Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to change the settings my new LDAP server let only users of the server read entries and not anonymous. Currently my olcAccess looks like this:

olcAccess: {0} to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: {1} to * by self write by dn="cn=admin,dc=example,dc=com" write by * read

I tried to change it like so:

olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: {1} to * by self write by dn="cn=admin,dc=exampme,dc=com" write by users read

But that gives me no access at all. Can someone help me on this?

thanks

UPDATE: This is the log read after the changes mentioned by userxxx

Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 fd=28 ACCEPT from IP=87.149.169.6:64121     (IP=0.0.0.0:389)
Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 op=0 do_bind: invalid dn (pbrechler)
Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 op=0 RESULT tag=97 err=34 text=invalid DN
Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 op=1 UNBIND
Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 fd=28 closed
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 fd=28 ACCEPT from IP=87.149.169.6:64122     (IP=0.0.0.0:389)
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 op=0 do_bind: invalid dn (pbrechler)
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 op=0 RESULT tag=97 err=34 text=invalid DN
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 op=1 UNBIND
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 fd=28 closed

pbrechler should be a valid user but has no system user (we don't need it) admin does't work also

  1. List item

share|improve this question
    
There is no need to explicitly specify any ACLs for the admin user (the one specified in olcRootDN which I assume is cn=admin,dc=exampme,dc=com in your examples). The admin user always has write access to everything. –  daff Sep 30 '11 at 4:26
1  
Follow-up: Your change to include by users read should be all you need, so if this is really your complete ACL it should work as you posted. For good measure make sure access to attrs=userPassword,shadowLastChange includes by users auth as well. –  daff Sep 30 '11 at 4:33

2 Answers 2

olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: {1}to attrs=uid,uidNumber,gidNumber by dn="cn=admin,dc=example,dc=com" write by * read
olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=com" write by users read by anonymous auth

olc{1} ... by * read might instead be by * auth depends on config of pam_ldap and how/if client machines (rather than users) authenticate themselves.

Edit as response:

Valid dns look like uid=username,ou=users,dc=sub,dc=domain,dc=tld.
username is not a valid dn syntax and never has been.
olcAccess cannot change this.
(SASL/olcAuthzRegexp can do all kinds of interesting things, however not enough detail was provided to know if system uses SASL at all.)

If this machine only uses ldap to talk to itself you can limit it to localhost (or sockets, aka ldapi, if your client software supports it). dn naming rules still apply.

Also, if dn="cn=admin,dc=example,dc=com" is defined as your rootdn for a database there is no need to list it in that database's olcAccess. A dn always has write access to all attrs in a database for which it is rootdn.

share|improve this answer
    
That didn't work. I can't connect to the ldap now and none of my system (redmine, dovecot) can even though they use a valid user to authenticate. Can't I just limit the ldap to listen on 127.0.0.1 only so that no user on the internet can read out our data? –  plaetzchen Sep 30 '11 at 8:46
    
See log below .. –  plaetzchen Sep 30 '11 at 8:48
    
I mean in the original post –  plaetzchen Sep 30 '11 at 8:57
    
answer edited (mainly because comments don't allow as much formatting) –  84104 Sep 30 '11 at 22:55
    
Thank you for your work. So what do I need to change? –  plaetzchen Oct 1 '11 at 22:53

Try this:

access to attrs=userPassword,shadowLastChange 
    by self write 
    by anonymous auth 
    by dn="cn=admin,dc=example,dc=com" write 
    by users read
    by * none
access to * 
    by self write 
    by dn="cn=admin,dc=example,dc=com" write 
    by * read

But you may consider 2 security risks: the first is access to attrs=userPassword,shadowLastChange by users read means that the users can read the shadow password and use tools to crack. The second is access to * by self write, so, the users can change uidNumber and/or gidNumber to becomes root.

Therefore, I suggest the following ACL:

access to attrs=userPassword,shadowLastChange 
    by self write 
    by anonymous auth 
    by dn="cn=admin,dc=example,dc=com" write 
    by users none
access to * 
    by dn="cn=admin,dc=example,dc=com" write 
    by * read
share|improve this answer
    
Thanks but this still allows anonymous to read all data –  plaetzchen Sep 29 '11 at 15:25
    
Enable logging and set loglevel to 128 to see what it say. –  quanta Sep 29 '11 at 16:23
1  
This won't work because by * read matches everyone, including the anonymous user. –  daff Sep 30 '11 at 4:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.