Netscape NETSCAPE DIRECTORY SERVER 6.02, Руководство администратора

Страница: 220 / 568

Bind Rules
220 Netscape Directory Server Administrator’s Guide • May 2002
The bind rule is evaluated to be true if the client accessing the directory is located at
the named IP address. This can be useful for allowing certain kinds of directory
access only from a specific subnet or machine.
For example, you could use a wildcard IP address such as 12.3.45.* to specify a
specific subnetwork or 123.45.6.*+255.255.255.115 to specify a subnetwork mask.
From the Server Console, you can define specific machines to which the ACI
applies through the Access Control Editor. For more information, see “Creating
ACIs From the Console,” on page 224.
Defining Access from a Specific Domain
A bind rule can specify that the bind operation must originate from a particular
domain or host machine. This is often used to force all directory updates to occur
from a given machine or network domain.
The LDIF syntax for setting a bind rule based on the DNS host name is as follows:
dns = "
DNS_Hostname
" or dns != "
DNS_Hostname
"
The
dns
keyword requires a fully qualified DNS domain name. Granting access to
a host without specifying the domain creates a potential security threat. For
example, the following expression is allowed but not recommended:
dns = "legend.eng";
You should use a fully qualified name such as:
dns = "legend.eng.example.com";
The dns keyword allows wildcards. For example:
dns = "*.example.com";
The bind rule is evaluated to be true if the client accessing the directory is located in
the named domain. This can be useful for allowing access only from a specific
domain. Note that wildcards will not work if your system uses a naming service
other than DNS. In such a case, if you want to restrict access to a particular domain,
use the ip keyword, as described in “Defining Access From a Specific IP Address,”
on page 219.
CAUTION The
dns
keyword requires that the naming service used on your
machine is DNS. If the name service is not DNS, you should use the
ip
keyword instead.