Splat is configured by a configuration file usually named
splat.conf. See the example config below (this
config file is also included with the Splat source), and the splat.conf man page.
Example 1.1. Example splat.conf
<LDAP>
# The LDAP Server configuration.
# URI of the server(s)
URI ldaps://ldap1.example.com
# The default search base for the server
BaseDN dc=example,dc=com
# The distinguished name to use to bind to the LDAP directory
# Both the BindDN and Password may be omitted, in which
# case an anonymous bind is made.
BindDN cn=Manager,dc=example,dc=com
# The password (may be in LDAP MD5/SHA1 form, generate using slappasswd)
Password {SSHA}0JjiKIXNxsrjzSRnFDDuJEM1wQLIMvv/
</LDAP>
<Logging>
# Log messages at level INFO or higher
Level info
# Log to syslog
<syslog>
Facility daemon
Address /var/run/log
</syslog>
# # Log messages to stdout
# <logfile>
# Path STDOUT
# </logfile>
</Logging>
<Service UserSSH>
# The helper module
Helper splat.helpers.sshPublicKeys
# The frequency at which the daemon will poll LDAP
Frequency 10m
# Helper-specific options. These are passed directly
# to the helper plugin.
<Option home>
# Only write keys to home directories in /home
Value /home
</Option>
<Option minuid>
# Do not write keys for users with a UID less than minuid
Value 1000
</Option>
<Option mingid>
# Do not write keys for users with a GID less than mingid
Value 1000
</Option>
# The base DN to use when searching for entries.
# Defaults to the LDAP BaseDN.
SearchBase ou=People,dc=example,dc=com
# The filer to use when searching for entries
SearchFilter (&(objectClass=sshAccount)(accountStatus=active))
# Group-specific options.
# Require that entries match one of the specified groups
RequireGroup yes
# Only the first matching group is used, and groups are evaluated in the
# order specified. Groups must store member DNs, which groupOfUniqueNames
# and groupOfNames object classes do. The posixGroup object class cannot be
# used because it stores member UIDs only.
<Group Administrators>
# The base DN to use when searching for groups
# Defaults to the LDAP BaseDN
SearchBase ou=Groups,dc=example,dc=com
# The filter to use when searching for groups
SearchFilter (&(objectClass=groupOfUniqueNames)(cn=administrators))
# LDAP attribute used to store member DNs. Defaults to uniqueMember.
MemberAttribute uniqueMember
</Group>
<Group Developers>
# The base DN to use when searching for groups
# Defaults to the LDAP BaseDN
SearchBase ou=Groups,dc=example,dc=com
# The filter to use when searching for groups
SearchFilter (&(objectClass=groupOfUniqueNames)(cn=developers))
# Limit developers to using svn, rooted in /export/svn/repos
<Option command>
Value /usr/local/bin/svnserve -t -r /export/svn/repos
</Option>
</Group>
</Service>
<Service MailForward>
# The helper module
Helper splat.helpers.mailForwardingAddress
# The frequency at which the daemon will poll LDAP
Frequency 10m
# Helper-specific options. These are passed directly
# to the helper plugin.
<Option home>
# Only write keys to home directories in /home
Value /home
</Option>
<Option minuid>
# Do not write keys for users with a UID less than minuid
Value 1000
</Option>
<Option mingid>
# Do not write keys for users with a GID less than mingid
Value 1000
</Option>
# The base DN to use when searching for entries.
# Defaults to the LDAP BaseDN.
SearchBase ou=People,dc=example,dc=com
# The filer to use when searching for entries
SearchFilter (&(objectClass=posixAccount)(accountStatus=active))
</Service>
<Service HomeDirectory>
# The helper module
Helper splat.helpers.homeDirectory
# The frequency at which the daemon will poll LDAP
Frequency 10m
# Helper-specific options. These are passed directly
# to the helper plugin.
<Option home>
# Only create home directories in /home
Value /home
</Option>
<Option minuid>
# Do not create directories for users with a UID less than minuid
Value 1000
</Option>
<Option mingid>
# Do not create directories for users with a GID less than mingid
Value 1000
</Option>
<Option skeldir>
# Skeletal home directory to copy files from. By default, created
# home directories are empty.
Value /usr/share/skel
</Option>
<Option postcreate>
# Script to execute post-homedir creation. Will be given the user's
# uid, gid, and home directory as arguments
Value /usr/local/libexec/splat-home-postcreate.sh
</Option>
# The base DN to use when searching for entries.
# Defaults to the LDAP BaseDN.
SearchBase ou=People,dc=example,dc=com
# The filer to use when searching for entries
SearchFilter (&(objectClass=posixAccount)(accountStatus=active))
</Service>
<Service purgeUser>
# The helper module
Helper splat.helpers.purgeUser
# The frequency at which the daemon will poll LDAP
Frequency 10m
# Helper-specific options. These are passed directly
# to the helper plugin.
<Option home>
# Only purge/archive users with home directories in home
Value /home
</Option>
<Option minuid>
# Do not purge users with a UID less than minuid
Value 1000
</Option>
<Option mingid>
# Do not purge users with a GID less than mingid
Value 1000
</Option>
<Option archivehomedir>
# Archive home directory before purging? Defaults to true.
Value true
</Option>
<Option purgehomedir>
# Actually purge home directory? Defaults to true.
Value true
</Option>
<Option purgehomearchive>
# Eventually purge archive made of home directory, too?
# Defaults to true.
Value true
</Option>
<Option archivedest>
# Where to place archives of home directories, if
# they are created. Defaults to /home.
Value /home
</Option>
<Option purgearchivewait>
# Number of days to wait after pendingPurge time before
# purging home archive, if purgehomearchive is set to
# true. Defaults to 14.
Value 14
</Option>
# The base DN to use when searching for entries.
# Defaults to the LDAP BaseDN.
SearchBase ou=People,dc=example,dc=com
# The filer to use when searching for entries
SearchFilter (&(objectClass=purgeableAccount)(accountStatus=disabled))
</Service>
<Service OpenNMS>
# The helper module
Helper splat.helpers.opennms
# The frequency at which the daemon will poll LDAP
Frequency 60m
# Helper-specific options. These are passed directly
# to the helper plugin.
<Option usersFile>
Value /usr/local/opennms/etc/users.xml
</Option>
<Option groupsFile>
Value /usr/local/opennms/etc/groups.xml
</Option>
<Option userNameAttribute>
Value uid
</Option>
<Option fullNameAttribute>
Value cn
</Option>
<Option emailAttribute>
Value mail
</Option>
<Option xmppAddressAttribute>
Value mail
</Option>
<Option commentsAttribute>
Value title
</Option>
<Option opennmsGroup>
Value Users
</Option>
# The base DN to use when searching for entries.
# Defaults to the LDAP BaseDN.
SearchBase ou=People,dc=example,dc=com
# The filer to use when searching for entries
SearchFilter (&(objectClass=sshAccount)(accountStatus=active))
# Group-specific options.
# Require that entries match one of the specified groups
RequireGroup no
# Only the first matching group is used, and groups are evaluated in the
# order specified.
<Group Administrators>
# The base DN to use when searching for groups
# Defaults to the LDAP BaseDN
SearchBase ou=Groups,dc=example,dc=com
# The filter to use when searching for groups
SearchFilter (&(objectClass=groupOfUniqueNames)(cn=administrators))
<Option opennmsGroup>
Value Administrators
</Option>
</Group>
</Service>