On Thu, Aug 13, 2026 at 08:36:01AM -0700, Chris Paul wrote:
On 8/12/26 9:12 AM, Howard Chu wrote:
Realistically, no company exposes their directory infrastructure to the public Internet. There have been many DoS's via leftover asserts in the code thru the years, but none of these have ever been associated with reports of actual attacks.
I know of some universities that purposely do expose a partial DIT to the world, very deliberately, and reasonably. I would never recommend this, but some do this.
I would say that's a reasonable deployment, but as you expose a limited fraction of the tree, those replicas should store only that "public" fraction and have no access to anything else.
A good security team would not imagine DOS as possible from only the internet. Internal DOS, often of the friendly-fire sort, happens, and with it, often degradation of security infra. A well-built identity and PAM system will be engineered to be resilient in the face of an LDAP outage, but usually won't like one for very long.
An accidental DoS vs. intentional. If there's intent, you can usually track it down to someone who originated it?
It's trivial to overwhelm an OpenLDAP server with simple hardware and simple client script. I wish that would be less easy to do.
Unfortunately for many admins an LDAP server is both an identity source (the cheap requests) and a database (the sort that you don't give random clients access to). Still, there is a lot you can do to limit that, e.g. (unchecked) limits, with 2.7 even exop/control restrictions and only let some accounts access the expensive parts of the protocol/DB.
Or what other scenarios do you have in mind above?
Regards,