How to correctly ldapmodify replace olcAccess lines?
24,117
This ldif worked for me, with previous command
dn: olcDatabase{1}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange
by dn="cn=admin,dc=somesite,dc=com" write
by dn="uid=anotheruser,ou=Users,dc=somesite,dc=com" write
by anonymous auth
by self write
by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to *
by self write
by dn="cn=admin,dc=somesite,dc=com" write
by dn="cn=anotheruser,ou=Users,dc=somesite,dc=com" write
by * read
Related videos on Youtube
Author by
Terence
Updated on September 18, 2022Comments
-
Terence almost 2 years
This is a part from olcDatabase={1}hdb.ldif
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=somesite,dc=com" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,dc=somesite,dc=com" write by * read
I would like to append
by dn="cn=anotheruser,ou=Users,dc=somesite,dc=com" write
to the{0}
and{2}
line.Before I destroy my LDAP server, is the following LDIF correct?
dn: olcDatabase{1}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=somesite,dc=com" write by dn="uid=anotheruser,ou=Users,dc=somesite,dc=com" write by anonymous auth by self write by * none olcAccess: {2}to * by self write by dn="cn=admin,dc=somesite,dc=com" write by dn="cn=anotheruser,ou=Users,dc=somesite,dc=com" write by * read
With:
ldapmodify -Y EXTERNAL -H ldapi:/// -f ./changes.ldif
My concerns are:
- there are 3
olcAccess:
lines, I did not include the {1} line so would it still be there after committing the ldif changes - is the
replace: olcAccess
line correct?
-
84104 almost 11 yearsPlease tell me this isn't managing
posixAccount
dn
s. Allowing such adn
to change itsuidNumber
andgidNumber
to 0 is a serious security problem.
- there are 3
-
Chad Skeeters about 7 yearsOn my machine it was
dn: olcDatabase={1}hdb,cn=config
with an '=' after olcDatabase.