Re: Force ldaps for named bind

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 05:02 AM 2002-06-14, Roland Muecke wrote:
>Is it possible to configure slapd so that named binds can only be done using encrypted connections?


Here's the text I just added to the Admin Guide:

It is often desirable to restrict operations based upon the level
of protection in place.  The following shows how security strength
factors (SSF) can be used.

   access to *
       by ssf=128 self write
       by ssf=64 anonymous auth
       by ssf=64 users read

This directive allows users to modify their own entries if security
protections have of strength 128 or better have been established,  
allows simple authentication and read access when 64 or better     
security protections have been established.

(See slapd.conf(5) for a discussion of security strength factors.)

>Anonymous binds should of course be possible without encryption.

The above disallows anonymous read... but can easily be tweaked
to allow such.