[389-users] Re: Bind ACI

On 15 Dec 2021, at 08:22, Gary Waters <gwaters-web(a)caltech.edu&gt; wrote: Hello, I found recently users who dont have modern machines are binding against our 389 machines without tls or ssl. I dont know if what I want is reasonable, but I want people to still be able to do some simple searches anonymously without ssl (I think that it is how some of the pam modules I have seen work, where it searches for the dn, then binds), but when a user binds with an actual user dn I want them to bind with authmethod=ssl. I am worried the users binding without ssl, are revealing their hash to anyone on the network. What do you guys think? Is my worry accurate, and if it is, can you help me articulate the aci's below? aci: (version 3.0; acl "anonymous-read-search"; allow (read,search) userdn="ldap://anyone" ) aci: (version 3.0; acl "force auth-method"; allow (read) authmethod = "ssl") I still want my accounts that have write permissions to be able to write though as well, so should that be (read,write)?. Thanks so much for your advise and help.

Regards, Gary _______________________________________________ 389-users mailing list -- 389-users(a)lists.fedoraproject.org To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure