☰

Como ldapmodify substituir corretamente as linhas olcAccess?

tag-icon • tag-icon debian ldap openldap access-control-list
Como ldapmodify substituir corretamente as linhas olcAccess?

Esta é uma parte de olcDatabase={1}hdb.ldif

olcAccess: {0}to attrs=userPassword,shadowLastChange
 by self write
 by anonymous auth
 by dn="cn=admin,dc=somesite,dc=com" write
 by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to *
 by self write
 by dn="cn=admin,dc=somesite,dc=com" write
 by * read

Eu gostaria de acrescentar by dn="cn=anotheruser,ou=Users,dc=somesite,dc=com" writeà linha {0}and {2}.

Antes de destruir meu servidor LDAP,o seguinte LDIF está correto?

dn: olcDatabase{1}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange
        by dn="cn=admin,dc=somesite,dc=com" write
        by dn="uid=anotheruser,ou=Users,dc=somesite,dc=com" write
        by anonymous auth
        by self write
        by * none
olcAccess: {2}to *
 by self write
 by dn="cn=admin,dc=somesite,dc=com" write
 by dn="cn=anotheruser,ou=Users,dc=somesite,dc=com" write
 by * read

Com:ldapmodify -Y EXTERNAL -H ldapi:/// -f ./changes.ldif

Minhas preocupações são:

  • existem 3 olcAccess:linhas, eu não incluí a linha {1}, então ela ainda estaria lá depois de confirmar as alterações do ldif
  • a replace: olcAccesslinha está correta?

Responder1

Este ldif funcionou para mim, com o comando anterior

dn: olcDatabase{1}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange
        by dn="cn=admin,dc=somesite,dc=com" write
        by dn="uid=anotheruser,ou=Users,dc=somesite,dc=com" write
        by anonymous auth
        by self write
        by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to *
 by self write
 by dn="cn=admin,dc=somesite,dc=com" write
 by dn="cn=anotheruser,ou=Users,dc=somesite,dc=com" write
 by * read

informação relacionada