The debian package by default just runs lightldapd as root.
Instead it should create a lightldapd user and run lightldapd with '-u lightldapd'.
It might also be nice to optionally set a password for lightldapd, add lightldapd to group shadow, and run it with '-r lightldapd'. This would allow lightldapd to export shadowAccount data. However, this is a security hole if the client machines (specifically root on client machines with access to the lightldapd password) are untrusted, so it should be optional, and not the default.
The debian package by default just runs lightldapd as root.
Instead it should create a lightldapd user and run lightldapd with '-u lightldapd'.
It might also be nice to optionally set a password for lightldapd, add lightldapd to group shadow, and run it with '-r lightldapd'. This would allow lightldapd to export shadowAccount data. However, this is a security hole if the client machines (specifically root on client machines with access to the lightldapd password) are untrusted, so it should be optional, and not the default.