I am working on securing LDAP server. We have a few scripts that help us to manage records in it, and the access (from outside) to the slapd is done over ldap(s) ports (389/636). Management scripts are executed from localhost on the server where slapd is running and use ldapi for access (as in
-Y EXTERNAL -H ldapi:///). Access to ldapi only open from localhost (using firewall).
I would like to make sure (if that at all is possible) that any changes attempted via ldap(s) would fail, while changes via ldapi are allowed.
Is there any way to configure that in slapd config itself?
PS: This setup uses new config model (
/etc/openldap/slapd.d/...) and not a file config.