diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2014-07-07 05:16:53 +0200 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2015-06-07 02:52:34 +0200 |
| commit | 7c01a383fae4d84727d6a036d93117c761b98e10 (patch) | |
| tree | 453fb77e9758ea29729fa4e65633bb3261e71345 /roles/common-LDAP/templates/etc/default | |
| parent | f9fa7026603a298c46aea77d753e0a8121e5d71b (diff) | |
Configure SyncRepl (OpenLDAP replication) and related ACLs.
The clients are identified using their certificate, and connect securely
to the SyncProv.
There are a few workarounds (XXX) in the ACLs due to Postfix not
supporting SASL binds in Wheezy.
Overview:
- Authentication (XXX: strong authentication) is required prior to any DIT
operation (see 'olcRequires').
- We force a Security Strength Factor of 128 or above for all operations (see
'olcSecurity'), meaning one must use either a local connection (eg,
ldapi://, possible since we set the 'olcLocalSSF' to 128), or TLS with at
least 128 bits of security.
- XXX: Services may not simple bind other than locally on a ldapi:// socket.
If no remote access is needed, they should use SASL/EXTERNAL on a ldapi://
socket whenever possible (if the service itself supports SASL binds).
If remote access is needed, they should use SASL/EXTERNAL on a ldaps://
socket, and their identity should be derived from the CN of the client
certificate only (hence services may not simple bind).
- Admins have restrictions similar to that of the services.
- User access is only restricted by our global 'olcSecurity' attribute.
Diffstat (limited to 'roles/common-LDAP/templates/etc/default')
| -rw-r--r-- | roles/common-LDAP/templates/etc/default/slapd.j2 | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/roles/common-LDAP/templates/etc/default/slapd.j2 b/roles/common-LDAP/templates/etc/default/slapd.j2 index 92b3b22..f652f9a 100644 --- a/roles/common-LDAP/templates/etc/default/slapd.j2 +++ b/roles/common-LDAP/templates/etc/default/slapd.j2 @@ -20,11 +20,11 @@ SLAPD_PIDFILE= # service requests on TCP-port 636 (ldaps) and requests via unix # sockets. SLAPD_SERVICES="ldapi:///" -{% for i in postfix_instance.keys() | intersect(group_names) | list %} +{% for i in ['IMAP','MX','lists'] | intersect(group_names) | sort %} SLAPD_SERVICES="$SLAPD_SERVICES ldapi://%2Fvar%2Fspool%2Fpostfix-{{ postfix_instance[i].name }}%2Fprivate%2Fldapi/" {% endfor %} {% if 'LDAP-provider' in group_names %} -SLAPD_SERVICES="$SLAPD_SERVICES ldap://172.16.0.1:389/" +SLAPD_SERVICES="$SLAPD_SERVICES ldaps:///" {% endif %} # If SLAPD_NO_START is set, the init script will not start or restart |