Internet DRAFT - draft-bannister-dbis-hosts

draft-bannister-dbis-hosts



 



Internet Draft                                           M. R. Bannister
<draft-bannister-dbis-hosts-07.txt>                Prose Consulting Ltd.
Category: Informational                                    July 24, 2015
Expires January 25, 2016

                 Directory-Based Information Services:
                      Hosts, Networks and Services

Status of this Memo

   Distribution of this memo is unlimited.

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   This Internet-Draft will expire on January 25, 2016.

Copyright Notice

   Copyright (c) 2015 IETF Trust and the persons identified as the
   document authors.  All rights reserved.   

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.




 


Bannister, Mark R.      Expires January 25, 2016                [Page 1]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


Abstract          

   This document extends Directory-Based Information Services (DBIS)
   described in [draft-bannister-dbis-mapping-00] to support hosts,
   networks, netmasks, protocols, rpc and services databases.

   The database schemas SHALL be backwards compatible with the Network
   Information Service [NIS] but stored within [X.500] entries so that
   they may be resolved with the Lightweight Directory Access Protocol
   [RFC4510].

   A hosts database maps hostnames to IP addresses, networks map network
   names to network numbers, netmasks map network numbers to netmasks,
   protocols map network protocol names to protocol numbers, rpc maps
   Remote Procedure Call [RFC1057] program names to RPC program numbers
   and services map network service names to port numbers and protocols.

   This document describes configuration maps [draft-bannister-dbis-
   mapping-00] for hosts, networks, protocols, rpc and services, and
   database entries referenced by those maps.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED" and "MAY" in this document are
   to be interpreted as described in [RFC2119].

Table of Contents

   1. Configuration Maps  . . . . . . . . . . . . . . . . . . . . . .  4
     1.1. Scope . . . . . . . . . . . . . . . . . . . . . . . . . . .  4
     1.2. Example Configuration Map Entries . . . . . . . . . . . . .  5
   2. Database  . . . . . . . . . . . . . . . . . . . . . . . . . . .  5
     2.1. hosts . . . . . . . . . . . . . . . . . . . . . . . . . . .  5
       2.1.1. Definition  . . . . . . . . . . . . . . . . . . . . . .  5
       2.1.2. Object Classes  . . . . . . . . . . . . . . . . . . . .  5
         2.1.2.1. Introduction  . . . . . . . . . . . . . . . . . . .  5
         2.1.2.2. dbisHostConfig  . . . . . . . . . . . . . . . . . .  5
         2.1.2.3. ipHostObject  . . . . . . . . . . . . . . . . . . .  6
         2.1.2.4. ipv4HostObject  . . . . . . . . . . . . . . . . . .  6
         2.1.2.5. ipv6HostObject  . . . . . . . . . . . . . . . . . .  6
       2.1.3. Attributes  . . . . . . . . . . . . . . . . . . . . . .  6
         2.1.3.1. rn  . . . . . . . . . . . . . . . . . . . . . . . .  6
         2.1.3.2. authPassword  . . . . . . . . . . . . . . . . . . .  7
         2.1.3.3. userPassword  . . . . . . . . . . . . . . . . . . .  7
         2.1.3.4. ipv4Address . . . . . . . . . . . . . . . . . . . .  7
         2.1.3.5. ipv6Address . . . . . . . . . . . . . . . . . . . .  7
       2.1.4. Example Host Entry  . . . . . . . . . . . . . . . . . .  7
     2.2. networks  . . . . . . . . . . . . . . . . . . . . . . . . .  8
       2.2.1. Definition  . . . . . . . . . . . . . . . . . . . . . .  8
 


Bannister, Mark R.      Expires January 25, 2016                [Page 2]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


