[Date Prev][Date Next]
Re: ssf=0 for localhost
Nathan Huesken writes:
> I have setup ldap with tls. To disallow users to authenticate without
> security form differenct computers, I added
> security ssf=64
> to slapd.conf. Now I want local users (connections from localhost) to
> allow authenticating without any tls or SASL. I added:
> localSSF 0
Read the localSSF description in the slapd.conf manpage.
localSSF applies to ldapi:// connections, not ldap://localhost/
connections. And what you just did was assign ldapi:// users
a security strength 0, which disallows them, rather than the default
71, which allows them on your setup (since it is above 64).
Do not use ldapi:// with clients or servers before OpenLDAP 2.3.35,
it had security issues.