0

I want to change the settings my new LDAP server let only users of the server read entries and not anonymous. Currently my olcAccess looks like this:

olcAccess: {0} to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: {1} to * by self write by dn="cn=admin,dc=example,dc=com" write by * read

I tried to change it like so:

olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: {1} to * by self write by dn="cn=admin,dc=exampme,dc=com" write by users read

But that gives me no access at all. Can someone help me on this?

thanks

UPDATE: This is the log read after the changes mentioned by userxxx

Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 fd=28 ACCEPT from IP=87.149.169.6:64121     (IP=0.0.0.0:389)
Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 op=0 do_bind: invalid dn (pbrechler)
Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 op=0 RESULT tag=97 err=34 text=invalid DN
Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 op=1 UNBIND
Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 fd=28 closed
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 fd=28 ACCEPT from IP=87.149.169.6:64122     (IP=0.0.0.0:389)
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 op=0 do_bind: invalid dn (pbrechler)
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 op=0 RESULT tag=97 err=34 text=invalid DN
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 op=1 UNBIND
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 fd=28 closed

pbrechler should be a valid user but has no system user (we don't need it) admin does't work also

  1. List item

2
  • There is no need to explicitly specify any ACLs for the admin user (the one specified in olcRootDN which I assume is cn=admin,dc=exampme,dc=com in your examples). The admin user always has write access to everything.
    – daff
    Sep 30, 2011 at 4:26
  • 1
    Follow-up: Your change to include by users read should be all you need, so if this is really your complete ACL it should work as you posted. For good measure make sure access to attrs=userPassword,shadowLastChange includes by users auth as well.
    – daff
    Sep 30, 2011 at 4:33

2 Answers 2

1

olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: {1}to attrs=uid,uidNumber,gidNumber by dn="cn=admin,dc=example,dc=com" write by * read
olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=com" write by users read by anonymous auth

olc{1} ... by * read might instead be by * auth depends on config of pam_ldap and how/if client machines (rather than users) authenticate themselves.

Edit as response:

Valid dns look like uid=username,ou=users,dc=sub,dc=domain,dc=tld.
username is not a valid dn syntax and never has been.
olcAccess cannot change this.
(SASL/olcAuthzRegexp can do all kinds of interesting things, however not enough detail was provided to know if system uses SASL at all.)

If this machine only uses ldap to talk to itself you can limit it to localhost (or sockets, aka ldapi, if your client software supports it). dn naming rules still apply.

Also, if dn="cn=admin,dc=example,dc=com" is defined as your rootdn for a database there is no need to list it in that database's olcAccess. A dn always has write access to all attrs in a database for which it is rootdn.

5
  • That didn't work. I can't connect to the ldap now and none of my system (redmine, dovecot) can even though they use a valid user to authenticate. Can't I just limit the ldap to listen on 127.0.0.1 only so that no user on the internet can read out our data?
    – plaetzchen
    Sep 30, 2011 at 8:46
  • See log below ..
    – plaetzchen
    Sep 30, 2011 at 8:48
  • I mean in the original post
    – plaetzchen
    Sep 30, 2011 at 8:57
  • answer edited (mainly because comments don't allow as much formatting)
    – 84104
    Sep 30, 2011 at 22:55
  • Thank you for your work. So what do I need to change?
    – plaetzchen
    Oct 1, 2011 at 22:53
0

Try this:

access to attrs=userPassword,shadowLastChange 
    by self write 
    by anonymous auth 
    by dn="cn=admin,dc=example,dc=com" write 
    by users read
    by * none
access to * 
    by self write 
    by dn="cn=admin,dc=example,dc=com" write 
    by * read

But you may consider 2 security risks: the first is access to attrs=userPassword,shadowLastChange by users read means that the users can read the shadow password and use tools to crack. The second is access to * by self write, so, the users can change uidNumber and/or gidNumber to becomes root.

Therefore, I suggest the following ACL:

access to attrs=userPassword,shadowLastChange 
    by self write 
    by anonymous auth 
    by dn="cn=admin,dc=example,dc=com" write 
    by users none
access to * 
    by dn="cn=admin,dc=example,dc=com" write 
    by * read
3
  • Thanks but this still allows anonymous to read all data
    – plaetzchen
    Sep 29, 2011 at 15:25
  • Enable logging and set loglevel to 128 to see what it say.
    – quanta
    Sep 29, 2011 at 16:23
  • 1
    This won't work because by * read matches everyone, including the anonymous user.
    – daff
    Sep 30, 2011 at 4:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .