<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 16/11/2016 16:46,
<a class="moz-txt-link-abbreviated" href="mailto:Dan.Finkelstein@high5games.com">Dan.Finkelstein@high5games.com</a> wrote:<br>
</div>
<blockquote
cite="mid:%3C8F863F5E-1F26-49F5-AA81-FD12FCEFF395@high5games.com%3E"
type="cite"><span style="font-size:11.0pt">I've seen some
discussion in the (distant) past about disabling anonymous binds
to the LDAP component of IPA, and I'm wondering if there's a
preferred method to do it. Further, are there any known problems
with disabling anonymous binds when using FreeIPA? The only
modern documentation I can find is here:
<a moz-do-not-send="true"
href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/disabling-anon-binds.html">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/disabling-anon-binds.html</a>,
and I'm curious if FreeIPA has a different way.</span></blockquote>
<p>FWIW, I see the same here. Installed ipa-server under CentOS 7
(which gave me freeipa 4.2.0), and found anonymous binds allowed:
tested by "ldapsearch -x ..."</p>
<p>I was able to disable anonymous bind (and also disable
unencrypted queries) by changing the cn=config entry:<br>
</p>
<p>
<meta charset="utf-8">
<meta charset="utf-8">
</p>
<div class="line number2 index1 alt1" style="margin: 0px; padding:
0px 1em 0px 0px; border-radius: 0px; background: 0px center
rgb(255, 255, 255); border: 0px; bottom: auto; float: none;
height: auto; left: auto; line-height: 20px; outline: 0px;
overflow: visible; position: static; right: auto; text-align:
left; top: auto; vertical-align: baseline; width: auto;
box-sizing: content-box; font-family: Consolas, "Bitstream
Vera Sans Mono", "Courier New", Courier, monospace;
font-weight: normal; font-style: normal; font-size: 14px;
min-height: inherit; white-space: nowrap; color: rgb(51, 51, 51);
font-variant-ligatures: normal; font-variant-caps: normal;
letter-spacing: normal; orphans: 2; text-indent: 0px;
text-transform: none; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px;"><code class="bash plain"
style="font-family: Consolas, "Bitstream Vera Sans
Mono", "Courier New", Courier, monospace;
border-radius: 0px; background: 0px center; border: 0px; bottom:
auto; float: none; height: auto; left: auto; line-height: 20px;
margin: 0px; outline: 0px; overflow: visible; padding: 0px;
position: static; right: auto; text-align: left; top: auto;
vertical-align: baseline; width: auto; box-sizing: content-box;
font-weight: normal; font-style: normal; font-size: 14px;
min-height: inherit; color: rgb(0, 0, 0) !important;">dn:
cn=config</code></div>
<div class="line number3 index2 alt2" style="margin: 0px; padding:
0px 1em 0px 0px; border-radius: 0px; background: 0px center
rgb(255, 255, 255); border: 0px; bottom: auto; float: none;
height: auto; left: auto; line-height: 20px; outline: 0px;
overflow: visible; position: static; right: auto; text-align:
left; top: auto; vertical-align: baseline; width: auto;
box-sizing: content-box; font-family: Consolas, "Bitstream
Vera Sans Mono", "Courier New", Courier, monospace;
font-weight: normal; font-style: normal; font-size: 14px;
min-height: inherit; white-space: nowrap; color: rgb(51, 51, 51);
font-variant-ligatures: normal; font-variant-caps: normal;
letter-spacing: normal; orphans: 2; text-indent: 0px;
text-transform: none; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px;"><code class="bash plain"
style="font-family: Consolas, "Bitstream Vera Sans
Mono", "Courier New", Courier, monospace;
border-radius: 0px; background: 0px center; border: 0px; bottom:
auto; float: none; height: auto; left: auto; line-height: 20px;
margin: 0px; outline: 0px; overflow: visible; padding: 0px;
