LX0-104 · Question #187
Which of the following ACL lines allows access to all hosts that have an IP address that starts with 192.168.1?
The correct answer is A. by peername=192.168.1.*. To allow access based on an IP address range in an OpenLDAP ACL, the peername keyword should be used with a wildcard for the IP address range, such as by peername=192.168.1.*.
Question
Options
- Aby peername=192.168.1.*
- Bby peername=192.168.1.
- Cby ipaddress=192.168.1.*
- Dby ipaddress=192.168.1.
How the community answered
(46 responses)- A89% (41)
- B7% (3)
- C2% (1)
- D2% (1)
Why each option
To allow access based on an IP address range in an OpenLDAP ACL, the `peername` keyword should be used with a wildcard for the IP address range, such as `by peername=192.168.1.*`.
In OpenLDAP ACLs, `peername` is used to specify access control based on the IP address of the client connection, and `192.168.1.*` correctly uses a wildcard to match any IP address starting with `192.168.1`. This allows access to all hosts within that specific subnet.
by peername=192.168.1. would only match a host with the exact IP address 192.168.1. (which is syntactically incomplete as an IP) or potentially lead to an error; it does not use a wildcard to specify a range.
ipaddress is not a valid keyword for specifying client IP addresses in OpenLDAP ACLs; the correct keyword is peername.
Both ipaddress is incorrect as a keyword and the IP address 192.168.1. is incomplete, so this option is doubly wrong.
Concept tested: OpenLDAP ACL IP-based access control
Source: https://www.openldap.org/doc/admin24/access-control.html
Topics
Community Discussion
No community discussion yet for this question.