I'm using TLS but would like to force clients to connect using TLS sans the
loopback device or LDAP server itself.
I found this post from 2006 which suggests the following.
It doesn't work for me:
# first, make sure TLS or localhost
access to *
by tls_ssf=1 none break
by peername.ip="127.0.0.1" none break
by * none
# "real" ACL(s) go here, something like
access to *
by self write
by users read
by anonymous auth
My current real ACLS'
10.3.5.205 is the IP address of the system on the loopback interface.
These settings still allow any system to connect without using TLS.
If I change the line in the last ACL to "by users read" bthen i can't connect
on the loopback anymore.. What am I doing wrong?
access to *
by tls_ssf=1 none break
by peername.ip="127.0.0.1" none break
by peername.ip="10.3.5.205" none break
by * none
access to dn.children="ou=people,dc=test,dc=lott"
attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowMax
by self write
by * auth break
access to dn.children="ou=people,dc=test,dc=lott"
attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowLastChange,sambaPwdMustChange,sambaPwdLastSet,pwdReset,pwdChangedTime,pwdPolicySubentry,shadowMax,mail,pwdAc
countLockedTime,sambaKickoffTime,shadowExpire,shadowWarning,shadowFlag,sambaAcctFlags,sambaPasswordHistory,mail,givenName
by dn.base="cn=root,dc=txcat,dc=lott" write
by group.base="cn=infrastructure,ou=test,ou=groups,dc=test,dc=lott"
write
by dn.base="uid=ldapmgr,ou=people,dc=test,dc=lott" write
by * read
access to dn.exact="cn=admins,ou=SUDOers,dc=test,dc=lott"
attrs=sudoUser
by dn.base="cn=root,dc=test,dc=lott" write
by group.base="cn=infrastructure,ou=test,ou=groups,dc=test,dc=lott"
write
by * read
access to dn.subtree="ou=SUDOers,dc=test,dc=lott"
attrs=sudoUser,sudoCommand,sudoHost,sudoOption
by dn.base="cn=root,dc=test,dc=lott" write
by group.base="cn=infrastructure,ou=test,ou=groups,dc=test,dc=lott"
write
by * read
access to *
by dn.base="cn=root,dc=test,dc=lott" write
by group.base="cn=infrastructure,ou=test,ou=groups,dc=test,dc=lott" read
by group.base="cn=operations,ou=test,ou=groups,dc=test,dc=lott" read
by dn.base="uid=ldapmgr,ou=people,dc=test,dc=lott" read
by * read
