LDAP migration plan.

2 files changed, 118 insertions, 0 deletions

diff --git a/addadmin.pl b/addadmin.pl
new file mode 100755
index 0000000..508d100
--- /dev/null
+++ b/addadmin.pl
@@ -0,0 +1,51 @@
+#!/usr/bin/perl
+
+# Run `sudo ./addadmin.pl' to add yourself as an administrator for virtual
+# mail hosting.
+# (Use the optional argument if you're not happy with your login name.)
+#
+# To use the tools, you'll need to edit `~/.fripost.yml' and replace
+# `bind_dn' and `bind_pw' by, respectively, the returned Distinguished Name
+# and your password
+
+use 5.010_000;
+use strict;
+use warnings;
+use utf8;
+
+use FindBin qw($Bin);
+use lib "$Bin/lib";
+
+use Fripost::Schema;
+use Fripost::Password;
+use Fripost::Prompt;
+use YAML::Syck;
+
+my $user = $ARGV[0];
+$user //= $ENV{SUDO_USER};
+$user //= $ENV{USER};
+
+die "Error: Cannot find user name.\n"
+    unless defined $user;
+
+# Connect to the LDAP server
+my $ldapconf = LoadFile ( 'ldap.yml' );
+my $ldap = Fripost::Schema->new( $ldapconf );
+$ldap = $ldap->{_ldap};
+
+
+my $dn = join ',', ( 'cn='.$user
+                   , 'ou=managers'
+                   , (split ',', $ldapconf->{base_dn},2)[1] );
+
+my $password = hash( undef, undef, prompt_password() );
+my $res = $ldap->add( $dn,
+                attrs => [ objectClass  => [ 'simpleSecurityObject'
+                                           , 'organizationalRole' ]
+                         , userPassword => $password
+                         ]
+              );
+    die "Error: " .$res->error. "\n" if $res->code;
+
+say $dn;
+$ldap->unbind();
diff --git a/ldap-migrate b/ldap-migrate
new file mode 100644
index 0000000..0e006b4
--- /dev/null
+++ b/ldap-migrate
@@ -0,0 +1,67 @@
+/*********************************************************************/
+/* Migration plan, to replace the MySQL database by a LDAP directory */
+/* structure (for virtual e-mail hosting).                           */
+/*********************************************************************/
+
+ * First we should stop to welcome new members for a little while.
+
+ * Then someone should run the following on mistral:
+    cd /etc/ldap/fripost/migration/ && sudo ./ldap-migrate.pl
+That will populate the base directory with what is in the MySQL
+database.
+A log file, `fripost-migration-$$.log' (where `$$' is the PID of the
+running process) will be created. One should read it, check the
+warning/errors (prefixed with `WARN:' or `Error:') and fix them if
+needed.
+Note: The new entries will be created by the DN
+"cn=migrator,ou=managers,...", created specialy for this purpose. Also,
+creation and modification timestamps will be reset.
+
+ * On each of the MX's, Postfix' configuration should be updated with LDAP
+lookup configuration files, which are currently in
+`/etc/ldap/fripost/ldap_*.cf'.
+Test the Postfix configuration. Send to at least one mailbox and one
+alias, check the logs to verify that emails are delivered.
+
+ * On mistral, Dovecot configuration should be updated as written in
+`fripost-docs.org'.
+Test Dovecot: Is it possible to login? Is it possible to browse the IMAP
+directory?
+    openssl s_client -connect imap.fripost.org:993 -CApath /etc/ssl/certs/
+    1 login user@fripost.org password
+    2 list "" "*"
+    3 logout
+
+ * Shut down MySQL.
+
+ * In git's repository for `fripost-tools' merge the `ldap' branch in
+`master'.
+
+ * Remove the DN "cn=migrator,ou=managers,...", and restrict the
+ACL for the managers to be allowed to write on "ou=domains,..." only.
+
+ * Wait for a week or two.
+
+ * Dump the MySQL database and save it somewhere? Anyways, then remove
+MySQL from hosts.
+
+
+
+/*********************************************************************/
+/* Note for the admins.                                              */
+
+To use the new `fripost-tools', you need to have an entry under
+`ou=managers,...'. To add yourself as a manager, run the following on
+mistral:
+    cd /etc/ldap/fripost/migration/ && sudo ./addadmin.pl
+
+ * (Use the optional argument if you're not happy with your login name.)
+
+ * (If you choose to randomly generate your password, beware that it will
+only be 20 characters long.)
+ 
+ * You'll then need to chmod 600 and create/edit `~/.fripost.yml' on the
+machine you plan to use the tools on (a template can be found in the
+git repository), and replace `bind_dn' and `bind_pw' by, respectively,
+the returned Distinguished Name and your password.
+