       2.2.2. Object Classes  . . . . . . . . . . . . . . . . . . . .  8
         2.2.2.1. Introduction  . . . . . . . . . . . . . . . . . . .  8
         2.2.2.2. dbisNetworkConfig . . . . . . . . . . . . . . . . .  9
         2.2.2.3. ipNetworkObject . . . . . . . . . . . . . . . . . .  9
       2.2.3. Attributes  . . . . . . . . . . . . . . . . . . . . . .  9
         2.2.3.1. en  . . . . . . . . . . . . . . . . . . . . . . . .  9
         2.2.3.2. ipNetworkNumber . . . . . . . . . . . . . . . . . .  9
         2.2.3.3. ipNetmaskNumber . . . . . . . . . . . . . . . . . . 10
       2.2.4. Example Network Entry . . . . . . . . . . . . . . . . . 10
     2.3. protocols . . . . . . . . . . . . . . . . . . . . . . . . . 10
       2.3.1. Definition  . . . . . . . . . . . . . . . . . . . . . . 10
       2.3.2. Object Classes  . . . . . . . . . . . . . . . . . . . . 11
         2.3.2.1. Introduction  . . . . . . . . . . . . . . . . . . . 11
         2.3.2.2. dbisProtocolConfig  . . . . . . . . . . . . . . . . 11
         2.3.2.3. ipProtocolObject  . . . . . . . . . . . . . . . . . 11
       2.3.3. Attributes  . . . . . . . . . . . . . . . . . . . . . . 11
         2.3.3.1. en  . . . . . . . . . . . . . . . . . . . . . . . . 11
         2.3.3.2. ipProtocolNumber  . . . . . . . . . . . . . . . . . 11
       2.3.4. Example Protocol Entry  . . . . . . . . . . . . . . . . 12
     2.4. rpc . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
       2.4.1. Definition  . . . . . . . . . . . . . . . . . . . . . . 12
       2.4.2. Object Classes  . . . . . . . . . . . . . . . . . . . . 12
         2.4.2.1. Introduction  . . . . . . . . . . . . . . . . . . . 12
         2.4.2.2. dbisRpcConfig . . . . . . . . . . . . . . . . . . . 13
         2.4.2.3. rpcObject . . . . . . . . . . . . . . . . . . . . . 13
       2.4.3. Attributes  . . . . . . . . . . . . . . . . . . . . . . 13
         2.4.3.1. en  . . . . . . . . . . . . . . . . . . . . . . . . 13
         2.4.3.2. rpcNumber . . . . . . . . . . . . . . . . . . . . . 13
       2.4.4. Example RPC Entry . . . . . . . . . . . . . . . . . . . 13
     2.5. services  . . . . . . . . . . . . . . . . . . . . . . . . . 14
       2.5.1. Definition  . . . . . . . . . . . . . . . . . . . . . . 14
       2.5.2. Object Classes  . . . . . . . . . . . . . . . . . . . . 14
         2.5.2.1. Introduction  . . . . . . . . . . . . . . . . . . . 14
         2.5.2.2. dbisServiceConfig . . . . . . . . . . . . . . . . . 14
         2.5.2.3. ipServiceObject . . . . . . . . . . . . . . . . . . 15
       2.5.3. Attributes  . . . . . . . . . . . . . . . . . . . . . . 15
         2.5.3.1. en  . . . . . . . . . . . . . . . . . . . . . . . . 15
         2.5.3.2. ipServicePort . . . . . . . . . . . . . . . . . . . 15
         2.5.3.3. ipProtocolName  . . . . . . . . . . . . . . . . . . 15
       2.5.4. Example Service Entry . . . . . . . . . . . . . . . . . 16
   3. Common Attributes . . . . . . . . . . . . . . . . . . . . . . . 16
     3.1. Definition  . . . . . . . . . . . . . . . . . . . . . . . . 16
     3.2. description . . . . . . . . . . . . . . . . . . . . . . . . 17
     3.3. manager . . . . . . . . . . . . . . . . . . . . . . . . . . 17
     3.4. l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
     3.5. disableObject . . . . . . . . . . . . . . . . . . . . . . . 17
   4. Attribute Syntax  . . . . . . . . . . . . . . . . . . . . . . . 17
   5. Implementation Notes  . . . . . . . . . . . . . . . . . . . . . 17
 


Bannister, Mark R.      Expires January 25, 2016                [Page 3]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


     5.1. NIS Compatible Field Mapping  . . . . . . . . . . . . . . . 17
       5.1.1. Introduction  . . . . . . . . . . . . . . . . . . . . . 17
       5.1.2. hosts . . . . . . . . . . . . . . . . . . . . . . . . . 18
       5.1.3. networks  . . . . . . . . . . . . . . . . . . . . . . . 18
       5.1.4. netmasks  . . . . . . . . . . . . . . . . . . . . . . . 18
       5.1.5. protocols . . . . . . . . . . . . . . . . . . . . . . . 18
       5.1.6. rpc . . . . . . . . . . . . . . . . . . . . . . . . . . 19
       5.1.7. services  . . . . . . . . . . . . . . . . . . . . . . . 19
     5.2. Common Search Filters . . . . . . . . . . . . . . . . . . . 19
       5.2.1. Search Parameters . . . . . . . . . . . . . . . . . . . 19
       5.2.2. Find Configuration Map for Domain . . . . . . . . . . . 20
       5.2.3. List All Entries  . . . . . . . . . . . . . . . . . . . 20
       5.2.4. Find Specific Entry . . . . . . . . . . . . . . . . . . 21
       5.2.5. Find Host by Address  . . . . . . . . . . . . . . . . . 21
       5.2.6. Find Network by Address . . . . . . . . . . . . . . . . 21
       5.2.7. Find Protocol by Number . . . . . . . . . . . . . . . . 21
       5.2.8. Find RPC by Number  . . . . . . . . . . . . . . . . . . 21
       5.2.9. Find Service by Name and Protocol . . . . . . . . . . . 22
       5.2.10. Find Service by Port and Protocol  . . . . . . . . . . 22
   6. Security Considerations . . . . . . . . . . . . . . . . . . . . 22
   7.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 22
     7.1.  Normative References . . . . . . . . . . . . . . . . . . . 22
     7.2.  Informative References . . . . . . . . . . . . . . . . . . 23
   Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 23


1. Configuration Maps

1.1. Scope

   All databases described in this document use the standard
   configuration maps defined in [draft-bannister-dbis-mapping-00],
   section 3.

