Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:


I have followed the instructions here to setup my OpenLdap and its working just fine, except an anonymous user can bind to my server and see the whole user/group structure. LDAP is running over SSL.

I have read online that i can add disallow bind_anon and require authc in the slapd.conf file and it will be disabled but there is no slapd.conf file to begin with and since this doesn't use slapd.conf for its configuration as i understand OpenLdap has moved to a cn=config setup so it wont read that file even if i create one. i have looked online without any luck.

I believe i need to change something in here

olcAccess: to attrs=userPassword by dn="cn=admin,dc=tuxnetworks,dc=com" write by anonymous auth by self write by * none
olcAccess: to attrs=shadowLastChange by self write by * read
olcAccess: to dn.base="" by * read
olcAccess: to * by dn="cn=admin,dc=tuxnetworks,dc=com" write by * read

but i am not sure what. Any help is appreciated.

Thank you!


share|improve this question

migrated from Jun 28 '11 at 19:40

This question came from our site for professional and enthusiast programmers.

marked as duplicate by 84104, Ward, EEAA, mdpc, voretaq7 May 29 '13 at 6:17

This question was marked as an exact duplicate of an existing question.

olcAccess: to * by self write by anonymous auth by * none

This directive allows the user to modify their entry, allows anonymous to authenticate against these entries, and allows all others to read these entries.

share|improve this answer

olcAccess: to * by dn="cn=admin,dc=tuxnetworks,dc=com" write by * read

This rule of yours makes the default to allow read access to everybody. Try changing the final 'read' to 'none', but better still have a look at how this syntax works and devise your own rule.

share|improve this answer