summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--roles/common-LDAP/templates/etc/ldap/database.ldif.j222
-rw-r--r--roles/mx/files/etc/postfix/virtual/alias_catchall_maps.cf3
-rw-r--r--roles/mx/files/etc/postfix/virtual/alias_maps.cf3
-rw-r--r--roles/mx/files/etc/postfix/virtual/lists_maps.cf3
-rw-r--r--roles/mx/files/etc/postfix/virtual/mailbox_domains.cf3
-rw-r--r--roles/mx/files/etc/postfix/virtual/mailbox_maps.cf3
-rw-r--r--roles/mx/files/etc/postfix/virtual/transport_lists_maps.cf3
7 files changed, 17 insertions, 23 deletions
diff --git a/roles/common-LDAP/templates/etc/ldap/database.ldif.j2 b/roles/common-LDAP/templates/etc/ldap/database.ldif.j2
index 8333032..03691f9 100644
--- a/roles/common-LDAP/templates/etc/ldap/database.ldif.j2
+++ b/roles/common-LDAP/templates/etc/ldap/database.ldif.j2
@@ -23,10 +23,9 @@ olcLastMod: TRUE
olcDbCheckpoint: 512 15
# Require LDAPv3 protocol and authentication prior to directory
# operations.
-olcRequires: LDAPv3 authc
-# We don't want to give "canAdd{Alias,List}" write access to alias/list
-# attributes.
-olcAddContentAcl: FALSE
+olcRequires: LDAPv3
+# TODO: how 'olcAddContentAcl' affects the test suite?
+olcAddContentAcl: TRUE
# The root user has all rights on the whole database (when SASL-binding
# on a UNIX socket).
olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
@@ -98,24 +97,25 @@ olcDbIndex: entryCSN,entryUUID eq
#
#
########################################################################
-# Most common services: Postfix, Amavis, SASLauth, Dovecot
+# Most common services: Postfix, Amavis, Dovecot
# (Most used ACLs are cheaper when written first.)
#
-# Postfix have read access to the attribute they need.
+# Postfix have read access to the attribute it needs when eg, doing
+# alias resolution.
olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org"
attrs=entry,objectClass,fvd,fvl,fripostMaildrop,fripostOptionalMaildrop,fripostLocalAlias
filter=(&(|(objectClass=FripostVirtualDomain)(objectClass=FripostVirtualUser)(objectClass=FripostVirtualAlias)(objectClass=FripostVirtualList)(objectClass=FripostVirtualListCommand))(!(objectClass=FripostPendingEntry))(!(fripostIsStatusActive=FALSE)))
by dn.exact="cn=Postfix,ou=services,o=mailHosting,dc=fripost,dc=org" =rsd
- by dn.exact="username=postfix,cn=peercred,cn=external,cn=auth" =rsd
+ by realanonymous =rsd
by users =0 break
#
-# Search lists and domain owners
+# Postfix needs to look up lists' local aliases.
olcAccess: to dn.exact="ou=virtual,o=mailHosting,dc=fripost,dc=org"
attrs=entry
- by dn.exact="username=postfix,cn=peercred,cn=external,cn=auth" =s
+ by realanonymous =s
by users =0 break
#
-# Search domain owners / postmasters
+# Search domain owners / postmasters (used by reserved-alias.pl).
olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org"
attrs=entry,objectClass,fvd,fvl,fripostPostmaster,fripostOwner
filter=(&(objectClass=FripostVirtualDomain)(!(objectClass=FripostPendingEntry))(!(fripostIsStatusActive=FALSE)))
@@ -128,7 +128,7 @@ olcAccess: to dn.one="ou=services,o=mailHosting,dc=fripost,dc=org"
attrs=userPassword
by realanonymous =xd
#
-# That's necessary for SASL proxy Authorize the web application.
