Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Received-SPF: pass (athena.apache.org: local policy includes SPF record at
 spf.trusted-forwarder.org)
Date: Fri, 13 Jun 2014 08:43:21 -0700 (PDT)
From: Mark D <temp1002@debusschere.com>
To: users@directory.apache.org
Message-ID: <2096388650.22199.1402674201873.JavaMail.zimbra@debusschere.com>
In-Reply-To: 
 <C84C1DDBD8DBF549ABABC19FB29C6207056ED7@mbx025-wd-ca-2.exch025.domain.local>
References: 
 <C84C1DDBD8DBF549ABABC19FB29C6207055DD6@mbx025-wd-ca-2.exch025.domain.local>
 <CABzFU-d4mcw39=jDZ1dQ4Mv7Ogc0Yq5_TdPT0vO=GYGx+MvB3A@mail.gmail.com>
 <C84C1DDBD8DBF549ABABC19FB29C6207056ED7@mbx025-wd-ca-2.exch025.domain.local>
Subject: Re: Auditing if anonymous LDAP connections are being made
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Thread-Topic: Auditing if anonymous LDAP connections are being made
Thread-Index: Ac+Gbm0JawFWNCEpRwyh3pH0mSXLlQAmn82AAASvgPDmKEacyA==

Log files shouldn't be the only test, we still test against the server to v=
erify.

I would have to second the request assuming there is no auditing currently =
in place, I haven't needed it yet !
It wouldn't be allowed in our PCI environments without sufficient audit rec=
ords.

This seems trivial to implement.  Another logger / file just for AUDIT.

----- Original Message -----
From: "Tou-Soua Heu" <tousouaheu@fico.com>
To: users@directory.apache.org
Sent: Friday, June 13, 2014 8:34:18 AM
Subject: RE: Auditing if anonymous LDAP connections are being made

I will raise a request.

The business case is for secure environments, like at a Financial instituti=
on (eg. Bank Of America) or Government agency (e.g. Department of Defense),=
 all LDAP connections must be authenticated (meaning no anonymous connectio=
n allowed). Currently we have no method to prove that ApacheDS meets this r=
equirement: the fact we unchecked the "Allow Anonymous Access" in the confi=
guration setting isn't sufficient to prove compliancy. We need to demonstra=
te this is actually happening and one way is via either a server status abo=
ut the identity of current connections or logging of identity connections.

Thanks.

-----Original Message-----
From: Kiran Ayyagari [mailto:kayyagari@apache.org]=20
Sent: Friday, June 13, 2014 1:11 AM
To: users@directory.apache.org
Subject: Re: Auditing if anonymous LDAP connections are being made

On Fri, Jun 13, 2014 at 12:17 AM, Tou-Soua Heu <tousouaheu@fico.com> wrote:

> How can you check if there are anonymous LDAP connections to ApacheDS 2.0=
?
>
> there is no way right now (other than looking at the debug logs, which=20
> is
painful)
if you can raise a feature request with enough details about the usecase we=
 might consider to implement it.

thank you

>
>
> According to the user manual (section 5.3.1 Logs overview, see=20
> https://directory.apache.org/apacheds/advanced-ug/5.3-logs.html ) this=20
> should work but it seems to log anything:
>
>
>
> # Logs all executed operations (search, add, delete, etc.)
>
> log4j.logger.org.apache.directory.server.OPERATION_LOG=3DDEBUG
>
> # Logs all incoming and outgoing LDAP Protocol requests/responses
>
> log4j.logger.org.apache.directory.api.CODEC_LOG=3DDEBUG
>
>
>
> So I ended up with changing "log4j.rootCategory=3DDEBUG". Unfortunately=
=20
> this puts a lot of noise in the apacheds.log file. In this case, what=20
> is the log entry that records the LDAP connection look like and what=20
> does it say when it=E2=80=99s anonymous vs. authenticated?
>
>
>
> Thanks.
>
>
>
>


--
Kiran Ayyagari
http://keydap.com

This email and any files transmitted with it are confidential, proprietary =
and intended solely for the individual or entity to whom they are addressed=
. If you have received this email in error please delete it immediately.