Disable OpenLDAP Anonymous Access

There may be instances where you would want to disable OpenLDAP searching via an anonymous source. By default slapd accepts an anonymous bind, so anyone who can reach port 389 can often browse the directory and read user names, groups and other attributes. This guide turns that off with one line in slapd.conf, shows the cn=config equivalent, and explains how to test it.

Prerequisites

• Root on the OpenLDAP server (this example is CentOS 6 with slapd configured from /etc/openldap/slapd.conf).
• A working bind DN and password (for example your cn=admin or a service account), because after this change every search needs one.
• A list of the clients that query the directory, since any client that was searching anonymously will need its own bind account.

1. Edit slapd.conf

Let’s get started: log in, and su to root.

Edit the slapd.conf:

vi /etc/openldap/slapd.conf

2. Add disallow bind_anon

Add the following to the slapd.conf file, in the global section near the top (before any database line):

disallow bind_anon

disallow bind_anon makes slapd refuse a bind with an empty DN and password. Many guides also add require authc, which rejects operations from clients that have not authenticated at all, including ones that never send a bind. Using both closes the gap.

3. Restart slapd

Now save+quit and restart the slapd service:

service slapd restart

That’s it, you have successfully disabled OpenLDAP anonymous access!

Verify

An anonymous search should now fail:

ldapsearch -x -H ldap://localhost -b "dc=mydomain,dc=local"

Expect ldap_bind: Inappropriate authentication (48) with anonymous bind disallowed. An authenticated search should still work:

ldapsearch -x -H ldap://localhost -D "cn=admin,dc=mydomain,dc=local" -W -b "dc=mydomain,dc=local"

If your server uses cn=config (slapd.d)

If the server has an /etc/openldap/slapd.d directory, slapd reads its configuration from there and edits to slapd.conf have no effect. Make the same change over LDAP instead. Save this as disable-anon.ldif:

dn: cn=config
changetype: modify
add: olcDisallows
olcDisallows: bind_anon

dn: olcDatabase={-1}frontend,cn=config
changetype: modify
add: olcRequires
olcRequires: authc

Apply it as root on the server; the change is live straight away, without a restart:

ldapmodify -Y EXTERNAL -H ldapi:/// -f disable-anon.ldif

Troubleshooting

• Logins stop working on Linux clients: nslcd or sssd was searching anonymously. Give it a service account: binddn and bindpw in /etc/nslcd.conf, or ldap_default_bind_dn and ldap_default_authtok in /etc/sssd/sssd.conf.
• slapd fails to start after the edit: check the syntax with slaptest -f /etc/openldap/slapd.conf (or slaptest -F /etc/openldap/slapd.d).
• Anonymous searches still succeed: you edited slapd.conf on a server that runs from slapd.d. Use the cn=config method above.

Modern RHEL, AlmaLinux and Rocky Linux

RHEL 8 and later no longer ship the OpenLDAP server (the client tools are still there), and Red Hat points users to 389 Directory Server. If you run slapd from another source on these systems, the cn=config steps above are the same, and you restart it with systemctl restart slapd. On 389 Directory Server the equivalent setting is covered in Disabling Anonymous Bind 389 Directory Server.

Hosted Linux Servers at www.zwiegnet.com/go

Related guides: Disabling Anonymous Bind 389 Directory Server | Configure LDAP Server on CentOS 6