diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2020-05-21 01:35:28 +0200 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2020-05-21 02:26:16 +0200 |
| commit | 5118f8d3394579a245b355c863c69410fe92e26e (patch) | |
| tree | 54fbaf5aca0a1d798fbecca9ba7929f3b25a604e /lib | |
| parent | 1df4c30a95abd9e7c6352e2b3d2766281c3e591d (diff) | |
dovecot-auth-proxy: replace directory traversal with LDAP lookups.
This provides better isolation opportunity as the service doesn't need
to run as ‘vmail’ user. We use a dedicated system user instead, and
LDAP ACLs to limit its access to the strict minimum.
The new solution is also more robust to quoting/escaping, and doesn't
depend on ‘home=/home/mail/virtual/%d/%n’ (we might use $entryUUID
instead of %d/%n at some point to make user renaming simpler).
OTOH we no longer lists users that have been removed from LDAP but still
have a mailstore lingering around. This is fair.
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/modules/openldap | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/modules/openldap b/lib/modules/openldap index 9afe1f1..219c9a6 100644 --- a/lib/modules/openldap +++ b/lib/modules/openldap @@ -61,7 +61,7 @@ indexedDN = { # 102 is postfix's UID and 106 its primary GID. # (Regular expressions are not allowed.) sasl_ext_re = re.compile( r"""(?P<start>\sby\s+dn(?:\.exact)?)= - (?P<quote>['\"]?)username=(?P<user>[a-z][-a-z0-9_]*), + (?P<quote>['\"]?)username=(?P<user>_?[a-z][-a-z0-9_]*), (?P<end>cn=peercred,cn=external,cn=auth) (?P=quote)\s""" , re.VERBOSE ) |