position: static; right: auto; text-align: left; top: auto;
vertical-align: baseline; width: auto; box-sizing: content-box;
font-weight: normal; font-style: normal; font-size: 14px;
min-height: inherit; color: rgb(0, 0, 0) !important;">changetype:
modify</code></div>
<div class="line number4 index3 alt1" style="margin: 0px; padding:
0px 1em 0px 0px; border-radius: 0px; background: 0px center
rgb(255, 255, 255); border: 0px; bottom: auto; float: none;
height: auto; left: auto; line-height: 20px; outline: 0px;
overflow: visible; position: static; right: auto; text-align:
left; top: auto; vertical-align: baseline; width: auto;
box-sizing: content-box; font-family: Consolas, "Bitstream
Vera Sans Mono", "Courier New", Courier, monospace;
font-weight: normal; font-style: normal; font-size: 14px;
min-height: inherit; white-space: nowrap; color: rgb(51, 51, 51);
font-variant-ligatures: normal; font-variant-caps: normal;
letter-spacing: normal; orphans: 2; text-indent: 0px;
text-transform: none; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px;"><code class="bash plain"
style="font-family: Consolas, "Bitstream Vera Sans
Mono", "Courier New", Courier, monospace;
border-radius: 0px; background: 0px center; border: 0px; bottom:
auto; float: none; height: auto; left: auto; line-height: 20px;
margin: 0px; outline: 0px; overflow: visible; padding: 0px;
position: static; right: auto; text-align: left; top: auto;
vertical-align: baseline; width: auto; box-sizing: content-box;
font-weight: normal; font-style: normal; font-size: 14px;
min-height: inherit; color: rgb(0, 0, 0) !important;">replace:
nsslapd-allow-anonymous-access</code></div>
<div class="line number5 index4 alt2" style="margin: 0px; padding:
0px 1em 0px 0px; border-radius: 0px; background: 0px center
rgb(255, 255, 255); border: 0px; bottom: auto; float: none;
height: auto; left: auto; line-height: 20px; outline: 0px;
overflow: visible; position: static; right: auto; text-align:
left; top: auto; vertical-align: baseline; width: auto;
box-sizing: content-box; font-family: Consolas, "Bitstream
Vera Sans Mono", "Courier New", Courier, monospace;
font-weight: normal; font-style: normal; font-size: 14px;
min-height: inherit; white-space: nowrap; color: rgb(51, 51, 51);
font-variant-ligatures: normal; font-variant-caps: normal;
letter-spacing: normal; orphans: 2; text-indent: 0px;
text-transform: none; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px;"><code class="bash plain"
style="font-family: Consolas, "Bitstream Vera Sans
Mono", "Courier New", Courier, monospace;
border-radius: 0px; background: 0px center; border: 0px; bottom:
auto; float: none; height: auto; left: auto; line-height: 20px;
margin: 0px; outline: 0px; overflow: visible; padding: 0px;
position: static; right: auto; text-align: left; top: auto;
vertical-align: baseline; width: auto; box-sizing: content-box;
font-weight: normal; font-style: normal; font-size: 14px;
min-height: inherit; color: rgb(0, 0, 0) !important;">nsslapd-allow-anonymous-access:
rootdse</code></div>
<div class="line number6 index5 alt1" style="margin: 0px; padding:
0px 1em 0px 0px; border-radius: 0px; background: 0px center
rgb(255, 255, 255); border: 0px; bottom: auto; float: none;
height: auto; left: auto; line-height: 20px; outline: 0px;
overflow: visible; position: static; right: auto; text-align:
left; top: auto; vertical-align: baseline; width: auto;
box-sizing: content-box; font-family: Consolas, "Bitstream
Vera Sans Mono", "Courier New", Courier, monospace;
font-weight: normal; font-style: normal; font-size: 14px;
min-height: inherit; white-space: nowrap; color: rgb(51, 51, 51);
font-variant-ligatures: normal; font-variant-caps: normal;
