Re: ACL Assistance

["Joshua M. Miller" <joshua@itsecureadmin.com>]

N/m, I figured it out.  I had mis-typed users:

access to attrs=userPassword
  by self write
  by anonymous auth
  by * none
access to *
  by self write
  by * read

Thanks,
--
Joshua M. Miller - RHCE,VCP


Joshua M. Miller wrote:
> I'm running OpenLDAP 2.3.34 and am having trouble figuring out the ACLs. 
>  I have the following:
>
> access  to attr=userPassword
>         by self         write
>         by anonymous    auth
>         by *            none
> access  to *
>         by self         write
>         by *            read
>
> My intention is to allow everything but the userPassword attribute to be 
> available to all users and have the userPassword attribute be available 
> for authentication and password changes by each user (but only for each 
> user).
>
> The problem with the above ACL is that I am able to read all user's 
> password hashes through an authenticated bind.  What am I doing wrong?
>
> Thanks,