[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: (ITS#4035) rootdn incorrect in cn=config backend/database



This is a multi-part message in MIME format.
--------------090007030100010708080707
Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: 7bit

2.3.9: Agreed with Andreas, only I can actually change any cn=config
hierarchy attribute, even though i get the "insufficient access" denial.

Compile and access details attached.

--Tonni


-- 
Mail: tonye@billy.demon.nl
http://www.billy.demon.nl


--------------090007030100010708080707
Content-Type: text/plain;
 name="do-conf"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="do-conf"

CFLAGS="-O -g" \
        ./configure \
        --with-tls \
        --with-cyrus-sasl \
	--enable-accesslog \
	--enable-denyop \
	--enable-dyngroup \
	--enable-dynlist \
	--enable-lastmod \
	--enable-ppolicy \
	--enable-proxycache \
	--enable-refint \
	--enable-retcode \
	--enable-rwm \
	--enable-syncprov \
	--enable-translucent \
	--enable-unique \
	--enable-valsort \
	--enable-spasswd \
	--enable-ldap

make depend && make


--------------090007030100010708080707
Content-Type: text/plain;
 name="slapd.access"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="slapd.access"

# Sample access control policy:
#	Root DSE: allow anyone to read it
#	Subschema (sub)entry DSE: allow anyone to read it
#	Other DSEs:
#		Allow self write access
#		Allow authenticated users read access
#		Allow anonymous users to authenticate
#	Directives needed to implement policy:

# Subtypes of "name" (e.g. "cn" and "ou") with the
# option ";x-hidden" can be searched for/compared,
# but are not shown.  See slapd.access(5).

#attributeoptions x-hidden lang-
#access to attr=name;x-hidden by * search

access to dn.base=""
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by peername.ip=127.0.0.1 read
  by peername.ip=192.168.0.2 read
  by peername.ip=192.168.0.3 read
  by sockurl.regex="^ldapi://.*$" read
  by * none

access to dn.base="cn=Subschema"
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by * read

access to dn.base="cn=config"
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by * read

access to dn.subtree="cn=config"
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by * read

access to dn.subtree="cn=monitor"
  by dn.exact=cn=admin,dc=billy,dc=demon,dc=nl write
  by * read

access to dn.base="cn=Subschema"
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by peername.ip=127.0.0.1 read
  by peername.ip=192.168.0.2 read
  by peername.ip=192.168.0.3 read
  by sockurl.regex="^ldapi://.*$" read
  by * read

access to dn.subtree=dc=billy,dc=demon,dc=nl 
  attr=userPassword,sambaLMPassword,sambaNTPassword
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by group=cn=peoplemanagers,ou=groups,dc=billy,dc=demon,dc=nl write
  by self read
  by * auth
  by * none

# If the last attribute isn't search, SASL proxy auth is not possible
access to dn.subtree=cn=admin,dc=billy,dc=demon,dc=nl
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by anonymous search

access to dn.subtree=dc=billy,dc=demon,dc=nl
  attrs=AuthzTo
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by group=cn=peoplemanagers,ou=groups,dc=billy,dc=demon,dc=nl write
  by * read

access to dn=cn=privileged,ou=mailaliases,ou=groups,dc=billy,dc=demon,dc=nl
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by group=cn=peoplemanagers,ou=groups,dc=billy,dc=demon,dc=nl write
  by * none

access to dn=cn=peoplemanagers,ou=groups,dc=billy,dc=demon,dc=nl
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by group=cn=peoplemanagers,ou=groups,dc=billy,dc=demon,dc=nl write
  by * read

access to dn=cn=people,ou=groups,dc=billy,dc=demon,dc=nl
  attrs=objectclass,entry
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by group=cn=peoplemanagers,ou=groups,dc=billy,dc=demon,dc=nl write
  by peername.ip=127.0.0.1 read
  by peername.ip=192.168.0.2 read
  by peername.ip=192.168.0.3 read
  by sockurl.regex="^ldapi://.*$" read

access to dn.subtree=cn=people,ou=groups,dc=billy,dc=demon,dc=nl
  attrs=objectclass,entry
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by group=cn=peoplemanagers,ou=groups,dc=billy,dc=demon,dc=nl write
  by peername.ip=127.0.0.1 read
  by peername.ip=192.168.0.2 read
  by peername.ip=192.168.0.3 read
  by sockurl.regex="^ldapi://.*$" read
  by * none

access to dn.subtree=cn=people,ou=groups,dc=billy,dc=demon,dc=nl
  attrs=homePostalAddress,homePhone,mobile,mailHost,destinationIndicator
  by self write
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by group=cn=peoplemanagers,ou=groups,dc=billy,dc=demon,dc=nl write
  by dn.subtree=cn=people,ou=groups,dc=billy,dc=demon,dc=nl read
  by * none

access to dn.subtree=cn=people,ou=groups,dc=billy,dc=demon,dc=nl
  attrs=accountstatus,confirmtext,maildrop,mailbox,mailMessageStore
  attrs=shadowLastChange,shadowMin,shadowMax,shadowWarning,shadowInactive,shadowFlag,shadowExpire
  attrs=sambaPwdCanChange,sambaPwdMustChange,sambaAcctFlags,sambaPwdLastSet
  attrs=sambaSID,sambaPrimaryGroupSID,sambaPasswordHistory,sambaKickoffTime
  attrs=sambaLogonHours,sambaLogonScript
  attrs=quota
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by group=cn=peoplemanagers,ou=groups,dc=billy,dc=demon,dc=nl write
  by * none

access to dn=cn=people,ou=groups,dc=billy,dc=demon,dc=nl
  attrs=children
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by group=cn=peoplemanagers,ou=groups,dc=billy,dc=demon,dc=nl write
  by peername.ip=127.0.0.1 read
  by peername.ip=192.168.0.2 read
  by peername.ip=192.168.0.3 read
  by sockurl.regex="^ldapi://.*$" read

access to dn=ou=contacts,dc=billy,dc=demon,dc=nl
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by group=cn=peoplemanagers,ou=groups,dc=billy,dc=demon,dc=nl write
  by * read

access to dn=ou=contacts,dc=billy,dc=demon,dc=nl
  attrs=children
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by group=cn=peoplemanagers,ou=groups,dc=billy,dc=demon,dc=nl write
  by * read

access to dn.subtree=ou=mailaliases,ou=groups,dc=billy,dc=demon,dc=nl
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by group=cn=peoplemanagers,ou=groups,dc=billy,dc=demon,dc=nl write
  by peername.ip=127.0.0.1 read
  by peername.ip=192.168.0.2 read
  by peername.ip=192.168.0.3 read
  by sockurl.regex="^ldapi://.*$" read
  by * none

access to dn.subtree=dc=billy,dc=demon,dc=nl
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by peername.ip=127.0.0.1 read
  by peername.ip=192.168.0.2 read
  by peername.ip=192.168.0.3 read
  by sockurl.regex="^ldapi://.*$" read

# Samba 3

access to dn=ou=smb,dc=billy,dc=demon,dc=nl
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by dn=uid=root,ou=smb,dc=billy,dc=demon,dc=nl write
  by self read

access to dn=ou=users,ou=smb,dc=billy,dc=demon,dc=nl
  by dn=cn=admin,dc=billy,dc=demon,dc=nl write
  by dn=uid=root,ou=smb,dc=billy,dc=demon,dc=nl write
  by self write

# if no access controls are present, the default policy is:
#	Allow read by all
#
# rootdn can always write!



--------------090007030100010708080707--