On 18 Apr 2020, at 00:41, Johannes Kastl <kastl(a)b1-systems.de>
wrote:
Hi all,
while setting up my demo server I found that I am completely lacking knowledge
in that respect.
I found those two and will work through them.
https://directory.fedoraproject.org/docs/389ds/howto/howto-accesscontrol....
https://access.redhat.com/documentation/en-us/red_hat_directory_server/9....
Are there any other good tutorials or best practices on how to secure a 389
server? Restrict the bind_DN that sssd uses? Restricting people to read all
contents of the LDAP tree?
The default acis are a good place:
https://pagure.io/389-ds-base/blob/master/f/src/lib389/lib389/configurati...
I wrote most of these, to have "best practice" in them.
https://access.redhat.com/documentation/en-us/red_hat_directory_server/11...
Is very expansive, and you want the latest 10/11 version, as a lot of work was put in to
improve the aci demos
I think there is an aci checker in the healthcheck, but it looks like it's not wired
in anymore (probably should open a bug for that ...)
Finally, here are two (now old, but still relevant) blog posts from me about aci's and
some of the traps when I was working at UofA
https://fy.blackhats.net.au/blog/html/2016/05/25/acis_for_group_creation_...
https://fy.blackhats.net.au/blog/html/2015/07/04/Unit_testing_LDAP_acis_f...
My general advice is be specific with attributes, never use !=, anonymous read over the
tree is fine for sssd needed attributes like uid etc (just keep personal info private
etc).
https://fy.blackhats.net.au/blog/html/2018/04/18/making_samba_4_the_defau...
This has an explainer of why anonymous bind is okay.
Hope that helps, sorry it's a lot of content! If you want help with your ACI's
post them here and I'll review them.
Kind Regards,
Johannes
--
Johannes Kastl
Linux Consultant & Trainer
Tel.: +49 (0) 151 2372 5802
Mail: kastl(a)b1-systems.de
B1 Systems GmbH
Osterfeldstraße 7 / 85088 Vohburg
http://www.b1-systems.de
GF: Ralph Dehner
Unternehmenssitz: Vohburg / AG: Ingolstadt,HRB 3537
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
—
Sincerely,
William Brown
Senior Software Engineer, 389 Directory Server
SUSE Labs