   Additionally, dbisMapConfig entries for the databases described in
   this document SHALL have assigned the object classes described below.
    It is RECOMMENDED that the dbisMapConfig entry for a passwd or group
   database have the dbisMapFilter attribute set according to the
   following table:

     --------------------------------------------------------------
     Database   Configuration Class   dbisMapFilter
     --------------------------------------------------------------
     hosts      dbisHostConfig        objectClass=ipHostObject
     networks   dbisNetworkConfig     objectClass=ipNetworkObject
     protocols  dbisProtocolConfig    objectClass=ipProtocolObject
     rpc        dbisRpcConfig         objectClass=rpcObject
     services   dbisServiceConfig     objectClass=ipServiceObject
 


Bannister, Mark R.      Expires January 25, 2016                [Page 4]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


     --------------------------------------------------------------

1.2. Example Configuration Map Entries

   The following gives an example of a configuration map entry for a
   hosts database:

       dn: cn=hosts,en=sales.corp,ou=domain-mappings,o=infra
       objectClass: top
       objectClass: dbisMapConfig
       objectClass: dbisHostConfig
       cn: hosts
       dbisMapDN: cn=hosts,ou=dbis,o=infra
       dbisMapFilter: objectClass=ipHostObject
       profileTTL: 900
       description: Primary hosts database

2. Database

2.1. hosts

2.1.1. Definition

   A hosts database contains the following fields:

   - IPv4 or IPv6 address.

   - Canonical host name.

   - Aliases.

   The information that makes up a database entry is obtained from the
   attributes described in the following sections.

2.1.2. Object Classes

2.1.2.1. Introduction

   A dbisMapConfig entry for a hosts database SHALL be assigned the
   object class dbisHostConfig.

   A host entry SHALL be defined by an LDAP entry with the object class
   ipv4HostObject or ipv6HostObject for IPv4 and IPv6 addresses
   respectively.

2.1.2.2. dbisHostConfig

   The dbisHostConfig class is defined as follows:
 


Bannister, Mark R.      Expires January 25, 2016                [Page 5]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


       objectclass ( 1.3.6.1.4.1.23780.219.1.15 NAME 'dbisHostConfig'
         DESC 'DBIS hosts configuration map'
         SUP dbisMapConfig STRUCTURAL )

2.1.2.3. ipHostObject

   The ipHostObject class is defined as follows:

       objectclass ( 1.3.6.1.4.1.23780.219.1.16 NAME 'ipHostObject'
         DESC 'An IP address and associated host name'
         SUP top ABSTRACT
         MUST rn
         MAY ( authPassword $ userPassword $ description $ manager $
               l $ disableObject ) )

   This class is an abstract class and is not to be used directly. The
   ipv4HostObject or ipv6HostObject classes must be used instead.

2.1.2.4. ipv4HostObject

   The ipv4HostObject class is defined as follows:

       objectclass ( 1.3.6.1.4.1.23780.219.1.17 NAME 'ipv4HostObject'
         DESC 'An IPv4 address'
         SUP ipHostObject STRUCTURAL
         MUST ipv4Address )

2.1.2.5. ipv6HostObject

   The ipv6HostObject class is defined as follows:

       objectclass ( 1.3.6.1.4.1.23780.219.1.18 NAME 'ipv6HostObject'
         DESC 'An IPv6 address'
         SUP ipHostObject STRUCTURAL
         MUST ipv6Address )

2.1.3. Attributes

2.1.3.1. rn

   The fully-qualified canonical name of the host is stored in the LDAP
   attribute rn which is defined in [draft-bannister-dbis-mapping-00].
   The rn attribute MUST be associated with an ipHostObject entry and
   SHALL form the RDN.

   If required, alias entries may be defined according to section 2.6 of
   [RFC4512] and as permitted by section 1.2 of [draft-bannister-dbis-
   mapping-00].
 


Bannister, Mark R.      Expires January 25, 2016                [Page 6]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


2.1.3.2. authPassword

   An encrypted password may be stored in the authPassword attribute,
   which is defined in section 2.5 of [RFC3112], and that MAY be
   assigned to an ipHostObject entry.  All notes regarding the use of
   the authPassword attribute described in section 2.1.3.7 of [draft-
   bannister-dbis-passwd-01] apply equally to this document.

2.1.3.3. userPassword

   For compatibility, an encrypted password may alternatively be stored
   in the userPassword attribute which is defined in section 2.41 of
   [RFC4519] and that MAY be assigned to an ipHostObject entry.  All
   notes regarding the use of the userPassword attribute described in
   section 2.1.3.8 of [draft-bannister-dbis-passwd-01] apply equally to
   this document.

