☰

如何正确地用 ldapmodify 替换 olcAccess 行？

tag-icon • tag-icon debian ldap openldap access-control-list
如何正确地用 ldapmodify 替换 olcAccess 行？

这是 olcDatabase={1}hdb.ldif 的一部分

olcAccess: {0}to attrs=userPassword,shadowLastChange
 by self write
 by anonymous auth
 by dn="cn=admin,dc=somesite,dc=com" write
 by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to *
 by self write
 by dn="cn=admin,dc=somesite,dc=com" write
 by * read

我想附加by dn="cn=anotheruser,ou=Users,dc=somesite,dc=com" write到{0}和{2}行。

在我销毁 LDAP 服务器之前，以下 LDIF 正确吗？

dn: olcDatabase{1}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange
        by dn="cn=admin,dc=somesite,dc=com" write
        by dn="uid=anotheruser,ou=Users,dc=somesite,dc=com" write
        by anonymous auth
        by self write
        by * none
olcAccess: {2}to *
 by self write
 by dn="cn=admin,dc=somesite,dc=com" write
 by dn="cn=anotheruser,ou=Users,dc=somesite,dc=com" write
 by * read

和：ldapmodify -Y EXTERNAL -H ldapi:/// -f ./changes.ldif

我担心的是：

  • 有 3olcAccess:行，我没有包含 {1} 行，所以在提交 ldif 更改后它还在那里吗
  • 这replace: olcAccess条线正确吗？

答案1

这个 ldif 对我有用，使用之前的命令

dn: olcDatabase{1}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange
        by dn="cn=admin,dc=somesite,dc=com" write
        by dn="uid=anotheruser,ou=Users,dc=somesite,dc=com" write
        by anonymous auth
        by self write
        by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to *
 by self write
 by dn="cn=admin,dc=somesite,dc=com" write
 by dn="cn=anotheruser,ou=Users,dc=somesite,dc=com" write
 by * read

相关内容