Hi! Knowing that rootdn always bypasses ACLs, is there any other way to restrict BIND operations that use rootdn to certain source IP addresses for clients? -- Best Regards, Aleksander Adamowski GG#: 274614 ICQ UIN: 19780575 http://olo.org.pl -- Aleksander Adamowski Administrator systemów korporacyjnych; Instruktor Altkom Akademia S.A. http://www.altkom.pl Warszawa, ul. Chłodna 51 kom. 0-601-318-080 Sąd Rejonowy dla m.st. Warszawy w Warszawie, XII Wydział Gospodarczy Krajowego Rejestru Sądowego, KRS: 0000120139, NIP 118-00-08-391, Kapitał zakładowy: 1000 000 PLN. Adres rejestrowy Firmy - ul. Stawki 2, 00-193 Warszawa. Niniejsza wiadomość zawiera informacje zastrzeżone i stanowiące tajemnicę przedsiębiorstwa firmy Altkom Akademia S.A. Ujawnianie tych informacji osobom trzecim lub nieuprawnione wykorzystanie ich do własnych celów jest zabronione. Jeżeli otrzymaliście Państwo niniejszą wiadomość omyłkowo, prosimy o niezwłoczne skontaktowanie się z nadawcą oraz usunięcie wszelkich kopii niniejszej wiadomości. This message contains proprietary information and trade secrets of Altkom Akademia S.A. company. Unauthorized use or disclosure of this information to any third party is prohibited. If you received this message by mistake, please contact the sender immediately and delete all copies of this message.

Only way to stop rootdn is to stop it from getting in in the first place: tcp wrappers/iptables/etc. Which of course do a lot more than rootdn, though... On Mon, 19 Nov 2007, Aleksander Adamowski wrote: > Hi! > > Knowing that rootdn always bypasses ACLs, is there any other way to > restrict BIND operations that use rootdn to certain source IP > addresses for clients? > > -- >

> I'm new and stupid, but why not just put an admin account in ldap and ditch > the rootdn?

Many sites choose to do exactly this. It depends whether you consider an ACL override capability more useful (which it argubly is) or dangerous (which it argubly is).

One question I pose to the list in light of recent features: Let's say you use (2.4, ACL-aware) back-config and totally flub the ACL config. This should be correctable with the rootdn (which will trump the broken ACL config). If you choose to not configure a rootdn, do you find yourself in a mandatory restart situation that might otherwise be avoided?

Aleksander Adamowski wrote: > Knowing that rootdn always bypasses ACLs, is there any other way to > restrict BIND operations that use rootdn to certain source IP addresses > for clients? > You can define a rootdn with no rootpw, and create an entry with the rootdn's DN. Then binding as the rootdn would require a regular bind to that DN, which in turn requires auth access to that entry's DN and userPassword, and this can be restricted via ACLs including ACLs on source IP address and so. As soon as that bind succeeds, that connection would have complete rootdn privileges and thus bypass further ACL checking.