On 11/11/2013 12:52 PM, Quanah Gibson-Mount wrote:
--On Monday, November 11, 2013 8:39 PM +0400 Oleg lego12239@yandex.ru wrote:
ok. How can i place restrictions for admin access to cn=config db? According to docs i must add a user to a db to do this.
I suggest looking at what Debian does in their default configurations, which restricts the admin user to using the ldapi:/// socket and the root user only, which meets your criteria for locking it down to localhost and even goes beyond that to locking down the user that is mapped to the rootdn as well.
--Quanah
Hi all,
I am trying to do something similar, and am experiencing issues as well. At the end of the day, my goal is to migrate from some older Mirapoint LDAP servers. Mirapoint uses OpenLDAP, but adds their own schema to the mix, and I'll have to import that as well. I also need the Samba support. Since Samba is a recognized service and schema, I thought I'd start with that.
Following your advice, here are some of my relevant config lines (though, not Debian):
******************* # rootdn can always read and write EVERYTHING! ...
database config access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none
...
rootdn "cn=Manager,dc=ndtel,dc=com" *******************
I can use cn=Manager,dc=ndtel,dc=com (and the associated password) to do other things (IE: see the existing structure and schemas in PHPLdapAdmin), but I cannot seem to update the config db.
Here's what happens when I attempt to import a schema LDIF, as explained at http://www.linuxquestions.org/questions/linux-server-73/how-to-add-a-new-sch...:
******************* [root@ldap1 ~]# ldapadd -x -W -D 'cn=Manager,dc=ndtel,dc=com' -W -f ./samba.ldif -H ldap://10.255.255.40 Enter LDAP Password: adding new entry "cn=samba,cn=schema,cn=config" ldap_add: Insufficient access (50) *******************
I have been researching this for a couple of days, and I can't seem to find the solution.
BTW: Centos 6.4, updated.
[root@ldap1 ~]# slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Apr 29 2013 07:47:08) $
mockbuild@c6b7.bsys.dev.centos.org:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd
If anything else is needed to help with this troubleshooting or to help me understand what it is I am missing (which is what I prefer: to learn), please let me know.
Thanks!
Alex