Question : Linux, LDAP, securing LDAP to preven anonymous searching....

We are using Samba here and LDAP and I have been told that people are actually taking information from the LDAP using anonymous access because they can get everything apart from passwords. This can result in e-mail addresses, names, and mailing addresses being used for SPAM and things of that nature.

I'm REALLY new to Linux and Samba and I wanted to know if there is a good step-by-step on how to prevent this by securing LDAP...

Answer : Linux, LDAP, securing LDAP to preven anonymous searching....

Everything concerning LDAP security is in the slapd.conf (/etc/openldap/slapd.conf)
This is part of that descryption.

# Sample access control policy:
#       Root DSE: allow anyone to read it
#       Subschema (sub)entry DSE: allow anyone to read it
#       Other DSEs:
#               Allow self write access
#               Allow authenticated users read access
#               Allow anonymous users to authenticate
#       Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#       by self write
#       by users read
#       by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
So first you need to think about what people are allowed, what applications can do
You can configure any access to only allow readaccess by f.e. self.
also allow the anonymous to auth otherwise no one can access ldap
to authenticate itself.

SAMBA might need access to the passwords in that case you need a proxy account that
can access the password field.

http://www.stress-free.co.nz/suse_openldap_samba_howto
http://www.gentoo.org/doc/en/ldap-howto.xml
http://www.mediaplaza.nl/uploaded/FILES/seminars/2006/OS Summercamps_160706/Micha Kersloot.pdf
http://www.lesbell.com.au/Home.nsf/b8ec57204f60dfcb4a2568c60014ed0f/ea0868177c73725fca25713f006fcefc/$FILE/eimnotes.pdf
http://www.islandlinux.org/HOWTO/openldap_samba.html
http://www.opensourcehowto.org/how-to/samba/openldap-lam-samba-as-pdc.html
http://gentoo-wiki.com/Special:Search?search=samba+pdc&go=Go