2.1.3.4. ipv4Address

   The IPv4 address in dotteetd decimal format is stored in the
   ipv4Address attribute which MUST be associated with an ipv4HostObject
   entry:

       attributetype ( 1.3.6.1.4.1.23780.219.2.27 NAME 'ipv4Address'
         DESC 'An IPv4 address in dotted decimal format'
         EQUALITY caseIgnoreIA5Match SINGLE-VALUE
         SUBSTR caseIgnoreIA5SubstringsMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{15} )

2.1.3.5. ipv6Address

   The IPv6 address [RFC2373] is stored in the ipv6Address attribute
   that MUST be associated with an ipv6HostObject entry:

       attributetype ( 1.3.6.1.4.1.23780.219.2.28 NAME 'ipv6Address'
         DESC 'An IPv6 address [RFC2373]'
         EQUALITY caseIgnoreIA5Match SINGLE-VALUE
         SUBSTR caseIgnoreIA5SubstringsMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{45} )

2.1.4. Example Host Entry

   The following is an example of an ipv4HostObject entry in LDIF format
   [RFC2849]:

       dn: rn=picard,ou=hosts,o=infra
       objectClass: top
       objectClass: ipHostObject
 


Bannister, Mark R.      Expires January 25, 2016                [Page 7]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


       objectClass: ipv4HostObject
       rn: picard
       ipv4Address: 10.11.12.13

   The following is an example of an ipv6HostObject entry:

       dn: rn=picard-hive,ou=hosts,o=infra
       objectClass: top
       objectClass: ipHostObject
       objectClass: ipv6HostObject
       rn: picard-hive
       ipv6Address: 0:1:2:3:4:5:6:7

   The following is an example of a host alias entry:

       dn: rn=picard-eth0,ou=hosts,o=infra
       objectClass: top
       objectClass: alias
       objectClass: extensibleObject
       rn: picard-eth0
       aliasedObjectName: rn=picard,ou=hosts,o=infra

2.2. networks

2.2.1. Definition

   A networks database contains the following fields:

   - Network name.

   - IP network number.

   - Aliases.

   The NIS netmasks map additionally contains the IP network mask.

   The information that makes up a database entry is obtained from the
   attributes described in the following sections.

2.2.2. Object Classes

2.2.2.1. Introduction

   A dbisMapConfig entry for a networks database SHALL be assigned the
   object class dbisNetworkConfig.

   A network entry SHALL be defined by an LDAP entry with the object
   class ipNetworkObject.
 


Bannister, Mark R.      Expires January 25, 2016                [Page 8]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


2.2.2.2. dbisNetworkConfig

   The dbisNetworkConfig class is defined as follows:

       objectclass ( 1.3.6.1.4.1.23780.219.1.19 NAME 'dbisNetworkConfig'
         DESC 'DBIS networks configuration map'
         SUP dbisMapConfig STRUCTURAL )

2.2.2.3. ipNetworkObject

   The ipNetworkObject class is defined as follows:

       objectclass ( 1.3.6.1.4.1.23780.219.1.20 NAME 'ipNetworkObject'
         DESC 'An IP network entry'
         SUP top STRUCTURAL
         MUST ipNetworkNumber
         MAY ( en $ ipNetmaskNumber $ description $ manager $
               l $ disableObject ) )

2.2.3. Attributes

2.2.3.1. en

   The name of the network is stored in the LDAP attribute en which is
   defined in [draft-bannister-dbis-mapping-00].  The en attribute MAY
   be associated with an ipNetworkObject entry, and if provided SHALL
   form the RDN.

   If required, alias entries may be defined according to section 2.6 of
   [RFC4512] and as permitted by section 1.2 of [draft-bannister-dbis-
   mapping-00].

2.2.3.2. ipNetworkNumber

   The IP network address in dotted decimal format is stored in the
   ipNetworkNumber attribute which MUST be associated with an
   ipNetworkObject entry:

       attributetype ( 1.3.6.1.1.1.1.20 NAME 'ipNetworkNumber'
         DESC 'IP network as a dotted decimal, eg. 192.168,
               omitting leading zeros'
         EQUALITY caseIgnoreIA5Match
         SUBSTR caseIgnoreIA5SubstringsMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )

   If the en attribute is not provided, then the ipNetworkNumber SHALL
   form the RDN.

 


Bannister, Mark R.      Expires January 25, 2016                [Page 9]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


2.2.3.3. ipNetmaskNumber

   The IP netmask address in dotted decimal format is stored in the
   ipNetmaskNumber attribute which MAY be associated with an
   ipNetworkObject entry:

       attributetype ( 1.3.6.1.1.1.1.21 NAME 'ipNetmaskNumber'
         DESC 'IP netmask as a dotted decimal, eg. 255.255.255.0,
               omitting leading zeros'
         EQUALITY caseIgnoreIA5Match
         SUBSTR caseIgnoreIA5SubstringsMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )

2.2.4. Example Network Entry

   The following is an example of an ipNetworkObject entry in LDIF
   format [RFC2849]:

       dn: en=lab,ou=networks,o=infra
       objectClass: top
       objectClass: ipNetworkObject
       en: lab
       ipNetworkNumber: 10.23.10
       ipNetmaskNumber: 255.255.255.0

   The following is an example of a network alias entry:

       dn: en=testnet,ou=networks,o=infra
       objectClass: top
       objectClass: alias
       objectClass: extensibleObject
       en: testnet
       aliasedObjectName: en=lab,ou=networks,o=infra

2.3. protocols

2.3.1. Definition

   A protocols database contains the following fields:

   - Protocol name.

   - Protocol number.

   - Aliases.

   The information that makes up a database entry is obtained from the
   attributes described in the following sections.
 


