LDAP Security Feature

LDAP Security Feature

LDAP and especially OpenLDAP has a number of security features which at first (second and third) glance may be a tad daunting. Diagram below provides a perspective of the problem before diving into detail. It shows the various access methods and interfaces to an LDAP system and then describes some security issues and what methods are available to manage the risks involved. The purpose of this exercise is to determine either a set of security policies or implementation priorities.

Remote Communications : Remote communication security may or may not be an issue. If you provide unlimited (anonymous) access to non-sensitive LDAP data then the security issue is moot. Caution: In these circumstances you potentially become vulnerable to DoS/DDoS attacks through malicious LDAP query loads - so even this apparently trivial environment may need careful consideration.

Passwords : Securing passwords during communications should not be confused with securing them within configuration files or DITs. Even if you have secured all passwords within the configuration file or the DIT using a hash-method, such as {SSHA}, when a password is sent from a client to the server it is sent in the clear, hashed at the server and compared with the stored contents. Without any further action it can therefore be snooped (or sniffed depending on your predilection for these terms).

Note: When an entry containing, say, a userPassword attribute stored using, say, {CRYPT} is requested by a client it is not sent in cleartext but in its hashed (stored) form. However when access to that same entry is required the client sends the authenticating password in cleartext and clearly(!) if the login is successful the snooper can reasonably assume the cleartext password was correct!