LFCS · Question #187
Which of the following ACL lines allows access to all hosts that have an IP address that starts with 192.168.1?
The correct answer is A. by peername=192.168.1.*. To grant access to all hosts within a specific subnet (e.g., 192.168.1.0/24) in OpenLDAP ACLs, the by peername clause is used with a wildcard. The by peername=192.168.1.* directive correctly matches any IP address starting with 192.168.1.
Question
Options
- Aby peername=192.168.1.*
- Bby peername=192.168.1.
- Cby ipaddress=192.168.1.*
- Dby ipaddress=192.168.1.
How the community answered
(32 responses)- A94% (30)
- B3% (1)
- C3% (1)
Why each option
To grant access to all hosts within a specific subnet (e.g., 192.168.1.0/24) in OpenLDAP ACLs, the `by peername` clause is used with a wildcard. The `by peername=192.168.1.*` directive correctly matches any IP address starting with 192.168.1.
In OpenLDAP Access Control Lists (ACLs), the `by peername` clause specifies access based on the client's hostname or IP address. Using `by peername=192.168.1.*` correctly employs a wildcard (`*`) to match any IP address that begins with `192.168.1.`, thereby encompassing the entire 192.168.1.0/24 subnet for access control.
The entry `by peername=192.168.1.` without a wildcard would only match the exact IP address `192.168.1.`, which is usually not a valid IP and would not cover an entire subnet.
`by ipaddress` is not a recognized keyword in OpenLDAP ACLs for specifying client IP addresses; `by peername` is the correct directive for this purpose.
Similar to (C), `by ipaddress` is an incorrect keyword, and even if it were, `192.168.1.` without a wildcard would not match the entire subnet.
Concept tested: OpenLDAP ACL IP subnet matching
Source: https://www.openldap.org/doc/admin24/access.html
Topics
Community Discussion
No community discussion yet for this question.