The ones I know who do, do this.I would say that's a reasonable deployment, but as you expose a limited fraction of the tree, those replicas should store only that "public" fraction and have no access to anything else.
Yup, for sure although I've "handled" a friendly DOS before by setting loglevel to 0, which greatly increases the load a server can handle; then analyzing cn=connections,cn=monitor saved the day.An accidental DoS vs. intentional. If there's intent, you can usually track it down to someone who originated it?
Yup, it's not that OpenLDAP has no guards. Limits do a lot, but they don't prevent multiple connections from the same IP, for example.Unfortunately for many admins an LDAP server is both an identity source (the cheap requests) and a database (the sort that you don't give random clients access to). Still, there is a lot you can do to limit that, e.g. (unchecked) limits, with 2.7 even exop/control restrictions and only let some accounts access the expensive parts of the protocol/DB.
Some configurations that would be worth considering:Or what other scenarios do you have in mind above?
Yes, firewalls can do some of this.
I should mention that I offer this just as room for improvement. OpenLDAP is extremely good, very resilient software. I recommend it to anyone who asks me for LDAP software. I don't know of other LDAP services that can handle as much load as OpenLDAP. Yet it would be better if it could impose more limits to protect itself from intentional or unintentional overuse.
-- Chris Paul | Rex Consulting, Inc. | https://www.rexconsulting.net