Direct LDAP Access

A restricted subset of information is available to non-developers via LDAP. If you wish relatively unfettered access to the LDAP database, connect to it from a machine, such as or

The LDAP utilities package (ldap-utils) provides an utility called ldapsearch that can be used to execute direct queries to the database. This is done by supplying the following arguments to ldapsearch: -x -H ldaps:// -b dc=debian,dc=org. Alternatively, the -H and -b options can be put in one's ~/.ldaprc, in the following form:

[ dbharris@people: ~/ ]$ cat ~/.ldaprc
URI ldaps://
BASE dc=debian,dc=org

-x tells ldapsearch to use "simple" (non-SASL, non-Kerberos) authentication. There appears to be no ~/.ldaprc option which does the same as -x. With these parameters specified, we're ready to begin searching. Here's an example:

[ dbharris@people: ~/ ]$ ldapsearch -x uid=dbharris keyfingerprint
dn: uid=dbharris,ou=users,dc=debian,dc=org
keyFingerPrint: CC53F12435C07BC258FE7A3C157DDFD959DDCB9F

The first non-option argument (uid=dbharris in this case) is the query to perform, and the rest of the arguments are the attributes to return. If you only specify the query, but don't provide any attributes to return, all readable attributes are returned. While the example was quite simple, complex queries can be performed as well:

[ dbharris@people: ~/ ]$ ldapsearch -x -H ldaps:// -b dc=debian,dc=org '(&(!(loginshell=/bin/bash))(uid=*))' loginshell

That query shows users that do not use bash as their shell. Some other interesting queries are:

RFC 2254 has more information about the filter expressions.

Other LDAP Browsers

The GQ package has a graphical LDAP browser that can browse the tree. It is somewhat ungainly with the large number of entries in our directory, but it does work nonetheless. Configuration is similar, use the preferences dialog to add a new host with the information given above.

Netscape has a browser for their mailer, but I have never been able to get it to work, please email if you have any luck.

To my knowledge there are no interfaces for popular mailers like mutt and gnus. Such an interface would allow using the directory as an enhanced address book.

You can contact us at

Last Modified: Mon, Mar 28 15:36:36 UTC 2022
Copyright © 1997-2022 SPI; See license terms
Debian is a registered trademark of Software in the Public Interest, Inc.