|
I'm using TLS but would like to force clients to connect using TLS sans the loopback device or LDAP server itself. I found this post from 2006 which suggests the following. It doesn't work for me: # first, make sure TLS or localhost access to * by tls_ssf=1 none break by peername.ip="127.0.0.1" none break by * none # "real" ACL(s) go here, something like access to * by self write by users read by anonymous auth My current real ACLS' 10.3.5.205 is the IP address of the system on the loopback interface. These settings still allow any system to connect without using TLS. If I change the line in the last ACL to "by users read" bthen i can't connect on the loopback anymore.. What am I doing wrong? access to * by tls_ssf=1 none break by peername.ip="127.0.0.1" none break by peername.ip="10.3.5.205" none break by * none access to dn.children="ou=people,dc=test,dc=lott" attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowMax by self write by * auth break access to dn.children="ou=people,dc=test,dc=lott" attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowLastChange,sambaPwdMustChange,sambaPwdLastSet,pwdReset,pwdChangedTime,pwdPolicySubentry,shadowMax,mail,pwdAc countLockedTime,sambaKickoffTime,shadowExpire,shadowWarning,shadowFlag,sambaAcctFlags,sambaPasswordHistory,mail,givenName by dn.base="cn=root,dc=txcat,dc=lott" write by group.base="cn=infrastructure,ou=test,ou=groups,dc=test,dc=lott" write by dn.base="uid=ldapmgr,ou=people,dc=test,dc=lott" write by * read access to dn.exact="cn=admins,ou=SUDOers,dc=test,dc=lott" attrs=sudoUser by dn.base="cn=root,dc=test,dc=lott" write by group.base="cn=infrastructure,ou=test,ou=groups,dc=test,dc=lott" write by * read access to dn.subtree="ou=SUDOers,dc=test,dc=lott" attrs=sudoUser,sudoCommand,sudoHost,sudoOption by dn.base="cn=root,dc=test,dc=lott" write by group.base="cn=infrastructure,ou=test,ou=groups,dc=test,dc=lott" write by * read access to * by dn.base="cn=root,dc=test,dc=lott" write by group.base="cn=infrastructure,ou=test,ou=groups,dc=test,dc=lott" read by group.base="cn=operations,ou=test,ou=groups,dc=test,dc=lott" read by dn.base="uid=ldapmgr,ou=people,dc=test,dc=lott" read by * read |