Re: ssf Security Question

[Quanah Gibson-Mount <quanah@symas.com>]

--On Tuesday, November 14, 2017 8:56 PM +0000 Kaya Saman 
<kayasaman@gmail.com> wrote:

> access to *
>          by ssf=128 self write
>      by ssf=128 anonymous auth
>      by ssf=128 users read
>
>
>
>
> # Added ACL for open access to AddressBook in Read and Search only mode
>
> access to dn.children="ou=AddressBook,dc=domain,dc=com"
>      by * search
>      by * read


Your second ACL will never be evaluated, since the first ACL matches 
everything.  As noted in the slapd.access(5) man page, ACL processing stops 
on the first matching ACL.

In addition, in your second ACL, the "by * read" will never be processed, 
because of the match to "by * search".  If you're already planning on 
granting read, there is no point to having by * search there at all.

I.e., your ACLs should be:

access to dn.children="ou=AddressBook,dc=domain,dc=com"
    by * read

access to *
    by ssf=128 self write
    by ssf=128 anonymous auth
    by ssf=128 users read

And I generally doubt you want to give users read to "*", as this means 
they can read the userPassword values of other users, etc.

You might want something more like:

access to dn.children="ou=AddressBook,dc=domain,dc=com"
    by * read

access to attrs=userPassword
    by ssf=128 anonymous auth
    by ssf=128 self write

access to *
    by ssf=128 self write
    by ssf=128 users read

And yes, you have to remove the global SSF setting if the phone cannot 
support startTLS on port 389.

--Quanah

--

Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>