From 1be510f9529cb082f802408b472a77d074b394c0 Mon Sep 17 00:00:00 2001 From: Nicolas Vigier Date: Sun, 14 Apr 2013 13:46:12 +0000 Subject: Add zarb MLs html archives --- zarb-ml/mageia-sysadm/2010-November/000944.html | 110 ++++++++++++++++++++++++ 1 file changed, 110 insertions(+) create mode 100644 zarb-ml/mageia-sysadm/2010-November/000944.html (limited to 'zarb-ml/mageia-sysadm/2010-November/000944.html') diff --git a/zarb-ml/mageia-sysadm/2010-November/000944.html b/zarb-ml/mageia-sysadm/2010-November/000944.html new file mode 100644 index 000000000..641b5a392 --- /dev/null +++ b/zarb-ml/mageia-sysadm/2010-November/000944.html @@ -0,0 +1,110 @@ + + + + [Mageia-sysadm] [377] - add nssldap password handling + + + + + + + + + +

[Mageia-sysadm] [377] - add nssldap password handling

+ Buchan Milne + bgmilne at multilinks.com +
+ Thu Nov 25 13:04:23 CET 2010 +

+
+ +
On Wednesday, 24 November 2010 21:04:51 Guillaume Rousse wrote:
+> Le 22/11/2010 12:56, Buchan Milne a écrit :
+> > I would prefer if we can instead use:
+> > -"rootbinddn" in /etc/ldap.conf, not binddn
+> > -place password in /etc/ldap.secret
+> > -use nscd, so all LDAP access is as root (so, no need to expose passwords
+> > in files that must be world-readable), as a side-effect also avoiding
+> > problems with file descriptors used by any process doing a user lookup
+> > etc.
+> > 
+> > Permissions on /etc/ldap.conf should be 0644, /etc/ldap.secret can be
+> > 0600.
+> 
+> Even better, give ldap write access to individual admin accounts,
+
+This is already the case:
+
+dn: cn=LDAP Admins,ou=System Groups,dc=mageia,dc=org
+cn: LDAP Admins
+objectClass: groupOfNames
+description: Members can administer all parts of the Directory
+owner: uid=LDAP Admin,ou=System Accounts,dc=mageia,dc=org
+member: uid=LDAP Admin,ou=System Accounts,dc=mageia,dc=org
+member: uid=boklm,ou=People,dc=mageia,dc=org
+member: uid=buchan,ou=People,dc=mageia,dc=org
+member: uid=colin,ou=People,dc=mageia,dc=org
+member: uid=dmorgan,ou=People,dc=mageia,dc=org
+member: uid=misc,ou=People,dc=mageia,dc=org
+member: uid=nanardon,ou=People,dc=mageia,dc=org
+member: uid=rda,ou=People,dc=mageia,dc=org
+member: uid=tmb,ou=People,dc=mageia,dc=org
+
+> and
+> not to root user.
+
+There is no rootpw, and there is no entry for the rootdn. I know the password 
+of uid=LDAP Admin, and I used it only until the point where my DN was a member 
+of LDAP admins.
+
+> No need to store any password, and you keep track of
+> who's doing what.
+
+But, you seem to be inferring that the 'rootbinddn' in ldap.conf is a rootdn 
+in the directory, or has any write privileges. This is not the case. It is 
+purely a DN with sufficient privileges to search for posixAccounts and 
+posixGroups so that we can prevent all anonymous access:
+
+[root at valstar ~]# ldapsearch -LL  -xZZ -b dc=mageia,dc=org
+version: 1
+
+No such object (32)
+[root at valstar ~]#
+
+Regards,
+Buchan
+
+ + +
+

+ +
+More information about the Mageia-sysadm +mailing list
+ -- cgit v1.2.1