Red Hat Directory Server 8.0 Administrator's Guide

ip = "12.123.1.*";
The bind rule is evaluated to be true if the client accessing the directory is located at the named
IP address. This can be useful for allowing certain kinds of directory access only from a specific
subnet or machine.
For example, use a wildcard IP address such as 12.3.45.* to specify a specific subnetwork or
123.45.6.*+255.255.255.115 to specify a subnetwork mask.
From the Directory Server Console, you can define specific machines to which the ACI applies
through the Access Control Editor. For more information, see Section 5, “Creating ACIs from
the Console”.
4.7. Defining Access from a Specific Domain
A bind rule can specify that the bind operation must originate from a particular domain or host
machine. This is often used to force all directory updates to occur from a given machine or
network domain.
The LDIF syntax for setting a bind rule based on the DNS hostname is as follows:
dns = "DNS_Hostname or dns != "DNS_Hostname
CAUTION
The dns keyword requires that the naming service used on your machine is DNS.
If the name service is not DNS, use the ip keyword instead.
The dns keyword requires a fully qualified DNS domain name. Granting access to a host without
specifying the domain creates a potential security threat. For example, the following expression
is allowed but not recommended:
dns = "legend.eng";
Instead, use a fully qualified name:
dns = "legend.eng.example.com";
The dns keyword allows wildcards. For example:
dns = "*.example.com";
Defining Access from a Specific Domain
197