Bug 798361 - Missing anonymous limits in IPA
Missing anonymous limits in IPA
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa (Show other bugs)
6.3
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Rob Crittenden
IDM QE LIST
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-02-28 13:04 EST by Rob Crittenden
Modified: 2012-06-20 09:20 EDT (History)
2 users (show)

See Also:
Fixed In Version: ipa-2.2.0-4.el6
Doc Type: Bug Fix
Doc Text:
No documentation needed.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-06-20 09:20:01 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Rob Crittenden 2012-02-28 13:04:30 EST
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/2452

We are not setting LDAP anonymous access limits correctly. This is an excerpt of ipaupgrade.log:

{{{
2012-02-27T15:59:56Z DEBUG add: 'dc=com' to nsslapd-anonlimitsdn, current value ['dc=com', u'cn=anonymous-limits', u'cn=etc', u'dc=idm', u'dc=lab', u'dc=bos', u'dc=redhat']
2012-02-27T15:59:56Z DEBUG add: updated value [u'cn=anonymous-limits', u'cn=etc', u'dc=idm', u'dc=lab', u'dc=bos', u'dc=redhat', u'dc=com']
}}}

`cn=anonymous-limits,cn=etc,SUFFIX` also does not contain the limits. Anonymous connections thus are not as restricted as they ought to be.
Comment 1 Rob Crittenden 2012-02-28 13:07:02 EST
We increase the server global limits to:

dn: cn=config,cn=ldbm database,cn=plugins,cn=config
nsslapd-lookthroughlimit:100000
nsslapd-idlistscanlimit:100000

The attempt to limit anonymous searches was incorrect but it should look like:

dn: cn=anonymous-limits,cn=etc,$SUFFIX
objectclass:nsContainer
objectclass:top
cn: anonymous-limits
nsSizeLimit: 5000

And in cn=config a pointer to this limit:

nsslapd-anonlimitsdn:cn=anonymous-limits,cn=etc,$SUFFIX
Comment 4 Jenny Galipeau 2012-03-21 15:42:37 EDT
verified :

# ldapsearch -x -D "cn=Directory Manager" -w Secret123 -b "cn=config" | grep nsslapd-lookthroughlimit
nsslapd-lookthroughlimit: 100000

# ldapsearch -x -D "cn=Directory Manager" -w Secret123 -b "cn=config" | grep nsslapd-idlistscanlimit
nsslapd-requiresrestart: cn=config,cn=ldbm:nsslapd-idlistscanlimit
nsslapd-idlistscanlimit: 100000

version :
ipa-server-2.2.0-4.el6.x86_64
Comment 6 Martin Kosek 2012-04-24 09:31:04 EDT
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
No documentation needed.
Comment 8 errata-xmlrpc 2012-06-20 09:20:01 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0819.html

Note You need to log in before you can comment on or make changes to this bug.