Topic: LDAP Sme 8b7

[Danysoft]

I want to know if there are any method to disable SSL authentication in ldap for the LAN.
Thank you.

[Daniel B.]

You'll need to create a custom template overriding /etc/e-smith/templates/etc/openldap/slapd.conf/95acls05userPassword. This template looks like this:

Code: [Select]

access to attrs=userPassword
        by self         peername.ip="127.0.0.1" read
        by self         ssf=128 read
        by anonymous    peername.ip="127.0.0.1" auth
        by anonymous    ssf=128 auth
        by *            none

If you want to allow IP 192.168.2.6 to authenticate without SSL nor TLS, you can modify it like this:

Code: [Select]

access to attrs=userPassword
        by self         peername.ip="127.0.0.1" read
        by self         ssf=128 read
        by anonymous    peername.ip="127.0.0.1" auth
        by anonymous    peername.ip="192.168.2.6" auth
        by anonymous    ssf=128 auth
        by *            none

Then, you can apply the change with a signal-event ldap-update

Be aware that doing this is very insecure, as passwords will be sent in clear text, and so I really do not recommand to do this, but instead, to make SSL or TLS working (certificates validation can be a pain sometimes, but it worth it security wise)

Regards, Daniel

[Danysoft]

You'll need to create a custom template overriding /etc/e-smith/templates/etc/openldap/slapd.conf/95acls05userPassword. This template looks like this:

Code: [Select]

access to attrs=userPassword
        by self         peername.ip="127.0.0.1" read
        by self         ssf=128 read
        by anonymous    peername.ip="127.0.0.1" auth
        by anonymous    ssf=128 auth
        by *            none

If you want to allow IP 192.168.2.6 to authenticate without SSL nor TLS, you can modify it like this:

Code: [Select]

access to attrs=userPassword
        by self         peername.ip="127.0.0.1" read
        by self         ssf=128 read
        by anonymous    peername.ip="127.0.0.1" auth
        by anonymous    peername.ip="192.168.2.6" auth
        by anonymous    ssf=128 auth
        by *            none

Then, you can apply the change with a signal-event ldap-update

Be aware that doing this is very insecure, as passwords will be sent in clear text, and so I really do not recommand to do this, but instead, to make SSL or TLS working (certificates validation can be a pain sometimes, but it worth it security wise)

Regards, Daniel

It works!!! Thank you very much!!!