Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The title should be self explanatory but more in detail I'm looking for a way to protect the ldap from LAN brute force attacks.

It would be fine to prevent password guessing by locking a password for a specified period of time after repeated authentication failures. It doesn't matter if this can be turned into a DOS.

Unfortunately I can't find a way to do this and the documents I've found are really confused.

share|improve this question
1  
what LDAP server? What OS/ This seems like something that is likely to be very closely tied to a specific implementation. For example, you could probably do something with fail2ban on a Linux system. Or maybe do some kind of rate-limiting with iptables. Your LDAP server may have built-in rate limiting features, or maybe not. –  Zoredache Jan 16 '13 at 7:20
    
Sorry, my bad. Openldap on debian. @Zoredache thanks for the tip: I'll dig about fail2ban –  dam Jan 16 '13 at 15:39
    
I found something interesting here. zytrax.com/books/ldap/ch6/ppolicy.html I'll do some tests and then I'll report something –  dam Jan 18 '13 at 16:39
add comment

1 Answer

up vote 1 down vote accepted

I found out a way to solve this problem using the Ppolicy overlay and I published a post with all the details

http://www.venturin.net/2013/01/19/ldap-how-to-prevent-bruce-force-attacks/

It's a good solution but, as always, it might be not the best for all the situations.

As @Zoredache says, fail2ban could be very useful in this situation but it requires to enable logs in ldap (which is not the best if you need speed and you have a slow I/O)

share|improve this answer
    
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.