letter-spacing: normal; orphans: 2; text-indent: 0px;
text-transform: none; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px;"><code class="bash plain"
style="font-family: Consolas, "Bitstream Vera Sans
Mono", "Courier New", Courier, monospace;
border-radius: 0px; background: 0px center; border: 0px; bottom:
auto; float: none; height: auto; left: auto; line-height: 20px;
margin: 0px; outline: 0px; overflow: visible; padding: 0px;
position: static; right: auto; text-align: left; top: auto;
vertical-align: baseline; width: auto; box-sizing: content-box;
font-weight: normal; font-style: normal; font-size: 14px;
min-height: inherit; color: rgb(0, 0, 0) !important;">-</code></div>
<div class="line number7 index6 alt2" style="margin: 0px; padding:
0px 1em 0px 0px; border-radius: 0px; background: 0px center
rgb(255, 255, 255); border: 0px; bottom: auto; float: none;
height: auto; left: auto; line-height: 20px; outline: 0px;
overflow: visible; position: static; right: auto; text-align:
left; top: auto; vertical-align: baseline; width: auto;
box-sizing: content-box; font-family: Consolas, "Bitstream
Vera Sans Mono", "Courier New", Courier, monospace;
font-weight: normal; font-style: normal; font-size: 14px;
min-height: inherit; white-space: nowrap; color: rgb(51, 51, 51);
font-variant-ligatures: normal; font-variant-caps: normal;
letter-spacing: normal; orphans: 2; text-indent: 0px;
text-transform: none; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px;"><code class="bash plain"
style="font-family: Consolas, "Bitstream Vera Sans
Mono", "Courier New", Courier, monospace;
border-radius: 0px; background: 0px center; border: 0px; bottom:
auto; float: none; height: auto; left: auto; line-height: 20px;
margin: 0px; outline: 0px; overflow: visible; padding: 0px;
position: static; right: auto; text-align: left; top: auto;
vertical-align: baseline; width: auto; box-sizing: content-box;
font-weight: normal; font-style: normal; font-size: 14px;
min-height: inherit; color: rgb(0, 0, 0) !important;">replace:
nsslapd-minssf</code></div>
<div class="line number8 index7 alt1" style="margin: 0px; padding:
0px 1em 0px 0px; border-radius: 0px; background: 0px center
rgb(255, 255, 255); border: 0px; bottom: auto; float: none;
height: auto; left: auto; line-height: 20px; outline: 0px;
overflow: visible; position: static; right: auto; text-align:
left; top: auto; vertical-align: baseline; width: auto;
box-sizing: content-box; font-family: Consolas, "Bitstream
Vera Sans Mono", "Courier New", Courier, monospace;
font-weight: normal; font-style: normal; font-size: 14px;
min-height: inherit; white-space: nowrap; color: rgb(51, 51, 51);
font-variant-ligatures: normal; font-variant-caps: normal;
letter-spacing: normal; orphans: 2; text-indent: 0px;
text-transform: none; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px;"><code class="bash plain"
style="font-family: Consolas, "Bitstream Vera Sans
Mono", "Courier New", Courier, monospace;
border-radius: 0px; background: 0px center; border: 0px; bottom:
auto; float: none; height: auto; left: auto; line-height: 20px;
margin: 0px; outline: 0px; overflow: visible; padding: 0px;
position: static; right: auto; text-align: left; top: auto;
vertical-align: baseline; width: auto; box-sizing: content-box;
font-weight: normal; font-style: normal; font-size: 14px;
min-height: inherit; color: rgb(0, 0, 0) !important;">nsslapd-minssf:
56</code></div>
<br>
I don't think this replicated from master to slave though, and I
ended up doing it on slaves as well.<br>
<br>
If there is an "official" way to disable anon bind on FreeIPA 4.x, I
would like to know it.<br>
<br>
Thanks,<br>
<br>
Brian.<br>
</body>
</html>