{
 "slug": "openldap",
 "name": "OpenLDAP",
 "tagline": "LDAP directory server with LMDB storage and TLS",
 "category": "security-identity",
 "use_cases": [
  "ldap",
  "directory",
  "authentication"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "The OpenLDAP Project",
  "url": "https://www.openldap.org",
  "license": "OLDAP-2.8",
  "license_url": "https://www.openldap.org/software/release/license.html"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   389,
   636
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "2.6.16",
   "last_build": "2026-10-23",
   "entity_id": "prod-e22upkrh4yhfa",
   "ami_alias": "/aws/service/marketplace/prod-e22upkrh4yhfa/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-2uh3j63qh4mv2",
   "recommended_instance_type": "t3.small",
   "price_usd_per_hour": 0.03,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "2.6.15",
   "last_build": "2026-09-13",
   "offer_id": "openldap",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:openldap:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.openldap?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/openldap/",
  "json": "https://lynxroute.com/products/openldap/product.json"
 },
 "release_notes": [
  {
   "version": "2.6.16",
   "title": "OpenLDAP 2.6.16",
   "notes": "* OpenLDAP updated 2.6.15 -> 2.6.16, a bugfix release. OpenLDAP Public License unchanged\n* Fixes slapd client-certificate verification with GnuTLS (ITS#10616), plus accesslog and sssvlv overlay fixes\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "2.6.15",
   "title": "OpenLDAP 2.6.15",
   "notes": "* OpenLDAP updated 2.6.14 -> 2.6.15, a patch release on the 2.6 stable train\n* Fixes two network-reachable memory leaks in the LDAP client library: a BER leak on a notice of disconnection and a request leak on a malformed BER response\n* Fixes TLS error-stack handling against the OpenSSL 3 series that Ubuntu 24.04 ships\n* Fixes the password-policy overlay handling of previously used passwords\n* Built from the upstream source release, PGP-verified against the OpenLDAP Project release key, and linked against the system OpenSSL and Cyrus SASL so every dependency stays in the Ubuntu security stream\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-11",
    "azure": "2026-09-13"
   }
  },
  {
   "version": "2.6.14",
   "title": "OpenLDAP v2.6.14",
   "notes": "* Re-release of OpenLDAP 2.6.14. The application version is unchanged; this build refreshes the underlying operating system image\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-03",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "2.6.13",
   "title": "OpenLDAP 2.6.13 - Initial release (August 2026)",
   "notes": "* OpenLDAP 2.6.13 on Ubuntu 24.04 LTS, built from the official upstream source release with a PGP-verified tarball\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Anonymous binds refused; every operation requires an authenticated identity\n* Cleartext password binds rejected - port 389 requires StartTLS, port 636 is LDAPS\n* Per-instance TLS certificate and administrator password generated at first launch\n* Salted password hashing (SSHA); password hashes are not readable, not even by their owner\n* Embedded LMDB storage sized to 1 GiB - no external database to operate\n* UFW firewall pre-configured (ports 22, 389, 636 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-05",
    "azure": "2026-08-05"
   }
  }
 ],
 "release_history": [
  {
   "version": "2.6.16",
   "aws": "2026-10-23"
  },
  {
   "version": "2.6.15",
   "aws": "2026-09-11",
   "azure": "2026-09-13"
  },
  {
   "version": "2.6.14",
   "aws": "2026-09-03",
   "azure": "2026-08-19"
  },
  {
   "version": "2.6.13",
   "aws": "2026-08-05",
   "azure": "2026-08-05"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-e22upkrh4yhfa/latest \\\n  --instance-type t3.small --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer openldap --plan payg-gen2\naz vm create -g my-rg -n openldap --size Standard_D2s_v3 \\\n  --image lynxroute:openldap:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "OpenLDAP is the reference open-source implementation of the Lightweight Directory Access Protocol and the directory server most self-hosted identity stacks are built on. Its server, slapd, is a single C daemon that stores users, groups, hosts and application entries in a hierarchical tree and answers LDAP queries over the network - the same protocol Linux hosts, VPN concentrators, mail servers, CI systems, wikis and hundreds of off-the-shelf applications already speak for authentication and identity lookup. Storage is LMDB, a memory-mapped transactional store compiled into the server, so there is no separate database process to run, tune or back up. Configuration is live: the whole server is described by entries under cn=config and changed with ordinary LDAP operations, with no restart and no configuration file to edit. Running your own directory keeps every credential, group membership and personnel attribute inside your own AWS account rather than a third-party identity service, which matters directly for GDPR and for sector rules on personal data. OpenLDAP Public License, no vendor lock-in.",
  "image_adds": "Security hardening:\n* Anonymous binds refused - the directory does not answer unauthenticated clients at all, and every operation requires an identity\n* No cleartext passwords on the wire - a security strength floor is enforced, so port 389 works only after StartTLS and a password bind over an unprotected connection is rejected by the server\n* Per-instance TLS certificate and private key, generated on your own instance at first launch and never shipped inside the image\n* Per-instance administrator password, generated at first launch and written to a root-only file - no shared or default credential exists in the image\n* Salted password hashing (SSHA) for every password set through the directory\n* Password hashes readable by nobody - the access rules let users change their own password without the right to read it, so a compromised session cannot walk away with a hash to crack offline\n* Directory data is not world-readable - the permissive default access rule is replaced, so an authenticated identity is required to read anything\n* UFW firewall pre-configured - only 22, 389 and 636 reachable\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n* Operational audit log - every connection, bind and result recorded to /var/log/openldap/slapd.log"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}