openldap-bugs

openldap-bugs@openldap.org

1 participants
21065 discussions

Start a nNew thread

ITS#9105 published: SECURITY: new feature
by openldap-its＠OpenLDAP.org 27 Oct '19

27 Oct '19

Private ITS#9105 is now publicly readable URL: http://www.OpenLDAP.org/its/?findid=9105

1 0

ITS#9104 published: SECURITY: new feature
by openldap-its＠OpenLDAP.org 27 Oct '19

27 Oct '19

Private ITS#9104 is now publicly readable URL: http://www.OpenLDAP.org/its/?findid=9104

1 0

ITS#9103 published: SECURITY: new feature
by openldap-its＠OpenLDAP.org 27 Oct '19

27 Oct '19

Private ITS#9103 is now publicly readable URL: http://www.OpenLDAP.org/its/?findid=9103

1 0

Re: (ITS#9107) new feature
by hyc＠symas.com 27 Oct '19

27 Oct '19

ydgdsnn(a)163.com wrote: > Full_Name: Nannan Song > Version: 2.4.44 > OS: SUSE > URL: > Submission from: (NULL) (221.226.97.96) > > > When LDAP is used to manage user and user group information, openldap only > supports the configuration of the plain text password of the read-only user in > the '/etc/ldap.conf/'. The password of the read-only user only supports plain > text storage. so there is a security issue that the authentication credential > file is readable to all users. > Now we hope ldap can support the feature that using the encrypted text to save > password for read only user. We saw this the first time, no need to resubmit it 10 times. Supposing you could put an encrypted password into ldap.conf - where would you put the key for decrypting the password, so that the software can use it? When LDAP is *correctly* used to manage user and group information, the credentials used to contact the LDAP server belong to a low-privilege account, so that theft of those credentials is of minimal harm. And they are used by a single authentication daemon (like nslcd in the nss-pam-ldapd package) and as such never appear in any world-readable files. Closing this ITS and all the other copies of it. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#9111) new feature:using the encrypted text to save password for read only user
by ydgdsnn＠163.com 27 Oct '19

27 Oct '19

Full_Name: Nannan Song Version: 2.4.44 OS: SUSE URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (221.226.97.96) When LDAP is used to manage user and user group information, openldap only supports the configuration of the plain text password of the read-only user in the '/etc/ldap.conf/'. The password of the read-only user only supports plain text storage. so there is a security issue that the authentication credential file is readable to all users. Now we hope ldap can support the feature that using the encrypted text to save password for read only user.

1 0

(ITS#9110) new feature
by ydgdsnn＠163.com 27 Oct '19

27 Oct '19

Full_Name: Nannan Song Version: 2.4.44 OS: SUSE URL: Submission from: (NULL) (221.226.97.96) When LDAP is used to manage user and user group information, openldap only supports the configuration of the plain text password of the read-only user in the '/etc/ldap.conf/'. The password of the read-only user only supports plain text storage. so there is a security issue that the authentication credential file is readable to all users. Now we hope ldap can support the feature that using the encrypted text to save password for read only user.

1 0

(ITS#9109) new feature
by ydgdsnn＠163.com 27 Oct '19

27 Oct '19

1 0

(ITS#9108) new feature
by ydgdsnn＠163.com 27 Oct '19

27 Oct '19

1 0

(ITS#9107) new feature
by ydgdsnn＠163.com 27 Oct '19

27 Oct '19

1 0

(ITS#9102) Update sasl-secprops ssf wording
by quanah＠openldap.org 25 Oct '19

25 Oct '19

Full_Name: Quanah Gibson-Mount Version: 2.4.48 OS: N/A URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.154.120) The slapd.conf(5)/slapd-config(5) man pages contain this wording for the sasl-secprops keyword: 0 (zero) implies no protection, 1 implies integrity protection only, 56 allows DES or other weak ciphers, 112 allows triple DES and other strong ciphers, 128 allows RC4, Blowfish and other modern strong ciphers. The default is 0. I think it's been quite a while since RC4 was considered a "modern strong cipher".

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs