mirror of
https://github.com/lldap/lldap.git
synced 2026-04-25 08:15:52 +03:00
[GH-ISSUE #1211] [BUG] Disabling LDAP when using LDAPS or Allow Independent host Config. #431
Labels
No labels
backend
blocked
bug
cleanup
dependencies
docker
documentation
duplicate
enhancement
enhancement
frontend
github_actions
good first issue
help wanted
help wanted
integration
invalid
ldap
pull-request
question
rust
rust
tests
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/lldap-lldap#431
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @crazytimmy on GitHub (Jul 10, 2025).
Original GitHub issue: https://github.com/lldap/lldap/issues/1211
I may not fully understand LDAP and/or how LLDAP operates so this may be a non-issue/bug/feature request.
After getting LDAPS running I noticed LDAP is still running listening to 0.0.0.0. I tried setting LDAP_HOST to 127.0.0.1 but that changed the service listening on for LDAPS as well. Is there a way to control these individually? Since I want to use LDAPS I also don't want LDAP (unencrypted) still running and accessible and any connection to be forced over LDAPS.
environment:
- TZ=${TIMEZONE:-UTC}
- UID=${LLDAP_UID}
- GID=${LLDAP_GID}
- LLDAP_JWT_SECRET_FILE=/run/secrets/lldap_jwt_secret
- LLDAP_KEY_SEED_FILE=/run/secrets/lldap_key_seed
- LLDAP_HTTP_URL=${LLDAP_HTTP_URL}
- LLDAP_LDAP_BASE_DN=${LLDAP_BASE_DN}
- LLDAP_LDAP_USER_DN_FILE=/run/secrets/lldap_ldap_user_dn
- LLDAP_LDAP_USER_PASS_FILE=/run/secrets/lldap_ldap_user_pass
- LLDAP_LDAPS_OPTIONS__ENABLED=true
- LLDAP_LDAPS_OPTIONS__PORT=6360
- LLDAP_LDAPS_OPTIONS__CERT_FILE=/run/secrets/site.crt
- LLDAP_LDAPS_OPTIONS__KEY_FILE=/run/secrets/site.key
- SMTP_OPTIONS_ENABLE_PASSWORD_RESET=true
- SMTP_OPTIONS_SERVER=${LLDAP_SMTP_SERVER}
- SMTP_OPTIONS_PORT=${LLDAP_SMTP_PORT}
- SMTP_OPTIONS_SMTP_ENCRYPTION=${LLDAP_SMTP_ENCRYPTION}
- SMTP_OPTIONS_USER_FILE=/run/secrets/lldap_smtp_user
- SMTP_OPTIONS_PASSWORD_FILE=/run/secrets/lldap_smtp_password
- SMTP_OPTIONS_FROM=${LLDAP_SMTP_FROM}
- SMTP_OPTIONS_TO=${LLDAP_SMTP_TO}
I would expect to be able to disable either LDAP or LDAPS individually or at least be able to control the listening host individually.
Startup Logs:
Loading configuration from /data/lldap_config.toml
2025-07-10T19:56:40.907975850+00:00 INFO set_up_server [ 23.4ms | 100.00% ]
2025-07-10T19:56:40.907991680+00:00 INFO ┝━ ｉ [info]: Starting LLDAP version 0.6.1
2025-07-10T19:56:40.959110505+00:00 INFO ┝━ ｉ [info]: Starting the LDAP server on port 3890
2025-07-10T19:56:40.959610574+00:00 INFO ┝━ ｉ [info]: Starting the LDAPS server on port 6360
2025-07-10T19:56:40.965591385+00:00 INFO ┕━ ｉ [info]: Starting the API/web server on port 17170
2025-07-10T19:56:40.965820339+00:00 INFO ｉ [info]: starting 1 workers
2025-07-10T19:56:40.965862629+00:00 INFO ｉ [info]: Actix runtime found; starting in Actix runtime
2025-07-10T19:56:40.965910400+00:00 INFO ｉ [info]: starting service: "ldap", workers: 1, listening on: 0.0.0.0:3890
2025-07-10T19:56:40.965951418+00:00 INFO ｉ [info]: starting service: "ldaps", workers: 1, listening on: 0.0.0.0:6360
2025-07-10T19:56:40.965992766+00:00 INFO ｉ [info]: starting service: "http", workers: 1, listening on: 0.0.0.0:17170
2025-07-10T19:56:40.967955792+00:00 INFO ｉ [info]: DB Cleanup Cron started
Maybe I'm just missing something, but I went through the lldap_config.toml in the data folder and wasn't able to find a setting I believe would resolve my issue.
@nitnelave commented on GitHub (Jul 10, 2025):
I'm assuming you're running LLDAP in a container? Can you avoid exposing the LDAP port?
There is no way to disable the LDAP interface, and both it and LDAPS listen to the same address
@crazytimmy commented on GitHub (Jul 10, 2025):
Yes, sorry in a Docker container. I should also mention this is a home lab environment so not a high importance/security issue.
When you suggest avoid exposing the LDAP port are you suggesting setting the port through config.toml or environment in compose to blank or "0"? Or through Docker networks somehow? Nothing is exposed outside the host, all server-to-server communication is going through docker networks and doesn't leave the host network. Aside from Traefik/Cloudflare Tunnel as my entrypoint.
I have LDAP and (soon to be) Authelia sharing their own network they will use to communicate on and another separate network for LDAP and Traefik to communicate on. So again should be minimal exposure. But the way LLDAP is configured it's listening on 0.0.0.0 so all networks attached to the LLDAP container would technically have access to LDAP ports no?
Thanks for your response.
@nitnelave commented on GitHub (Jul 10, 2025):
It seems you already have it configured pretty well.
If LLDAP is only exposed through docker networks, then you're in control of all the software that has access to that port. What is the threat model exactly? What specifically are you worried about?
If you're worried that one of the containers might start acting against you, do a port scan and find the unencrypted LDAP connection, first of all containers are not much protection for running untrusted code. Secondly, they also have access to the encrypted connection, so you're not exposing new capabilities.
The only protection the feature would bring is against:
That sounds very unlikely. You can make the first one even more unlikely by changing the LDAP port from the default to a random one.
@crazytimmy commented on GitHub (Jul 11, 2025):
Thanks for your response, I really appreciate the time you took to provide feedback.
I think I was just trying to practice least privileged access model. In doing so, thought I was either missing something or found an opportunity to further secure the setup with additional settings.
But I understand what you're saying and appreciate the confirmation I'm likely setup well enough the way it is. I'm a bit of an over thinker 😄