Public SourceMage Discussion List

[Thomas Orgis <thomas-forum AT orgis.org>]

To anyone who is interested in using LDAP for user databases and
authentication:

There is a friend of mine who uses LDAP all around his network, including
user authentication with pam_ldap and name service stuff via nss_ldap.
Some time ago, he spotted a serious flaw in the workings of the
ldap library, causing funny things like endless loop/deadlock in the
automounter trying to mount a user home and looking out for a personal
ldap config file in the very same dir.
Apart from nicely killing your network setup, this "feature" lets any
logged-in user manipulate the configuration pam_ldap uses (e.g. for
"su") to fake any LDAP data by providing an own LDAP server.

He made some patches, adding context support for LDAP default
configuration, including prevention of parsing user-defined config files
for system auth.

Have a read: http://timof.qipc.org/ldap/libldap.html

After we waited long enough for upstream to show any reaction to reports
(all of openldap, pam_ldap and nss_ldap -- is there no one concerned by
security issues???), I went along to integrate his patches as opt-in in
the test grimoire, with these commits:

2a3d4aa9bf7bb272107ca89837fc60f5f1780d51
18ae539dc87aa532ddadbfd2ef59034d176867dc
11a081d8e69be92efbc42191798bcda0f15de977
b055e1f5c69127918e14a8bbf140f76dd54a42d7
ac7437f834251058d160477632cce9e893d50478


I don't use such an LDAP setup myself, so I am really interested in
ppl. here that use such a setup trying out the security options and
giving feedback.

It's not our policy to deliberately patching upstream stuff, but I think
this a breakage in the openldap client libs that just has to be fixed.
And it's opt-in, anyway...


Alrighty then,

Thomas.

Attachment: signature.asc
Description: PGP signature