Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Руководство администратора

Страница: 225 / 578

Bind Rules
Chapter 6 Managing Access Control 225
The
dns
keyword requires a fully qualified DNS domain name. Granting access to
a host without specifying the domain creates a potential security threat. For
example, the following expression is allowed but not recommended:
dns = "legend.eng";
You should use a fully qualified name such as:
dns = "legend.eng.example.com";
The dns keyword allows wildcards. For example:
dns = "*.example.com";
The bind rule is evaluated to be true if the client accessing the directory is located in
the named domain. This can be useful for allowing access only from a specific
domain. Note that wildcards will not work if your system uses a naming service
other than DNS. In such a case, if you want to restrict access to a particular domain,
use the ip keyword, as described in “Defining Access From a Specific IP Address,”
on page 224.
Defining Access at a Specific Time of Day or
Day of Week
You can use bind rules to specify that binding can only occur at a certain time of
day or on a certain day of the week. For example, you can set a rule that will allow
access only if it is between the hours of 8 am and 5 pm Monday through Friday.
The time used to evaluate access rights is the time on the Directory Server, not the
time on the client.
The LDIF syntax for setting a bind rule based on the time of day is as follows:
timeofday
operator
"
time
"
where
operator
can be one of the following symbols: equal to (=), not equal to (!=),
greater than (>), greater than or equal to (>=), less than (<), or less than or equal to
(<=).
The
timeofday
keyword requires a time of day expressed in hours and minutes in
the 24 hour clock (0 to 2359).
The LDIF syntax for setting a bind rule based on the day in the week is as follows:
NOTE
The time on the server is used for the evaluation, and not the time
on the client.