8f17da5 Ticket #110 - RFE limiting root DN by host, IP, time of day, day of week

10 files Authored by mreynolds 11 years ago, Committed by rmeggins 11 years ago,
    Ticket #110 - RFE limiting root DN by host, IP, time of day, day of week
    
    RFE Description:  There is no way to restrict when and where some one can attempt
                      root DN binds.  An intruder can brute force guess the password all
                      day long until they succeed, especailly if the DS is publicly
                      available.
    
    Fix Description:  Created a new plugin, type "internalpreoperation" and an internal
                      preop bind function.  You can configure the plugin with some basic
                      access control:
    
                rootdn-open-time: 0800
                rootdn-close-time: 1700
                rootdn-days-allowed: Mon, Tue, Wed, Thu, Fri
                rootdn-allow-host: *.redhat.com
                rootdn-allow-host: *.fedora.com
                rootdn-deny-host: dangerous.boracle.com
                rootdn-allow-ip: 127.0.0.1
                rootdn-allow-ip: 2000:db8:de30::11
                rootdn-deny-ip: 192.168.1.*
    
                              As with our other ACL code, deny's always override the allow rules.
    
    https://fedorahosted.org/389/ticket/110
    
    Reviewed by: richm(Thanks Rich!)
    (cherry picked from commit c61ee8e16c3e3ca91ffef725fadbeb0a62fb5e80)
    
        
file modified
+12 -1
file modified
+47 -3
file modified
+27 -7
file modified
+14 -0
file modified
+10 -1
file modified
+2 -0