LogLevel

{logging level}

Logging level of the component.

If the parameter value is not specified, the DefaultLogLevel parameter value from the [Root] section is used.

Default value: Notice

Log

{log type}

Logging method of the component.

Default value: Auto

ExePath

{path to file}

Executable path to the component.

Default value: <opt_dir>/bin/drweb-lookupd.

•For GNU/Linux: /opt/drweb.com/bin/drweb-lookupd.

•For FreeBSD: /usr/local/libexec/drweb.com/bin/drweb-lookupd

RunAsUser

{UID | user name}

The parameter determines under which user name the component should be run. The user name can be specified either as the user’s number UID or as the user’s login. If the user name consists of numbers (i.e. similar to number UID), it is specified with the “name:” prefix, for example: RunAsUser = name:123456.

When a user name is not specified, the component operation terminates with an error after the startup.

Default value: drweb

IdleTimeLimit

{time interval}

Maximum idle time for the component. When the specified period of time expires, the component shuts down.

Acceptable values: from 10 seconds (10s) to 30 days (30d) inclusive.
If the None value is set, the component will functionate eternally; the SIGTERM signal will not be sent if the components goes idle.

Default value: 30s

DebugLibldap

{Boolean}

Indicates whether debug messages of the libldap library are also included into the log file on the debug level (i.e. when LogLevel = DEBUG).

Default value: No

LdapCheckCertificate

{No | Allow | Try | Yes}

The mode of certificate verification for LDAP connections via SSL/TLS.

Allowed values:

•No—do not request the server certificate;

•Allow—request the server certificate. If the certificate is not provided, the session will continue in its normal way. If the server certificate is provided but cannot be scanned (it is impossible to find the corresponding root certificate), the certificate will be ignored and the session keeps running in its normal way;

•Try—request the server certificate. If the certificate is not provided, the will continue in its normal way. If the server certificate is provided but cannot be checked (it is impossible to find the corresponding root certificate), the session will be terminated;

•Yes—request the server certificate. If the certificate is not provided or cannot be scanned (it is impossible to find the corresponding root certificate), the session is terminated.

For LDAP data sources this certificate verification mode influences the way the URL is processed when the ldaps:// scheme or the StartTLS extension is used; and for AD data sources it will influence connections to the server, if UseSSL=Yes has been specified in the corresponding section (see below).

Default value: Yes

LdapCertificatePath

{path to file}

Path to the SSL certificate used for connection to the LDAP servers (Active Directory) via a secure SSL/TLS connection.

Please note that the certificate file and the private key file (which is specified by a parameter described below) must form a matching pair.

Default value: (not set)

LdapKeyPath

{path to file}

Path to the private key used for connection to the LDAP servers (Active Directory) via a secure SSL/TLS connection.

Please note that the certificate file and the private key file (which is specified by the mentioned parameter) must form a matching pair.

Default value: (not set)

LdapCaPath

{path}

Path to the directory or file with system list of trusted root certificates which are trusted for sharing data through the LDAP protocol via SSL/TLS.

Default value: <path to the list of trusted certificates>. The path depends on your GNU/Linux distribution.

•For Astra Linux, Debian, Linux Mint, SUSE Linux and Ubuntu, usually it is a path /etc/ssl/certs/.

•For CentOS and Fedora—a path /etc/pki/tls/certs/ca-bundle.crt.

•For other distributions a path can be defined through results of execution of the command openssl version -d.

•If a command is unavailable or an OS distribution could not be identified, the value /etc/ssl/certs/ is used.

DbIdleTimeout

{time interval}

The time-out period at the end of which the established connection to the database (or the Redis storage) will be broken if it is idle.

Default value: 5m

MysqlDefaultConn

{URL}

The URI that sets the parameters for connecting to the MySQL database by default.

Allowed values:

•tcp://[<user>[:<password>]@][<host>][:<port>][/<database name>][?<parameter>=<value>[&…]];

•unix://[<user>[:<password>]@]<path to socket>[:<database name>][?<parameter>=<value>[&…]].

Note the URI requirements.

Default value: (not set)

PqDefaultConn

{URL}

The URI that sets the parameters for connecting to the PostgreSQL database by default.

Allowed values:

•tcp://[<user>[:<password>]@][<host>][:<port>][/<database name>][?<parameter>=<value>[&…]];

•unix://[<user>[:<password>]@]<path to socket>[:<database name>][?<parameter>=<value>[&…]].

