Ideal way to restrict querying of sudoers ldap configuration by anonymous users

Question

I configured sudoers ldap (with openldap as backend LDAP) using the instruction provided from the official sudoers website. (link)

Also restricted /etc/sudo-ldap.conf with 600 root:root permissions so that the normal users in the machine won't be able to know the LDAP server to which they are talking.

But the ldap server at the moment allow anonymous access connections to everything including sudoers OU. Is it possible in anyway to restrict the sudoers OU (say ou=sudoers,dc=example,dc=com) on the ldap server to a specific user and keep rest of the ldap structure for anonymous access ? (I couldn't figure out a proper way to do with access control)

Configuration details:

slapd.conf:

access to dn.subtree="dc=example,dc=com"
        by * read

sudo-ldap.conf:

uri ldap://LDAP_SERVER
sudoers_base ou=sudoers,dc=example,dc=com

Let me know if you need further details.

Answer 1

I figured out the right approach:

• Create a new user in LDAP say cn=sudoread,dc=example,dc=com

cat > /tmp/tmplif <<EOF
dn: cn=sudoread,dc=example,dc=com
objectClass: top
objectClass: person
cn: sudoread
sn: read
userPassword: sudoread
EOF
$ ldapadd -H ldap://localhost -f /tmp/tmplif -D 'cn=root,dc=example,dc=com' -W
$ printf "sudoread" | base64
c3Vkb3JlYWQ=

• Grant access to ou=sudoers,dc=example,dc=com for the above created user before granting all access.

access to dn.one="ou=sudoers,dc=example,dc=com"
        by dn="cn=sudoread,dc=example,dc=com" read
access to *
        by * read

• Use binddn and bindpw parameters in sudo-ldap.conf:

$ cat >> /etc/sudo-ldap.conf <<EOF
binddn cn=sudoread,dc=example,dc=com
bindpw base64:c3Vkb3JlYWQ=
EOF

This would create a user which can be used for querying the ldap and keeping the rest of the LDAP access to everything.