Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The title should be self explanatory but more in detail I'm looking for a way to protect the ldap from LAN brute force attacks.

It would be fine to prevent password guessing by locking a password for a specified period of time after repeated authentication failures. It doesn't matter if this can be turned into a DOS.

Unfortunately I can't find a way to do this and the documents I've found are really confused.

share|improve this question
what LDAP server? What OS/ This seems like something that is likely to be very closely tied to a specific implementation. For example, you could probably do something with fail2ban on a Linux system. Or maybe do some kind of rate-limiting with iptables. Your LDAP server may have built-in rate limiting features, or maybe not. – Zoredache Jan 16 '13 at 7:20
Sorry, my bad. Openldap on debian. @Zoredache thanks for the tip: I'll dig about fail2ban – damko Jan 16 '13 at 15:39
I found something interesting here. I'll do some tests and then I'll report something – damko Jan 18 '13 at 16:39
up vote 1 down vote accepted

I found out a way to solve this problem using the Ppolicy overlay and I published a post with all the details

It's a good solution but, as always, it might be not the best for all the situations.

As @Zoredache says, fail2ban could be very useful in this situation but it requires to enable logs in ldap (which is not the best if you need speed and you have a slow I/O)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.