Bannister, Mark R.      Expires January 25, 2016               [Page 10]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


2.3.2. Object Classes

2.3.2.1. Introduction

   A dbisMapConfig entry for a protocols database SHALL be assigned the
   object class dbisProtocolConfig.

   A protocol entry SHALL be defined by an LDAP entry with the object
   class ipProtocolObject.

2.3.2.2. dbisProtocolConfig

   The dbisProtocolConfig class is defined as follows:

       objectclass ( 1.3.6.1.4.1.23780.219.1.21 NAME 'dbisProtocolConfig'
         DESC 'DBIS protocols configuration map'
         SUP dbisMapConfig STRUCTURAL )

2.3.2.3. ipProtocolObject

   The ipProtocolObject class is defined as follows:

       objectclass ( 1.3.6.1.4.1.23780.219.1.22 NAME 'ipProtocolObject'
         DESC 'An IP protocol entry'
         SUP top STRUCTURAL
         MUST ( en $ ipProtocolNumber )
         MAY ( description $ manager $ disableObject ) )

2.3.3. Attributes

2.3.3.1. en

   The name of the protocol is stored in the LDAP attribute en which is
   defined in [draft-bannister-dbis-mapping-00].  The en attribute MUST
   be associated with an ipProtocolObject entry and SHALL form the RDN.

   If required, alias entries may be defined according to section 2.6 of
   [RFC4512] and as permitted by section 1.2 of [draft-bannister-dbis-
   mapping-00].

2.3.3.2. ipProtocolNumber

   The IP protocol number is stored in the ipProtocolNumber attribute
   which MUST be associated with an ipProtocolObject entry:

       attributetype ( 1.3.6.1.1.1.1.17 NAME 'ipProtocolNumber'
         DESC 'IP protocol number'
         EQUALITY integerMatch
 


Bannister, Mark R.      Expires January 25, 2016               [Page 11]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


         ORDERING integerOrderingMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )

2.3.4. Example Protocol Entry

   The following is an example of an ipProtocolObject entry in LDIF
   format [RFC2849]:

       dn: en=ip,ou=protocols,o=infra
       objectClass: top
       objectClass: ipProtocolObject
       en: ip
       ipProtocolNumber: 0

   The following is an example of a protocol alias entry:

       dn: en=IP,ou=protocols,o=infra
       objectClass: top
       objectClass: alias
       objectClass: extensibleObject
       en: IP
       aliasedObjectName: en=ip,ou=protocols,o=infra

2.4. rpc

2.4.1. Definition

   An RPC database contains the following fields:

   - RPC program name.

   - RPC program number.

   - Aliases.

   The information that makes up a database entry is obtained from the
   attributes described in the following sections.

2.4.2. Object Classes

2.4.2.1. Introduction

   A dbisMapConfig entry for an rpc database SHALL be assigned the
   object class dbisRpcConfig.

   A protocol entry SHALL be defined by an LDAP entry with the object
   class rpcObject.

 


Bannister, Mark R.      Expires January 25, 2016               [Page 12]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


2.4.2.2. dbisRpcConfig

   The dbisRpcConfig class is defined as follows:

       objectclass ( 1.3.6.1.4.1.23780.219.1.23 NAME 'dbisRpcConfig'
         DESC 'DBIS rpc configuration map'
         SUP dbisMapConfig STRUCTURAL )

2.4.2.3. rpcObject

   The rpcObject class is defined as follows:

       objectclass ( 1.3.6.1.4.1.23780.219.1.24 NAME 'rpcObject'
         DESC 'An rpc entry [RFC1057]'
         SUP top STRUCTURAL
         MUST ( en $ rpcNumber )
         MAY ( description $ manager $ disableObject ) )

2.4.3. Attributes

2.4.3.1. en

   The name of the RPC program is stored in the LDAP attribute en which
   is defined in [draft-bannister-dbis-mapping-00].  The en attribute
   MUST be associated with an rpcObject entry and SHALL form the RDN.

   If required, alias entries may be defined according to section 2.6 of
   [RFC4512] and as permitted by section 1.2 of [draft-bannister-dbis-
   mapping-00].

2.4.3.2. rpcNumber

   The RPC program number is stored in the rpcNumber attribute which
   MUST be associated with an rpcObject entry:

       attributetype ( 1.3.6.1.4.1.23780.219.2.29 NAME 'rpcNumber'
         DESC 'RPC program number [RFC1057]'
         EQUALITY integerMatch
         ORDERING integerOrderingMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )

2.4.4. Example RPC Entry

   The following is an example of an rpcObject entry in LDIF format
   [RFC2849]:

       dn: en=rpcbind,ou=rpc,o=infra
       objectClass: top
 


Bannister, Mark R.      Expires January 25, 2016               [Page 13]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


       objectClass: rpcObject
       en: rpcbind
       rpcNumber: 100000

   The following is an example of an RPC alias entry:

       dn: en=portmap,ou=protocols,o=infra
       objectClass: top
       objectClass: alias
       objectClass: extensibleObject
       en: portmap
       aliasedObjectName: en=rpcbind,ou=rpc,o=infra

2.5. services

2.5.1. Definition

   A services database contains the following fields:

   - Service name.

