From afcecce52862f171c15a8a8748a8ecfce34ba47e Mon Sep 17 00:00:00 2001 From: Warren Block Date: Mon, 21 Apr 2014 16:23:41 +0000 Subject: [PATCH] Correct email port number. While here, fix title capitalization and contractions. PR: docs/188845 Submitted by: Ondra Knezour --- .../articles/ldap-auth/article.xml | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/en_US.ISO8859-1/articles/ldap-auth/article.xml b/en_US.ISO8859-1/articles/ldap-auth/article.xml index 0660586c86..491c6da726 100644 --- a/en_US.ISO8859-1/articles/ldap-auth/article.xml +++ b/en_US.ISO8859-1/articles/ldap-auth/article.xml @@ -129,7 +129,7 @@ SSL stands for Secure Sockets Layer, and services that implement SSL do not listen on the same ports as their non-SSL counterparts. Thus SMTPS listens - on port 465 (not 45), HTTPS listens on 443, and LDAPS on + on port 465 (not 25), HTTPS listens on 443, and LDAPS on 636. The reason SSL uses a different port than TLS is because a @@ -171,7 +171,7 @@ TLSCACertificateFile /path/to/your/cacert.crt self-signed certificate with OpenSSL: - Generating an RSA key + Generating an RSA Key &prompt.user; openssl genrsa -out cert.key 1024 Generating RSA private key, 1024 bit long modulus @@ -196,7 +196,7 @@ e is 65537 (0x10001) signed: - Self-signing the certificate + Self-signing the Certificate &prompt.user; openssl x509 -req -in cert.csr -days 365 -signkey cert.key -out cert.crt Signature ok @@ -335,7 +335,7 @@ cn: tuser I start my LDAP users' UIDs at 10000 to avoid collisions with system accounts; you can configure whatever number you wish here, - as long as it's less than 65536. + as long as it is less than 65536. We also need group entries. They are as configurable as user entries, but we will use the defaults below: @@ -555,7 +555,7 @@ passwd: files ldap you should be made aware of; see - Shell script for changing passwords + Shell Script for Changing Passwords - Ruby script for changing passwords + Ruby Script for Changing Passwords improvements. - Setting attributes read-only + Setting Attributes Read-only Several attributes in LDAP should be read-only. If left writable by the user, for example, a user could change his @@ -667,7 +667,7 @@ conn.modify(luser, [replace])]]> the following in slapd.conf: - Hide passwords + Hide Passwords access to dn.subtree="ou=people,dc=example,dc=org" attrs=userPassword @@ -691,7 +691,7 @@ access to * hole, modify the above to - Read-only attributes + Read-only Attributes access to dn.subtree="ou=people,dc=example,dc=org" attrs=userPassword @@ -712,7 +712,7 @@ access to * - <systemitem class="username">Root</systemitem> account definition + <systemitem class="username">root</systemitem> Account Definition Often the root or manager account for the LDAP service will be defined in the configuration file. @@ -724,21 +724,21 @@ access to * Even better is to define accounts that have limited permissions, and omit a root account entirely. - For example, users to can add or remove user accounts are added to + For example, users that can add or remove user accounts are added to one group, but they cannot themselves change the membership of this group. Such a security policy would help mitigate the effects of a leaked password. - Creating a management group + Creating a Management Group Say you want your IT department to be able to change home - directories for users, but you don't want all of them to be able + directories for users, but you do not want all of them to be able to add or remove users. The way to do this is to add a group for these admins: - Creating a management group + Creating a Management Group dn: cn=homemanagement,dc=example,dc=org objectClass: top @@ -753,7 +753,7 @@ memberUid: uid=user2,ou=people,dc=example,dc=org slapd.conf: - ACLs for a home directory management group + ACLs for a Home Directory Management Group access to dn.subtree="ou=people,dc=example,dc=org" attr=homeDirectory @@ -764,7 +764,7 @@ memberUid: uid=user2,ou=people,dc=example,dc=org Now tuser and user2 can change other users' home directories. - In this example we've given a subset of administrative + In this example we have given a subset of administrative power to certain users without giving them power in other domains. The idea is that soon no single user account has the power of a root account, but every power @@ -774,7 +774,7 @@ memberUid: uid=user2,ou=people,dc=example,dc=org - Password storage + Password Storage By default OpenLDAP will store the value of the userPassword attribute as it @@ -823,7 +823,7 @@ memberUid: uid=user2,ou=people,dc=example,dc=org - <application>OpenSSL</application> Certificates For LDAP + <application>OpenSSL</application> Certificates for LDAP If you are hosting two or more LDAP servers, you will probably not want to use self-signed certificates, since each client will @@ -841,7 +841,7 @@ memberUid: uid=user2,ou=people,dc=example,dc=org are - Creating a certificate + Creating a Certificate &prompt.user; openssl genrsa -out root.key 1024 &prompt.user; openssl req -new -key root.key -out root.csr @@ -872,7 +872,7 @@ memberUid: uid=user2,ou=people,dc=example,dc=org : - Signing as a certificate authority + Signing as a Certificate Authority &prompt.user; openssl x509 -req -days 1024 \ -in ldap-server-one.csr -CA root.crt -CAkey root.key \