Re: Slapd Security based on port

On Feb 11, 2011, at 09:50 AM, Chris Jackson wrote:

Is it possible to prevent anonymous and unauthenticated binds to ldaps:// 636 but allow them on ldap:// 389?

I want to allow staff to query my ldaps:// outside of my network while requiring them to login to do so but allow anyone to bind (anonymous, unauthenticated, or authenticated) internally on ldaps//: 389.

I know:
Anonymous bind can be disabled by "disallow bind_anon" and Unauthenticated bind mechanism is disabled by default. But if I use "disallow bind_anon it stops in on both ports. I want to stop it just on ldaps://.

Chris Jackson

On Feb 14, 2011, at 11:28 AM, Aaron Richton wrote:

Stopping users that are "unauthenticated" makes no sense; everything's unauthenticated at time=0. You might as well stop slapd if you want a 100% inability to serve data.

You can deny anonymous users that aren't plaintext, including any ldaps:/// connections, with something like:

access to *
by anonymous ssf=0 transport_ssf=0 tls_ssf=0 sasl_ssf=0 none break
by anonymous none

early on in your ACL stanzas. I'm pretty sure this'll deny anonymous StartTLS users on 389, though; not sure if that's what you want. I can't think of any way to use the slapd access language to differentiate based on listeners, which would probably be the most elegant way to handle what you asked. To be fair, this entire exercise seems really odd from where I sit -- are you positive that this will have the desired effect? (If somebody out in Peru is permitted to connect in unencrypted and make anonymous queries, why not allow them to make those same queries encrypted? What's the difference?)

here is a scenario:

Site has a ldap server on ldap://389. Firewall blocks access to 389 from internet. Everyone queries the ldap via anonymous binds. Site would like to allow staff the ability to query the ldap from outside the firewall. This would be done via ldaps:// 636 to users who have authenticated via username/password. They do not want to allow anonymous queries outside the firewall.

Using the "disallow bind_anon" would prevent anon binds on both ldap:// and ldaps://. This would break the inside machines ability to query. If we dont use "disallow bind_anon" then machines outside of the firewall could query the ldap.

---Is the only option for them to setup two separate ldap servers? One with "disallow bind_anon" and one without. Then only open the firewall for port 636 to the ldap server which has "disallow bind_anon".

Chris Jackson