Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

Folks,

I have followed the instructions here http://tuxnetworks.blogspot.com/2010/06/howto-ldap-server-on-1004-lucid-lynx.html to setup my OpenLdap and its working just fine, except an anonymous user can bind to my server and see the whole user/group structure. LDAP is running over SSL.

I have read online that i can add disallow bind_anon and require authc in the slapd.conf file and it will be disabled but there is no slapd.conf file to begin with and since this doesn't use slapd.conf for its configuration as i understand OpenLdap has moved to a cn=config setup so it wont read that file even if i create one. i have looked online without any luck.

I believe i need to change something in here

olcAccess: to attrs=userPassword by dn="cn=admin,dc=tuxnetworks,dc=com" write by anonymous auth by self write by * none
olcAccess: to attrs=shadowLastChange by self write by * read
olcAccess: to dn.base="" by * read
olcAccess: to * by dn="cn=admin,dc=tuxnetworks,dc=com" write by * read

but i am not sure what. Any help is appreciated.

Thank you!

-shashank

share|improve this question

migrated from stackoverflow.com Jun 28 '11 at 19:40

This question came from our site for professional and enthusiast programmers.

marked as duplicate by 84104, Ward, EEAA, mdpc, voretaq7 May 29 '13 at 6:17

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

olcAccess: to * by self write by anonymous auth by * none

This directive allows the user to modify their entry, allows anonymous to authenticate against these entries, and allows all others to read these entries.

share|improve this answer

olcAccess: to * by dn="cn=admin,dc=tuxnetworks,dc=com" write by * read

This rule of yours makes the default to allow read access to everybody. Try changing the final 'read' to 'none', but better still have a look at how this syntax works and devise your own rule.

share|improve this answer