While working on Internal PT for PCI DSS compliance, it flags that LDAP (389 server, FreeIPA) the anonymous bind is allowing listing list of user accounts.

Many searches are leading to setting up

nsslapd-allow-anonymous-access: off


nsslapd-allow-anonymous-access: rootdse

But changing this appears to be breaking the authentication at the clients using this LDAP server for authentication. The id, getent does not return any information.

How should we secure the LDAP server while making sure that the central authentication continues to work properly?

  • Have you considered configuring the clients to use authentication? – Jenny D Mar 4 at 19:33
  • I had been searching for a way to configure it, but the authconfig-tui does not provide any such option. Any pointer will help. – MPN Mar 5 at 3:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.