| Commit message (Collapse) | Author | Age | Files |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
This provides better isolation opportunity as the service doesn't need
to run as ‘vmail’ user. We use a dedicated system user instead, and
LDAP ACLs to limit its access to the strict minimum.
The new solution is also more robust to quoting/escaping, and doesn't
depend on ‘home=/home/mail/virtual/%d/%n’ (we might use $entryUUID
instead of %d/%n at some point to make user renaming simpler).
OTOH we no longer lists users that have been removed from LDAP but still
have a mailstore lingering around. This is fair.
|
| |
|
|
|
|
|
|
| |
This avoids the
[WARNING]: The value False (type bool) in a string field was converted
to u'False' (type string). If this does not look like what you expect,
quote the entire value to ensure it does not change.
|
| | |
|
| | |
|
| |
|
|
| |
Cf. lmdb_table(5).
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
locally.
And use this to fetch all X.509 leaf certificates.
|
| | |
|
| |
|
|
|
| |
We don't use the provided 'slapd_' Munin plugin because it doesn't
support SASL binds.
|
| | |
|
| | |
|
| |
|
|
|
| |
Use it to delete cn=admin,dc=fripost,dc=org, and to remove the rootDN on
the 'config' database.
|
| |
|
|
|
|
| |
So our suffix is now a mere 'dc=fripost,dc=org'. We're also using the
default '/var/lib/ldap' as olcDbDirectory (hence we don't clear it
before hand).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The clients are identified using their certificate, and connect securely
to the SyncProv.
There are a few workarounds (XXX) in the ACLs due to Postfix not
supporting SASL binds in Wheezy.
Overview:
- Authentication (XXX: strong authentication) is required prior to any DIT
operation (see 'olcRequires').
- We force a Security Strength Factor of 128 or above for all operations (see
'olcSecurity'), meaning one must use either a local connection (eg,
ldapi://, possible since we set the 'olcLocalSSF' to 128), or TLS with at
least 128 bits of security.
- XXX: Services may not simple bind other than locally on a ldapi:// socket.
If no remote access is needed, they should use SASL/EXTERNAL on a ldapi://
socket whenever possible (if the service itself supports SASL binds).
If remote access is needed, they should use SASL/EXTERNAL on a ldaps://
socket, and their identity should be derived from the CN of the client
certificate only (hence services may not simple bind).
- Admins have restrictions similar to that of the services.
- User access is only restricted by our global 'olcSecurity' attribute.
|
| | |
|
| |
|
