slapd access to private key owned by root

From	jeremy ardley <jeremy@ardley.org>
Newsgroups	linux.debian.user
Subject	slapd access to private key owned by root
Date	2023-03-05 02:10 +0100
Message-ID	<G5L2V-aa8H-1@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

I think the problem is probably unsolvable but I thought I'd ask.

I understand slapd starts as user root and reads config etc and then 
changes to user openldap

This means that it could potentially read a private key owned by root 
during startup?

The problem is when I try and configure private keys for ldap TLS the 
permissions are checked and if it's not owned by openldap and 
permissions 400 or 600 the configuration fails.

Is there a known solution to this problem?

My config:

apt show slapd ldap-utils

Package: slapd
Version: 2.4.57+dfsg-3+deb11u1

Package: ldap-utils
Version: 2.4.57+dfsg-3+deb11u1


Jeremy

Back to linux.debian.user | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

slapd access to private key owned by root jeremy ardley <jeremy@ardley.org> - 2023-03-05 02:10 +0100
  Re: slapd access to private key owned by root Andy Smith <andy@strugglers.net> - 2023-03-05 12:00 +0100

csiph-web