OpenDirectory userPassword attribute – Security Problem!

Has anyone noticed that the userPassword attribute is readable by anonymous LDAP searches? This is a Very Bad Thing for security. This means that anyone can grab your users’ (including the admin!) encrypted passwords and run a password cracking program on them. You can disabled read access to the userPassword field in /private/etc/slapd_macosxserver.conf, but I am wondering what the ramifications of this will be. Local authentication seems to work, but I haven’t tested this with OpenDirectory clients. It does break authentication for Linux/LDAP clients, though.

Anyway, this seems like a pretty big security problem in places that deploy OpenDirectory for centralized authentication. What do ya’ll think?

-matthew