap1.ivenue.net -b dc=ivenue,dc=net')

define(`confLDAP_CLUSTER', `Production')

FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db',`LDAP')dnl

FEATURE(`genericstable',`LDAP')dnl

FEATURE(`virtusertable',`LDAP')dnl

FEATURE(`access_db',`LDAP')dnl

FEATURE(`local_procmail',`/usr/bin/maildrop',`maildrop -w 80 -d $u')

LOCAL_CONFIG

F{w}@LDAP

# base <dc=ivenue,dc=net> with scope sub

# filter: (sendmailMTAKey=cannonball@misterball.com)

# requesting: ALL

#

# cannonball@misterball.com, virtuser, ivenue.net

dn: sendmailMTAKey=cannonball@misterball.com,sendmailMTAMapName=virtuser,\

dc=ivenue,dc=net

objectClass: sendmailMTA

objectClass: sendmailMTAMap

objectClass: sendmailMTAMapObject

sendmailMTACluster: Production

description: misterball.com

description: customerNumber->58144

sendmailMTAMapName: virtuser

sendmailMTAKey: cannonball@misterball.com

sendmailMTAMapValue: cannonball.misterball.com@smtp.ivenue.com

Command:

ldapsearch -x -D 'cn=sendmail,dc=ivenue,dc=net' -b 'dc=ivenue,dc=net' -w password -h ldap1 "(sendmailMTAKey=cannonball@misterball.com)"

Schema

# attribute sendmailMTAMapName cis

attributetype ( 1.3.6.1.4.1.6152.10.3.1.14

NAME 'sendmailMTAMapName'

DESC 'identifier for the particular map'

EQUALITY caseIgnoreMatch

SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} SINGLE-VALUE )

# attribute sendmailMTAMapValue cis

attributetype ( 1.3.6.1.4.1.6152.10.3.1.16

NAME 'sendmailMTAMapValue'

DESC 'value (right hand side) of a map entry'

EQUALITY caseIgnoreMatch

SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )

#objectClass sendmailMTAMap

# requires

# objectClass,

# sendmailMTAMapName,

# allows

# sendmailMTACluster,

# sendmailMTAHost,

# Description

objectclass ( 1.3.6.1.4.1.6152.10.3.2.11

NAME 'sendmailMTAMap'

SUP sendmailMTA STRUCTURAL

DESC 'Sendmail MTA map definition'

MUST sendmailMTAMapName

MAY ( sendmailMTACluster $ sendmailMTAHost $ Description ) )

