sample-psql.cfg

#################
# glauth.conf

#################
# General configuration.
debug = true
# syslog = true
# structuredlog = true
#
# Enable hot-reload of configuration on changes
# - does NOT work [ldap], [ldaps], [backend] or [api] sections
# watchconfig = true

#################
# yubikeyclientid = "yubi-api-clientid"
# yubikeysecret = "yubi-api-secret"

#################
# Server configuration.
[ldap]
  enabled = true
  # run on a non privileged port
  listen = "0.0.0.0:3893"

[ldaps]
# to enable ldaps generate a certificate, eg. with:
# openssl req -x509 -newkey rsa:4096 -keyout glauth.key -out glauth.crt -days 365 -nodes -subj '/CN=`hostname`'
  enabled = false
  listen = "0.0.0.0:3894"
  cert = "glauth.crt"
  key = "glauth.key"

#################
# The backend section controls the data store.
[backend]
  datastore = "plugin"
  plugin = "bin/postgres-linux-amd64.so"
  pluginHandler = "NewPostgresHandler"
  database = "host=127.0.0.1 port=5432 dbname=glauth user=glauthtest password=glauth sslmode=disable"
  baseDN = "dc=glauth,dc=com"
  nameformat = "cn"
  groupformat = "ou"

  # If you are using a client that requires reading the root DSE first
  # such as SSSD
  # anonymousdse = true

  ## Configure dn format to use structures like 
  ## "uid=serviceuser,cn=svcaccts,$BASEDN" instead of "cn=serviceuser,ou=svcaccts,$BASEDN"
  ## to help ease migrations from other LDAP systems
  # nameformat = "uid"
  # groupformat = "cn"

  ## Configure ssh-key attribute name, default is 'sshPublicKey'
  # sshkeyattr = "ipaSshPubKey"

[behaviors]
  # Ignore all capabilities restrictions, for instance allowing every user to perform a search
  IgnoreCapabilities = false
  # Enable a "fail2ban" type backoff mechanism temporarily banning repeated failed login attempts
  LimitFailedBinds = true
  # How many failed login attempts are allowed before a ban is imposed
  NumberOfFailedBinds = 3
  # How long (in seconds) is the window for failed login attempts
  PeriodOfFailedBinds = 10
  # How long (in seconds) is the ban duration
  BlockFailedBindsFor = 60
  # Clean learnt IP addresses every N seconds
  PruneSourceTableEvery = 600
  # Clean learnt IP addresses not seen in N seconds
  PruneSourcesOlderThan = 600

#################
# Enable and configure the optional REST API here.
[api]
  enabled = true
  internals = true # debug application performance
  tls = false # enable TLS for production!!
  listen = "0.0.0.0:5555"
  cert = "cert.pem"
  key = "key.pem"