How does openldap allowed nslcd to access DB without authentication?
Server Side Configuration
Started slapd service and modified olcSuffix, olcRootDN, olcRootPW, olcAccess as shown below
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=sam,dc=com
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=samio,dc=sam,dc=com
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {SSHA}v3AAHxk25g32BxWSUTyWUQltdFqZPbbJ
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=samio,dc=sam,dc=com" read by * none
Then added nss.ldif inetorgperson.ldif cosine.ldif as shown below.
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nss.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
Now Added some users as shown below.
ldapadd -x -w samio -D cn=samio,dc=sam,dc=com -f users.ldif
users.ldif
dn: dc=sam,dc=com
dc: sam
objectClass: top
objectClass: domain
dn: cn=samio,dc=sam,dc=com
objectClass: organizationalRole
cn: samio
description: LDAP Manager
dn: ou=People,dc=sam,dc=com
objectClass: organizationalUnit
ou: People
dn: ou=Group,dc=sam,dc=com
objectClass: organizationalUnit
ou: Group
dn: uid=pinehead,ou=People,dc=sam,dc=com
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: pinehead
uid: pinehead
uidNumber: 9999
gidNumber: 100
homeDirectory: /home/pinehead
loginShell: /bin/bash
gecos: pinehead [Lead Penguin (at) Linux Academy]
userPassword: pinehead
shadowLastChange: 17058
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
dn: uid=tcox,ou=People,dc=sam,dc=com
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: tcox
uid: tcox
uidNumber: 10000
gidNumber: 100
homeDirectory: /home/tcox
loginShell: /bin/bash
gecos: Terry Cox [Super Dude (at) Linux Academy]
userPassword: tcox
shadowLastChange: 17058
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
Client Side configuration
Now on the client machine, Installed all the required packages and ran the following
authconfig --update --enableldap --enableldapauth --ldapserver=172.31.7.3 --ldapbasedn=dc=sam,dc=com --enablemkhomedir
I could able to successfully login now.
[root@25811cb8b71c ~]# ssh tcox@localhost
Password:
[tcox@25811cb8b71c ~]$ pwd
/home/tcox
[tcox@25811cb8b71c ~]$
Im surprised that how does the Openldap server allowed the nslcd client to access db without authenticating? Help me know what am I missing here.