Pierangelo Masarati pisze:
Aleksander Adamowski wrote:
> Knowing that rootdn always bypasses ACLs, is there any other way to
> restrict BIND operations that use rootdn to certain source IP addresses
> for clients?
You can define a rootdn with no rootpw, and create an entry with the
rootdn's DN. Then binding as the rootdn would require a regular bind to
that DN, which in turn requires auth access to that entry's DN and
userPassword, and this can be restricted via ACLs including ACLs on
source IP address and so. As soon as that bind succeeds, that
connection would have complete rootdn privileges and thus bypass further
Perfect! It worked! Pierangelo, you're a real guru.
Thanks for the info.
BTW, I've submitted the recipe for this to FAQ-O-Matic. Until it's
published, here's the recipe text for the record:
Alternatively, you can specify rootdn in slapd.conf without specifying a
rootpw. Then you have to add an actual directory entry with the same dn,
Then binding as the rootdn will require a regular bind to that DN, which
in turn requires auth access to that entry's DN and userPassword, and
this can be restricted via ACLs. E.g.:
access to dn.base="cn=Manager,o=MyOrganization"
by peername.regex=127\.0\.0\.1 auth
by peername.regex=192\.168\.0\..* auth
by users none
by anonymous none
The ACLs above will only allow binding using rootdn from localhost and
ICQ UIN: 19780575