   - Port number and protocol name.

   - Aliases.

   The information that makes up a database entry is obtained from the
   attributes described in the following sections.

   The RDN may be comprised of just the en attribute, however, where an
   entry cannot be uniquely identified due to the presence of another
   service that uses the same service name and port number but a
   different protocol name, a multi-valued RDN [RFC4512] SHALL be used
   instead.  An example may be found in section 2.5.4 below.

2.5.2. Object Classes

2.5.2.1. Introduction

   A dbisMapConfig entry for a services database SHALL be assigned the
   object class dbisServiceConfig.

   A service entry SHALL be defined by an LDAP entry with the object
   class ipServiceObject.

2.5.2.2. dbisServiceConfig

   The dbisServiceConfig class is defined as follows:

 


Bannister, Mark R.      Expires January 25, 2016               [Page 14]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


       objectclass ( 1.3.6.1.4.1.23780.219.1.25 NAME 'dbisServiceConfig'
         DESC 'DBIS services configuration map'
         SUP dbisMapConfig STRUCTURAL )

2.5.2.3. ipServiceObject

   The ipServiceObject class is defined as follows:

       objectclass ( 1.3.6.1.4.1.23780.219.1.26 NAME 'ipServiceObject'
         DESC 'An IP service entry'
         SUP top STRUCTURAL
         MUST ( en $ ipServicePort $ ipProtocolName )
         MAY ( description $ manager $ disableObject ) )

2.5.3. Attributes

2.5.3.1. en

   The name of the service is stored in the LDAP attribute en which is
   defined in [draft-bannister-dbis-mapping-00].  The en attribute MUST
   be associated with an ipServiceObject entry and SHALL form the RDN,
   except where noted in section 2.5.1 above.

   If required, alias entries may be defined according to section 2.6 of
   [RFC4512] and as permitted by section 1.2 of [draft-bannister-dbis-
   mapping-00].

2.5.3.2. ipServicePort

   The IP port number is stored in the ipServicePort attribute which
   MUST be associated with an ipServiceObject entry:

       attributetype ( 1.3.6.1.1.1.1.15
         NAME ( 'ipServicePort' )
         DESC 'IP port number'
         EQUALITY integerMatch
         ORDERING integerOrderingMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )

2.5.3.3. ipProtocolName

   The IP service protocol name is stored in the ipProtocolName
   attribute which MUST be associated with an ipServiceObject entry:

       attributetype ( 1.3.6.1.4.1.23780.219.2.30 NAME 'ipProtocolName'
         DESC 'IP protocol name'
         EQUALITY caseExactMatch SINGLE-VALUE
         SUBSTR caseExactSubstringsMatch
 


Bannister, Mark R.      Expires January 25, 2016               [Page 15]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


         SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )

   The ipProtocolName may form part of a multi-valued RDN as discussed
   in section 2.5.1 above.

2.5.4. Example Service Entry

   The following is an example of an ipServiceObject entry in LDIF
   format [RFC2849]:

       dn: en=smtp,ou=services,o=infra
       objectClass: top
       objectClass: ipServiceObject
       en: smtp
       ipServicePort: 25
       ipProtocolName: tcp

   The following is an example of a service alias entry:

       dn: en=mail,ou=services,o=infra
       objectClass: top
       objectClass: alias
       objectClass: extensibleObject
       en: mail
       aliasedObjectName: en=smtp,ou=services,o=infra

   The following is an example of two multi-valued service entries:

       dn: en=rpcbind+ipProtocolName=udp,ou=services,o=infra
       objectClass: top
       objectClass: ipServiceObject
       en: rpcbind
       ipServicePort: 111
       ipProtocolName: udp

       dn: en=rpcbind+ipProtocolName=tcp,ou=services,o=infra
       objectClass: top
       objectClass: ipServiceObject
       en: rpcbind
       ipServicePort: 111
       ipProtocolName: tcp

3. Common Attributes

3.1. Definition

   This document makes use of the common attributes defined below.

 


Bannister, Mark R.      Expires January 25, 2016               [Page 16]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


3.2. description

   The description attribute MAY be associated with an entry to provide
   an arbitrary description of the entry.

3.3. manager

   The manager attribute MAY be associated with an entry to provide one
   or more DNs of the individuals, groups or systems that are
   responsible for maintaining the entry.

3.4. l

   The l attribute MAY be associated with an entry to provide details of
   locality.

3.5. disableObject

   An entry MAY be disabled by setting the disableObject attribute
   [draft-bannister-dbis-mapping-00] to TRUE.  If an entry is disabled,
   then the DUA SHALL behave as if the entry does not exist. The DUA MAY
   optionally provide a separate mechanism for listing disabled entries,
   but they MUST be clearly marked as disabled so that no confusion can
   arise.

