ldapsearches diferentes, sem saída

2

quando eu uso

ldapsearch -LLLZZ -H ldap://centos7s.domen.lan -x

Eu obtenho tudo:

dn: dc=domen,dc=lan
objectClass: domain
dc: domen
o: domen.lan organization
description: The Domen Company

dn: ou=users,dc=domen,dc=lan
ou: users
objectClass: top
objectClass: organizationalUnit

dn: ou=groups,dc=domen,dc=lan
ou: groups
objectClass: top
objectClass: organizationalUnit

dn: uid=ldapuser1,ou=users,dc=domen,dc=lan
uid: ldapuser1
cn: ldapuser1
sn: ldapuser1
mail: [email protected]
objectClass: person
objectClass: organizationalPerson....

mas com

ldapsearch  -ZZWD cn=manager,dc=domen,dc=lan -b cn=config -h centos7s.domen.lan

não recebo nada:

Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <cn=config> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# search result
search: 3
result: 32 No such object

# numResponses: 1

O que eu fiz de errado? Qual é a diferença com essas pesquisas?

No original eu tenho:

ldapsearch -LLLY EXTERNAL -H ldapi:/// -b cn=config '(olcAccess=*)' olcAccess olcSuffix

-

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
dn: olcDatabase={0}config,cn=config
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external
 ,cn=auth" manage by * none

dn: olcDatabase={1}monitor,cn=config
olcAccess: {0}to * by 

dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external
     ,cn=auth" read    by dn.base="cn=manager,dc=domen,dc=lan" read    by * none

Agora, após a alteração:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
dn: olcDatabase={0}config,cn=config
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external
 ,cn=auth" manage by * none

dn: olcDatabase={1}monitor,cn=config
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external
 ,cn=auth" read    by dn.base="cn=manager,dc=domen,dc=lan" read    by * none

dn: olcDatabase={2}hdb,cn=config
olcSuffix: dc=domen,dc=lan
olcAccess: {0}to attrs=userPassword,shadowLastChange   by dn="cn=manager,dc=do
 men,dc=lan" write   by anonymous auth   by self write   by * none
olcAccess: {1}to dn.base=""   by * read
olcAccess: {2}to * by dn="cn=manager,dc=domen,dc=lan" write   by * read

Ainda o mesmo resultado acima, segundo ldapsearch não retorna nada.

    
por andrej 05.08.2015 / 13:15

1 resposta

2

Essas duas pesquisas têm diferentes bases de pesquisa. Verifique suas ACLs para mais informações.

Tudo o que sei com certeza é que:

  1. anonymous tem algum acesso à subárvore dc=domen,dc=lan .
  2. cn=manager,dc=domen,dc=lan não tem acesso à subárvore cn=config .
por 07.08.2015 / 06:32

Tags