Note the URI requirements.

Default value: (not set)

SqliteDefaultConn

{path to file}

Path to a default SQLite database file (specify the file:// scheme prefix).

Default value: (not set)

RedisDefaultConn

{URL}

The URL that sets the connection parameters for the Redis database by default.

Allowed values:

•tcp://[<password>@][<host>][:<port>][/<database index>];

•unix://[<password>@]<socket path>[:<database index>].

Note the URI requirements.

Default value: (not set)

init

MYSQL_INIT_COMMAND

String

A SQL command to be executed after connecting to the database

compression

MYSQL_OPT_COMPRESS

Logical

Use data compression

connect-timeout

MYSQL_OPT_CONNECT_TIMEOUT

Integer

Time-out for disconnecting an unused connection in seconds

reconnect

MYSQL_OPT_RECONNECT

Logical

Allow or deny automatic reconnection

read-timeout

MYSQL_OPT_READ_TIMEOUT

Integer

Time-out for receiving packets from server in seconds

write-timeout

MYSQL_OPT_WRITE_TIMEOUT

Integer

Time-out for sending packets to the server in seconds

charset

MYSQL_SET_CHARSET_NAME

String

Name of the character encoding used for the default connection

plugin-dir

MYSQL_PLUGIN_DIR

String

Path to the directory on the server storing the plug-ins

nonblock

MYSQL_OPT_NONBLOCK

Integer

Stack size for non-blocking I/O operations

ssl-key

MYSQL_OPT_SSL_KEY

String

Path to the private key (in PEM format) used to establish a secure connection

ssl-cert

MYSQL_OPT_SSL_CERT

String

Path to the public key certificate (in PEM format) used to establish a secure connection

ssl-ca

MYSQL_OPT_SSL_CA

String

Path to the file (in PEM format) containing trusted CA certificates

ssl-capath

MYSQL_OPT_SSL_CAPATH

String

Path to the directory containing trusted CA certificates (in PEM format)

ssl-cipher

MYSQL_OPT_SSL_CIPHER

String

List of supported encryption algorithms for secure connection

ssl-crl

MYSQL_OPT_SSL_CRL

String

Path to the file (in PEM format) containing revoked certificates

ssl-crlpath

MYSQL_OPT_SSL_CRLPATH

String

Path to the directory containing revoked certificates (in PEM format)

ssl-fp

MARIADB_OPT_SSL_FP

String

the SHA1 hash of the valid server certificate

ssl-fp-list

MARIADB_OPT_SSL_FP_LIST

String

Path to the file containing the SHA1 hashes of valid server certificates

tls-passphrase

MARIADB_OPT_TLS_PASSPHRASE

String

Password for the password-protected client private key

tls-version

MARIADB_OPT_TLS_VERSION

String

List of supported TLS versions

server-verify-cert

MYSQL_OPT_SSL_VERIFY_SERVER_CERT

Logical

Allow or deny verification of server certificates

server-public-key-path

MYSQL_SERVER_PUBLIC_KEY

String

Path to the file (in PEM format) containing the RSA server public key

Parameter

Description

Url

{string}

URL that defines the used LDAP server and extracted data. According to RFC 4516, URL is built on the basis of the following scheme:

<scheme>://<host>[:<port>]/<dn>[?<attrs>[?<scope>[?<filter>[?<extensions>]]]]

Where:

<scheme>—method of connection to the server (the following schemes are allowed: ldap, ldaps and ldapi);

<host>[:<port>]—LDAP server address that receives a request;

<dn>—distinguished name of an object. Information on this object has been sent;

<attrs>—names of the record attributes, the values of which must be received in the request;

<scope>—search scope (base, one, sub);

<filter>—filtering condition for values of extracted attributes;

<extensions>—list of LDAP extensions used in the request.

Features

•In the list of attributes <attrs>, it is possible to use special characters of choice '*', '+' and '1.1'.

•The following automatically resolved placeholders can be used in the <dn> and <filter> parts of the URL:

▫$u is automatically replaced with user, the user name, sent by the client component;

▫$d is automatically replaced with domain, the domain, sent by the client component;

▫$D—chain <subdomain>.<domain>, modified into dc=<subdomain>,dc=<domain>;

▫$$—an '$' character.