4. Attribute Syntax

   The following syntaxes are used by the attributes defined in this
   document:

   -----------------------------------------------------------
   Syntax OID                     Value             Reference
   -----------------------------------------------------------
   1.3.6.1.4.1.1466.115.121.1.15  Directory String  [RFC4517]
   1.3.6.1.4.1.1466.115.121.1.26  IA5 String        [RFC4517]
   1.3.6.1.4.1.1466.115.121.1.27  Integer           [RFC4517]
   -----------------------------------------------------------

5. Implementation Notes

5.1. NIS Compatible Field Mapping

5.1.1. Introduction

   All fields that are required to generate NIS-compatible space-
   separated hosts, networks, netmasks, protocols, rpc or services
   database formats exist in this schema and can be mapped to attribute
   types using common ABNF productions described in [draft-bannister-
 


Bannister, Mark R.      Expires January 25, 2016               [Page 17]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


   dbis-netgroup-00], section 1.2.

   These are described for each database in the following sections.

5.1.2. hosts

   The NIS-compatible hosts database fields are mapped as follows:

         ipaddr      = ipv4Address / ipv6Address
         hostname    = rn
         alias       = rn           ; derived, see below

         hosts-entry = ipaddr SPACE hostname *(SPACE alias)

   In the hosts mappings above:

   - alias is derived from the rn attribute used with entries that
     reference this one via aliasedObjectName.

5.1.3. networks

   The NIS-compatible networks database fields are mapped as follows:

         network-name   = en
         network-number = ipNetworkNumber
         alias          = en       ; derived, see below

         networks-entry = network-name SPACE network-number
                              *(SPACE alias)

   In the networks mappings above:

   - alias is derived from the en attribute used with entries that
     reference this one via aliasedObjectName.

5.1.4. netmasks

   The NIS-compatible netmasks database fields are mapped as follows:

         network-number = ipNetworkNumber
         netmask        = ipNetmaskNumber

         netmasks-entry = network-number SPACE netmask

5.1.5. protocols

   The NIS-compatible protocols database fields are mapped as follows:

 


Bannister, Mark R.      Expires January 25, 2016               [Page 18]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


         proto-name     = en
         proto-number   = ipProtocolNumber
         alias          = en       ; derived, see below

         protocols-entry = proto-name SPACE proto-number *(SPACE alias)

   In the protocols mappings above:

   - alias is derived from the en attribute used with entries that
     reference this one via aliasedObjectName.

5.1.6. rpc

   The NIS-compatible rpc database fields are mapped as follows:

         rpc-name       = en
         rpc-number     = rpcNumber
         alias          = en       ; derived, see below

         rpc-entry = rpc-name SPACE rpc-number *(SPACE alias)

   In the rpc mappings above:

   - alias is derived from the en attribute used with entries that
     reference this one via aliasedObjectName.

5.1.7. services

   The NIS-compatible services database fields are mapped as follows:

         service-name     = en
         service-port     = ipServicePort
         service-protocol = ipProtocolName
         alias            = en     ; derived, see below

         services-entry = service-name SPACE service-port SLASH
                               service-protocol *(SPACE alias)

   In the services mappings above:

   - alias is derived from the en attribute used with entries that
     reference this one via aliasedObjectName.

5.2. Common Search Filters

5.2.1. Search Parameters

   This section provides example LDAP search filters [RFC4515] for
 


Bannister, Mark R.      Expires January 25, 2016               [Page 19]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


   obtaining database entries with commonly used input criteria.

   To simplify the examples, all databases are assumed to have been
   defined with only a single configuration map entry (dbisMapConfig). 
   However, [draft-bannister-dbis-mapping-00] permits multiple such
   entries, so an implementation must support this, increasing the
   number of search operations as necessary to locate all of the
   database entries in scope.

   The base DN used in the search operations described in this section
   comes from the dbisMapDN attribute assigned to the dbisMapConfig
   entry. Note that a dbisMapConfig entry may have more than one of
   these.

   Where it appears in search filters below, the text "dbisMapFilter"
   refers to the value assigned to the attribute of the same name in the
   corresponding dbisMapConfig entry.  Note that each database has
   different dbisMapConfig entries.  Attribute names used in these
   search filters may be modified by the dbisMapAttr attribute assigned
   to the dbisMapConfig entry.

5.2.2. Find Configuration Map for Domain

   To locate the configuration map for a given DBIS domain, search for
   entries underneath the dbisDomainObject entry [draft-bannister-dbis-
   mapping-00].

   Hosts maps can be found with the following search filter:

         (&(objectClass=dbisHostConfig)(!(disableObject=TRUE)))

   Networks maps can be found with:

         (&(objectClass=dbisNetworkConfig)(!(disableObject=TRUE)))

   Protocols maps can be found with:

         (&(objectClass=dbisProtocolConfig)(!(disableObject=TRUE)))

   RPC maps can be found with:

         (&(objectClass=dbisRpcConfig)(!(disableObject=TRUE)))

   Services maps can be found with:

         (&(objectClass=dbisServiceConfig)(!(disableObject=TRUE)))

5.2.3. List All Entries
 


Bannister, Mark R.      Expires January 25, 2016               [Page 20]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


   Entries for a given database are enumerated by applying the
   dbisMapFilter as follows:

         (&(dbisMapFilter)(!(disableObject=TRUE)))

   This filter returns all enabled entries.

