From dd62baf63ccc35db4b4a98abbf91d64d23326c84 Mon Sep 17 00:00:00 2001 From: pgamba <pgamba@localhost> Date: Fri, 30 Nov 2007 09:18:10 +0000 Subject: [PATCH] Fix 2319 - protect acces to dc=replicationChanges by default Description dc=replicationChanges is enabled by default on all the replication servers and show all the modifications done on all replicated suffixes. It may therefore contain sensitive information and should be available only administrators. --- opends/resource/config/config.ldif | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/opends/resource/config/config.ldif b/opends/resource/config/config.ldif index 6c4ab34..ffb4bd3 100644 --- a/opends/resource/config/config.ldif +++ b/opends/resource/config/config.ldif @@ -74,6 +74,7 @@ ds-cfg-global-aci: (target="ldap:///cn=schema")(targetscope="base")(targetattr="attributeTypes||dITContentRules||dITStructureRules||ldapSyntaxes||matchingRules||matchingRuleUse||nameForms||objectClasses")(version 3.0; acl "User-Visible Schema Operational Attributes"; allow (read,search,compare) userdn="ldap:///anyone";) ds-cfg-global-aci: (target="ldap:///")(targetscope="base")(targetattr="namingContexts||supportedAuthPasswordSchemes||supportedControl||supportedExtension||supportedFeatures||supportedLDAPVersion||supportedSASLMechanisms||vendorName||vendorVersion")(version 3.0; acl "User-Visible Root DSE Operational Attributes"; allow (read,search,compare) userdn="ldap:///anyone";) ds-cfg-global-aci: (targetattr="createTimestamp||creatorsName||modifiersName||modifyTimestamp||entryDN||entryUUID||subschemaSubentry")(version 3.0; acl "User-Visible Operational Attributes"; allow (read,search,compare) userdn="ldap:///anyone";) +ds-cfg-global-aci: (target="ldap:///dc=replicationchanges")(targetattr="*")(version 3.0; acl "Replication backend access"; deny (all) userdn="ldap:///anyone";) cn: Access Control Handler ds-cfg-java-class: org.opends.server.authorization.dseecompat.AciHandler ds-cfg-enabled: true -- Gitblit v1.10.0