On Tue, 10 May 2005, Farkas Levente wrote:
hi, if we'd like to use nss_ldap with tls certificzte files than we have to use a least 644 permission even on the key file. it's not a good security concern. it's better than without tls, but local user still too powerful in this case:-( is there any way to prevent this? i mean to be able to change the file permission to root:root 640 and use nss_ldap too? usualy in this case a small portion of the progam run as setuid root, but of course in this case it can't help since it's a library and the whole nss philosophy are different from this. what can i do? or currently there is no solution for this? thanks in advance. yours.
If you run 'nscd', then all nss requests will be routed through nscd (running as root) and you may be able to use stricter permissions on the config file and certificate files.
Andy