1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE> [Mageia-sysadm] [377] - add nssldap password handling
</TITLE>
<LINK REL="Index" HREF="index.html" >
<LINK REL="made" HREF="mailto:mageia-sysadm%40mageia.org?Subject=Re%3A%20%5BMageia-sysadm%5D%20%5B377%5D%20-%20add%20nssldap%20password%20handling&In-Reply-To=%3C20101123072403.GA28038%40maude.comedia.it%3E">
<META NAME="robots" CONTENT="index,nofollow">
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
<LINK REL="Previous" HREF="000809.html">
<LINK REL="Next" HREF="000830.html">
</HEAD>
<BODY BGCOLOR="#ffffff">
<H1>[Mageia-sysadm] [377] - add nssldap password handling</H1>
<B>Luca Berra</B>
<A HREF="mailto:mageia-sysadm%40mageia.org?Subject=Re%3A%20%5BMageia-sysadm%5D%20%5B377%5D%20-%20add%20nssldap%20password%20handling&In-Reply-To=%3C20101123072403.GA28038%40maude.comedia.it%3E"
TITLE="[Mageia-sysadm] [377] - add nssldap password handling">bluca at vodka.it
</A><BR>
<I>Tue Nov 23 08:24:03 CET 2010</I>
<P><UL>
<LI>Previous message: <A HREF="000809.html">[Mageia-sysadm] [377] - add nssldap password handling
</A></li>
<LI>Next message: <A HREF="000830.html">[Mageia-sysadm] [377] - add nssldap password handling
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#823">[ date ]</a>
<a href="thread.html#823">[ thread ]</a>
<a href="subject.html#823">[ subject ]</a>
<a href="author.html#823">[ author ]</a>
</LI>
</UL>
<HR>
<!--beginarticle-->
<PRE>On Mon, Nov 22, 2010 at 12:56:32PM +0100, Buchan Milne wrote:
>><i> +binddn uid=nssldap,ou=System Accounts,<%= dc_suffix %>
</I>>><i> +bindpw <%= nssldap_password %>
</I>>><i> uri <A HREF="ldaps://ldap.<%=">ldaps://ldap.<%=</A> domain %>
</I>>><i> base <%= dc_suffix %>
</I>>><i> pam_lookup_policy no
</I>><i>
</I>><i>
</I>><i>I would prefer if we can instead use:
</I>><i>-"rootbinddn" in /etc/ldap.conf, not binddn
</I>><i>-place password in /etc/ldap.secret
</I>><i>-use nscd, so all LDAP access is as root (so, no need to expose passwords in
</I>><i>files that must be world-readable), as a side-effect also avoiding problems
</I>><i>with file descriptors used by any process doing a user lookup etc.
</I>><i>
</I>><i>Permissions on /etc/ldap.conf should be 0644, /etc/ldap.secret can be 0600.
</I>
what is the real use of rootbinddn?
is there really any need to expose different information to NSS when
caller is uid 0?
also the idea of a proxy user is flawed, it gives just about the same
security of opening anonymous read access. With the added bonus that
changing the proxyuser password poses a risk of breaking things.
since the info exposed to NSS is no big secret we can cope with it, but
i prefer leaving nss to anonymous binds and adding on ldap server (at
the end of access control)
access to dn.subtree="dc=mageia,dc=org"
attrs=@<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">posixAccount, at posixGroup</A><A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">, at ipService</A><A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">, at ipProtocol</A><A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">, at ipHost</A><A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">, at ipNetwork</A><A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">, at oncRpc</A><A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">, at nisNetgroup</A>
by peername.ip="127.0.0.1" read
by peername.ip="x.y.w.z" read
by * none
--
Luca Berra -- <A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">bluca at vodka.it</A>
</PRE>
<!--endarticle-->
<HR>
<P><UL>
<!--threads-->
<LI>Previous message: <A HREF="000809.html">[Mageia-sysadm] [377] - add nssldap password handling
</A></li>
<LI>Next message: <A HREF="000830.html">[Mageia-sysadm] [377] - add nssldap password handling
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#823">[ date ]</a>
<a href="thread.html#823">[ thread ]</a>
<a href="subject.html#823">[ subject ]</a>
<a href="author.html#823">[ author ]</a>
</LI>
</UL>
<hr>
<a href="https://www.mageia.org/mailman/listinfo/mageia-sysadm">More information about the Mageia-sysadm
mailing list</a><br>
</body></html>
|
