OpenLDAP With No Anonymous Access And Hashes Only Their Owner Reads

openldap

OpenLDAP from EPEL as a directory server that gives nothing away: no anonymous binds and nothing below the suffix for a client that never binds, passwords only over TLS, each password hash readable by its owner alone and stored as yescrypt even when it was written in clear, the directory readable only by its own entries, local root as the only administrator, and the listener on loopback until you open it. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No download, and no version to pin. EL 10 packages slapd in EPEL, so the role installs it by name and takes what the distribution ships: a security update arrives through dnf, not through a new release of this role. What the role owns is the configuration and the proof that the service works.

The distribution's unit, our configuration. The role installs openldap-servers from EPEL, gives the package's slapd.service a drop-in with the URLs it should listen on (ldap://127.0.0.1:389/ and ldapi:/// by default; no ldaps:///, StartTLS on 389 instead), and writes its settings into cn=config through ldapi, where slapd checks each value as it is written. The helper that does that changes only what differs, reads every value back, and says what it changed. The live test reads the listening sockets and expects loopback only, and nothing on 636.

The package's directory is open. Its unit listens on every address, on 389 and on 636; anonymous clients bind and read; and with no access rules on the database anyone - anonymous included - reads every userPassword hash, while a user cannot change their own password (measured). The role refuses anonymous binds, requires TLS for a simple bind (a plain-text bind gets "Confidentiality required"), lets each user read and change only their own hash, and answers a search sent with no bind at all with nothing below the suffix (the root DSE, which names the suffix and the supported mechanisms, stays readable).

A local account is an authenticated LDAP user. Through ldapi:///, any account on the host binds as gidNumber=...+uidNumber=...,cn=peercred,... without a password, so the usual by users read lets every local account read the directory (measured). The role grants reading to the directory's own entries (dn.subtree of the suffix) instead: a local account reads nothing, root manages everything through ldapi, and there is no root password at all: olcRootPW is removed if present - the live test starts from a running slapd whose database has one, and a bind with it is refused afterwards.

Hashes that are not SHA-1, even for a password written in clear. The package hashes with salted SHA-1 ({SSHA}) and ships neither argon2 nor the SHA-2 module. The role sets {CRYPT} with a yescrypt salt format, the scheme EL 10 uses for /etc/shadow, and loads the password-policy overlay to hash a password that arrives as a plain attribute: without it, a userPassword added in clear is stored in clear. The live test reads back {CRYPT}$y$ for a password added in clear and for one changed by its owner.

TLS 1.2 or later. The system policy already makes slapd refuse TLS 1.1 (measured, asked by a client that offers it); the role sets olcTLSProtocolMin 3.3 so a host with a looser policy keeps that floor.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.