> On 15 Dec 2021, at 08:22, Gary Waters <email@example.com> wrote:
> I found recently users who dont have modern machines are binding against our 389 machines without tls or ssl. I dont know if what I want is reasonable, but I want people to still be able to do some simple searches anonymously without ssl (I think that it is how some of the pam modules I have seen work, where it searches for the dn, then binds), but when a user binds with an actual user dn I want them to bind with authmethod=ssl. I am worried the users binding without ssl, are revealing their hash to anyone on the network.
> What do you guys think? Is my worry accurate, and if it is, can you help me articulate the aci's below?
> aci: (version 3.0; acl "anonymous-read-search"; allow (read,search) userdn="ldap://anyone" )
> aci: (version 3.0; acl "force auth-method"; allow (read) authmethod = "ssl")
> I still want my accounts that have write permissions to be able to write though as well, so should that be (read,write)?.
> Thanks so much for your advise and help.
There is a setting in cn=config for this,
As well, you can only use LDAPS. StartTLS it's still possible to leak data. See:
> 389-users mailing list -- firstname.lastname@example.org
> To unsubscribe send an email to email@example.com
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://firstname.lastname@example.org
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
Senior Software Engineer, Identity and Access Management
SUSE Labs, Australia
389-users mailing list -- email@example.com
To unsubscribe send an email to firstname.lastname@example.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://email@example.com
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure