Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to secure my LDAP server and am not quite sure the best way to go about it. I am running Debian "Lenny", and using OpenLDAP (slapd).

I notice that if I run:

ldapsearch -x -W -b 'dc=example,dc=com' -H 'ldap://127.0.0.1:389/' 'objectclass=*'

and just press ENTER when it prompts for a password, that I get a list of directory entries. Anonymous access is not acceptable if I am opening this up to the internet, but cannot find a way to disable anonymous access.

I have tried modifying /etc/ldap/slapd.conf to the following:

access to *
    by dn="cn=admin,dc=example,dc=com" write
    by * none

... but that doesn't do the trick.

After this, I will get it running over TLS, but it is pointless doing that step while still allowing anonymous access.

Any ideas?

share|improve this question
    
TLS is not completely pointless. It also allows securing passwords for non-anonymous binds, and making sure it's really your LDAP server you're connecting to. –  grawity Sep 10 '09 at 4:42

2 Answers 2

up vote 6 down vote accepted

To completely disable anonymous bind, add this line to slapd.conf:

disallow bind_anon

Then restart the service.

share|improve this answer

Since you are planning to go SSL/TLS soon, you may want to consider using client certificate verification to further tighten your security. Stunnel with -v -A options would do nicely.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.