5.2.4. Find Specific Entry

   If a hosts entry is known by "name", its definition is located using
   the following search filter:

         (&(dbisMapFilter)(!(disableObject=TRUE))(rn=name))

   If a networks, protocols, rpc or services entry is known by "name",
   its definition is located using the following search filter:

         (&(dbisMapFilter)(!(disableObject=TRUE))(en=name))

5.2.5. Find Host by Address

   If a hosts entry has an IPv4 address "ipv4", its definition is
   located using the following search filter:

         (&(dbisMapFilter)(!(disableObject=TRUE))(ipv4Address=ipv4))

   If a hosts entry has an IPv6 address "ipv6", it may be located using:

         (&(dbisMapFilter)(!(disableObject=TRUE))(ipv6Address=ipv6))

5.2.6. Find Network by Address

   To locate a networks entry by its address "netip", use the following
   search filter:

         (&(dbisMapFilter)(!(disableObject=TRUE))
             (ipNetworkNumber=netip))

5.2.7. Find Protocol by Number

   Given the IP protocol number "protonum", the following search filter
   will locate the associated protocols entry:

         (&(dbisMapFilter)(!(disableObject=TRUE))
             (ipProtocolNumber=protonum))

5.2.8. Find RPC by Number

 


Bannister, Mark R.      Expires January 25, 2016               [Page 21]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


   To locate an rpc entry by its program number "rpcnum", use the
   following search filter:

         (&(dbisMapFilter)(!(disableObject=TRUE))(rpcNumber=rpcnum))

5.2.9. Find Service by Name and Protocol

   To find the services entry for a given service name "servname" and
   protocol "servproto", the following search filter may be used:

         (&(dbisMapFilter)(!(disableObject=TRUE))
             (en=servname)(ipProtocolName=servproto))

5.2.10. Find Service by Port and Protocol

   To find the services entry for a given service port "servport" and
   protocol "servproto", the following search filter may be used:

         (&(dbisMapFilter)(!(disableObject=TRUE))
             (ipServicePort=servport)(ipProtocolName=servproto))

6. Security Considerations

   The security considerations discussed in [draft-bannister-dbis-
   mapping-00] and [draft-bannister-dbis-passwd-01] apply equally to
   this document.

7.  References

7.1.  Normative References

   [RFC1057]  Sun Microsystems, Inc., "RPC: Remote Procedure Call
              Protocol Specification: Version 2", RFC1057, June 1988.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [RFC2373]  Hinden, R. and Deering, S., "IP Version 6 Addressing
              Architecture", RFC 2373, July 1998.

   [RFC2849]  Good, G., "The LDAP Data Interchange Format (LDIF) -
              Technical Specification", RFC 2849, June 2000.

   [RFC3112]  Zeilenga, K., "LDAP Authentication Password Schema", RFC
              3112, May 2001.

   [RFC4510]  Zeilenga, K., Ed., "Lightweight Directory Access Protocol
              (LDAP): Technical Specification Road Map", RFC 4510, June
 


Bannister, Mark R.      Expires January 25, 2016               [Page 22]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015


              2006.

   [RFC4512]  Zeilenga, K., Ed., "Lightweight Directory Access Protocol
              (LDAP): Directory Information Models", RFC 4512, June
              2006.

   [RFC4515]  Smith, M., Ed., and T. Howes, "Lightweight Directory
              Access Protocol (LDAP): String Representation of Search
              Filters", RFC 4515, June 2006.

   [RFC4517]  Legg, S., Ed., "Lightweight Directory Access Protocol
              (LDAP): Syntaxes and Matching Rules", RFC 4517, June 2006.

   [RFC4519]  Sciberras, A., Ed., "Lightweight Directory Access Protocol
              (LDAP): Schema for User Applications", RFC 4519, June
              2006.

   [draft-bannister-dbis-mapping-00]  Bannister, M. R., "Directory-Based
              Information Services: Mapping Objects", draft-bannister-
              dbis-mapping-00.txt, August 2013.

   [draft-bannister-dbis-netgroup-00]  Bannister, M. R., "Directory-
              Based Information Services: Netgroups and Netservices",
              draft-bannister-dbis-netgroups-00.txt, August 2013.

   [draft-bannister-dbis-passwd-01]  Bannister, M. R., "Directory-Based
              Information Services: Users and Groups", draft-bannister-
              dbis-passwd-01.txt, September 2013.

7.2.  Informative References

   [X.500]  Weider, C. and J. Reynolds, "Executive Introduction to
              Directory Services Using the X.500 Protocol", FYI 13, RFC
              1308, March 1992.

   [NIS]  Wikipedia, "Network Information Service", <http://
              en.wikipedia.org/wiki/Network_Information_Service>.

Author's Address

   Mark R. Bannister
   Prose Consulting Ltd.
   73 Claygate Lane
   Esher, Surrey, KT10 0BQ
   United Kingdom

   Tel: +44 7764 604316
   EMail: dbis@proseconsulting.co.uk
 


Bannister, Mark R.      Expires January 25, 2016               [Page 23]

Internet Draft     DBIS Hosts, Networks and Services       July 24, 2015





















































Bannister, Mark R.      Expires January 25, 2016               [Page 24]