diff options
author | Guilhem Moulin <guilhem@fripost.org> | 2020-05-21 01:35:28 +0200 |
---|---|---|
committer | Guilhem Moulin <guilhem@fripost.org> | 2020-05-21 02:26:16 +0200 |
commit | 5118f8d3394579a245b355c863c69410fe92e26e (patch) | |
tree | 54fbaf5aca0a1d798fbecca9ba7929f3b25a604e /roles/nextcloud/templates/etc/nginx/snippets/cloud.fripost.org.hpkp-hdr.j2 | |
parent | 1df4c30a95abd9e7c6352e2b3d2766281c3e591d (diff) |
dovecot-auth-proxy: replace directory traversal with LDAP lookups.
This provides better isolation opportunity as the service doesn't need
to run as ‘vmail’ user. We use a dedicated system user instead, and
LDAP ACLs to limit its access to the strict minimum.
The new solution is also more robust to quoting/escaping, and doesn't
depend on ‘home=/home/mail/virtual/%d/%n’ (we might use $entryUUID
instead of %d/%n at some point to make user renaming simpler).
OTOH we no longer lists users that have been removed from LDAP but still
have a mailstore lingering around. This is fair.
Diffstat (limited to 'roles/nextcloud/templates/etc/nginx/snippets/cloud.fripost.org.hpkp-hdr.j2')
0 files changed, 0 insertions, 0 deletions