Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm using the Debian Squeeze OpenLDAP. Where can I set ACLs? Isn't it possible to execute the access to directives with ldapmodify? There's no slapd.conf file in Debian, they use a slapd.d folder

share|improve this question
add comment

migrated from stackoverflow.com Apr 18 '11 at 10:28

This question came from our site for professional and enthusiast programmers.

3 Answers

Procedure is very similar to procedure of changing password that I described in another question.

There are also two ways.

1) Editing config file. You need to find config file of your backend. Each ACL is defined as value of olcAccess attribute. Syntax of ACL is identical as in "normal" slapd.conf file, but at the beginning of each ACL you must insert number that define "position" of ACL in ACL queue to check.

Example ACL entry looks like that:

olcAccess: {0}to * by anonymous write

2) Second way: using config database. If config database is enabled you could biind to it using LDAP client and edit olcAccess values for each backend.

share|improve this answer
add comment

I'm not saying this is a solution but it might help you on your way :-)

I asked a similar question of serverfault.

http://serverfault.com/questions/246252/openldap-rhel-6

I never got an answer , in the end I had to create a slapd.conf and convert it to the slapd dir using the following commands ( note this was on RHEL)

Remove the contents of the /etc/openldap/slapd.d/ directory:

rm -rf /etc/openldap/slapd.d/* 

Edit your custom slapd.conf file.

Run slaptest to check the validity of the configuration file and create a new slapd.d directory with your settings

slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d 

Configure permissions on the new directory so ldap doesnt moan.

chown -R ldap:ldap /etc/openldap/slapd.d 

chmod -R 000 /etc/openldap/slapd.d 

chmod -R u+rwX /etc/openldap/slapd.d 

the start up your LDAP server.

I created a small script to run these commands every time I made a change to slapd.conf

Regards Andy

share|improve this answer
add comment

The entire contents of slapd.d is concatenated together at runtime to generate a sort of pseudo slapd.conf file (that description isn't entirely exactly accurate, but I'm more trying to get the concept across). This is a common practice in Debian, and personally in many cases I highly prefer it.

Create a new file inside of slapd.d named acl (or similar, you will want to include a numbered prefix if other files have it) and put your ACL entries in there then restart slapd.

That should do it.* But be warned, that slapd's ACL structure can be difficult for the uninitiated. It's easy to do the wrong and/or unintended thing.

*Provided there aren't any sequence limitations (I don't know slapd that well, so you're on your own for that).

share|improve this answer
    
This is completely false for OpenLDAP. slapd.d is an ldif file based ldap database. –  Jeff Strunk Jun 14 '12 at 22:41
    
@JeffStrunk Ah yes, that's different than I had expected :-( –  bahamat Jun 14 '12 at 22:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.