+# The following is required for SASL proxy Authorize the web application.
olcAccess: to dn.exact="cn=AdminWebPanel,ou=services,o=mailHosting,dc=fripost,dc=org"
attrs=entry,objectClass,authzTo
by realanonymous =x
diff --git a/roles/mx/files/etc/postfix/virtual/alias_catchall_maps.cf b/roles/mx/files/etc/postfix/virtual/alias_catchall_maps.cf
index 2de4667..c405f47 100644
--- a/roles/mx/files/etc/postfix/virtual/alias_catchall_maps.cf
+++ b/roles/mx/files/etc/postfix/virtual/alias_catchall_maps.cf
@@ -2,7 +2,6 @@ server_host = ldapi://%2Fprivate%2Fldapi/
version = 3
search_base = fvd=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
scope = base
-bind = sasl
-sasl_mechs = EXTERNAL
+bind = none
query_filter = (&(ObjectClass=FripostVirtualDomain)(fvd=%d)(fripostOptionalMaildrop=*))
result_attribute = fripostOptionalMaildrop
diff --git a/roles/mx/files/etc/postfix/virtual/alias_maps.cf b/roles/mx/files/etc/postfix/virtual/alias_maps.cf
index aa26e18..9265d0b 100644
--- a/roles/mx/files/etc/postfix/virtual/alias_maps.cf
+++ b/roles/mx/files/etc/postfix/virtual/alias_maps.cf
@@ -1,7 +1,6 @@
server_host = ldapi://%2Fprivate%2Fldapi/
version = 3
search_base = fvl=%u,fvd=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
-bind = sasl
-sasl_mechs = EXTERNAL
+scope = base
query_filter = (&(ObjectClass=FripostVirtualAlias)(fvl=%u))
result_attribute = fripostMaildrop
diff --git a/roles/mx/files/etc/postfix/virtual/lists_maps.cf b/roles/mx/files/etc/postfix/virtual/lists_maps.cf
index a4657ec..b60dcf6 100644
--- a/roles/mx/files/etc/postfix/virtual/lists_maps.cf
+++ b/roles/mx/files/etc/postfix/virtual/lists_maps.cf
@@ -2,7 +2,6 @@ server_host = ldapi://%2Fprivate%2Fldapi/
version = 3
search_base = fvl=%u,fvd=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
scope = base
-bind = sasl
-sasl_mechs = EXTERNAL
+bind = none
query_filter = (&(|(ObjectClass=FripostVirtualList)(ObjectClass=FripostVirtualListCommand))(fvl=%u)(fripostLocalAlias=%u#%d))
result_attribute = fripostLocalAlias
diff --git a/roles/mx/files/etc/postfix/virtual/mailbox_domains.cf b/roles/mx/files/etc/postfix/virtual/mailbox_domains.cf
index d580cb9..22d6be3 100644
--- a/roles/mx/files/etc/postfix/virtual/mailbox_domains.cf
+++ b/roles/mx/files/etc/postfix/virtual/mailbox_domains.cf
@@ -2,8 +2,7 @@ server_host = ldapi://%2Fprivate%2Fldapi/
version = 3
search_base = fvd=%s,ou=virtual,o=mailHosting,dc=fripost,dc=org
scope = base
-bind = sasl
-sasl_mechs = EXTERNAL
+bind = none
query_filter = (&(ObjectClass=FripostVirtualDomain)(fvd=%s))
result_attribute = fvd
result_format = OK
diff --git a/roles/mx/files/etc/postfix/virtual/mailbox_maps.cf b/roles/mx/files/etc/postfix/virtual/mailbox_maps.cf
index 0f0e0e4..dc97177 100644
--- a/roles/mx/files/etc/postfix/virtual/mailbox_maps.cf
+++ b/roles/mx/files/etc/postfix/virtual/mailbox_maps.cf
@@ -2,8 +2,7 @@ server_host = ldapi://%2Fprivate%2Fldapi/
version = 3
search_base = fvl=%u,fvd=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
scope = base
-bind = sasl
-sasl_mechs = EXTERNAL
+bind = none
query_filter = (&(ObjectClass=FripostVirtualUser)(fvl=%u))
result_attribute = fvl
result_format = OK
diff --git a/roles/mx/files/etc/postfix/virtual/transport_lists_maps.cf b/roles/mx/files/etc/postfix/virtual/transport_lists_maps.cf
index 3cca999..9a7bca0 100644
--- a/roles/mx/files/etc/postfix/virtual/transport_lists_maps.cf
+++ b/roles/mx/files/etc/postfix/virtual/transport_lists_maps.cf
@@ -5,8 +5,7 @@ server_host = ldapi://%2Fprivate%2Fldapi/
version = 3
search_base = ou=virtual,o=mailHosting,dc=fripost,dc=org
scope = sub
-bind = sasl
-sasl_mechs = EXTERNAL
+bind = none
query_filter = (&(|(ObjectClass=FripostVirtualList)(ObjectClass=FripostVirtualListCommand))(fripostLocalAlias=%s))
result_attribute = fripostLocalAlias
result_format = smtp:[127.0.0.1]:2345