summaryrefslogtreecommitdiffstats
path: root/lib/modules
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2020-05-21 01:35:28 +0200
committerGuilhem Moulin <guilhem@fripost.org>2020-05-21 02:26:16 +0200
commit5118f8d3394579a245b355c863c69410fe92e26e (patch)
tree54fbaf5aca0a1d798fbecca9ba7929f3b25a604e /lib/modules
parent1df4c30a95abd9e7c6352e2b3d2766281c3e591d (diff)
dovecot-auth-proxy: replace directory traversal with LDAP lookups.
This provides better isolation opportunity as the service doesn't need to run as ‘vmail’ user. We use a dedicated system user instead, and LDAP ACLs to limit its access to the strict minimum. The new solution is also more robust to quoting/escaping, and doesn't depend on ‘home=/home/mail/virtual/%d/%n’ (we might use $entryUUID instead of %d/%n at some point to make user renaming simpler). OTOH we no longer lists users that have been removed from LDAP but still have a mailstore lingering around. This is fair.
Diffstat (limited to 'lib/modules')
-rw-r--r--lib/modules/openldap2
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/modules/openldap b/lib/modules/openldap
index 9afe1f1..219c9a6 100644
--- a/lib/modules/openldap
+++ b/lib/modules/openldap
@@ -61,7 +61,7 @@ indexedDN = {
# 102 is postfix's UID and 106 its primary GID.
# (Regular expressions are not allowed.)
sasl_ext_re = re.compile( r"""(?P<start>\sby\s+dn(?:\.exact)?)=
- (?P<quote>['\"]?)username=(?P<user>[a-z][-a-z0-9_]*),
+ (?P<quote>['\"]?)username=(?P<user>_?[a-z][-a-z0-9_]*),
(?P<end>cn=peercred,cn=external,cn=auth)
(?P=quote)\s"""
, re.VERBOSE )