Re: size limit by ip?

["Pierangelo Masarati" <ando@sys-net.it>]

> Is it possible to control the size limit based on the ip address?
>
> man slapd.conf
>
>        *limits* <*who*> <*limit*> *[*<*limit*> *[...]]
>
> *The argument *who* can be any of
>
> 		     anonymous	  |   users   |   [dn[.<style>]=]<pattern>   |
> 		     group[/oc[/at]]=<pattern>
>
>
> Which doesn't look like the 'who' can be an ip address,
> but I just want to confirm that is the case (since the 'who' in
> slapd.access support peername.ip and I'm hoping that
> that the underlying code for both 'who's is the same :)

The man page is correct, it's not possible.

> Basically we have software running on a host that is
> unable to authenticate (due to 3rd party software)
> and we need to increase the size limits for queries coming from it,
> without increasing that limit for all anonymous binds.

Your problem sounds general enough to deserve an extension of the limits
"who" clause semantics (I don't see it quite high-priority, though).  In
any case, the modification should be trivial enough.  I suggest you file
an ITS for a feature request.

> Are there alternative ways of doing this?
> Possibly setting up a server with back-ldap running, only allowing
> access from the specific
> ip address and letting the back-ldap server bind to real servers as an
> authorized account?
>
> Or is there a way to map ip address to an identity that can be used in
> the limits control.

Using idassert-bind with back-ldap would allow to transform an anonymous
connection into an authorized one.  However, the request would then appear
as originating from the DSA instantiating the back-ldap, rather than from
the actual client.

> We're running 2.3.24.

You should definitely upgrade.

p.



Ing. Pierangelo Masarati
OpenLDAP Core Team

SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
---------------------------------------
Office:  +39 02 23998309
Mobile:  +39 333 4963172
Email:   pierangelo.masarati@sys-net.it
---------------------------------------