Ldap

mr.telnet · Post by **mr.telnet** » Tue Nov 22, 2005 8:11 pm

On OpenSource M2 I am trying to access LDAP with a windows client and am using uid=zimbra,cn=admins,cn=zimbra as the User DN but i have no clue as to what to use as the password. Please Help.

mr.telnet · Post by **mr.telnet** » Tue Nov 22, 2005 8:15 pm

thx

jgao · Post by **jgao** » Wed Jan 11, 2006 5:56 pm

After zimbra installed, how to access its LDAP using third party tool? What're the accounts installed with zimbra, and their passwords?

marcmac · Post by **marcmac** » Wed Jan 11, 2006 6:13 pm

zmlocalconfig -s | grep ldap will show the DN and password

jgao · Post by **jgao** » Mon Jan 16, 2006 3:39 pm

I noticed that the zimbra LDAP anonymous login is on by default.
What's the reason?
How to turn it off in slapd.conf?

concept · Post by **concept** » Fri Feb 17, 2006 8:44 am

I've noticed that the ldap server does not require authentication also. So if it were open on the internet, anybody could connect with an ldap client and view your GAL. Is there a way to require authenticatiion for accessing the the zimbra ldap server?

14319KevinH · Post by **14319KevinH** » Fri Feb 17, 2006 4:15 pm

We've tighten this down in the GA release. In general you don't want your LDAP server on the internet. It's just not a good idea to open it up like that. There should be a way to set a password for LDAP GAL access. Might want to look at the Open LDAP docs.

14240scottp · Post by **14240scottp** » Sun Mar 26, 2006 2:26 am

[quote user="14319KevinH"]We've tighten this down in the GA release. In general you don't want your LDAP server on the internet. It's just not a good idea to open it up like that. There should be a way to set a password for LDAP GAL access. Might want to look at the Open LDAP docs.[/QUOTE]
That is excellent. I was about to start a thread on the fact that the LDAP server is completely open, meaning that our friendly spammers can now read and confirm every one of our address very easily, not counting customers stealing data, and of course the fact that we would be breaking all Australia Privacy laws by providing an open access list.
I have installed the latest Debian Package (as of March 2006) 3.0.1 - and it is still open. I have been reading the OpenLDAP docs and found the obvious line to insert is disallow bind_simple_unprotected - but it does not work. Perhaps slapd on Zimbra is not using the /opt/zimbra/openldap/etc/openldap/slapd.conf file.
Regarding the above - I have noticed a number of conf files where it is hard to figure out which is valid - there is a few duplicates, some in the etc/conf dir and some in the etc/conf dir of the actual application.
Can you help with the LDAP config to secure the lookups.
Thanks
Scott

14240scottp · Post by **14240scottp** » Sun Mar 26, 2006 2:29 am

[quote user="14240scottp"]Zimbra is not using the /opt/zimbra/openldap/etc/openldap/slapd.conf file.[/QUOTE]
Ahhh this was in fact the case. However, if I add the
disallow bind_simple_unprotected
Line to the configuration, then Zimbra will no longer startup, I assume that the local system does not login/bind.
So I need to be able to disallow external, but allow local IP connections.
Scott

bobby · Post by **bobby** » Sun Mar 26, 2006 3:31 am

[QUOTE]So I need to be able to disallow external, but allow local IP connections

[/QUOTE]
is the server not behind a firewall?