[Date Prev][Date Next]
Re: i have no name!
Tony Earnshaw wrote:
tor, 2003-02-13 kl. 14:35 skrev John Dalbec:
access to dn="" by * read
access to *
by self write
by users read
by anonymous auth
That seems like it would be hard for a user to NOT have access to
Actually ordinary users access the directory anonymously.
A "user" is not a "user" until he has authenticated with a DN and a
password. He will not then be anonymous any longer.
But only for the duration of that LDAP connection. If a user process
reconnects to LDAP, it has to bind anonymously or ask you to type in
your password again.
system would have to repeatedly ask you to enter your password in order
to bind as you.
For each separate bind as an authenticated user, a valid DN and the
associated password are required. For the password to be accessible, an
anonymous authentication is necessary, hence "by anonymous auth." The
system authenticates automatically, if the DN and given password are
correct. After each directory operation, an unbind is issued. For a new
operation a new bind is necessary.
Right, so logins work, but bash complains "I have no name!" because it
tries to access the user attributes anonymously. It doesn't know your
account's bind password, so it can't bind as you. Or would you prefer
that bash ask you for a password every time you open an xterm or run a
Root is an exception because there's only one password
that it has to use (in /etc/ldap.secret).
The proxy user, as defined in /etc/ldap.conf, has his password in
/etc/ldap.secret. He is not "root" or shouldn't be. It is not necessary
to have a proxy user to bind as a mortal.
The rootbinddn defined in /etc/ldap.conf is only used for processes
running as "root". Or do you mean the binddn/bindpw setting?
Try "by anonymous read" in
This would defeat the whole concept of security and give the whole world
access to your entire DIT.
If that's a big problem, you can restrict it by IP address.
by anonymous peername="IP=aaa\.bbb\.ccc\.ddd" read
But any machine using OpenLDAP for logins needs anonymous access to
certain attributes in the directory tree for correct operation. If you
look at the source for nss_ldap you'll see a list of "passwd" attributes
and a list of "shadow" attributes. The machine needs anonymous access
to _all_ of those.
You might want to have a separate "access to
attr=userPassword" paragraph so your encrypted passwords are not exposed.
What access exactly? You've just given the world read access to
everything. You will not be able to revoke that access, once given.
Right, so you put the "access to attr=userPassword" _before_ the "access
Brian's problem would seem (from what he writes) to be due to the fact
that he hasn't defined his DN.