[Date Prev][Date Next] [Chronological] [Thread] [Top]

RE: using pam binddn/bindpw w/slapd anonymous access disallowed

Hi Greg,

Thanks for the reply!

I don't believe this is an issue for me as I don't believe autofs
participates in the pipeline of calls I'm troubleshooting.  Simply put, I'm
trying to get pam_ldap to pass binddn and binddw to the ldap server for
login/authentication calls so that pam uses a non-anonymous user to get
password information.  This way I can secure anonymous access to the LDAP

In fact, if I decide not to care about this issue, my setup works.  I just
happen to care about security in this case, since I want to be able to query
my ldap server directly if need be from anywhere.



-----Original Message-----
From: owner-openldap-software@OpenLDAP.org
[mailto:owner-openldap-software@OpenLDAP.org]On Behalf Of Greg Matthews
Sent: Monday, June 30, 2003 4:43 AM
To: Gene Sohn
Cc: openldap-software@OpenLDAP.org
Subject: Re: using pam binddn/bindpw w/slapd anonymous access disallowed

One possible gotcha... autofs on linux needs anonymous access unless you
write executable maps to grab the automount maps for you. See:

On Fri, 2003-06-27 at 23:14, Gene Sohn wrote:
> I'm attempting to centralize all my user-related information in LDAP,
> including unix logins, windows logins and contact information.  So far, so
> good.  My unix logins now use ldap as the authentication backend.
> However, I am leery of having (even encrypted) passwords (and other
> information about my users) available to anyone with anonymous access to
> ldap server.  Therefore I'm planning on effectively shutting off anonymous
> access to the LDAP server.  (Can anyone explain whether there are any
> pitfalls with this plan or whether this is even a good idea, and if not,
> what alternatives I have?)
> Therefore, I set up the ldap access privileges in slapd.conf to disallow
> anonymous access.  At this point, my access settings are basic (though I
> will add more later):
> /etc/ldap/slapd.conf
> ...
> access to attr=userPassword
>         by dn="cn=admin,dc=foo,dc=com" write
>         by dn="cn=pam,dc=foo,dc=com" read
>         by self write
>         by anonymous auth
>         by * none
> # The admin dn has full write access, no access by default
> access to *
>         by dn="cn=admin,dc=foo,dc=com" write
>         by dn="cn=pam,dc=foo,dc=com" read
>         by self write
>         by * none
> ...
> I have verified using ldapsearch that my access privileges properly deny
> access to anonymous and allow access to pam for userPassword.  Therefore I
> believe the ldap side of the equation is working.
> Which leads me to pam_ldap.  I've tested binddn and bindpw in
> /etc/pam_ldap.conf but they don't seem to behave as advertised.  When I
> the configuration, I get exactly the same behavior as if binddn and bindpw
> were not set, which is to say pam-ldap appears to bind to slapd as
> anonymous, rather than as my binddn.  Here's all I did to pam_ldap.conf:
> /etc/pam_ldap.conf
> ...
> binddn cn=pamuser, dc=foo, dc=com
> bindpw secret
> ...
> Several questions:
> 1) Am I missing something in my setup of binddn and binddw?
> 2) Is there anything I'm missing in my setup of the slapd.conf access
> privileges?
> 3) Is there any useful logging for what pam sends over to slapd?  I can't
> really decipher the slapd logs too well for this issue.
> 4) (on a different note) Is there a mailing list archives for this list?
> Related threads:
> http://www.netsys.com/openldap-software/2003/05/msg00575.html (and I also
> notice that a read rather than an auth privilege is necessary which is not
> good)
> http://www.netsys.com/openldap-software/2000/04/msg00020.html (I'm trying
> binddn/bindpw)
> According to Debian, I'm using OpenLDAP 2.0.23-6.3 and pam-ldap 140-1.
> (I've also posted this to ldap-nis@padl.com--sorry if it's effectively a
> cross-post)
> Thanks,
> Gene
Greg Matthews
iTSS Wallingford	01491 692445