[Pkg-openldap-devel] Bug#761406: slapd: dangerous access rule in default config

[Dietrich Clauss]

Package: slapd
Version: 2.4.31-1+nmu2
Severity: normal

The configure script sets the following access rules for the LDAP
database:

| olcAccess: to attrs=userPassword,shadowLastChange
|   by self write
|   by anonymous auth
|   by dn="cn=admin, at SUFFIX@" write
|   by * none
| olcAccess: to dn.base="" by * read
| olcAccess: to *
|   by self write
|   by dn="cn=admin, at SUFFIX@" write
|   by * read

When the LDAP is used to authenticate users (e.g. in conjunction with
libnss-ldapd and libpam-ldapd), the rule "olcAccess: to * by self write" allows
the user to change her uidNumber and impersonate another user.

IMO the default config should allow self-write access to userPassword
and shadowLastChange only.  If this is not possible, write access should
at least be limited to attributes which are commonly expected to be
user-writeable, e.g.:

| olcAccess: to attrs=userPassword,shadowLastChange
|   by self write
|   by anonymous auth
|   by dn="cn=admin, at SUFFIX@" write
|   by * none
| olcAccess: to attrs=loginShell,gecos
|   by self write
|   by dn="cn=admin, at SUFFIX@" write
|   by * read
| olcAccess: to dn.base="" by * read
| olcAccess: to *
|   by dn="cn=admin, at SUFFIX@" write
|   by * read

-- System Information:
Debian Release: 7.6
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-4-amd64 (SMP w/1 CPU core)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages slapd depends on:
ii  adduser                     3.113+nmu3
ii  coreutils                   8.13-3.5
ii  debconf [debconf-2.0]       1.5.49
ii  libc6                       2.13-38+deb7u4
ii  libdb5.1                    5.1.29-5
ii  libgcrypt11                 1.5.0-5+deb7u1
ii  libgnutls26                 2.12.20-8+deb7u2
ii  libldap-2.4-2               2.4.31-1+nmu2
ii  libltdl7                    2.4.2-1.1
ii  libodbc1                    2.2.14p2-5
ii  libperl5.14                 5.14.2-21+deb7u1
ii  libsasl2-2                  2.1.25.dfsg1-6+deb7u1
ii  libslp1                     1.2.1-9
ii  libwrap0                    7.6.q-24
ii  lsb-base                    4.1+Debian8+deb7u1
ii  multiarch-support           2.13-38+deb7u4
ii  perl [libmime-base64-perl]  5.14.2-21+deb7u1
ii  psmisc                      22.19-1+deb7u1

Versions of packages slapd recommends:
ii  libsasl2-modules  2.1.25.dfsg1-6+deb7u1

Versions of packages slapd suggests:
ii  ldap-utils  2.4.31-1+nmu2

-- Configuration Files:
/etc/default/slapd changed [not included]

-- debconf information excluded