Beav Petrie wrote:
Sluggers,
Any ways to hide LDAP binddn/passwd so
if I connect as user 'myname' and passwd 'mypass'
(not connecting as 'anonymous') I enter:
$ldapsearch <something>
<something> will not include 'myname'/'mypass'.
I know this command: $ldapsearch -x -D
"uid=myname,ou=people,dc=mydomain,dc=com" \
-w mypass (Don't want to show mypass or enter mypass with a -W option)l
There are a lot of different ldapsearch'es out there, so the
answer will vary with each one. For the time being I'll assume
you are using OpenLDAP.
The obvious, but complex, answer is to use SASL & Kerberos. Then
you just get the tgt once and from then on you're bound to the
server. That's a whole minefield of things that need setting up
so I suggest you google about for it a bit, there is plenty of
documentation.
The next obvious answer is to use -y passwdfile, where passwdfile
contains the password you want to use. That file should be somewhere
where nobody else can find it, and where only you can read it, and
even then I wouldn't trust it.
--
Del
--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
