[Mageia-sysadm] [377] - add nssldap password handling

[Buchan Milne]

On Wednesday, 24 November 2010 21:04:51 Guillaume Rousse wrote:
> Le 22/11/2010 12:56, Buchan Milne a écrit :
> > I would prefer if we can instead use:
> > -"rootbinddn" in /etc/ldap.conf, not binddn
> > -place password in /etc/ldap.secret
> > -use nscd, so all LDAP access is as root (so, no need to expose passwords
> > in files that must be world-readable), as a side-effect also avoiding
> > problems with file descriptors used by any process doing a user lookup
> > etc.
> > 
> > Permissions on /etc/ldap.conf should be 0644, /etc/ldap.secret can be
> > 0600.
> 
> Even better, give ldap write access to individual admin accounts,

This is already the case:

dn: cn=LDAP Admins,ou=System Groups,dc=mageia,dc=org
cn: LDAP Admins
objectClass: groupOfNames
description: Members can administer all parts of the Directory
owner: uid=LDAP Admin,ou=System Accounts,dc=mageia,dc=org
member: uid=LDAP Admin,ou=System Accounts,dc=mageia,dc=org
member: uid=boklm,ou=People,dc=mageia,dc=org
member: uid=buchan,ou=People,dc=mageia,dc=org
member: uid=colin,ou=People,dc=mageia,dc=org
member: uid=dmorgan,ou=People,dc=mageia,dc=org
member: uid=misc,ou=People,dc=mageia,dc=org
member: uid=nanardon,ou=People,dc=mageia,dc=org
member: uid=rda,ou=People,dc=mageia,dc=org
member: uid=tmb,ou=People,dc=mageia,dc=org

> and
> not to root user.

There is no rootpw, and there is no entry for the rootdn. I know the password 
of uid=LDAP Admin, and I used it only until the point where my DN was a member 
of LDAP admins.

> No need to store any password, and you keep track of
> who's doing what.

But, you seem to be inferring that the 'rootbinddn' in ldap.conf is a rootdn 
in the directory, or has any write privileges. This is not the case. It is 
purely a DN with sufficient privileges to search for posixAccounts and 
posixGroups so that we can prevent all anonymous access:

[root at valstar ~]# ldapsearch -LL  -xZZ -b dc=mageia,dc=org
version: 1

No such object (32)
[root at valstar ~]#

Regards,
Buchan