From: Quanah Gibson-Mount quanah@zimbra.com To: espeake@oreillyauto.com Cc: openldap-technical@openldap.org Date: 09/06/2013 02:14 PM Subject: Re: SyncRepl Chaining
--On Friday, September 06, 2013 1:46 PM -0500 espeake@oreillyauto.com wrote:
From: Quanah Gibson-Mount quanah@zimbra.com To: espeake@oreillyauto.com Cc: openldap-technical@openldap.org Date: 09/06/2013 12:29 PM Subject: Re: SyncRepl Chaining
--On Friday, September 06, 2013 12:21 PM -0500 espeake@oreillyauto.com wrote:
add: olcAccess olcAccess: {0}to * by dn.base="uid=syncrepl,ou=System,dc=oreillyauto,dc=com" read by dn.base="uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" read by dn.base="uid=ldapAdmin,ou=System,dc=oreillyauto,dc=com" write by dn.base="uid=newUserAdmin,ou=System,dc=oreillyauto,dc=com" write by dn.base="uid=passwordAdmin,ou=System,dc=oreillyauto,dc=com" write break
This should be "by * break" not "break"
You have no ACL granting access to the pseudo-attribute "entry".
I personally have as my last ACL:
olcAccess: {10}to attrs=entry by dn.children="cn=admins,cn=zimbra" write by * read
--Quanah
--
Quanah Gibson-Mount Lead Engineer Zimbra, Inc
Zimbra :: the leader in open source messaging and collaboration
Here is the access list from a new slapcat, this is for olcDatabase=
{1}hdb
olcAccess: {0}to * by dn.base="uid=syncrepl,ou=System,dc=oreillyauto,dc=com" read by dn.base="uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" read by dn.base="uid=ldapAdmin,ou=System,dc=oreillyauto,dc=com" write by dn.base ="uid=newUserAdmin,ou=System,dc=oreillyauto,dc=com" write by dn.base="uid=p asswordAdmin,ou=System,dc=oreillyauto,dc=com" write by * break olcAccess: {1}to dn.subtree="dc=oreillyauto,dc=com" by group/groupOfUniqueNa mes/uniqueMember="cn=System Administrators,ou=Groups,dc=oreillyauto,dc=com" w rite by group/groupOfUniqueNames/uniqueMember="cn=LDAP Admin,ou=Groups,dc=o reillyauto,dc=com" write olcAccess: {2}to attrs=userPassword by group/groupOfUniqueNames/uniqueMember ="cn=Authenticate,ou=Groups,dc=oreillyauto,dc=com" write by anonymous read olcAccess: {3}to attrs=uid by anonymous read by users read olcAccess: {4}to attrs=ou,employeeNumber by users read olcAccess: {5}to dn.subtree="ou=System,dc=oreillyauto,dc=com" by dn.subtree= "ou=Users,dc=oreillyauto,dc=com" none by users read olcAccess: {6}to dn.children="ou=Groups,dc=oreillyauto,dc=com" by dnattr=own er write by dnattr=uniqueMember read by * none olcAccess: {7}to dn.children="ou=Users,dc=oreillyauto,dc=com" by self read by
group/groupOfUniqueNames/uniqueMember="cn=Authenticate,ou=Groups,dc=oreill
yauto,dc=com" read by * none olcAccess: {8}to * by self read by users read olcAccess: {9} to attrs=entry by dn.children="cn=admins" write by * read
Your acls are still clearly a mess.
olcAccess{1} blocks access to most of the tree for everything but two identities.
I would also note that ACL 9 is clearly never going to be evaluated because
ACL{8} covers everything, and has no break clause.
I would also note that ACL2 is a significant security risk, as it grants read access on the user password attribute to anonymous, instead of AUTH access.
I would note that ACLs 5, 6, and 7 will never be evaluated because of ACL {1}
I would note that ACLS 3, 4, and 8 likely do not do anything, given ACL{1},
since the majority of the tree is closed to them. You probably want a by *
break on ACL{1} as well.
I would note that the general way in which you've structured your ACLs makes them difficult to evaluate and maintain.
--Quanah
--
Quanah Gibson-Mount Lead Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration
This was definately an issue with the ACL's I took down to three for testing and I will work on any areas our team deems to be a security issue.
Thank you for all of your help.
Eric
This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.