Courier-IMAP LDAP Config

smtp1 root # grep "^[^#]" /etc/courier-imap/authldaprc

LDAP_SERVER admin1.ivenue.net

LDAP_PORT 389

LDAP_BASEDN dc=ivenue,dc=net

LDAP_BINDDN cn=courier,dc=ivenue,dc=net

LDAP_BINDPW password

LDAP_TIMEOUT 5

LDAP_MAIL uid

LDAP_HOMEDIR homeDirectory

LDAP_DEFAULTDELIVERY defaultDelivery

LDAP_FULLNAME cn

LDAP_CLEARPW userPassword

LDAP_UID uidNumber

LDAP_GID gidNumber

LDAP_DEREF never

LDAP_TLS 0

# cannonball.misterball.com, users, ivenue.net

dn: uid=cannonball.misterball.com,ou=users,dc=ivenue,dc=net

loginShell: /sbin/nologin

gidNumber: 1000

uidNumber: 1008

shadowMax: 99999

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

objectClass: account

objectClass: CourierMailAccount

uid: cannonball@misterball.com

uid: cannonball.misterball.com

gecos:: IA==

shadowLastChange: 11740

cn:: IA==

homeDirectory: /netapp1/mail/maildirs/m/i/s/cannonball.misterball.com

description: customerNumber->58144

shadowWarning: 7

userPassword:: cGFzc3dvcmQ=

mail: cannonball@misterball.com

quota: 10000000S

Courier-IMAP LDAP Config

smtp1 root # grep "^[^#]" /etc/courier-imap/authldaprc

LDAP_SERVER admin1.ivenue.net

LDAP_PORT 389

LDAP_BASEDN dc=ivenue,dc=net

LDAP_BINDDN cn=courier,dc=ivenue,dc=net

LDAP_BINDPW password

LDAP_TIMEOUT 5

LDAP_MAIL uid

LDAP_HOMEDIR homeDirectory

LDAP_DEFAULTDELIVERY defaultDelivery

LDAP_FULLNAME cn

LDAP_CLEARPW userPassword

LDAP_UID uidNumber

LDAP_GID gidNumber

LDAP_DEREF never

LDAP_TLS 0

# cannonball.misterball.com, users, ivenue.net

dn: uid=cannonball.misterball.com,ou=users,dc=ivenue,dc=net

loginShell: /sbin/nologin

gidNumber: 1000

uidNumber: 1008

shadowMax: 99999

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

objectClass: account

objectClass: CourierMailAccount

uid: cannonball@misterball.com

uid: cannonball.misterball.com

gecos:: IA==

shadowLastChange: 11740

cn:: IA==

homeDirectory: /netapp1/mail/maildirs/m/i/s/cannonball.misterball.com

description: customerNumber->58144

shadowWarning: 7

userPassword:: cGFzc3dvcmQ=

mail: cannonball@misterball.com

quota: 10000000S

A Real-World System

smtp1 root # ldapsearch -x -D 'cn=sendmail,dc=ivenue,dc=net' -b 'dc=ivenue,dc=net' -w password -h ldap1 "(sendmailMTAKey=cannonball@misterball.com)" | grep "^sendmailMTA.*cannonball"

sendmailMTAKey: cannonball@misterball.com

sendmailMTAMapValue: cannonball.misterball.com@smtp.ivenue.com

smtp1 root # ldapsearch -x -D 'cn=pam,dc=ivenue,dc=net' -b 'dc=ivenue,dc=net' -w password -h ldap1 "(uid=cannonball.misterball.com)" | grep "^.idNumber"

gidNumber: 1000

uidNumber: 1008

smtp1 root # getent passwd cannonball@misterball.com

cannonball@misterball.com:x:1008:1000: :/netapp1/mail/maildirs/m/i/s/cannonball.misterball.com:/bin/bash

smtp1 root # vdir /netapp1/mail/maildirs/m/i/s/cannonball.misterball.com/Maildir/

total 2516

drwxr-xr-x 2 cannonball@misterball.com mailusers 2117632 Oct 21 21:30 courierimapkeywords

-rw-r--r-- 1 cannonball@misterball.com mailusers 72 Aug 2 10:12 courierimapsubscribed

-rw-r--r-- 1 cannonball@misterball.com mailusers 33348 Oct 25 11:30 courierimapuiddb

drwxr-xr-x 2 cannonball@misterball.com mailusers 339968 Oct 25 11:30 cur

-rw-r--r-- 1 cannonball@misterball.com mailusers 3734 Oct 25 11:28 maildirsize

drwxr-xr-x 2 cannonball@misterball.com mailusers 61440 Oct 25 11:30 new

-rw-r----- 1 cannonball@misterball.com mailusers 0 Sep 30 15:36 quotawarn

drwxr-xr-x 2 cannonball@misterball.com mailusers 4096 Oct 25 17:30 tmp

GQ

LDAP Browser

PHP LDAP Admin

Conclusion

LDAP is just another presentation of data.

LDAP is optimized for many read / few write operation.

Many apps already support LDAP for varying purposes.

Analyze if your data belongs in a directory.

References

“Understanding and Deploying LDAP Directory Services”, by Howes, Smith, and Good, New Riders Publishing, ISBN 1-57870-070-1.

http://www.zytrax.com/books/ldap/

http://www.openldap.org

http://www.linuxfocus.org/English/July2000/article159.shtml

http://www.yo-linux.com/cgi-bin/search-yolinux.com.cgi?target=ldap&rule=and

http://www.tldp.org/HOWTO/LDAP-HOWTO/

http://www.unav.es/cti/ldap-smb-howto.html

http://www.postfix.org/LDAP_README.html

http://www.sendmail.org/m4/ldap.html

http://www.google.com/search?hl=en&q=ldap+howto&btnG=Google+Search

2004-10-25T13:10:19