I implemented SSL/TLS support for my ldap server but I need to prevent slapd from listening on port 389 for unencrypted requests.

Does anyone know how to force slapd to only listen to port 389 on the local loopback address on RHEL5?

The init.d script references the file ldap under /etc/sysconfig so I tried adding the options to /etc/sysconfig/ldap but it still listens on all addresses.

Thanks.

I don't know the answer wrt configuration, but you could always block it with iptables.

Ya that is part of my overall plan, but I am just concerned with the relying on just iptables or even tcp wrappers or xinetd.

The environment I am using ldap in has to be extremely paranoid because the servers are accessible via the Internet.

From slapd man page, I think that you can try something like:

I tried using this but the only port ldap was listening to was 389, nothing on 636.

Does the /etc/ldap.conf file control any slapd configuration or is that just for ldap client options?

Maybe it needs the double quotes:
Of course it controls various setup aspects of the slapd daemon, but nothing regarding the networking part (like listening ports and such). But you need to put in slapd.conf the TLS options for the server to use ldaps.

The TLS options are configured and working.

I should add that I have been using the redhat "service ldap start" (and also /etc/init.d/ldap)feature to get slapd to start. I took a look at the /var/run/openldap/slapd.args file to see how it is being started using these features and found this:

/usr/sbin/slapd -h ldap:/// ldaps:/// -u ldap

So I stopped slapd and manually ran it as so:

/usr/sbin/slapd -h ldaps:/// -u ldap

Which worked. So.....looks like I have to edit the init script for ldap to turn off using port 389 so that a reboot doesn't open up this hole.

Anyone good at editing init scripts?

The ldap init script references /etc/sysconfig/ldap, so i shouldn't have to modify the script directly however the options I added are not getting picked up, any reason why?

I don't have a redhat system handy at the moment, so could you post the contents of /etc/sysconfig/ldap.

Here is what I have:

# File: /etc/sysconfig/ldap
#
# Run slapd with -h "... ldap:/// ..."
# yes/no, default: yes
SLAPD_LDAP=no
#
# Run slapd with -h "... ldapi:/// ..."
# yes/no, default: no
SLAPD_LDAPI=no
#
# Run slapd with -h "... ldaps:/// ..."
# yes/no, default: no
SLAPD_LDAPS=yes

You can set every option to "no" in /etc/sysconfig/ldap and add the working -h "ldap://127.0.0.1/ ldaps:///" option in the slapd startup script /etc/init.d/slapd.

can you please guide me to configure a ldap server which will be using instead of nis.

thanks.
santanu

Try the howto at www.linuxhomenetworking.com

Thanks for the info, I took your suggestion of modifying the init script and the /etc/sysconfig/ldap options and modified it a little. I looked for the variable for ldap:/// within the script and simply modified it so it looked like this: "ldap://127.0.0.1", and restarted slapd. Worked like a charm!!!!

Thanks again!!

Thanks... I am trying....