🚀 go-pugleaf

I was given the following items to fix security on one of our
NetscapeDirectory Sever -

Any Assistance Would Be Greatly Appreciated!

LDAP Configuration
LDAP configuration information available
An attacker could access the LDAP configuration to gain information about
the LDAP server. This configuration information can reveal what sort of
backend is being used. An attacker could use this information to access
directory listings and plan further attacks.
[Graveline, Marc] Fix: Disable the cn=config entry or allow only authorized
users to view the entry.

LDAP monitor
LDAP monitor information gathering
An attacker could access the LDAP monitor to gain information about the LDAP
server. The LDAP server dumps monitoring information about connections, the
number of back-ends, and which users are logged on. An attacker could use
this information to access directory listings and plan further attacks.
[Graveline, Marc] Fix: Disable the cn=monitor entry or allow only authorized
users to view it.

LDAP NullBase
LDAP null base returns information

If LDAP allows a NULL base in an LDAP search, a user can submit a search
that returns information on naming Contexts and supported controls. An
attacker could use this information to access directory listings and plan
further attacks.
[Graveline, Marc] Fix: Use an access list control to prevent users from
dumping the base of the tree or issuing a request without knowing the base
object.

LDAP NullBind
LDAP anonymous access to directory

The NULL bind entry allows a user to access the LDAP directory anonymously.
An attacker could take advantage of the NULL bind entry
to anonymously view files on the LDAP director.
[Graveline, Marc]  Cognos requires anonymous bind. However, by setting the
appropriate access permissions (via ACLs), the data accessible by
an anonymously bound session is extremely limited in scope and sensitive
data is encrypted.  As well, customers have successfully hardened the access
to the directory servers with tools such as SSH.

LDAP NullSubtree
LDAP null subtree allows user to gain information

If LDAP allows a NULL base in an LDAP search with a scope set to subtree,
the LDAP server will dump all viewable information in a directory.
[Graveline, Marc]  Fix: To increase your LDAP security:
      - Use an access list to deny all access by default.
      - Create groups and modify group permissions according to each group's
requirements.
      - Assign users to the appropriate group(s) according to their needs.

LDAP Schema
LDAP schema information gathering

An attacker could access the LDAP schema to gain information about the LDAP
server. The LDAP server dumps its schema, which can show all necessary
attributes needed for an object, including hidden or non-readable
attributes. An attacker could use this information to access directory
listings and plan further attacks.

[Graveline, Marc] Fix: Disable the cn=schema entry or allow only authorized
users to view the entry.

Thanks -

Jeff