From 073d6286af7f0a41c16ad5cd6e4bc12b6e3392b6 Mon Sep 17 00:00:00 2001
From: Simon Clark <simon.richard.clark@gmail.com>
Date: Apr 23 2018 18:58:28 +0000
Subject: Add #89 'OpenLDAP: Drop TCP wrappers support'


---

diff --git a/en-US/sysadmin/Security.adoc b/en-US/sysadmin/Security.adoc
index 9ae92ff..a0874eb 100644
--- a/en-US/sysadmin/Security.adoc
+++ b/en-US/sysadmin/Security.adoc
@@ -38,3 +38,11 @@ With this update, the OpenLDAP distribution in Fedora changed from using the *NS
 == OpenLDAP defaults to use only Shared System Certificates
 
 OpenLDAP clients and server now use the https://fedoraproject.org/wiki/Features/SharedSystemCertificates[system-wide certificate store] by default, instead of `/etc/openldap/certs`.
+
+
+== OpenLDAP drops TCP wrappers support
+
+Fedora has https://fedoraproject.org/wiki/Changes/Deprecate_TCP_wrappers[deprecated the use of TCP wrappers].
+The OpenLDAP project also https://www.openldap.org/doc/admin24/security.html#TCP%20Wrappers[discourages their use] and recommends that an IP firewall is used instead.
+With this update, OpenLDAP will not be configured with `--enable-wrappers` and so any TCP wrappers configuration will have no effect on OpenLDAP.
+Other means should be used to protect the OpenLDAP server.