•If the condition <filter> requires usage of special characters (for example: '*', '(', ')', '\', character with code 0) as usual ones, they should be written as \XX. Besides, special characters in URL LDAP are encoded using sequences %XX. For example, when using URL according to the scheme ldapi of the character '/' as a part of the path to the local LDAP server socket, this character is encoded as %2f.

•As allowed extensions in <extensions>, only StartTLS and 1.3.6.1.4.1.1466.20037 are supported, they include usage of the TLS mechanism (i.e. establishment of the protected connection with the LDAP server, even if it does not explicitly indicate usage of the protected scheme ldaps) If the name of the used extension is preceded by the character '!', then usage of TLS is required, i.e. in case the establishment of the secure connection is impossible, the request will not be handled. Otherwise, the request will be handled even if the secure connection is not established.

Examples:

"ldaps://ds.example.com:990/$D?givenName,sn,cn?sub?(uid=$u)"
"ldap://ldap.local/o=org,dc=nodomain?ipNetworkNumber?sub?(objectClass=ipNetwork)?!StartTLS"

Default value: (not set)

BindDn

{string}

An object in the LDAP directory to which the user is bound to get authorization.

Example: "cn=admin,dc=nodomain".

Default value: (not set)

BindPassword

{string}

The user’s password for authentication on the LDAP server.

Default value: (not set)

ChaseReferrals

{Boolean}

Instructs the component to follow references to other LDAP servers, if the current LDAP server returns them as a reply to the request.

Default value: No

Parameter

Description

Host

{string}

The domain name (FQDN) or the IP address of the host on which the server of the Active Directory service that you would like to connect to is running.

Example: "win2012.win.local".

Default value: (not set)

Port

{integer}

Port on the host which is listened to by the server of the Active Directory service.

Default value: 389

Dn

{string}

DN of an object in the Active Directory; it is similar to the dn part of an LDAP URL.

Example: "dc=win,dc=local".

Default value: (not set)

User

{string}

The full identifier of a user on the server, to be used for identification.

Example: "Administrator@WIN.LOCAL".

Default value: (not set)

Password

{string}

Password of the user for authentication on the Active Directory server.

Default value: (not set)

ChaseReferrals

{Boolean}

Instructs the component to follow references to other LDAP servers, if the current Active Directory server returns them as a reply to the request.

Default value: No

UseSSL

{Boolean}

Instructs to use SSL/TLS for connecting to the Active Directory.

Default value: No

Parameter

Description

File

{path}

Path to a text file containing search strings.

Example: "/etc/file1".

Default value: (not set)

Conn

{string}

Database connection string.

Allowed values:

•for the Mysql (MySQL), Pq (PostgreSQL) section:

tcp://[<user>[:<password>]@]<host>[:<port>][/<database name>][?<parameter>=<value>[&…]]

unix://[<user>[:<password>]@]<path to socket>[:<database name>][?<parameter>=<value>[&…]]

Example: "tcp://user:pwd@localhost:1234/userdb", "unix://user:pwd@/tmp/pgsql.sock:userdb"

Note the URI requirements.

•for the Sqlite (SQLite) section:

Path to a database file (specify the file:// scheme prefix).

Example: "file:///home/user/users.db"

Default value: defined by the corresponding *DefaultConn parameter value

Request

{string}

SQL query string (SELECT) to a database. As for sources of AD and LDAP types, in query, the following automatically permitted markers can be used:

•$u, $U is automatically replaced with user, the user name sent by the client component;

•$d, $D is automatically replaced with domain, the domain sent by the client component;

•$$ is replaced with '$' character.

Example: "SELECT username FROM users INNER JOIN domains ON users.domain = domains.id WHERE domains.name = $d AND users.name = $u"

Default value: (not set)

Conn

{string}

Connection string with the Redis data storage.

Allowed values:

•tcp://[<password>@]<host>[:<port>][/<database index>]

•unix://[<password>@]<socket path>[:<database index>]

Note the URI requirements.

Example: "tcp://localhost:6379"

Default value: defined by RedisDefaultConn parameter value

Request

{string}

Redis storage query string. In query, the following automatically permitted markers can be used:

•$u, $U is automatically replaced with user, the user name sent by the client component;

•$d, $D is automatically replaced with domain, the domain sent by the client component;

•$$ is replaced with '$' character.

Example: "HVALS bad_users"

Default value: (not set)