diff options
| -rwxr-xr-x | addadmin.pl | 51 | ||||
| -rw-r--r-- | ldap-migrate | 67 |
2 files changed, 118 insertions, 0 deletions
diff --git a/addadmin.pl b/addadmin.pl new file mode 100755 index 0000000..508d100 --- /dev/null +++ b/addadmin.pl @@ -0,0 +1,51 @@ +#!/usr/bin/perl + +# Run `sudo ./addadmin.pl' to add yourself as an administrator for virtual +# mail hosting. +# (Use the optional argument if you're not happy with your login name.) +# +# To use the tools, you'll need to edit `~/.fripost.yml' and replace +# `bind_dn' and `bind_pw' by, respectively, the returned Distinguished Name +# and your password + +use 5.010_000; +use strict; +use warnings; +use utf8; + +use FindBin qw($Bin); +use lib "$Bin/lib"; + +use Fripost::Schema; +use Fripost::Password; +use Fripost::Prompt; +use YAML::Syck; + +my $user = $ARGV[0]; +$user //= $ENV{SUDO_USER}; +$user //= $ENV{USER}; + +die "Error: Cannot find user name.\n" + unless defined $user; + +# Connect to the LDAP server +my $ldapconf = LoadFile ( 'ldap.yml' ); +my $ldap = Fripost::Schema->new( $ldapconf ); +$ldap = $ldap->{_ldap}; + + +my $dn = join ',', ( 'cn='.$user + , 'ou=managers' + , (split ',', $ldapconf->{base_dn},2)[1] ); + +my $password = hash( undef, undef, prompt_password() ); +my $res = $ldap->add( $dn, + attrs => [ objectClass => [ 'simpleSecurityObject' + , 'organizationalRole' ] + , userPassword => $password + ] + ); + die "Error: " .$res->error. "\n" if $res->code; + +say $dn; +$ldap->unbind(); diff --git a/ldap-migrate b/ldap-migrate new file mode 100644 index 0000000..0e006b4 --- /dev/null +++ b/ldap-migrate @@ -0,0 +1,67 @@ +/*********************************************************************/ +/* Migration plan, to replace the MySQL database by a LDAP directory */ +/* structure (for virtual e-mail hosting). */ +/*********************************************************************/ + + * First we should stop to welcome new members for a little while. + + * Then someone should run the following on mistral: + cd /etc/ldap/fripost/migration/ && sudo ./ldap-migrate.pl +That will populate the base directory with what is in the MySQL +database. +A log file, `fripost-migration-$$.log' (where `$$' is the PID of the +running process) will be created. One should read it, check the +warning/errors (prefixed with `WARN:' or `Error:') and fix them if +needed. +Note: The new entries will be created by the DN +"cn=migrator,ou=managers,...", created specialy for this purpose. Also, +creation and modification timestamps will be reset. + + * On each of the MX's, Postfix' configuration should be updated with LDAP +lookup configuration files, which are currently in +`/etc/ldap/fripost/ldap_*.cf'. +Test the Postfix configuration. Send to at least one mailbox and one +alias, check the logs to verify that emails are delivered. + + * On mistral, Dovecot configuration should be updated as written in +`fripost-docs.org'. +Test Dovecot: Is it possible to login? Is it possible to browse the IMAP +directory? + openssl s_client -connect imap.fripost.org:993 -CApath /etc/ssl/certs/ + 1 login user@fripost.org password + 2 list "" "*" + 3 logout + + * Shut down MySQL. + + * In git's repository for `fripost-tools' merge the `ldap' branch in +`master'. + + * Remove the DN "cn=migrator,ou=managers,...", and restrict the +ACL for the managers to be allowed to write on "ou=domains,..." only. + + * Wait for a week or two. + + * Dump the MySQL database and save it somewhere? Anyways, then remove +MySQL from hosts. + + + +/*********************************************************************/ +/* Note for the admins. */ + +To use the new `fripost-tools', you need to have an entry under +`ou=managers,...'. To add yourself as a manager, run the following on +mistral: + cd /etc/ldap/fripost/migration/ && sudo ./addadmin.pl + + * (Use the optional argument if you're not happy with your login name.) + + * (If you choose to randomly generate your password, beware that it will +only be 20 characters long.) + + * You'll then need to chmod 600 and create/edit `~/.fripost.yml' on the +machine you plan to use the tools on (a template can be found in the +git repository), and replace `bind_dn' and `bind_pw' by, respectively, +the returned Distinguished Name and your password. + |