/usr/sbin/ldap2bind could be made with minor changes to support LDAP bind with a password from file by using ldapsearch's "-y" option. Having this support out from repository would be nice (not included in this patch). /usr/sbin/ldap2zone doesn't support non-anonymous bind at all. I've searched the net and came to a github page with modified version of ldap2zone at: https://github.com/FransUrbo/bind9-ldap This version already supports non-anonymous bind, try TLS, require TLS and SASL. But the only way to specify bind password is by including it in command line with -w option which isn't secure enough. So, I enchanted it some: - -y option to specify file to read password from - use LDAP V3 always, even if no TLS and SASL asked I've made a patch between the version I've got from the above url with my changes and Debian's most fresh 0.2-3.1, it seems to be clean enough. There are much sasl code which is not used due to SECUREBIND_SASL not defined. It should be quite easy to add SASL support by adding sasl.c from the above url and define SECUREBIND_SASL, if somebody interested.
[Pokotilenko Kostik] Hi. Me and Mike just took over the ldap2zone package, and hope to get it into better shape for Jessie. :) Your patch seem to do a bit more than only adding LDAP bind and TLS support. We have updated the Debian package for ldap2zone quite a bit the last few days, and your patch no longer applies. Can you update it to only add LDAP bind and TLS support (some part of it is already applied, for example the int->size_t change), and provide a new and updated patch?
Hi, I have looked into that bug report and the patch, but am a bit confused as to what it has to do with the current ldap2bind in Debian. As I understand it, the linked code on GitHub implements an sdb LDAP backend for bind, while the ldap2bind/ldap2zone pair of tools creates BIND configuration and zone files outside of BIND. The approaches are entirely different, however, there seems to be shared code between the two, the reason for which I do not yet understand (does that bind9-ldap thing do some sort of just-in-time dump from LDAP to zone files, or something? The author of the patch did not see this difference, as it appears, or the patch is incomplete. The patch updates ldap2zone, the C program that gets a single zone from LDAP and dumps it to a BIND9 zone file. However, in the accompanying bug mail, the author talks about passing a password to the ldapsearch command - which obviously is not in the ldap2zone program, but would rather be found in the ldap2bind wrapper script. This script, however, is not patched and so the patch has nothing to do with the described intention. In any case, I do not think the two should be mixed. bind9-ldap could certainly go into Debian, but not as a patch or replacement for ldap2zone. I am currently doing a full rewrite of ldap2bind and ldap2zone, which will work as a drop-in replacement, and cover the things the author desired. Cheers, Nik
Hi Petter, I took a look at it and still find it is something completely different. It seems to share ldap2zone, but apart from that, ldap2bind and bind9-ldap serve a different purpose. Maybe we could use the new ldap2zone from bind9-ldap and just rewrite ldap2bind around it, but I do not like that because it somehow does not make much sense to me to have the tools seperated completely. It might be that I miss something important, so please point me at how bind9-ldap would be a drop-in replacement for ldap2bind should I be wrong :). Cheers, Nik