diff options
| author | Oliver Liebel <oliver@itc.li> | 2008-09-08 14:39:54 +1000 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2008-09-08 14:39:54 +1000 |
| commit | b76f383eefe961e8a2f42ac782031e3e09ff7192 (patch) | |
| tree | 61660ccf360213e6e4609b308726b31cfb13c9f2 /source4/setup | |
| parent | a33eaf564fed201994e799c0f724cd41a3848dc5 (diff) | |
| download | samba-b76f383eefe961e8a2f42ac782031e3e09ff7192.tar.gz samba-b76f383eefe961e8a2f42ac782031e3e09ff7192.tar.bz2 samba-b76f383eefe961e8a2f42ac782031e3e09ff7192.zip | |
Use DIGEST-MD5 authentication for OpenLDAP replication
This avoids passing rootdn passwords or replicated data in cleartext
across the network.
Signed-of-by: Andrew Bartlett <abartlet@samba.org>
(This used to be commit 67373c143a1d8a9f310fd116dbf81c1dd123b75f)
Diffstat (limited to 'source4/setup')
| -rw-r--r-- | source4/setup/cn=replicator.ldif | 12 | ||||
| -rw-r--r-- | source4/setup/mmr_syncrepl.conf | 5 | ||||
| -rw-r--r-- | source4/setup/slapd.conf | 8 |
3 files changed, 19 insertions, 6 deletions
diff --git a/source4/setup/cn=replicator.ldif b/source4/setup/cn=replicator.ldif new file mode 100644 index 0000000000..e7c5a2408c --- /dev/null +++ b/source4/setup/cn=replicator.ldif @@ -0,0 +1,12 @@ +dn: cn=replicator +objectClass: top +objectClass: person +cn: replicator +userPassword:: ${LDAPADMINPASS_B64} +structuralObjectClass: person +entryUUID: ${UUID} +creatorsName: +createTimestamp: ${LDAPTIME} +entryCSN: 20080714010529.241039Z#000000#000#000000 +modifiersName: +modifyTimestamp: ${LDAPTIME} diff --git a/source4/setup/mmr_syncrepl.conf b/source4/setup/mmr_syncrepl.conf index 3a207b2d13..1373858c4e 100644 --- a/source4/setup/mmr_syncrepl.conf +++ b/source4/setup/mmr_syncrepl.conf @@ -5,7 +5,8 @@ syncrepl rid=${RID} searchbase="${MMRDN}" type=refreshAndPersist retry="10 +" - bindmethod=simple - binddn="CN=Manager,${MMRDN}" + bindmethod=sasl + saslmech=DIGEST-MD5 + authcid="replicator" credentials="${MMR_PASSWORD}" diff --git a/source4/setup/slapd.conf b/source4/setup/slapd.conf index 141c0cd27a..b64d581e0d 100644 --- a/source4/setup/slapd.conf +++ b/source4/setup/slapd.conf @@ -1,5 +1,8 @@ loglevel 0 +### needed for initial content load ### +sizelimit unlimited + ### Multimaster-ServerIDs and URLs ### ${MMR_SERVERIDS_CONFIG} @@ -36,7 +39,7 @@ access to dn.subtree="cn=samba" by anonymous auth access to dn.subtree="${DOMAINDN}" - by dn=cn=samba-admin,cn=samba manage + by dn=cn=samba-admin,cn=samba manage${REPLICATOR_ACL} by dn=cn=manager manage by * none @@ -62,7 +65,6 @@ rootdn cn=Manager,cn=Samba database hdb suffix ${SCHEMADN} rootdn cn=Manager,${SCHEMADN} -rootpw "${MMR_PASSWORD}" directory ${LDAPDIR}/db/schema index objectClass eq index samAccountName eq @@ -89,7 +91,6 @@ ${MIRRORMODE} database hdb suffix ${CONFIGDN} rootdn cn=Manager,${CONFIGDN} -rootpw "${MMR_PASSWORD}" directory ${LDAPDIR}/db/config index objectClass eq index samAccountName eq @@ -118,7 +119,6 @@ ${MIRRORMODE} database hdb suffix ${DOMAINDN} rootdn cn=Manager,${DOMAINDN} -rootpw "${MMR_PASSWORD}" directory ${LDAPDIR}/db/user index objectClass eq index samAccountName eq |