Peter Mogensen wrote:
Only question now is if this is enough to prevent people from binding as cn=config on ldap://<public-IP>/, where the server is also listening.
Omit rootpw in config database and no one will be able to bind as cn=config.
p.
Ing. Pierangelo Masarati OpenLDAP Core Team
SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando@sys-net.it -----------------------------------