Hi Michael,
On 11/04/16 09:11, Michael Ströder wrote:
OK - I'm going to have to get my head around that :) On a test platform... Am I right in thinking the job of the 2nd ACL is because if employeeType is Archive|Delete, the first ACL will simple fall through - so the second ACL is semantically a "Deny All"?
Yepp.
Thanks! That's clearer now.
One other thing - I did not mention, which is retrospect might be important:
I don't let slapd store password hashes - it passes through to Kerberos via saslauthd. So the attribute is of this form:
userPassword: {SASL}someuser@MY.KERB.REALM
I presume that blocking access to userPassword will still cause authentication to fail in this case as it won't be able to do that lookup?
Yes, I think so. But I never used saslauthd myself.
I'll set up a test and confirm to this list (to make the archive of this thread more useful to someone else).
I thought you'd say that :) I'm OK with limiting access to the parent directory (in this case to the slapd user and root). For me, it feels simpler. You may disagree, but I just wanted to say it wasn't an oversight.
Your server, your attack vectors...
:)
Cheers!
Tim