Direct LDAP Access

Since the compromise, the information available to non-developers via the LDAP interface has been limited a great deal. However, as always, the full database is accessible from any .oftc.net machine. If you wish relatively unfettered access to the LDAP database, connect to it from a .oftc.net machine, such as gluck.oftc.net (which is recommended for general shell usage anyhow).

The LDAP utilities package (ldap-utils) provides an utility called ldapsearch that can be used to execute direct queries to the database. This is done by supplying the following arguments to ldapsearch: -x -H ldap://db.oftc.net -b dc=debian,dc=org. Alternatively, the -H and -b options can be put in one's ~/.ldaprc, in the following form:

[ dbharris@gluck: ~/ ]$ cat ~/.ldaprc
HOST db.oftc.net
BASE dc=debian,dc=org

-x tells ldapsearch to use "simple" (non-SASL, non-Kerberos) authentication. There appears to be no ~/.ldaprc option which does the same as -x. With these parameters specified, we're ready to begin searching. Here's an example:

[ dbharris@gluck: ~/ ]$ ldapsearch -x uid=dbharris keyfingerprint
<snip>
dn: uid=dbharris,ou=users,dc=debian,dc=org
keyFingerPrint: CC53F12435C07BC258FE7A3C157DDFD959DDCB9F
<snip>

The first non-option argument (uid=dbharris in this case) is the query to perform, and the rest of the arguments are the attributes to return. If you only specify the query, but don't provide any attributes to return, all readable attributes are returned. While the example was quite simple, complex queries can be performed as well:

[ dbharris@gluck: ~/ ]$ ldapsearch -x -H ldap://db.oftc.net -b dc=debian,dc=org '(&(!(loginshell=/bin/bash))(uid=*))' loginshell

That query shows users that do not use bash as their shell. Some other interesting queries are:

Count the number of developers (&(keyfingerprint=*)(gidnumber=800))
Show people in a certain group gidmembership=adm
People named james cn=james
Someone whos last name phonetically sounds like 'Ackerma' sn~=ackerm
All the sparcs host=sparc

RFC 2254 has more information about the filter expressions.

Other LDAP Browsers

The GQ package has a graphical LDAP browser that can browse the oftc.net tree. It is somewhat ungainly with the large number of entries in our directory, but it does work nonetheless. Configuration is similar, use the preferences dialog to add a new host with the information given above.

Netscape has a browser for their mailer, but I have never been able to get it to work, please email if you have any luck.

To my knowledge there are no interfaces for popular mailers like mutt and gnus. Such an interface would allow using the directory as an enhanced address book.

Back to the Debian Project homepage.

You can contact us at admin@db.oftc.net.